{"title":"布尔函数代数度的概率估计","authors":"Ana Sălăgean, Percy Reyes-Paredes","doi":"10.1007/s12095-023-00660-4","DOIUrl":null,"url":null,"abstract":"Abstract The algebraic degree is an important parameter of Boolean functions used in cryptography. When a function in a large number of variables is not given explicitly in algebraic normal form, it is usually not feasible to compute its degree, so we need to estimate it. We propose a probabilistic test for deciding whether the algebraic degree of a Boolean function f is below a certain value k . If the degree is indeed below k , then f will always pass the test, otherwise f will fail each instance of the test with a probability $$\\textrm{dt}_k(f)$$ <mml:math xmlns:mml=\"http://www.w3.org/1998/Math/MathML\"> <mml:mrow> <mml:msub> <mml:mtext>dt</mml:mtext> <mml:mi>k</mml:mi> </mml:msub> <mml:mrow> <mml:mo>(</mml:mo> <mml:mi>f</mml:mi> <mml:mo>)</mml:mo> </mml:mrow> </mml:mrow> </mml:math> , which is closely related to the average number of monomials of degree k of the polynomials which are affine equivalent to f . The test has a good accuracy only if this probability $$\\textrm{dt}_k(f)$$ <mml:math xmlns:mml=\"http://www.w3.org/1998/Math/MathML\"> <mml:mrow> <mml:msub> <mml:mtext>dt</mml:mtext> <mml:mi>k</mml:mi> </mml:msub> <mml:mrow> <mml:mo>(</mml:mo> <mml:mi>f</mml:mi> <mml:mo>)</mml:mo> </mml:mrow> </mml:mrow> </mml:math> of failing the test is not too small. We initiate the study of $$\\textrm{dt}_k(f)$$ <mml:math xmlns:mml=\"http://www.w3.org/1998/Math/MathML\"> <mml:mrow> <mml:msub> <mml:mtext>dt</mml:mtext> <mml:mi>k</mml:mi> </mml:msub> <mml:mrow> <mml:mo>(</mml:mo> <mml:mi>f</mml:mi> <mml:mo>)</mml:mo> </mml:mrow> </mml:mrow> </mml:math> by showing that in the particular case when the degree of f is actually equal to k , the probability will be in the interval (0.288788, 0.5], and therefore a small number of runs of the test will be sufficient to give, with very high probability, the correct answer. Exact values of $$\\textrm{dt}_k(f)$$ <mml:math xmlns:mml=\"http://www.w3.org/1998/Math/MathML\"> <mml:mrow> <mml:msub> <mml:mtext>dt</mml:mtext> <mml:mi>k</mml:mi> </mml:msub> <mml:mrow> <mml:mo>(</mml:mo> <mml:mi>f</mml:mi> <mml:mo>)</mml:mo> </mml:mrow> </mml:mrow> </mml:math> for all the polynomials in 8 variables were computed using the representatives listed by Hou and by Langevin and Leander.","PeriodicalId":10788,"journal":{"name":"Cryptography and Communications","volume":"22 1","pages":"0"},"PeriodicalIF":0.0000,"publicationDate":"2023-08-12","publicationTypes":"Journal Article","fieldsOfStudy":null,"isOpenAccess":false,"openAccessPdf":"","citationCount":"0","resultStr":"{\"title\":\"Probabilistic estimation of the algebraic degree of Boolean functions\",\"authors\":\"Ana Sălăgean, Percy Reyes-Paredes\",\"doi\":\"10.1007/s12095-023-00660-4\",\"DOIUrl\":null,\"url\":null,\"abstract\":\"Abstract The algebraic degree is an important parameter of Boolean functions used in cryptography. When a function in a large number of variables is not given explicitly in algebraic normal form, it is usually not feasible to compute its degree, so we need to estimate it. We propose a probabilistic test for deciding whether the algebraic degree of a Boolean function f is below a certain value k . If the degree is indeed below k , then f will always pass the test, otherwise f will fail each instance of the test with a probability $$\\\\textrm{dt}_k(f)$$ <mml:math xmlns:mml=\\\"http://www.w3.org/1998/Math/MathML\\\"> <mml:mrow> <mml:msub> <mml:mtext>dt</mml:mtext> <mml:mi>k</mml:mi> </mml:msub> <mml:mrow> <mml:mo>(</mml:mo> <mml:mi>f</mml:mi> <mml:mo>)</mml:mo> </mml:mrow> </mml:mrow> </mml:math> , which is closely related to the average number of monomials of degree k of the polynomials which are affine equivalent to f . The test has a good accuracy only if this probability $$\\\\textrm{dt}_k(f)$$ <mml:math