Differentially low uniform permutations from known 4-uniform functions

Abstract

Functions with low differential uniformity can be used in a block cipher as S-boxes since they have good resistance to differential attacks. In this paper we consider piecewise constructions for permutations with low differential uniformity. In particular, we give two constructions of differentially 6-uniform functions, modifying the Gold function and the Bracken–Leander function on a subfield.

1 Introduction

Let n be a positive integer, we will denote by ${{\mathbb {F}}}_{2^n}$ the finite field with $2^n$ elements and its multiplicative group by ${{\mathbb {F}}}_{2^n}^\star$. Permutation maps defined over ${{\mathbb {F}}}_{2^n}$ are used as the S-boxes of some symmetric cryptosystems. So, it is important to construct permutations with good cryptographic properties in order to design a cipher that can resist known attacks. In particular, among these properties we have a low differential and boomerang uniformity for preventing differential and boomerang attacks [1, 36], high nonlinearity for avoiding linear cryptanalysis [25] and also not a too low algebraic degree to resist higher order differential attacks [21].

Over a field of even characteristic, the best differential uniformity of a function F is two. Functions achieving this value are called almost perfect nonlinear (APN). Many works have been done on the construction of APN functions (see for instance [4, 8,9,10,11]). For odd values of n there are known families of APN permutations; while for n even there exists only one example of APN permutation over ${{\mathbb {F}}}_{2^6}$ [7] and the existence of others remains an open problem. For ease of implementation, usually, the integer n is required to be even in a cryptosystem. Therefore, finding permutations with good cryptographic properties over ${{\mathbb {F}}}_{2^{n}}$ with n even is an interesting research topic for providing more choices for the S-boxes.

The construction of low differentially uniform permutations with the highest nonlinearity over ${{\mathbb {F}}}_{2^{n}}$ (with n even) is a difficult task. In Table 1 we give five families of primarily constructed differentially 4-uniform permutations with the best known nonlinearity. For all these primarily constructed permutations, but the Kasami function, the boomerang uniformity as been determined [3, 12, 26]. Note that amongst these functions, the Gold, Bracken–Leander and the Bracken–Tan–Tan functions have algebraic degrees 2 or 3.

Table 1 Primarily-constructed differentially 4-uniform permutations over ${{\mathbb {F}}}_{2^{n}}$ (n even) with the best known nonlinearity

In the last years, many works on permutations with low differential uniformity have been done. Several constructions of differentially 4-uniform permutations have been found by modifying the inverse function on some subsets of ${{\mathbb {F}}}_{2^n}$ [28, 29, 31,32,33,34, 37, 39]. For example, some new constructions of differentially 4-uniform functions were obtained by shifting the inverse function on some subsets of ${{\mathbb {F}}}_{2^n}$ [32, 33]. While in [28, 37, 39] the authors change the inverse function on some subfields of ${{\mathbb {F}}}_{2^n}$. Moreover, all the functions constructed in those references were proved to have the optimal algebraic degree ($n-1$) and high nonlinearity.

For the case of 6-uniform permutations, in [2] the authors studied the differential spectra of some power functions. In [16], the authors study some particular sparse permutation polynomials showing, in particular, that we can obtain 6-uniform permutation polynomials of type $x^{-1}+\gamma {{\,\mathrm{Tr}\,}}(x^r)$. In [40], the authors give two examples of 6-uniform permutations modifying the Gold function.

In this paper, we investigate the piecewise construction as in [28, 37, 39] by modifying the image of other well-known 4-uniform permutations on some subfields of ${{\mathbb {F}}}_{2^n}$. In particular, we consider the case of the Gold and of the Bracken–Leander functions. We show that in these cases it is possible to obtain permutations with differential uniformity at most 6. Moreover, if we modify these functions using the inverse function (or a function equivalent to it) on a subfield of ${{\mathbb {F}}}_{2^n}$, then we can obtain permutations with algebraic degree $n-1$ (which is the highest possible) and high nonlinearity. These results extend those given in [40].

The paper is organized as follows. In Sect. 2, we give some notations and preliminaries. In Sect. 3, we just give a result for obtaining 4-uniform permutation using the piecewise construction with APN permutations. In Sect. 4, we report our study on the piecewise construction coming from the Gold and Bracken–Leander functions. We show that for these functions the construction can produce a permutation with differential uniformity at most 6. Moreover, when we use the inverse function on the subfield, the obtained function has also algebraic degree $n-1$ and high nonlinearity. In the last section, we give some results on the boomerang uniformity for some type of piecewise permutations. In particular, we give an upper bound on the boomerang uniformity of piecewise permutations obtained using a 4-uniform Gold function.

2 Preliminaries

Any function F from ${{\mathbb {F}}}_{2^n}$ to itself can be represented as a univariate polynomial of degree at most $2^n-1$, that is

$$\begin{aligned} F(x)=\sum _{i=0}^{2^n-1}a_ix^i. \end{aligned}$$

The 2-weight of an integer $0\le i\le 2^n-1$, denoted by $w_2(i)$, is the (Hamming) weight of its binary representation. It is well known that the algebraic degree of a function F is given by

$$\begin{aligned} \deg (F)=\max \{w_2(i)\,\mid \, a_i\ne 0\}. \end{aligned}$$

Functions of algebraic degree 1 are called affine. Linear functions are affine functions with constant term equal to zero and they can be represented as $L(x)=\sum _{i=0}^{n-1} a_i x^{2^i}$. For any permutation $F:{{\mathbb {F}}}_{2^n}\rightarrow {{\mathbb {F}}}_{2^n}$ it is well known that the algebraic degree can be at most $n-1$.

For any $m\ge 1$ such that m|n we can define the (linear) trace function from ${{\mathbb {F}}}_{2^n}$ to ${{\mathbb {F}}}_{2^m}$ by

$$\begin{aligned} {{\,\mathrm{Tr}\,}}_m^n(x)=\sum _{i=0}^{n/m-1}x^{2^{im}}. \end{aligned}$$

When $m=1$ we will denote ${{\,\mathrm{Tr}\,}}_1^n(x)$ by ${{\,\mathrm{Tr}\,}}(x)$.

For any function $F:{{\mathbb {F}}}_{2^n}\rightarrow {{\mathbb {F}}}_{2^n}$ we denote the Walsh transform in $a,b\in {{\mathbb {F}}}_{2^n}$ by

$$\begin{aligned} {\mathscr {W}}_F(a,b)=\sum _{x\in {{\mathbb {F}}}_{2^n}}(-1)^{{{\,\mathrm{Tr}\,}}(ax+bF(x))}. \end{aligned}$$

With Walsh spectrum we refer to the set of all possible values of the Walsh transform. The Walsh spectrum of a vectorial Boolean function F is strictly related to the notion of nonlinearity of F, denoted by ${\mathscr {N}}{\mathscr {L}}(F)$, indeed we have

$$\begin{aligned} {\mathscr {N}}{\mathscr {L}}(F)=2^{n-1}-\frac{ 1}{2} \max _{a\in {{\mathbb {F}}}_{2^n},b\in {{\mathbb {F}}}_{2^n}^\star }|{\mathscr {W}}_F(a,b)|. \end{aligned}$$

When n is odd, it has been proved that ${\mathscr {N}}{\mathscr {L}}(F) \le 2^{n-1}-2^{\frac{n-1}{2}}$; for n even, the best known nonlinearity is $2^{n-1}-2^{\frac{n}{2}}$, and it is conjectured that ${\mathscr {N}}{\mathscr {L}}(F) \le 2^{n-1}-2^{\frac{n}{2}}$. All the functions in Table 1 reach this value.

The concept of differential uniformity of a function F is related to the number of solutions of the equation $F(x+a)+F(x)=b$ for $a\in {{\mathbb {F}}}_{2^n}^\star$ and $b\in {{\mathbb {F}}}_{2^n}$.

Definition 2.1

For a function F from ${{\mathbb {F}}}_{2^n}$ to itself, and any $a\in {{\mathbb {F}}}_{2^n}^\star$ and $b\in {{\mathbb {F}}}_{2^n}$, we denote by $\delta _F (a, b)$ the number of solutions of the equation $F (x + a) + F (x) = b$. The maximum

$$\begin{aligned} \delta _F=\max _{a\in {{\mathbb {F}}}_{2^n}^\star ,b\in {{\mathbb {F}}}_{2^n}}\delta _F(a,b) \end{aligned}$$

is called the differential uniformity of F, and F is said to be differentially $\delta _F$-uniform.

A function F is called almost perfect nonlinear (APN) if $\delta _F=2$. Note that the possible minimum value of $\delta _F$ is 2, since if x is a solution of $F (x + a) + F (x) = b$, then $x + a$ is also a solution of the equation.

In [17], Cid et al. introduced the concept of Boomerang Connectivity Table for a permutation F over ${\mathbb {F}}_{2^n}$. Next, in [3] the authors introduced the notion of boomerang uniformity.

