On the Influence of the Algebraic Degree of $F^{-1}$ on the Algebraic Degree of G ∘ F

Christina Boura (1, 2) , Anne Canteaut (1)

1 SECRET - Security, Cryptology and Transmissions
2 Gemalto [Meudon]

We present a study on the algebraic degree of iterated permutations seen as multivariate polynomials. The main result shows that this degree depends on the algebraic degree of the inverse of the permutation which is iterated. This result is also extended to non-injective balanced vectorial functions where the relevant quantity is the minimal degree of the inverse of a permutation expanding the function. This property has consequences in symmetric cryptography since several attacks or distinguishers exploit a low algebraic degree, like higher-order di erential attacks, cube attacks and cube testers, or algebraic attacks. Here, we present some applications of this improved bound to a higherdegree variant of the block cipher KN, to the block cipher Rijndael-256 and to the inner permutations of the hash functions ECHO and JH.

Mots clés: algebraic degree; higher-order di erential attacks; hash functions; block ciphers

Domaines: Cryptographie et sécurité [cs.CR]

Christina Boura, Anne Canteaut. On the Influence of the Algebraic Degree of $F^{-1}$ on the Algebraic Degree of G ∘ F. IEEE Transactions on Information Theory, 2013, 59 (1), pp.691-702. ⟨10.1109/TIT.2012.2214203⟩. ⟨hal-00738398⟩