Propagation properties of a non-linear mapping based on squaring in odd characteristic

Abstract

Many modern cryptographic primitives for hashing and (authenticated) encryption make use of constructions that are instantiated with an iterated cryptographic permutation that operates on a fixed-width state consisting of an array of bits. Often, such permutations are the repeated application of a relatively simple round function consisting of a linear layer and a non-linear layer. These constructions do not require that the underlying function is a permutation and they can plausibly be based on a non-invertible transformation. Recently, Grassi proposed the use of non-invertible mappings operating on arrays of digits that are elements of a finite field of odd characteristic for so-called MPC-/FHE-/ZK-friendly symmetric cryptographic primitives. In this work, we consider a mapping that we call \(\gamma \) that has a simple expression and is based on squaring. We discuss, for the first time, the differential and linear propagation properties of \(\gamma \) and observe that these follow the same rules up to a relabeling of the digits. This is an intriguing property that, as far as we know, only exists for \(\gamma \) and the binary mapping \(\chi _{_{3}}\) that is used in the cryptographic permutation Xoodoo. Moreover, we study the implications of its non-invertibility on differentials with zero output difference and on biases at the output of the \(\gamma \) mapping and show that they are as small as they can possibly be.