Definition 2.2

Let F be a permutation over ${{\mathbb {F}}}_{2^n}$, and a, b in ${{\mathbb {F}}}_{2^n}$. The Boomerang Connectivity Table (BCT) of F is given by a $2^n \times 2^n$ table $T_F$, in which the entry for the position (a, b) is given by

$$\begin{aligned} T_F (a, b) = |\{x\in {\mathbb {F}}_{2^n}\,:\, F^{-1}(F (x) + a) + F^{-1}(F (x + b) + a) = b\}|. \end{aligned}$$

Moreover, the value

$$\begin{aligned} \beta _F = \max _{a,b\in {{\mathbb {F}}}_{2^n}^\star }|\{x\in {\mathbb {F}}_{2^n}\,:\, F^{-1}(F (x) + a) + F^{-1}(F (x + b) + a) = b\}| \end{aligned}$$

is called the boomerang uniformity of F, or we call F a boomerang $\beta _F$-uniform function.

In [17], the authors show that $\delta _F\le \beta _F$ for any function F. Moreover, $\delta _F=2$ if and only if $\beta _F=2$. So, APN permutations offer an optimal resistance to both differential and boomerang attacks.

There are several equivalence relations of functions for which the differential uniformity and the Walsh spectrum (and in particular the nonlinearity) are preserved. Two functions F and $F'$ from ${{\mathbb {F}}}_{2^n}$ to itself are called:

• affine equivalent if $F' = A_1 \circ F \circ A_2$ where the mappings $A_1,A_2:{{\mathbb {F}}}_{2^n}\rightarrow {{\mathbb {F}}}_{2^n}$ are affine permutations;

• extended affine equivalent (EA-equivalent) if $F' =F'' + A$, where the mappings $A:{{\mathbb {F}}}_{2^n}\rightarrow {{\mathbb {F}}}_{2^n}$ is affine and $F''$ is affine equivalent to F;

• Carlet-Charpin-Zinoviev equivalent (CCZ-equivalent) if for some affine permutation ${\mathscr {L}}$ of ${{\mathbb {F}}}_{2^n}\times {{\mathbb {F}}}_{2^n}$ the image of the graph of F is the graph of $F'$, that is, ${\mathscr {L}}(G_F) = G_{F'}$, where $G_F = \{(x,F(x)) \,:\, x \in {{\mathbb {F}}}_{2^n}\}$ and $G_{F'} = \{(x,F'(x)) \,:\, x \in {{\mathbb {F}}}_{2^n}\}$.

Obviously, affine equivalence is included in the EA-equivalence, and it is also well known that EA-equivalence is a particular case of CCZ-equivalence and every permutation is CCZ-equivalent to its inverse [14].

The algebraic degree is invariant for the affine equivalence and also for the EA-equivalence for nonlinear functions, but not for the CCZ-equivalence. The boomerang uniformity is preserved by affine equivalence and inverse transformation, but not from EA- and CCZ-equivalence in general [3].

Some secondary construction methods have been introduced to find new low differentially uniform functions from the known ones. For example, some constructions of differentially 4-uniform permutations over ${{\mathbb {F}}}_{2^{2m}}$, of degree $m+1$, by using Gold APN functions over ${{\mathbb {F}}}_{2^{2m+1}}$, were obtained by Li and Wang in [24], inspired by the idea introduced by Carlet in [13]. In [15], Carlet et al. give a construction of a differentially 4-uniform function over ${{\mathbb {F}}}_{2^{2m}}$ from the inverse permutation over ${{\mathbb {F}}}_{2^{2m-1}}$. In the following we will denote the inverse function by $x^{-1}$ (with $0^{-1}:=0$).

The inverse function is APN over ${{\mathbb {F}}}_{2^n}$ when n is odd, and is differentially 4-uniform when n is even [27]. In the recent years, it has been found that a large number of differentially 4-uniform permutations can be obtained by modifying the inverse function on some subset of ${{\mathbb {F}}}_{2^n}$. Among these constructions we have

• The function

  $$\begin{aligned} F_1(x)={\left\{ \begin{array}{ll} x^{-1}+1&{}\hbox { if}\ x\in S\\ x^{-1}&{}\hbox { if}\ x\notin S \end{array}\right. } \end{aligned}$$

  where S is some specific subset of ${{\mathbb {F}}}_{2^n}$ (n even). Some classes of differentially 4-uniform permutations of this form are given in [29, 31, 32, 34, 41]

• The function

  $$\begin{aligned} F_{t_1,t_2}(x)={\left\{ \begin{array}{ll} t_1x^{-1}+t_2&{}\hbox { if}\ x\in {{\mathbb {F}}}_{2^s}\\ x^{-1}&{}\hbox { if}\ x\notin {{\mathbb {F}}}_{2^s} \end{array}\right. } \end{aligned}$$

  where $n=sm$ with s even and n/s odd, $t_1,t_2\in {{\mathbb {F}}}_{2^s}$ and $t_1\ne 0$ [39].

• The function

  $$\begin{aligned} F_{\alpha ,\beta }(x)={\left\{ \begin{array}{ll} \beta (x+1)^{-1}+\alpha &{}\hbox { if}\ x\in {{\mathbb {F}}}_{2^s}\\ x^{-1}&{}\hbox { if}\ x\notin {{\mathbb {F}}}_{2^s} \end{array}\right. } \end{aligned}$$

  where $n=sm$ with s even and n/s odd, $\alpha ,\beta \in {{\mathbb {F}}}_{2^s}$ and $\beta \ne 0$ [28].

• The function

  $$\begin{aligned} F_\gamma (x)={\left\{ \begin{array}{ll} (\gamma x)^{-1}&{}\hbox { if}\ x\in U\\ x^{-1}&{}\hbox { if}\ x\notin U \end{array}\right. } \end{aligned}$$

  where ${{\,\mathrm{Tr}\,}}(\gamma )={{\,\mathrm{Tr}\,}}(\gamma ^{-1})=1$ and U is some specific subset of ${{\mathbb {F}}}_{2^n}$ (n even such that n/2 is odd) [30].

• The function

  $$\begin{aligned} F_{\gamma }(x)={\left\{ \begin{array}{ll} (\gamma x)^{-1}&{}\hbox { if}\ x\in {{\mathbb {F}}}_{2^s}\\ x^{-1}&{}\hbox { if}\ x\notin {{\mathbb {F}}}_{2^s} \end{array}\right. } \end{aligned}$$

  where $n=sm$ with s even and n/s odd for any $\gamma \in {{\mathbb {F}}}_{2^s}^\star$, and with also s odd if ${{\,\mathrm{Tr}\,}}(\gamma )=0$ [37].

In the next sections, we will study the piecewise construction for the case of Gold and Bracken–Leander 4-uniform permutations and we will show that it is possible to obtain permutations with low differential uniformity.

3 Differentially 4-uniform piecewise functions from APN functions

If we use APN permutations in the piecewise construction, then we can obtain a differentially 4-uniform function. This applies in particular to the case of n odd for which some families of APN permutations are known.

Proposition 3.1

Let $n=sm$, with m odd. Let f be an APN permutation over ${{\mathbb {F}}}_{2^s}$ and $g\in {{\mathbb {F}}}_{2^s}[x]$ an APN permutation over ${{\mathbb {F}}}_{2^n}$. Then, the function

$$\begin{aligned} F(x)=f(x)+(f(x)+g(x))(x^{2^s}+x)^{2^n-1}={\left\{ \begin{array}{ll} f(x)&{}\hbox { if}\ x\in {{\mathbb {F}}}_{2^s}\\ g(x)&{}\hbox { if}\ x\notin {{\mathbb {F}}}_{2^s} \end{array}\right. } \end{aligned}$$

is a differentially 4-uniform permutation.

Proof

We need to check that for any $a\in {{\mathbb {F}}}_{2^n}^\star$ and $b\in {{\mathbb {F}}}_{2^n}$ the equation

$$\begin{aligned} F(x)+F(x+a)=b \end{aligned}$$

(1)

admits at most 4 solutions. First consider $a\in {{\mathbb {F}}}_{2^s}^\star$. Then we can have the equations

$$\begin{aligned} f(x)+f(x+a)=b \end{aligned}$$

and

$$\begin{aligned} g(x)+g(x+a)=b \end{aligned}$$

if $x\in {{\mathbb {F}}}_{2^s}$ or $x\notin {{\mathbb {F}}}_{2^s}$. In both cases we can have at most 2 solutions which implies that we can have at most 4 solutions for (1).

When a is not in ${{\mathbb {F}}}_{2^s}$, then we can have two cases:

• a solution x is in ${{\mathbb {F}}}_{2^s}$ and $x+a$ not;

• both the solutions x and $x+a$ are not in ${{\mathbb {F}}}_{2^s}$.