xmlns:mml=\\\"http://www.w3.org/1998/Math/MathML\\\"> <mml:mrow> <mml:msub> <mml:mtext>dt</mml:mtext> <mml:mi>k</mml:mi> </mml:msub> <mml:mrow> <mml:mo>(</mml:mo> <mml:mi>f</mml:mi> <mml:mo>)</mml:mo> </mml:mrow> </mml:mrow> </mml:math> of failing the test is not too small. We initiate the study of $$\\\\textrm{dt}_k(f)$$ <mml:math xmlns:mml=\\\"http://www.w3.org/1998/Math/MathML\\\"> <mml:mrow> <mml:msub> <mml:mtext>dt</mml:mtext> <mml:mi>k</mml:mi> </mml:msub> <mml:mrow> <mml:mo>(</mml:mo> <mml:mi>f</mml:mi> <mml:mo>)</mml:mo> </mml:mrow> </mml:mrow> </mml:math> by showing that in the particular case when the degree of f is actually equal to k , the probability will be in the interval (0.288788, 0.5], and therefore a small number of runs of the test will be sufficient to give, with very high probability, the correct answer. Exact values of $$\\\\textrm{dt}_k(f)$$ <mml:math xmlns:mml=\\\"http://www.w3.org/1998/Math/MathML\\\"> <mml:mrow> <mml:msub> <mml:mtext>dt</mml:mtext> <mml:mi>k</mml:mi> </mml:msub> <mml:mrow> <mml:mo>(</mml:mo> <mml:mi>f</mml:mi> <mml:mo>)</mml:mo> </mml:mrow> </mml:mrow> </mml:math> for all the polynomials in 8 variables were computed using the representatives listed by Hou and by Langevin and Leander.\",\"PeriodicalId\":10788,\"journal\":{\"name\":\"Cryptography and Communications\",\"volume\":\"22 1\",\"pages\":\"0\"},\"PeriodicalIF\":0.0000,\"publicationDate\":\"2023-08-12\",\"publicationTypes\":\"Journal Article\",\"fieldsOfStudy\":null,\"isOpenAccess\":false,\"openAccessPdf\":\"\",\"citationCount\":\"0\",\"resultStr\":null,\"platform\":\"Semanticscholar\",\"paperid\":null,\"PeriodicalName\":\"Cryptography and Communications\",\"FirstCategoryId\":\"1085\",\"ListUrlMain\":\"https://doi.org/10.1007/s12095-023-00660-4\",\"RegionNum\":0,\"RegionCategory\":null,\"ArticlePicture\":[],\"TitleCN\":null,\"AbstractTextCN\":null,\"PMCID\":null,\"EPubDate\":\"\",\"PubModel\":\"\",\"JCR\":\"\",\"JCRName\":\"\",\"Score\":null,\"Total\":0}","platform":"Semanticscholar","paperid":null,"PeriodicalName":"Cryptography and Communications","FirstCategoryId":"1085","ListUrlMain":"https://doi.org/10.1007/s12095-023-00660-4","RegionNum":0,"RegionCategory":null,"ArticlePicture":[],"TitleCN":null,"AbstractTextCN":null,"PMCID":null,"EPubDate":"","PubModel":"","JCR":"","JCRName":"","Score":null,"Total":0}
引用次数: 0
摘要
代数度是密码学中布尔函数的一个重要参数。当含有大量变量的函数没有以代数范式显式给出时,通常无法计算其次数,因此需要对其进行估计。我们提出了一个判别布尔函数f的代数度是否低于某一值k的概率检验。如果阶数确实低于k,则f总能通过测试,否则f每次测试失败的概率为$$\textrm{dt}_k(f)$$ dt k (f),这与f的仿射等价多项式的k阶单项式的平均个数密切相关。只有当测试失败的概率$$\textrm{dt}_k(f)$$ dt k (f)不太小时,测试才具有良好的准确性。我们开始研究$$\textrm{dt}_k(f)$$ dt k (f),通过表明在f的度实际上等于k的特殊情况下,概率将在(0.288788,0.5)区间内,因此少量的测试运行将足以以非常高的概率给出正确答案。使用Hou和Langevin和Leander列出的代表,计算8个变量中所有多项式的精确值$$\textrm{dt}_k(f)$$ dt k (f)。
Probabilistic estimation of the algebraic degree of Boolean functions
Abstract The algebraic degree is an important parameter of Boolean functions used in cryptography. When a function in a large number of variables is not given explicitly in algebraic normal form, it is usually not feasible to compute its degree, so we need to estimate it. We propose a probabilistic test for deciding whether the algebraic degree of a Boolean function f is below a certain value k . If the degree is indeed below k , then f will always pass the test, otherwise f will fail each instance of the test with a probability $$\textrm{dt}_k(f)$$ dtk(f) , which is closely related to the average number of monomials of degree k of the polynomials which are affine equivalent to f . The test has a good accuracy only if this probability $$\textrm{dt}_k(f)$$ dtk(f) of failing the test is not too small. We initiate the study of $$\textrm{dt}_k(f)$$ dtk(f) by showing that in the particular case when the degree of f is actually equal to k , the probability will be in the interval (0.288788, 0.5], and therefore a small number of runs of the test will be sufficient to give, with very high probability, the correct answer. Exact values of $$\textrm{dt}_k(f)$$ dtk(f) for all the polynomials in 8 variables were computed using the representatives listed by Hou and by Langevin and Leander.