Fast Implementation of the ANF Transform

Transcription

1 Fast Implementation of the ANF Transform Valentin Bakoev Faculty of Mathematics and Informatics, Veliko Turnovo University, Bulgaria MDS OCRT, 4 July, 27 Sofia, Bulgaria V. Bakoev (FMI, VTU) Fast Implementation of the ANFT OCRT, / 29

2 Outline Introduction 2 Basic notions and preliminary results 3 Fast implementation of the ANFT 4 Experimental results and conclusions V. Bakoev (FMI, VTU) Fast Implementation of the ANFT OCRT, / 29

3 . Introduction Importance: the algebraic degree of an S-box (or a vectorial Boolean function) is one of its most important cryptographic parameters. V. Bakoev (FMI, VTU) Fast Implementation of the ANFT OCRT, / 29

4 . Introduction Importance: the algebraic degree of an S-box (or a vectorial Boolean function) is one of its most important cryptographic parameters. Computing: its computing includes obtaining of the algebraic normal forms of the coordinate Boolean functions, which form the S-box. V. Bakoev (FMI, VTU) Fast Implementation of the ANFT OCRT, / 29

5 . Introduction Importance: the algebraic degree of an S-box (or a vectorial Boolean function) is one of its most important cryptographic parameters. Computing: its computing includes obtaining of the algebraic normal forms of the coordinate Boolean functions, which form the S-box. During the generation of S-boxes it should be done as fast as possible (as well as computing the other cryptographic criteria), in order to obtain more S-boxes and to select the best of them. V. Bakoev (FMI, VTU) Fast Implementation of the ANFT OCRT, / 29

6 . Introduction Importance: the algebraic degree of an S-box (or a vectorial Boolean function) is one of its most important cryptographic parameters. Computing: its computing includes obtaining of the algebraic normal forms of the coordinate Boolean functions, which form the S-box. During the generation of S-boxes it should be done as fast as possible (as well as computing the other cryptographic criteria), in order to obtain more S-boxes and to select the best of them. The algebraic degree of a Boolean function is defined by one special representation in the area of algebra and cryptology it is known as Algebraic Normal Form (ANF). V. Bakoev (FMI, VTU) Fast Implementation of the ANFT OCRT, / 29

7 . Introduction The ANF representation is considered in the literature from other viewpoints and has many generalizations: The classical (logical) one it is known as Zhegalkin polynomial. The famous Zhegalkin theorem states that for every Boolean function there exists an unique polynomial form of it over the functionally complete set of Boolean functions {x.y, x y, }. Yablonski S., Introduction to discrete mathematics, Fourth Edition, Visshaia Shkola, Moskow, 23. (in Russian) V. Bakoev (FMI, VTU) Fast Implementation of the ANFT OCRT, / 29

8 . Introduction The ANF representation is considered in the literature from other viewpoints and has many generalizations: The classical (logical) one it is known as Zhegalkin polynomial. The famous Zhegalkin theorem states that for every Boolean function there exists an unique polynomial form of it over the functionally complete set of Boolean functions {x.y, x y, }. Yablonski S., Introduction to discrete mathematics, Fourth Edition, Visshaia Shkola, Moskow, 23. (in Russian) Circuit theory, switching functions etc. it is known as: modulo-2 sum-of-products, Reed-Muller-canonical expansion, positive polarity Reed-Muller form, etc. Harking B., Efficient algorithm for canonical Reed-Muller expansions of Boolean functions, IEE Proc. Comput. Digit. Tech., 37, 5, 99, Porwik P., Efficient calculation of the Reed-Muller form by means of the Walsh transform, Int. J. Appl. Math. Comput. Sci., 2, 4, 22, V. Bakoev (FMI, VTU) Fast Implementation of the ANFT OCRT, / 29

9 . Introduction The computing of these representations for a given Boolean function can be done in different ways. In dependence of the area of consideration they have different names: ANF Transform (ANFT); (fast) Möbius (or Moebius) Transform; Zhegalkin Transform; Positive polarity Reed-Muller Transform (PPRMT), etc. Our experience convinced us how important these facts are in searching papers by keywords. V. Bakoev (FMI, VTU) Fast Implementation of the ANFT OCRT, / 29