Let us count the solutions of first type, that is, we want to count the number of pairs in ${{\mathbb {F}}}_{2^s}\times (a+{{\mathbb {F}}}_{2^s})$ which are solutions of our equation. To do that, we can count the number of solutions which belong to $a+{{\mathbb {F}}}_{2^s}$. Then, consider $x\in a+{{\mathbb {F}}}_{2^s}$, from (1) we obtain

$$\begin{aligned} g(x)+f(x+a)=b. \end{aligned}$$

(2)

Raising (2) to the power $2^s$ and adding the result to (2) we have

$$\begin{aligned} g(x)+g(x^{2^s})=b^{2^s}+b, \end{aligned}$$

recall that $g(x)^{2^s}=g(x^{2^s})$ since $g\in {{\mathbb {F}}}_{2^s}[x]$. Moreover, since g is a permutation over ${{\mathbb {F}}}_{2^n}$, for $b\in {{\mathbb {F}}}_{2^s}$ we have no solution of this type. If $b\notin {{\mathbb {F}}}_{2^s}$, then we have $x^{2^s}=x+c$ whit $c=a^{2^s}+a\ne 0$. Thus, the equation $g(x)+g(x^{2^s})=b^{2^s}+b$ admits at most two solutions x and $x+c$ (recall that g is APN over ${{\mathbb {F}}}_{2^n}$). Since $x\in a+{{\mathbb {F}}}_{2^s}$, we have that $x+c\in a^{2^s}+{{\mathbb {F}}}_{2^s}$ and $a^{2^s}+{{\mathbb {F}}}_{2^s}\cap a+{{\mathbb {F}}}_{2^s}=\emptyset$. Indeed, if $a^{2^s}+{{\mathbb {F}}}_{2^s}\cap a+{{\mathbb {F}}}_{2^s}\ne \emptyset$, then $a^{2^s}+a\in {{\mathbb {F}}}_{2^s}$ and thus $a^{2^{2s}}=a$, implying ${{\mathbb {F}}}_{2^{2s}}\subseteq {{\mathbb {F}}}_{2^n}$, which is not possible. This implies that we can have at most one solution of (2) in $a+{{\mathbb {F}}}_{2^s}$. This leads to at most two solutions of (1).

For the second case, we have that (1) is given by

$$\begin{aligned} g(x)+g(x+a)=b, \end{aligned}$$

which admits at most 2 solutions. This implies that for $a\notin {{\mathbb {F}}}_{2^s}$ Equation (1) admits at most 4 solutions. $\square$

Remark 3.1

Note that if in Proposition 3.1 one APN function is a permutation and the other one no, then the piecewise function is still differentially 4-uniform but it may not be a permutation. In particular, the restriction on m odd is necessary for having g to be an APN permutation (see for instance [19]).

4 Differentially 6-uniform permutations from the Gold and Bracken–Leander functions

In this section we will study the piecewise construction for the case of Gold and the Bracken–Leander function. Before considering these functions, we will give a general result on the differential uniformity of some piecewise functions.

Theorem 4.1

Let $n=sm$ for some positive integers s and m. Let f and g be two polynomials with coefficients in ${{\mathbb {F}}}_{2^s}$, that is $f,g\in {{\mathbb {F}}}_{2^s}[x]$, and g permuting ${{\mathbb {F}}}_{2^n}$. Suppose that:

• (H1) f is a $\delta _f$-uniform function over ${{\mathbb {F}}}_{2^s}$;

• (H2) g is a $\delta _g$-uniform function over ${{\mathbb {F}}}_{2^n}$;

• (H3) for any $a\in {{\mathbb {F}}}_{2^s}^\star$ and $b\in {{\mathbb {F}}}_{2^s}$ the equation $g(x)+g(x+a)=b$ has no solution in ${{\mathbb {F}}}_{2^n}\setminus {{\mathbb {F}}}_{2^s}$.

Then, the function

$$\begin{aligned} F(x)=f(x)+(f(x)+g(x))(x^{2^s}+x)^{2^n-1}={\left\{ \begin{array}{ll} f(x)&{}\hbox { if}\ x\in {{\mathbb {F}}}_{2^s}\\ g(x)&{}\hbox { if}\ x\notin {{\mathbb {F}}}_{2^s} \end{array}\right. } \end{aligned}$$

is such that

$$\begin{aligned} \delta _F(a,b)\le {\left\{ \begin{array}{ll} \max \{\delta _f,\delta _g\}&{}\hbox { if}\ a\in {{\mathbb {F}}}_{2^s}\\ \delta _g+2&{}\hbox { if}\ a\notin {{\mathbb {F}}}_{2^s}. \end{array}\right. } \end{aligned}$$

Proof

We need to check the number of solutions of the equation

$$\begin{aligned} F(x)+F(x+a)=b. \end{aligned}$$

(3)

Suppose that $a\in {{\mathbb {F}}}_{2^s}^\star$. Then, we can have that both the solutions x and $x+a$ are in ${{\mathbb {F}}}_{2^s}$ or none is in ${{\mathbb {F}}}_{2^s}$. In the first case, (3) becomes

$$\begin{aligned} f(x)+f(x+a)=b, \end{aligned}$$

which has at most $\delta _f$ solutions if $b\in {{\mathbb {F}}}_{2^s}$ and none when $b\notin {{\mathbb {F}}}_{2^s}$.

In the second case, we have the equation

$$\begin{aligned} g(x)+g(x+a)=b. \end{aligned}$$

From (H3) we have no solution in ${{\mathbb {F}}}_{2^n}\setminus {{\mathbb {F}}}_{2^s}$ if $b\in {{\mathbb {F}}}_{2^s}$. If $b\notin {{\mathbb {F}}}_{2^s}$ we can have at most $\delta _g$ solutions. Then, for $a\in {{\mathbb {F}}}_{2^s}^\star$ we have at most $\delta =\max \{\delta _f,\delta _g\}$ solutions for Equation (3) for any b.

Consider, now, $a \notin {{\mathbb {F}}}_{2^s}$. We can have two cases:

• (i) a solution x is in ${{\mathbb {F}}}_{2^s}$ and $x+a$ not;

• (ii) both the solutions x and $x+a$ are not in ${{\mathbb {F}}}_{2^s}$.

We want to count the number of pairs $(x,x+a)$ in ${{\mathbb {F}}}_{2^s}\times (a+{{\mathbb {F}}}_{2^s})$ which are solutions of Equation (3). Without loss of generality, we can suppose $x\in a+{{\mathbb {F}}}_{2^s}$. Then (3) becomes

$$\begin{aligned} g(x)+f(x+a)=b. \end{aligned}$$

(4)

From this, raising (4) by $2^s$ and adding the result to (4), we obtain the equation $g(x)^{2^s}+g(x)=b^{2^s}+b$. Denoting by $y=g(x)$, we obtain

$$\begin{aligned} y^{2^s}+y=b^{2^s}+b. \end{aligned}$$

The solutions of this last equation are the elements of the coset $b+{{\mathbb {F}}}_{2^s}$. Since we supposed that $x\in a+{{\mathbb {F}}}_{2^s}$ and g permutes ${{\mathbb {F}}}_{2^n}$ we need to check how many elements we have in $g(a+{{\mathbb {F}}}_{2^s})\cap (b+{{\mathbb {F}}}_{2^s})$, where $g(a+{{\mathbb {F}}}_{2^s}):=\{g(x)\,:\,x\in a+{{\mathbb {F}}}_{2^s}\}$. Suppose that $|g(a+{{\mathbb {F}}}_{2^s})\cap (b+{{\mathbb {F}}}_{2^s})|\ge 2$. Then, there exist $z_1,z_2,w_1,w_2\in {{\mathbb {F}}}_{2^s}$ such that $b+z_1=g(a+w_1)$, $b+z_2=g(a+w_2)$ and $z_1\ne z_2$, $w_1\ne w_2$. Thus,

$$\begin{aligned} g(a+w_1)+g(a+w_2)=z_1+z_2. \end{aligned}$$

Denoting by $x'= a+w_1$ and $a'=w_1+w_2$, we obtain that

$$\begin{aligned} g(x')+g(x'+a')=z_1+z_2. \end{aligned}$$

Thus we would have a solution $x'\notin {{\mathbb {F}}}_{2^s}$ for the equation $g(x)+g(x'+a')=z_1+z_2$, which is not possible by (H3). Therefore, $|g(a+{{\mathbb {F}}}_{2^s})\cap (b+{{\mathbb {F}}}_{2^s})|\le 1$, implying that in ${{\mathbb {F}}}_{2^s}\times (a+{{\mathbb {F}}}_{2^s})$ we have at most one pair $(x,x+a)$ which can be solutions of (3).

For the second case we have the equation

$$\begin{aligned} g(x)+g(x+a)=b, \end{aligned}$$

which admits at most $\delta _g$ solutions for any b. Then, in total for the case $a\notin {{\mathbb {F}}}_{2^s}$ Equation (3) admits at most $\delta _g+2$ solutions. $\square$

It is easy to note that if also f permutes ${{\mathbb {F}}}_{2^s}$, then F is a permutation over ${{\mathbb {F}}}_{2^n}$.

Remark 4.1

Note that Proposition 3.1 and Theorem 4.1 use a similar analysis. However, the proof of Proposition 3.1 relies strictly on the APN property of g for the case $x\in {{\mathbb {F}}}_{2^s}$ and $x+a\notin {{\mathbb {F}}}_{2^s}$ and not on Condition (H3). So we cannot include the result of Proposition 3.1 into Theorem 4.1.

Remark 4.2

When the function g in Theorem 4.1 is a power function, i.e. $g(x)=x^d$, Condition (H3) can be checked only for $a=1$. Indeed, for any nonzero a we have that studying

$$\begin{aligned} x^d+(x+a)^d=b \end{aligned}$$

is equivalent to study

$$\begin{aligned} \left( \frac{x}{a}\right) ^d+\left( \frac{x}{a}+1\right) ^d=\frac{b}{a^d}. \end{aligned}$$

Thus, for the case of Gold and Bracken–Leander functions we need to check if the equation $x^d+(x+1)^d=b$ has no solution in ${{\mathbb {F}}}_{2^n}\setminus {{\mathbb {F}}}_{2^s}$ whenever b is in ${{\mathbb {F}}}_{2^s}$.

For the Gold function we have the following.

