A note on the Walsh spectrum of the Flystel

Abstract

Anemoi is a family of compression and hash functions over finite fields \(\mathbb {F}_q\) for efficient Zero-Knowledge applications. Its round function is based on a novel permutation \(\mathcal {H}: \mathbb {F}_q^2 \rightarrow \mathbb {F}_q^2\), called the open Flystel, which is parametrized by a permutation \(E: \mathbb {F}_q \rightarrow \mathbb {F}_q\) and two functions \(Q_\gamma , Q_\delta : \mathbb {F}_q \rightarrow \mathbb {F}_q\). Over a prime field \(\mathbb {F}_p\) with E a power permutation and \(Q_\gamma \), \(Q_\delta \) quadratic functions with identical leading coefficient, the Anemoi designers conjectured for the absolute value of the Walsh transform that \(\max _{\textbf{a} \in \mathbb {F}_p^2,\ \textbf{b} \in \mathbb {F}_p^2 {\setminus } \{ \textbf{0} \}} \left| \mathcal {W}_\mathcal {H} (\psi , \textbf{a}, \textbf{b}) \right| \le p \cdot \log \left( p \right) \). By exploiting that the open Flystel is CCZ-equivalent to the closed Flystel, we prove in this note that \(\max _{\textbf{a} \in \mathbb {F}_p^2,\ \textbf{b} \in \mathbb {F}_p^2 {\setminus } \{ \textbf{0} \}} \left| \mathcal {W}_\mathcal {H} (\psi , \textbf{a}, \textbf{b}) \right| \le (d - 1) \cdot p\), where \(d = \deg \left( E \right) \).