10 . Introduction The algorithm for performing ANFT in its typical form (i.e. operating on bytes) is well-known and is given in many sources. However its bitwise implementation is considered quite rarely. J. Fuller and A. Joux Fuller J., Analysis of affine equivalent Boolean functions for cryptography, Ph.D. Thesis, Queensland University of Technology, Australia, 23. Joux A., Algorithmic Cryptanalysis, Chapman & Hall/CRC Cryptography and Network Security, 22. stress to the necessity of optimization issues and techniques, and consider some of them. They give two different programs (in C language) that perform the ANFT. They use the bitwise representation of Boolean functions in 32-bits computer words. However, in both sources: the role of shifts and masks is not explained; the correctness and the complexity of the programs are not given; there are not experimental results; it is not clear how to modify the programs to run on 64-bits (or more bits) computer words. V. Bakoev (FMI, VTU) Fast Implementation of the ANFT OCRT, / 29

11 . Introduction In 998 we developed an algorithm for computing the Zhegalkin transform. In 28 we proposed other version of this algorithm (called PPRMT), derived in a different way. Manev K. and Bakoev V., Algorithms for performing the Zhegulakin transfroemation, in Proc. of the XXVII Spring Conf. of the Union of Bulgarian Mathematicians, (Pleven, Bulgaria, April 9, 998), Mathematics and education in mathematics, Sofia, 998, Bakoev V. and Manev K., Fast computing of the positive polarity Reed-Muller transform over GF(2) and GF(3), in Proc. of the XI Intern. Workshop on Algebraic and Combinatorial Coding Theory (ACCT), 6-22 June, 28, Pamporovo, Bulgaria, 28, 3 2. We also commented its bitwise representation and implementation, that can improve its time and space complexity. However, this work did not attract the attention of cryptographers and a reason for this might have been its name PPRMT. V. Bakoev (FMI, VTU) Fast Implementation of the ANFT OCRT, / 29

12 . Introduction Our report is a continuation of the last work. We represent our full version of the bitwise ANFT with comments about its implementation and correctness. We obtained a general time complexity Θ((9n 2).2 n 7 ) by using a bitwise representation of Boolean functions in 64-bits computer words. Some experimental results are also given. V. Bakoev (FMI, VTU) Fast Implementation of the ANFT OCRT, / 29

13 2. Basic notions and preliminary results Here we consider: F 2 = {, } the field of two elements with two operations: x y and x.y (or xy), for x, y F 2 ; F n 2 the n-dimensional vector space over F 2, it includes all 2 n binary vectors; for an arbitrary a = (a, a 2,..., a n ) F n 2, ā is the natural number ā = n i= a i.2 n i. The binary representation of ā ( ā 2 n ) in n bits determines the coordinates of a. The correspondence between a and ā is a bijection. for a = (a, a 2,..., a n ) and b = (b, b 2,..., b n ) F n 2, we say that "a precedes lexicographically b" and denote it by a b if k, k < n, such that a i = b i, for i k, and a k+ < b k+. V. Bakoev (FMI, VTU) Fast Implementation of the ANFT OCRT, / 29

14 2. Basic notions and preliminary results The relation " " over F n 2, gives an unique lexicographic (standard) order of the vectors of F n 2 in the sequence a = (,,..., ) a = (,,...,, ) a 2 n = (,,..., ). So ā = < ā = < < ā 2 n = 2 n. Boolean function of n variables (denoted by x, x 2,..., x n ) is a mapping f : F n 2 F 2, i.e. f maps any binary input x = (x, x 2,..., x n ) F n 2 to a single binary output y = f (x) F 2. Any Boolean function f can be represented in an unique way by its True Table vector: TT (f ) = (f, f,... f 2 n ), where f i = f (a i ) and a i is the i-th vector in the lexicographic order of F n 2, for i =,,..., 2 n. When the TT (f ) is considered as vector-column, it is denoted by [f ]. F n is the set of all Boolean functions of n variables, its size is F n = 2 2n. V. Bakoev (FMI, VTU) Fast Implementation of the ANFT OCRT, / 29