Lemma 4.1

Let $n=sm$ with s even and m odd. Let k be such that $\gcd (k,n)=2$. For any $b\in {{\mathbb {F}}}_{2^s}$ the equation

$$\begin{aligned} x^{2^k}+x=b \end{aligned}$$

does not admit any solution x in ${{\mathbb {F}}}_{2^n}\setminus {{\mathbb {F}}}_{2^s}$.

Proof

Suppose that there exists $b\in {{\mathbb {F}}}_{2^s}$ for which the equation admits a solution $x\notin {{\mathbb {F}}}_{2^s}$. Then, we have that $x^{2^k}+x=x^{2^{k+s}}+x^{2^s}$, which also implies $(x^{2^s}+x)^{2^k}=x^{2^s}+x$. Then, $x^{2^s}+x\in {{\mathbb {F}}}_{2^n}\cap {{\mathbb {F}}}_{2^k}={{\mathbb {F}}}_{4}\subset {{\mathbb {F}}}_{2^s}$. Since m is odd and $x\notin {{\mathbb {F}}}_{2^s}$ this is not possible. Indeed, $x^{2^s}+x\in {{\mathbb {F}}}_{2^s}$ implies $(x^{2^s}+x)^{2^s}=x^{2^s}+x$ and thus $x^{2^{2s}}=x$, and then $x\in {{\mathbb {F}}}_{2^n}\cap {{\mathbb {F}}}_{2^{2s}}={{\mathbb {F}}}_{2^s}$. $\square$

Thus, we have immediately the following result.

Theorem 4.2

Let $n=sm$ with s even such that s/2 and m are odd. Let k be such that $\gcd (k,n)=2$ and f be a permutation at most differentially 6-uniform over ${{\mathbb {F}}}_{2^s}$. Then

$$\begin{aligned} F(x)=f(x)+(f(x)+x^{2^k+1})(x^{2^s}+x)^{2^n-1}={\left\{ \begin{array}{ll} f(x)&{}\hbox { if}\ x\in {{\mathbb {F}}}_{2^s}\\ x^{2^k+1}&{}\hbox { if}\ x\notin {{\mathbb {F}}}_{2^s} \end{array}\right. } \end{aligned}$$

is a differentially 6-uniform permutation over ${{\mathbb {F}}}_{2^n}$.

Proof

Lemma 4.1 implies that we have no solution in ${{\mathbb {F}}}_{2^n}\setminus {{\mathbb {F}}}_{2^s}$ of $x^{2^k}+(x+1)^{2^k}=b$ when $b\in {{\mathbb {F}}}_{2^s}$. Then, we have our claim from Theorem 4.1. $\square$

For the Gold function it was considered in [40] the case of changing its image on the subfield ${{\mathbb {F}}}_{4}$ composing the function with the cycle $(1,\omega ,\omega ^2)$, where $\omega ^2=\omega +1$; or modifying it using $f(x)=x^{2^k+1}+1$ over a subfield ${{\mathbb {F}}}_{2^s}$, with s/2 odd. Theorem 4.2 generalizes the results given in [40].

Also for the case of Bracken–Leander function it is possible to prove a similar result as in Lemma 4.1.

Lemma 4.2

Let $n=4k=sm$ with k and m odd. For any $b\in {{\mathbb {F}}}_{2^s}$ the equation

$$\begin{aligned} x^{2^{2k}+2^k} +x^{2^{2k}+1} +x^{2^k+1} +x^{2^{2k}} +x^{2^k} +x =b \end{aligned}$$

(5)

does not admit any solution x in ${{\mathbb {F}}}_{2^n}\setminus {{\mathbb {F}}}_{2^s}$.

Proof

The proof is obtained following similar steps to those used in [5, Theorem 1] for proving the differential 4-uniformity of the map $x^{2^{2k}+2^k+1}$.

Denoting by ${{\,\mathrm{Tr}\,}}^{4k}_k$ the trace map from ${{\mathbb {F}}}_{2^{4k}}$ to ${{\mathbb {F}}}_{2^k}$, since

$$\begin{aligned} {{\,\mathrm{Tr}\,}}^{4k}_k (x^{2^{2k}+2^k}+x^{2^{2k}+1}+x^{2^k+1}+x^{2^{2k}}+x^{2^k})=0, \end{aligned}$$

from (5) we obtain ${{\,\mathrm{Tr}\,}}^{4k}_k(x)= x^{2^{3k}}+x^{2^{2k}}+x^{2^{k}}+x={{\,\mathrm{Tr}\,}}^{4k}_k(b)=c$ and thus $x^{2^{2k}}+x^{2^k}=x^{2^{3k}}+x+c$. From this, Eq. (5) can be rewritten as

$$\begin{aligned} x^{2^{2k}+2^k} +x(x^{2^{3k}}+x+c) +x^{2^{3k}} =c+b \end{aligned}$$

(6)

Now, using always the fact that $x^{2^{3k}}+x^{2^{2k}}+x^{2^{k}}+x=c$, we have that raising (6) to the power ${2^{2k}}$ and adding the result to Eq. (6) we obtain

$$\begin{aligned} (x+x^{2^{2k}})^2+(c+1)(x+x^{2^{2k}})=b^{2^{2k}}+b+c=b'. \end{aligned}$$

(7)

Note that, since $b\in {{\mathbb {F}}}_{2^s}$ then also $c\in {{\mathbb {F}}}_{2^s}$ and $b'\in {{\mathbb {F}}}_{2^s}$.

Now, suppose that $c=1$, then Eq. (7) becomes

$$\begin{aligned} x+x^{2^{2k}}={b'}^{2^{-1}}=b''. \end{aligned}$$

Thus, we can substitute $x^{2^{2k}}= x+b''$ in Eq. (5) obtaining

$$\begin{aligned} x^2+{b''}(x+x^{2^k})+x^{2^k}=b+b''. \end{aligned}$$

(8)

If we raise (8) by ${2^{k}}$ and we add it to (8), we have

$$\begin{aligned} (x+x^{2^k})^2+(b''+b''^{2^k}+1)(x+x^{2^k})=b''^{2^k+1}+b+b^{2^k}+b''^{2^k}. \end{aligned}$$

Noting that $b''+b''^{2^k}= (x+x^{2^{2k}})+ (x+x^{2^{2k}})^{2^k}=c=1$ we have

$$\begin{aligned} x+x^{2^k}=({b''^{2^k+1}+b''^{2^k}+b+b^{2^k}})^{2^{-1}}=t. \end{aligned}$$

Now, substituting $x^{2^k}=x+t$ in (8) we obtain the equation

$$\begin{aligned} x^2+x=b+b''+{b''}t+t. \end{aligned}$$

Since $b+b''+{b''}t+t\in {{\mathbb {F}}}_{2^s}$ we have that $x^2+x=x^{2^{s+1}}+x^{2^s}$. Therefore, $x^{2^s}+x\in {{\mathbb {F}}}_{2}\subset {{\mathbb {F}}}_{2^s}$. This is not possible since it would imply $x=x^{2^{2s}}$ and $x\in {{\mathbb {F}}}_{2^n}\cap {{\mathbb {F}}}_{2^{2s}}={{\mathbb {F}}}_{2^s}$. Then, if $c=1$ we cannot have solutions $x\notin {{\mathbb {F}}}_{2^s}$.

Consider now, $c\ne 1$. Substituting $x=(c+1)y$ in (7) we obtain

$$\begin{aligned} (c+1)^2 [(y+y^{2^{2k}})^2+(y+y^{2^{2k}})]=b'. \end{aligned}$$

Note that $c\in {{\mathbb {F}}}_{2^k}\cap {{\mathbb {F}}}_{2^s}$ and then if $x\notin {{\mathbb {F}}}_{2^s}$ so do y. Now, we have that $y+y^{2^{2k}}$ is a solution of the equation $z^2+z=b'/(c+1)^2$. Then, $y+y^{2^{2k}}=t$ or $t+1$ for some $t \in {{\mathbb {F}}}_{2^s}\cap {{\mathbb {F}}}_{2^{2k}}$ (note that $b'\in {{\mathbb {F}}}_{2^s}$ and we cannot have solution in ${{\mathbb {F}}}_{2^n}\setminus {{\mathbb {F}}}_{2^s}$ for $z^2 +z=b'$).

If $y+y^{2^{2k}}=t$ then we can substitute $y^{2^{2k}}=y+t$ in Eq. (5) giving

$$\begin{aligned} (c+1)^{2}((y+y^{2^k})t+y^2)+(c+1)(y^{2^k}+t)=b. \end{aligned}$$

(9)

Adding Eq. (9) to itself raised by ${2^k}$ we get

$$\begin{aligned}&(c+1)^{2}(y+y^{2^k})^2 + [(c+1)^{2}(t+t^{2^k})+(c+1)](y+y^{2^k}) \nonumber \\&\quad +(c+1)^{2}t^{2^k+1}+(c+1)t^{2^{k}}+b+b^{2^k}=0. \end{aligned}$$

(10)

Since $x=(c+1)y$ we have $c={{\,\mathrm{Tr}\,}}^{4k}_k(x)=(c+1){{\,\mathrm{Tr}\,}}^{4k}_k(y)$ and ${{\,\mathrm{Tr}\,}}^{4k}_k(y)=t^{2^k}+t$. Therefore, $t^{2^k}+t=c/(c+1)$ and

$$\begin{aligned}&(c+1)^{2}((y+y^{2^k})^2 + (y+y^{2^k})) \nonumber \\&\quad +(c+1)^{2}t^{2^k+1}+(c+1)t^{2^{k}}+b+b^{2^k}=0. \end{aligned}$$

(11)

Note that also considering $y+y^{2^{2k}}=t+1$ we would obtain the same equation.