15 2. Basic notions and preliminary results Algebraic Normal Form (ANF) other unique representation of any f F n. It is a multivariate polynomial f (x, x 2,..., x n ) = u F n 2 aū x u. () Here u = (u, u 2,..., u n ) F n 2, a ū {, }, and x u means the monomial x u x u x n un = n i= x u i i, where xi = and xi = x i, for i =, 2,... n. If f F n and the TT(f) is given, the coefficients ā, ā,..., ā 2 n can be computed by fast algorithm, usually called ANF Transform. This algorithm is derived in different ways, but its versions are similar to each other. The vector ā = (ā, ā,..., ā 2 n ), obtained after ANFT is denoted by A f, or by [A f ] when it is considered as a vector-column. V. Bakoev (FMI, VTU) Fast Implementation of the ANFT OCRT, / 29

16 2. Basic notions and preliminary results So, if f F n and TT (f ) = (f, f,... f 2 n ), then: [A f ] = M n. [f ], and [f ] = M n. [A f ] over F 2. The matrix M n is defined recursively, as well as by Kronecker product: M = ( ) ( Mn O, M n = n M n M n ), or M n = M M n = n M, where M n is the corresponding transformation matrix of dimension 2 n 2 n, and O n is a 2 n 2 n zero matrix. Furthermore M n = Mn over F 2 and hence the forward and the inverse ANFT are performed in the same way so we consider only the forward ANFT. The pseudocode of our algorithm (referred here as Algorithm ) is given below. i= V. Bakoev (FMI, VTU) Fast Implementation of the ANFT OCRT, / 29

17 2. Basic notions and preliminary results Algorithm ANF_Transform (f, n) : blocksize 2: for step = to n do 3: source {initial position of the first source block} 4: while source < 2 n do 5: target source + blocksize {init. pos. of the first target block} 6: for i = to blocksize do 7: f [target + i] f [target + i] XOR f [source + i] 8: end for 9: source source + 2 blocksize {beg. of the next source block} : end while : blocksize 2 blocksize 2: end for 3: return f V. Bakoev (FMI, VTU) Fast Implementation of the ANFT OCRT, / 29

18 2. Basic notions and preliminary results Notes about Algorithm : the elements of the array f are bytes and they are numbered starting from ; every value of the TT(f) is stored in a separate byte as a Boolean value true or false; the result A f is obtained in the same array; the precise estimation of the time complexity is Θ(n.2 n ), whereas many authors give an estimation O(n.2 n ) for analogous algorithms. V. Bakoev (FMI, VTU) Fast Implementation of the ANFT OCRT, / 29

19 3. Fast implementation of the ANFT We note that an implementation of ANFT, based on the bitwise representation of Boolean function, is possible because of: f and A f F n. 2 The sizes of blocks, XOR-ed to other blocks in the algorithm, are powers of 2, as well as the sizes of the computer words for representation of integers. So the source and the target blocks occupy parts of a computer word or some adjacent computer words their number is also a power of 2. 3 All necessary operations are available as fast processor instructions shifts, bitwise XOR, AND, etc. V. Bakoev (FMI, VTU) Fast Implementation of the ANFT OCRT, / 29

20 3. Fast implementation of the ANFT Example (The butterfly diagram) Let us consider the function f (x, x 2, x 3 ) = (,,,,,,, ). The steps, performed by Algorithm, are illustrated as usually by its butterfly (signal-flow) diagram: (x, x 2, x 3 ) (,,) (,,) (,,) (,,) (,,) (,,) (,,) (,,) f V. Bakoev (FMI, VTU) Fast Implementation of the ANFT OCRT, / 29

21 3. Fast implementation of the ANFT Example (The butterfly diagram) Let us consider the function f (x, x 2, x 3 ) = (,,,,,,, ). The steps, performed by Algorithm, are illustrated as usually by its butterfly (signal-flow) diagram: (x, x 2, x 3 ) (,,) (,,) (,,) (,,) (,,) (,,) (,,) (,,) f step f V. Bakoev (FMI, VTU) Fast Implementation of the ANFT OCRT, / 29