Now, from (11) we have that $y+y^{2^k}=r$ or $r+1$ for some $r\in {{\mathbb {F}}}_{2^s}$.

If $y^{2^k}=y+r$ then $y^{2^{2k}}=y+r+r^{2^k}$ and, substituting in (5), we obtain

$$\begin{aligned} \begin{aligned} (c+1)^{2}((y+r+r^{2^k})(y+r)+(y+r+r^{2^k})y+(y+r)y)+(c+1)(y+r^{2^k})=&\\ (c+1)^{2}y^2+(c+1)y+(c+1)^2(r^{2^k+1}+r^2)+(c+1)r^{2^k}=b\end{aligned} \end{aligned}$$

which is the same as

$$\begin{aligned} x^2+x+(c+1)^2(r^{2^k+1}+r^2)+(c+1)r^{2^k}=b, \end{aligned}$$

and then $x^2+x=d$ for some $d\in {{\mathbb {F}}}_{2^s}$, which is not possible as seen above.

If $y^{2^k}=y+r+1$, then we would obtain

$$\begin{aligned} x^2+x+(c+1)^2(r^{2^k+1}+r^{2^k}+r^2+r)+(c+1)(r+1)^{2^k}=b. \end{aligned}$$

Then, Eq. (5) does not admit solutions in ${{\mathbb {F}}}_{2^n}\setminus {{\mathbb {F}}}_{2^s}$ when $b\in {{\mathbb {F}}}_{2^s}$. $\square$

Theorem 4.3

Let $n=4k=sm$, with k, m odd and s even. Let f be a permutation at most differentially 6-uniform over ${{\mathbb {F}}}_{2^s}$. Then

$$\begin{aligned} F(x)=f(x)+(f(x)+x^{2^{2k}+2^k+1})(x^{2^s}+x)^{2^n-1}={\left\{ \begin{array}{ll} f(x)&{}\hbox { if}\ x\in {{\mathbb {F}}}_{2^s}\\ x^{2^{2k}+2^k+1}&{}\hbox { if}\ x\notin {{\mathbb {F}}}_{2^s} \end{array}\right. } \end{aligned}$$

is a differentially 6-uniform permutation over ${{\mathbb {F}}}_{2^n}$.

Proof

From Lemma 4.2 we have that $x^{2^{2k}+2^k+1}+(x+1)^{2^{2k}+2^k+1}=b$ has no solution in ${{\mathbb {F}}}_{2^n}\setminus {{\mathbb {F}}}_{2^s}$ when $b\in {{\mathbb {F}}}_{2^s}$. So the claim follows from Theorem 4.1. $\square$

From Theorems 4.2 and 4.3 we obtain a general construction for piecewise functions with differential uniformity at most 6. In the following, we will show that using a function f which is affine equivalent to the inverse function we can obtain a permutation of maximal degree $n-1$ with high nonlinearity.

We, first, give the following result.

Lemma 4.3

Let F be a function defined over ${{\mathbb {F}}}_{2^n}$. Then, F in its polynomial representation has a term of algebraic degree $n-1$ if and only if there exists a linear monomial $x^{2^j}$ such that $\sum _{x\in {{\mathbb {F}}}_{2^n}}F(x)x^{2^j}\ne 0$.

Proof

We note that for any $i\le 2^n-1$ and $j\le n-1$ we have

$$\begin{aligned} w_2(i)+1\ge w_2(i+2^j)\ge \deg (x^{i+2^j} \mod x^{2^n}-x). \end{aligned}$$

Indeed, let us consider the first inequality. If $2^j$ is not in the binary expansion of i, that is $i=\sum _{k=0}^{n-1}b_k2^k$ with $b_j=0$, then $w_2(i+2^j)=w_2(i)+1$. If $b_j=1$, then, denoting by $h=\min \{n, k\,:\, j+1\le k\le n-1, \, b_k=0\}$, we have $i+2^j=\sum _{k=0}^{j-1}b_k2^k+2^h+ \sum _{k=h+1}^{n-1}b_k2^k$, implying $w_2(i+2^j)=w_2(i)-(h-j)+1< w_2(i)+1$.

For the second inequality, we have that if $i+2^j\le 2^n-1$, then $w_2(i+2^j)=\deg (x^{i+2^j} \mod x^{2^n}-x)=\deg (x^{i+2^j})$. If $i+2^j> 2^n-1$, then it means that $i=\sum _{k=0}^{j-1}b_k2^k+\sum _{k=j}^{n-1}2^k$ and $i+2^j=2^n+\sum _{k=0}^{j-1}b_k2^k$. So, denoting by $h=\min \{j, k\,:\, 0\le k\le j-1, \, b_k=0\}$, we have

$$\begin{aligned} x^{i+2^j} \mod x^{2^n}-x=x\cdot x^{\sum _{k=0}^{j-1}b_k2^k}= x^{2^h+\sum _{k=h+1}^{j-1}b_k2^k}, \end{aligned}$$

and so $w_2(i+2^j)\ge \deg (x^{2^h+\sum _{k=h+1}^{j-1}b_k2^k})$.

Thus, since for any function G we have $\sum _{x\in {{\mathbb {F}}}_{2^n}}G(x)\ne 0$ if and only if $\deg (G)=n$, we obtain that if $w_2(i)<n-1$, then $\sum _{x\in {{\mathbb {F}}}_{2^n}}x^{i+2^j}=0$.

Now, consider the function F. We can write $F(x)=cx^{2^n-1}+\sum _{k=0}^{n-1}a_kx^{2^n-1-2^k}+G(x)$, where $\deg (G)\le n-2$. Note that for any $k=0,...,n-1$ and $0\le j\le n-1$, we have

$$\begin{aligned} x^{2^n-1-2^k+2^j} \mod x^{2^n}-x\equiv {\left\{ \begin{array}{ll} x^{2^n-1}&{} \text { if } j=k\\ x^{(2^{n}-1)-(2^{k-1}+...+2^{j})}&{} \text { if } j <k\\ x^{2^{j-1}+...+2^k}&{} \text { if } j> k. \end{array}\right. } \end{aligned}$$

Let ${\bar{k}}=\min \{k\,:\, a_k\ne 0\}$, we have that

$$\begin{aligned} \begin{aligned} \sum _{x\in {{\mathbb {F}}}_{2^n}}F(x)x^{2^{{\bar{k}}}}=&c\sum _{x\in {{\mathbb {F}}}_{2^n}}x^{2^{{\bar{k}}}}+a_{{\bar{k}}}\sum _{x\in {{\mathbb {F}}}_{2^n}}x^{2^n-1}+\sum _{k=0}^{{\bar{k}}-1}\sum _{x\in {{\mathbb {F}}}_{2^n}}a_kx^{2^{{\bar{k}}-1}+...+2^k}\\&+\sum _{k={\bar{k}}+1}^{n-1}\sum _{x\in {{\mathbb {F}}}_{2^n}}a_kx^{2^n-1-(2^{k-1}+...+2^{{\bar{k}}})}+\sum _{x\in {{\mathbb {F}}}_{2^n}}G(x)x^{2^{{\bar{k}}}}=a_{{\bar{k}}}. \end{aligned} \end{aligned}$$

Thus, if F(x) has a term of algebraic degree $n-1$, that is, there exists $a_k\ne 0$, then we can find a monomial $x^{2^j}$ for which $\sum _{x\in {{\mathbb {F}}}_{2^n}}F(x)x^{2^{j}}\ne 0$.

Vice versa, from above we have that if, by contradiction, $F(x)=cx^{2^n-1}+G(x)$, with $\deg (G)\le n-2$, then $\sum _{x\in {{\mathbb {F}}}_{2^n}}F(x)x^{2^{j}}= c\sum _{x\in {{\mathbb {F}}}_{2^n}}x^{2^{j}}+\sum _{x\in {{\mathbb {F}}}_{2^n}}G(x)x^{2^{j}}=0$ for any j. $\square$

Remark 4.3

If F is a permutation, Lemma 4.3 gives a necessary and sufficient condition for having $\deg (F)=n-1$. Moreover, it is possible to generalize Lemma 4.3 also for the case $\deg (F)=n-t$, using monomials $x^d$ with $w_2(d)=t$. This result is similar to that given in [28, 33], where the authors use an n-variables Boolean function to give a sufficient condition for having $\deg (F)=n-1$. In particular, they show that if there exists a Boolean function h(x) of degree $n-k$ such that $\sum _{x\in {{\mathbb {F}}}_{2^n}}F(x)h(x)\ne 0$, then $\deg (F)\ge k$.

Corollary 4.1

Let $n=sm$ with s even such that s/2 and m are odd. Let k be such that $\gcd (k,n)=2$ and $f(x)=A_1\circ Inv\circ A_2(x)$, where $Inv(x)=x^{-1}$ and $A_1,A_2$ are affine permutations over ${{\mathbb {F}}}_{2^s}$. Then

$$\begin{aligned} F(x)=f(x)+(f(x)+x^{2^k+1})(x^{2^s}+x)^{2^n-1}={\left\{ \begin{array}{ll} f(x)&{}\hbox { if}\ x\in {{\mathbb {F}}}_{2^s}\\ x^{2^k+1}&{}\hbox { if}\ x\notin {{\mathbb {F}}}_{2^s} \end{array}\right. } \end{aligned}$$

is a differentially 6-uniform permutation over ${{\mathbb {F}}}_{2^n}$. Moreover, if $s>2$ then the algebraic degree of F is $n-1$.

Proof

We need to prove only that the degree of F is $n-1$. From Lemma 4.3, since f(x) is affine-equivalent to the inverse function over ${{\mathbb {F}}}_{2^s}$, there exists a monomial $h(x)=x^{2^j}$ in ${{\mathbb {F}}}_{2^s}[x]$ (with $j\le s-1$) such that

$$\begin{aligned} \sum _{x\in {{\mathbb {F}}}_{2^s}}f(x)h(x)\ne 0. \end{aligned}$$

Thus, since $x^{2^k+1}$ has algebraic degree equal to $2<s-1$ over ${{\mathbb {F}}}_{2^n}$ and also over ${{\mathbb {F}}}_{2^s}$, we obtain

$$\begin{aligned} \begin{aligned} \sum _{x\in {{\mathbb {F}}}_{2^n}}F(x)h(x)&=\sum _{x\in {{\mathbb {F}}}_{2^s}}f(x)h(x)+\sum _{x\in {{\mathbb {F}}}_{2^n}}x^{2^k+1}h(x)+\sum _{x\in {{\mathbb {F}}}_{2^s}}x^{2^k+1}h(x)\\ {}&=\sum _{x\in {{\mathbb {F}}}_{2^s}}f(x)h(x)\ne 0. \end{aligned} \end{aligned}$$

Then, we have a term of degree $n-1$ in the polynomial representation of F(x), implying $\deg (F)= n-1$ since F is a permutation. $\square$

Remark 4.4

When $s=2$, we have that $x^{2^k+1}$ has algebraic degree $s-1=1$ over ${{\mathbb {F}}}_{2^s}$, and we could obtain a permutation $F(x)=f(x)+(f(x)+x^{2^{2k}+2^k+1})(x^{2^s}+x)^{2^n-1}$ of degree less than $n-1$ (an example is provided for $n=6$ and $n=10$ in Tables 2 and 3).

Similarly we have the following construction using the Bracken–Leander function.

Corollary 4.2

Let $n=4k=sm$ with k, m odd and s even. Let $f(x)=A_1\circ Inv\circ A_2(x)$, where $Inv(x)=x^{-1}$ and $A_1,A_2$ are affine permutations over ${{\mathbb {F}}}_{2^s}$. Then

$$\begin{aligned} F(x)=f(x)+(f(x)+x^{2^{2k}+2^k+1})(x^{2^s}+x)^{2^n-1}={\left\{ \begin{array}{ll} f(x)&{}\hbox { if}\ x\in {{\mathbb {F}}}_{2^s}\\ x^{2^{2k}+2^k+1}&{}\hbox { if}\ x\notin {{\mathbb {F}}}_{2^s} \end{array}\right. } \end{aligned}$$

is a differentially 6-uniform permutation over ${{\mathbb {F}}}_{2^n}$. Moreover, if $s>4$ then $\deg (F)=n-1$.

Remark 4.5

For $s=4$, we have that $x^{2^{2k}+2^k+1}$ has algebraic degree $s-1=3$ over ${{\mathbb {F}}}_{2^s}$, and we could obtain a permutation $F(x)=f(x)+(f(x)+x^{2^{2k}+2^k+1})(x^{2^s}+x)^{2^n-1}$ of degree less than $n-1$ (we will provide an example for $n=12$ in Table 4).

Proposition 4.1

The nonlinearity of the functions in Corollaries 4.1 and 4.2 is at least $2^{n-1}-2^{\frac{n}{2}}-2^{\frac{s}{2}+1}$.

Proof

Consider any function

$$\begin{aligned} F(x)={\left\{ \begin{array}{ll} f(x)&{}\hbox { if}\ x\in {{\mathbb {F}}}_{2^s}\\ g(x)&{}\hbox { if}\ x\notin {{\mathbb {F}}}_{2^s} \end{array}\right. } \end{aligned}$$

where f and g have coefficients in ${{\mathbb {F}}}_{q^s}$.

Then the Walsh coefficient ${\mathscr {W}}_F(a,b)$ satisfies the following

$$\begin{aligned} \begin{aligned} {\mathscr {W}}_F(a,b)=&\sum _{x\in {{\mathbb {F}}}_{2^s}}(-1)^{Tr(ax+bf(x))}+\sum _{x\in {{\mathbb {F}}}_{2^n}\setminus {{\mathbb {F}}}_{2^s}}(-1)^{Tr(ax+bg(x))}\\ =&\sum _{x\in {{\mathbb {F}}}_{2^s}}(-1)^{Tr(ax+bf(x))}+\sum _{x\in {{\mathbb {F}}}_{2^n}}(-1)^{Tr(ax+bg(x))}-\sum _{x\in {{\mathbb {F}}}_{2^s}}(-1)^{Tr(ax+bg(x))}\\ =&\sum _{x\in {{\mathbb {F}}}_{2^s}}(-1)^{Tr^s_1(Tr^n_s(a)x+Tr^n_s(b)f(x))}+\sum _{x\in {{\mathbb {F}}}_{2^n}}(-1)^{Tr(ax+bg(x))}\\&-\sum _{x\in {{\mathbb {F}}}_{2^s}}(-1)^{Tr^s_1(Tr^n_s(a)x+Tr^n_s(b)g(x))}. \end{aligned} \end{aligned}$$

Then,

$$\begin{aligned} \begin{aligned} |{\mathscr {W}}_F(a,b)|\le&|\sum _{x\in {{\mathbb {F}}}_{2^s}}(-1)^{Tr^s_1(Tr^n_s(a)x+Tr^n_s(b)f(x))}|+|\sum _{x\in {{\mathbb {F}}}_{2^n}}(-1)^{Tr(ax+bg(x))}|\\&+|\sum _{x\in {{\mathbb {F}}}_{2^s}}(-1)^{Tr^s_1(Tr^n_s(a)x+Tr^n_s(b)g(x))}|\\ =&|{\mathscr {W}}^{(s)}_f(Tr^n_s(a),Tr^n_s(b))|+|{\mathscr {W}}^{(s)}_g(Tr^n_s(a),Tr^n_s(b))|+|{\mathscr {W}}_g(a,b)|. \end{aligned} \end{aligned}$$

where ${\mathscr {W}}^{(s)}$ denotes the Walsh transform computed over ${{\mathbb {F}}}_{2^s}$. For the inverse function, Gold function and Bracken–Leander function the maximal values of the module of a Walsh coefficient is $2^{\frac{t}{2}+1}$ [5, 27], where t is the degree of the field extension where we are computing the Walsh coefficient.

Thus, for F as in Corollary 4.1 or Corollary 4.2 we have

$$\begin{aligned} |{\mathscr {W}}_F(a,b)|\le 2^{\frac{s}{2}+2}+2^{\frac{n}{2}+1}, \end{aligned}$$

implying

$$\begin{aligned} {\mathscr {N}}\ell (F)\ge 2^{n-1}-2^{\frac{s}{2}+1}-2^{\frac{n}{2}}. \end{aligned}$$

$\square$

Remark 4.6

We can note that, whenever we modify the Gold or Bracken–Leander function with a bijective vectorial Boolean function $f(x)\in {{\mathbb {F}}}_{2^s}[x]$, which is at most 6-uniform of algebraic degree $s-1$, we can obtain a 6-uniform permutation of maximal algebraic degree. Moreover, the nonlinearity of the obtained function is greater or equal to $2^{n-1}-\frac{\max _{a\in {{\mathbb {F}}}_{2^s}^\star ,b\in {{\mathbb {F}}}_{2^s}}|{\mathscr {W}}^{(s)}_f(a,b)|+2^{\frac{s}{2}+1}}{2}-2^{\frac{n}{2}}$.

It is well known that the algebraic degree is not preserved by the CCZ-equivalence and in particular when replacing a permutation by its inverse. However, for any permutation of maximal algebraic degree, from Lemma 4.3, we have the following easy observation.

Proposition 4.2

Let F be a permutation defined over ${{\mathbb {F}}}_{2^n}$. Then, $\deg (F)=n-1$ if and only if $\deg (F^{-1})=n-1$.

Proof

Suppose $\deg (F)=n-1$. From Lemma 4.3 there exists a linear monomial h(x) for which we have $\sum _{x\in {{\mathbb {F}}}_{2^n}}F(x)h(x)\ne 0$. Since F is a permutation we have

$$\begin{aligned} \sum _{x\in {{\mathbb {F}}}_{2^n}}F(x)h(x)=\sum _{x\in {{\mathbb {F}}}_{2^n}}xh(F^{-1}(x)), \end{aligned}$$

which implies $\deg (h\circ F^{-1})=n-1$. Since h is a linear monomial we have that $\deg (F^{-1})=n-1$.$\square$

From this result we have that also the compositional inverses of the functions given in Corollaries 4.1 and 4.2 are differentially 6-uniform functions with high nonlinearity and algebraic degree $n-1$.