22 3. Fast implementation of the ANFT Example (The butterfly diagram) Let us consider the function f (x, x 2, x 3 ) = (,,,,,,, ). The steps, performed by Algorithm, are illustrated as usually by its butterfly (signal-flow) diagram: (x, x 2, x 3 ) (,,) (,,) (,,) (,,) (,,) (,,) (,,) (,,) f step f V. Bakoev (FMI, VTU) Fast Implementation of the ANFT OCRT, / 29

23 3. Fast implementation of the ANFT Example (The butterfly diagram) Let us consider the function f (x, x 2, x 3 ) = (,,,,,,, ). The steps, performed by Algorithm, are illustrated as usually by its butterfly (signal-flow) diagram: (x, x 2, x 3 ) (,,) (,,) (,,) (,,) (,,) (,,) (,,) (,,) f step f step 2 f 2 V. Bakoev (FMI, VTU) Fast Implementation of the ANFT OCRT, / 29

24 3. Fast implementation of the ANFT Example (The butterfly diagram) Let us consider the function f (x, x 2, x 3 ) = (,,,,,,, ). The steps, performed by Algorithm, are illustrated as usually by its butterfly (signal-flow) diagram: (x, x 2, x 3 ) (,,) (,,) (,,) (,,) (,,) (,,) (,,) (,,) f step f step 2 f 2 V. Bakoev (FMI, VTU) Fast Implementation of the ANFT OCRT, / 29

25 3. Fast implementation of the ANFT Example (The butterfly diagram) Let us consider the function f (x, x 2, x 3 ) = (,,,,,,, ). The steps, performed by Algorithm, are illustrated as usually by its butterfly (signal-flow) diagram: (x, x 2, x 3 ) (,,) (,,) (,,) (,,) (,,) (,,) (,,) (,,) f step f step 2 f 2 step 3 A f V. Bakoev (FMI, VTU) Fast Implementation of the ANFT OCRT, / 29

26 3. Fast implementation of the ANFT Example (The butterfly diagram) Let us consider the function f (x, x 2, x 3 ) = (,,,,,,, ). The steps, performed by Algorithm, are illustrated as usually by its butterfly (signal-flow) diagram: (x, x 2, x 3 ) (,,) (,,) (,,) (,,) (,,) (,,) (,,) (,,) f step f step 2 f 2 step 3 A f V. Bakoev (FMI, VTU) Fast Implementation of the ANFT OCRT, / 29

27 3. Fast implementation of the ANFT Example (The butterfly diagram) Let us consider the function f (x, x 2, x 3 ) = (,,,,,,, ). The steps, performed by Algorithm, are illustrated as usually by its butterfly (signal-flow) diagram: (x, x 2, x 3 ) (,,) (,,) (,,) (,,) (,,) (,,) (,,) (,,) f step f step 2 f 2 step 3 A f = a = a = a 2 = a 3 = a 4 = a 5 = a 6 = a 7 V. Bakoev (FMI, VTU) Fast Implementation of the ANFT OCRT, / 29

28 3. Fast implementation of the ANFT Example (The bitwise operations on each step) Following Eq. () we obtain the ANF: f (x, x 2, x 3 ) = x 3 x 2 x 3 x x x 2 x x 2 x 3. Let us consider the bitwise implementation. First step: (x, x 2, x 3 ) (,,) (,,) (,,) (,,) (,,) (,,) (,,) (,,) f Step Variables/operators Values/results Input f. m V. Bakoev (FMI, VTU) Fast Implementation of the ANFT OCRT, / 29

29 3. Fast implementation of the ANFT Example (The bitwise operations on each step) Following Eq. () we obtain the ANF: f (x, x 2, x 3 ) = x 3 x 2 x 3 x x x 2 x x 2 x 3. Let us consider the bitwise implementation. First step: (x, x 2, x 3 ) (,,) (,,) (,,) (,,) (,,) (,,) (,,) (,,) f step temp Step Variables/operators Values/results Input f. m. temp= f AND m V. Bakoev (FMI, VTU) Fast Implementation of the ANFT OCRT, / 29