In Tables 2 and 3, we give the CCZ-inequivalent functions that can be obtained by Corollary 4.1 for $n=6,10$. Let ${{\mathbb {F}}}_{2^n}^\star =\langle \zeta \rangle$, we denote by $\omega =\zeta ^{\frac{2^n-1}{3}}$ the primitive element of ${{\mathbb {F}}}_{4}$. Since over ${{\mathbb {F}}}_{4}$ all the permutations are linear (affine) we consider $f(x)=A\circ Inv$. In both cases, we have 5 CCZ-inequivalent functions. One is the Gold function $x^5$, obtained for $A(x)=x$ and it is differentially 4-uniform, three of these were obtained also in [40] and one is new. Note that the new function has degree $n-2$, indeed as pointed out in the proof of Corollary 4.1 when $s=2$ we could obtain functions with degree lower that $n-1$.

Table 2 CCZ-inequivalent permutations from Corollary  4.1 over ${{\mathbb {F}}}_{2^6}$

Table 3 CCZ-inequivalent permutations from Corollary  4.1 over ${{\mathbb {F}}}_{2^{10}}$

In Table 4 we report some permutations constructed from Corollary 4.2 for $n=12$ (in this case $s=4$ and $m=3$). As before, we denote by $\omega =\zeta ^{\frac{2^n-1}{3}}$ the primitive element of ${{\mathbb {F}}}_{4}\subset {{\mathbb {F}}}_{2^s}$ and we consider $f(x)=A\circ Inv$ with A affine permutations defined over ${{\mathbb {F}}}_{4}[x]$. Note that for $A(x)=x^2$ we obtain the Bracken–Leander permutation.

Table 4 CCZ-inequivalent permutations from Corollary  4.2 over ${{\mathbb {F}}}_{2^{12}}$

5 Remarks on the boomerang uniformity for some piecewise permutations

Recently, the boomerang uniformity of some permutations has been studied in [3, 12, 22, 23, 26, 35, 38]. However, the analysis has been focused, principally, on the case of quadratic or power functions. Only in [22] and in [12], it has been determined the boomerang uniformity of some piecewise functions obtained from the inverse function modified on the subfield ${{\mathbb {F}}}_{4}$.

In this section, we give some results about the boomerang uniformity of piecewise permutations as in Theorem 4.1.

It was noted in [22], that the entry $T_F(a,b)$ of the BCT of a function F can be given by the number of solutions (x, y) of the system

$$\begin{aligned} {\left\{ \begin{array}{ll} F^{-1}(x+a)+F^{-1}(y+a)=b\\ F^{-1}(x)+F^{-1}(y)=b. \end{array}\right. } \end{aligned}$$

Moreover, for the functions F and $F^{-1}$ we have that $T_F(a,b)=T_{F^{-1}}(b,a)$. So, the boomerang uniformity of F is given by the maximum number of solutions of the system

$$\begin{aligned} {\left\{ \begin{array}{ll} F(x+a)+F(y+a)=b\\ F(x)+F(y)=b. \end{array}\right. } \end{aligned}$$

(12)

Denoting $y=x+\alpha$ and $D_aF(x)=F(x)+F(x+a)$ , we obtain

$$\begin{aligned} {\left\{ \begin{array}{ll} D_\alpha F(x+a)=b\\ D_\alpha F(x)=b. \end{array}\right. } \end{aligned}$$

(13)

Therefore, let

$$\begin{aligned} \begin{aligned}\beta _F(a,b)=&|\{(x,y)\in {\mathbb {F}}_{2^n}^2\,:\, (x,y) \text { is a solution of} (12)\}|\\ =&|\{(x,\alpha )\in {\mathbb {F}}_{2^n}^2\,:\, (x,\alpha ) \text { is a solution of} (31)|,\end{aligned} \end{aligned}$$

the boomerang uniformity of F is given by

$$\begin{aligned} \beta _F = \max _{a,b\in {{\mathbb {F}}}_{2^n}^\star }\beta _F(a,b). \end{aligned}$$

For piecewise permutations as in Theorem 4.1 we obtain the following result.

Proposition 5.1

Let $n=sm$. Let

$$\begin{aligned} F(x)=f(x)+(f(x)+g(x))(x^{2^s}+x)^{2^n-1}={\left\{ \begin{array}{ll} f(x)&{}\hbox { if}\ x\in {{\mathbb {F}}}_{2^s}\\ g(x)&{}\hbox { if}\ x\notin {{\mathbb {F}}}_{2^s} \end{array}\right. } \end{aligned}$$

be a permutation over ${{\mathbb {F}}}_{2^n}$ where f, g are as in Theorem 4.1, with g satisfying (H3). Then, for any $a,b\in {{\mathbb {F}}}_{2^n}^\star$

$$\begin{aligned} \beta _F(a,b)\le {\left\{ \begin{array}{ll} \beta _f(a,b)+\beta _g(a,b)&{} \hbox { if}\ a,b\in {{\mathbb {F}}}_{2^s}^\star \\ \beta _g(a,b)&{} \hbox {if} a\in {{\mathbb {F}}}_{2^s}^\star \hbox {and} b\notin {{\mathbb {F}}}_{2^s}\\ \beta _g(a,b)+4\cdot N+2&{} \hbox { if}\ a,b\notin {{\mathbb {F}}}_{2^s}, \end{array}\right. } \end{aligned}$$

where $N=|\{\alpha \notin {{\mathbb {F}}}_{2^s}\mid \, f(x)+g(x+\alpha )=b \hbox { has solutions}\ x\in {{\mathbb {F}}}_{2^s}\}|$.

Proof

Note that System (12) could be divided into sixteen systems depending on x, $x+a$, y and $y+a$ lying in ${{\mathbb {F}}}_{2^s}$ or not. However, for four of these systems we can immediately see that they are not possible, such as

$$\begin{aligned} {\left\{ \begin{array}{ll} f(x)+f(y)=b\\ f(x+a)+g(y+a)=b, \end{array}\right. } \end{aligned}$$

since it would mean that $x,x+a$ and y are in ${{\mathbb {F}}}_{2^s}$ and $y+a$ is not. But then, also $a\in {{\mathbb {F}}}_{2^s}$ and so $y+a\in {{\mathbb {F}}}_{2^s}$, which is a contradiction.

Therefore, the possible systems that we could obtain are twelve:

$$\begin{aligned} (S1){\left\{ \begin{array}{ll} f(x)+f(y)=b\\ f(x+a)+f(y+a)=b, \end{array}\right. }\quad (S2){\left\{ \begin{array}{ll} g(x)+g(y)=b\\ g(x+a)+g(y+a)=b, \end{array}\right. } \end{aligned}$$

$$\begin{aligned} (S3){\left\{ \begin{array}{ll} f(x)+g(y)=b\\ f(x+a)+g(y+a)=b, \end{array}\right. }\quad (S4){\left\{ \begin{array}{ll} g(x)+f(y)=b\\ g(x+a)+f(y+a)=b, \end{array}\right. } \end{aligned}$$

$$\begin{aligned} (S5){\left\{ \begin{array}{ll} f(x)+g(y)=b\\ g(x+a)+f(y+a)=b, \end{array}\right. }\quad (S6){\left\{ \begin{array}{ll} g(x)+f(y)=b\\ f(x+a)+g(y+a)=b, \end{array}\right. } \end{aligned}$$

$$\begin{aligned} (S7){\left\{ \begin{array}{ll} f(x)+g(y)=b\\ g(x+a)+g(y+a)=b, \end{array}\right. }\quad (S8){\left\{ \begin{array}{ll} g(x)+f(y)=b\\ g(x+a)+g(y+a)=b, \end{array}\right. } \end{aligned}$$

$$\begin{aligned} (S9){\left\{ \begin{array}{ll} g(x)+g(y)=b\\ f(x+a)+g(y+a)=b, \end{array}\right. }\quad (S10){\left\{ \begin{array}{ll} g(x)+g(y)=b\\ g(x+a)+f(y+a)=b, \end{array}\right. } \end{aligned}$$

$$\begin{aligned} (S11){\left\{ \begin{array}{ll} f(x)+f(y)=b\\ g(x+a)+g(y+a)=b, \end{array}\right. }\quad (S12){\left\{ \begin{array}{ll} g(x)+g(y)=b\\ f(x+a)+f(y+a)=b. \end{array}\right. } \end{aligned}$$

First of all, note that:

• $(x,y)\in {{\mathbb {F}}}_{2^s}\times ({{\mathbb {F}}}_{2^n}\setminus {{\mathbb {F}}}_{2^s})$ is a solution of (S3) if and only if (y, x) is a solution of (S4);

• $(x,y)\in {{\mathbb {F}}}_{2^s}\times ({{\mathbb {F}}}_{2^n}\setminus {{\mathbb {F}}}_{2^s})$ is a solution of (S5) if and only if (y, x) is a solution of (S6);

• $(x,y)\in {{\mathbb {F}}}_{2^s}\times ({{\mathbb {F}}}_{2^n}\setminus {{\mathbb {F}}}_{2^s})$ is a solution of (S7) if and only if (y, x) is a solution of (S8);

• $(x,y)\in {{\mathbb {F}}}_{2^s}\times ({{\mathbb {F}}}_{2^n}\setminus {{\mathbb {F}}}_{2^s})$ is a solution of (S7) if and only if $(x+a,y+a)$ is a solution of (S9);

• $(x,y)\in {{\mathbb {F}}}_{2^s}\times ({{\mathbb {F}}}_{2^n}\setminus {{\mathbb {F}}}_{2^s})$ is a solution of (S7) if and only if $(y+a,x+a)$ is a solution of (S10);

• $(x,y)\in {{\mathbb {F}}}_{2^s}\times {{\mathbb {F}}}_{2^s}$ is a solution of (S11) if and only if $(x+a,y+a)$ is a solution of (S12).