30 3. Fast implementation of the ANFT Example (The bitwise operations on each step) Following Eq. () we obtain the ANF: f (x, x 2, x 3 ) = x 3 x 2 x 3 x x x 2 x x 2 x 3. Let us consider the bitwise implementation. First step: (x, x 2, x 3 ) (,,) (,,) (,,) (,,) (,,) (,,) (,,) (,,) f step temp Step Variables/operators Values/results Input f. m. temp= f AND m.2 temp= temp SHR V. Bakoev (FMI, VTU) Fast Implementation of the ANFT OCRT, / 29

31 3. Fast implementation of the ANFT Example (The bitwise operations on each step) Following Eq. () we obtain the ANF: f (x, x 2, x 3 ) = x 3 x 2 x 3 x x x 2 x x 2 x 3. Let us consider the bitwise implementation. First step: (x, x 2, x 3 ) (,,) (,,) (,,) (,,) (,,) (,,) (,,) (,,) f step f Step Variables/operators Values/results Input f. m. temp= f AND m.2 temp= temp SHR.3 f=f XOR temp V. Bakoev (FMI, VTU) Fast Implementation of the ANFT OCRT, / 29

32 3. Fast implementation of the ANFT Example (The bitwise operations on each step) Step Variables or operators Values or results Input f. m (XAA). temp = f AND m.2 temp = temp SHR.3 f = f XOR temp 2. m 2 (XCC) 2. temp = f AND m temp = temp SHR f = f XOR temp 3. m 3 (XF) 3. temp = f AND m temp = temp SHR f = f XOR temp Output A f = f Table: Step-by-step bitwise ANFT V. Bakoev (FMI, VTU) Fast Implementation of the ANFT OCRT, / 29

33 3. Fast implementation of the ANFT Example (The bitwise operations on each step) We obtained again A f = () and hence the same ANF: f (x, x 2, x 3 ) = x 3 x 2 x 3 x x x 2 x x 2 x 3. So, for any f F 3, the bitwise ANFT performs the same steps We unify them in the following 3 operators in C language: f^= (f & m)>>; f^= (f & m2)>>2; f^= (f & m3)>>4; Generally we have 3.4 = 2 operations. V. Bakoev (FMI, VTU) Fast Implementation of the ANFT OCRT, / 29

34 3. Fast implementation of the ANFT Table: The masks for 4 and 5 variables. Number of variables Masks 4 (XAAAA) (XCCCC) (XFF) (XFF) 5 XAAAAAAAA XCCCCCCCC XFFFF XFFFF XFFFF The masks for 6 variables can be obtained analogously. We shall see them further. V. Bakoev (FMI, VTU) Fast Implementation of the ANFT OCRT, / 29

35 3. Fast implementation of the ANFT Thus we considered the first case when the bitwise representation of f occupies one computer word (of, 2, 4 or 8 bytes). The ANFT is computed by 4.n operations only. The second case when f F n and n > 6. We use a bitwise representation of f as an array of 2 n 6 computer words of size 2 6 = 64 bits. So the space complexity is Θ(2 n 6 ). The fast ANFT performs two main steps: Step ) Bitwise ANFT on each computer word, as it was described above. Since we have 2 additional assignments, we obtain exactly 4n + 2 operations for one computer word. So Θ((4n + 2).2 n 6 ) operations will be performed. Step 2) The usual ANFT (as in Algorithm ) on whole computer words. Here the number of operations is Θ((n 6).2 n 7 ) V. Bakoev (FMI, VTU) Fast Implementation of the ANFT OCRT, / 29

36 3. Fast implementation of the ANFT Therefore the total time complexity of the fast ANFT is Θ((4n + 2).2 n 6 ) + Θ((n 6).2 n 7 ) = Θ((9n 2).2 n 7 ). The correctness of the fast ANFT follows by the notes Jump to notes in the beginning of this section and also by the correctness of Algorithm, since the fast ANFT does the same, but in an optimized way. V. Bakoev (FMI, VTU) Fast Implementation of the ANFT OCRT, / 29