So, we need to count the number of solutions of (S1), (S2), (S3), (S5), (S7) and (S11).

Let $a,b \in {{\mathbb {F}}}_{2^s}^\star$. Then, the first equation of (S3) cannot be satisfied (recall that f acts on ${{\mathbb {F}}}_{2^s}$ and g over ${{\mathbb {F}}}_{2^n}\setminus {{\mathbb {F}}}_{2^s}$). The same for (S5) and (S7), while for (S11) the second equation is not possible. So, only (S1) and (S2) could admit solutions, and thus we have at most $\beta _f(a,b)+\beta _g(a,b)$ solutions, where $\beta _f(a,b)$ is computed over ${{\mathbb {F}}}_{2^s}$.

Let $b \in {{\mathbb {F}}}_{2^s}^\star$ and $a \notin {{\mathbb {F}}}_{2^s}$. As before, (S3), (S5) and (S7) have no solutions. The same for (S1) since $x+a$ is not in ${{\mathbb {F}}}_{2^s}$. Let us check the solutions of (S11).

Denoting by $y=x+\alpha$, we would obtain

$$\begin{aligned} {\left\{ \begin{array}{ll} D_\alpha f(x)=b\\ D_\alpha g(x+a)=b, \end{array}\right. } \end{aligned}$$

where $\alpha \in {{\mathbb {F}}}_{2^s}$. So $x+a\in {{\mathbb {F}}}_{2^n}\setminus {{\mathbb {F}}}_{2^s}$ would be a solution for $D_\alpha g(x+a)=b$ with $\alpha$ and b in ${{\mathbb {F}}}_{2^s}$, which is not possible from hypothesis (H3). Then, only (S2) admits solutions, implying at most $\beta _g(a,b)$ solutions.

Let $b \notin {{\mathbb {F}}}_{2^s}$ and $a \in {{\mathbb {F}}}_{2^s}^\star$. Then, the first equation in (S1) is not admissible. Similar for (S11). Moreover, (S5) does not admit solutions since x should be in ${{\mathbb {F}}}_{2^s}$ and $x+a$ not. The same for (S7).

Consider now (S3). Denoting by $y=x+\alpha$, then we would obtain

$$\begin{aligned} {\left\{ \begin{array}{ll} f(x)+g(x+\alpha )=b\\ f(x+a)+g(x+a+\alpha )=b. \end{array}\right. } \end{aligned}$$

From the proof of Theorem 4.1 we can have only one solution of $f(x)+g(x+\alpha )=b$ with $x\in {{\mathbb {F}}}_{2^s}$ ($\alpha \notin {{\mathbb {F}}}_{2^s}$). Then, $x=x+a$, implying $a=0$. So, also in this case, only (S2) can admit solutions.

Now, let $a,b \notin {{\mathbb {F}}}_{2^s}$. Then, with same arguments as above, (S1) and (S11) are not admissible. Also (S3) is not possible since x and $x+a$ should be both in ${{\mathbb {F}}}_{2^s}$. Then, we need to analize the solutions of (S5) and (S7). Consider (S5) and denote $y=x+\alpha$. System (S5) is given by

$$\begin{aligned} {\left\{ \begin{array}{ll} f(x)+g(x+\alpha )=b\\ g(x+a)+f(x+a+\alpha )=b, \end{array}\right. } \end{aligned}$$

where $\alpha \in {{\mathbb {F}}}_{2^n}\setminus {{\mathbb {F}}}_{2^s}$. From the proof of Theorem 4.1 we have at most one solution x in ${{\mathbb {F}}}_{2^s}$ for $f(x)+g(x+\alpha )=b$. This implies $x=x+a+\alpha$, and thus $\alpha =a$. So, we have only one possible pair $(x,x+\alpha )$ which can be a solution of (S5), and so also for (S6).

Consider, now, (S7). We get the system

$$\begin{aligned} {\left\{ \begin{array}{ll} f(x)+g(x+\alpha )=b\\ g(x+a)+g(x+a+\alpha )=b. \end{array}\right. } \end{aligned}$$

Since from Theorem 4.1 we have at most one solution x in ${{\mathbb {F}}}_{2^s}$ for $f(x)+g(x+\alpha )=b$, the number of solutions of (S7) are at most $N=|\{\alpha \notin {{\mathbb {F}}}_{2^s}\mid \, f(x)+g(x+\alpha )=b \hbox { has solutions}\ x\in {{\mathbb {F}}}_{2^s}\}|$. This implies, also, at most N solutions for (S8), (S9) and (S10). To conclude, (S2) admits at most $\beta _g(a,b)$ solutions. $\square$

Remark 5.1

Since f and g are permutations for any $x\in {{\mathbb {F}}}_{2^s}$ we have a unique $\alpha \notin {{\mathbb {F}}}_{2^s}$ such that $f(x)+g(x+\alpha )=b$. In particular, when $s=2$, we can have at most 4 solutions for (S7), and when it admits 4 solutions, (S5) has no solution. Thus, for $s=2$, the boomerang uniformity of the functions as in Theorem 4.1 is upper bounded by $\beta _g+16$.

In the following we consider the case when g(x) is a 4-uniform Gold function, and $f(x)=g(x)+\gamma$ for some $\gamma \in {{\mathbb {F}}}_{2^s}^\star$, i.e. $F(x)=g(x)+\gamma +\gamma (x^{2^s}+x)^{2^n-1}$. Since g is a power function, $F(x)=g(x)+\gamma +\gamma (x^{2^s}+x)^{2^n-1}$ is equivalent to $F'(x)=g(x)+1+(x^{2^s}+x)^{2^n-1}=\frac{1}{\gamma }F(g^{-1}(\gamma )\cdot x)$, so we can suppose that $\gamma =1$. Note that, such functions are differentially 6-uniform from Theorem 4.2.

Proposition 5.2

Let $n=sm$ with s even such that s/2 and m are odd. Let k be an integer such that $\gcd (k,n)=2$ and $g(x)=x^{2^k+1}$. Let

$$\begin{aligned} F(x)=x^{2^k+1}+1+(x^{2^s}+x)^{2^n-1}={\left\{ \begin{array}{ll} x^{2^k+1}+1&{}\hbox { if}\ x\in {{\mathbb {F}}}_{2^s}\\ x^{2^k+1}&{}\hbox { if}\ x\notin {{\mathbb {F}}}_{2^s}. \end{array}\right. } \end{aligned}$$

Then, for any $a,b\in {{\mathbb {F}}}_{2^n}^\star$ we have

$$\begin{aligned} \beta _F(a,b)\le {\left\{ \begin{array}{ll} 4&{} \hbox {if}\ a\in {{\mathbb {F}}}_{2^s}^\star \hbox {or}\ b\in {{\mathbb {F}}}_{2^s}^\star \\ 22&{} \hbox { if}\ a,b\notin {{\mathbb {F}}}_{2^s}. \end{array}\right. } \end{aligned}$$

Proof

First of all, we can note that (S1) and (S2) in this case coincide. So for the case $a,b\in {{\mathbb {F}}}_{2^s}^\star$ we have $\beta _g(a,b)$ solutions, where $\beta _g(a,b)$ is computed on ${{\mathbb {F}}}_{2^n}$, and the boomerang uniformity of the Gold function $x^{2^k+1}$, over ${{\mathbb {F}}}_{2^n}$, is equal to 4 (see for instance [3]).

System (S7) in this case is given by

$$\begin{aligned} {\left\{ \begin{array}{ll} D_\alpha f(x)=b+1\\ D_\alpha f(x+a)=b, \end{array}\right. } \end{aligned}$$

which is equivalent to

$$\begin{aligned} {\left\{ \begin{array}{ll} D_\alpha f(x)=b+1\\ D_aD_\alpha f(x)=1. \end{array}\right. } \end{aligned}$$

Since f is quadratic the second derivative $D_aD_\alpha f(x)=a^{2^k}\alpha +a\alpha ^{2^k}$ does not depend on x. So, for System (S7) the equation $D_aD_\alpha f(x)=1$ is satisfied if and only if $\alpha \in \rho +a{{\mathbb {F}}}_{4}$, where $\rho$ is such that $a^{2^k}\rho +a\rho ^{2^k}=1$. This, implies that we can have at most four $\alpha$’s admitting solutions in ${{\mathbb {F}}}_{2^s}$ for the equation $D_\alpha f(x)=b$. $\square$

For the functions given in Tables 2 and 3, we give the boomerang uniformity in Tables 5 and 6, respectively. From the analysis given in Proposition 5.1, we need to compute, principally, the number of solutions of Systems (S2), (S5) and (S7).

Note that for $A(x)=x+\omega$, since $x^5=x^{-1}$ over ${{\mathbb {F}}}_{4}$, we obtain the function studied in Proposition 5.2.

Table 5 Boomerang uniformity of the CCZ-inequivalent permutations from Corollary 4.1 over ${{\mathbb {F}}}_{2^6}$

Table 6 Boomerang uniformity of the CCZ-inequivalent permutations from Corollary 4.1 over ${{\mathbb {F}}}_{2^{10}}$