37 3. Fast implementation of the ANFT The C code of the fast ANFT typedef unsigned long long ull; const ull m= XAAAAAAAAAAAAAAAA, m2= XCCCCCCCCCCCCCCCC, m3= XFFFFFFFF, m4= XFFFFFFFF, m5= XFFFFFFFF, m6= XFFFFFFFF; const int num_of_vars= 8; //number of variables const int num_of_steps= num_of_vars - 6; //for Step (2) of ANFT const int num_of_comp_words= <<num_of_steps; //=4 for 8 vars void ANF (ull f[]) { // Step - bitwise ANF on computer words for (int k= ; k < num_of_comp_words; k++) { ull temp= f[k]; temp ^= (temp & m)>>; temp ^= (temp & m2)>>2; temp ^= (temp & m3)>>4; temp ^= (temp & m4)>>8; temp ^= (temp & m5)>>6; temp ^= (temp & m6)>>32; f[k]= temp; } V. Bakoev (FMI, VTU) Fast Implementation of the ANFT OCRT, / 29

38 3. Fast implementation of the ANFT // Step 2 int blocksize= ; for (int step= ; step <= num_of_steps; step++) { int source= ; //init. pos. of the first source block while (source < num_of_comp_words) { int target= source + blocksize; for (int i= ; i < blocksize; i++) { f[target + i] = f[target + i] ^ f[source + i]; } source += 2*blocksize; //beginning of next source bl. } blocksize *= 2; } return; } V. Bakoev (FMI, VTU) Fast Implementation of the ANFT OCRT, / 29

39 4. Experimental results and conclusions In order to compare the real time complexities of the usual byte-wise implementation of ANFT and the fast ANFT we conduct a sequence of tests under the following conditions: Hardware parameters Intel Pentium CPU G44, 3.3 GHz, 4GB RAM. V. Bakoev (FMI, VTU) Fast Implementation of the ANFT OCRT, / 29

40 4. Experimental results and conclusions In order to compare the real time complexities of the usual byte-wise implementation of ANFT and the fast ANFT we conduct a sequence of tests under the following conditions: Hardware parameters Intel Pentium CPU G44, 3.3 GHz, 4GB RAM. 2 Software parameters Windows OS, Code::Blocks 3.2 IDE (the programs are created as C + + console apps, compiled in Release mode and executed without Internet connection). V. Bakoev (FMI, VTU) Fast Implementation of the ANFT OCRT, / 29

41 4. Experimental results and conclusions In order to compare the real time complexities of the usual byte-wise implementation of ANFT and the fast ANFT we conduct a sequence of tests under the following conditions: Hardware parameters Intel Pentium CPU G44, 3.3 GHz, 4GB RAM. 2 Software parameters Windows OS, Code::Blocks 3.2 IDE (the programs are created as C + + console apps, compiled in Release mode and executed without Internet connection). 3 Methodology of testing: all tests are performed 3 times and their running times are taken in average; the time for reading from file, for converting the input to array of bytes (for the byte-wise ANFT), etc. is excluded; for every test the obtained ANFs from the byte-wise ANFT and the fast ANFT were compared for matching; the following running times are for execution of the byte-wise ANFT and the fast ANFT only. V. Bakoev (FMI, VTU) Fast Implementation of the ANFT OCRT, / 29

42 4. Experimental results and conclusions For all 2 32 Boolean functions of 5 variables, the byte-wise ANFT runs in sec., whereas the fast ANFT runs in 3.88 secons so it is more than 8 times faster. For the other tests we created 4 files with 6, 7, 8 and 9 integers, randomly generated in 64-bits computer words. They were used as input data, i.e. as TT vectors of functions. The results in the following table concern the largest file (of size.4 GB). V. Bakoev (FMI, VTU) Fast Implementation of the ANFT OCRT, / 29

43 4. Experimental results and conclusions Running times in seconds for: Number of variables Number of functions 9 9 /4 9 /6 9 /64 9 /24 Byte-wise ANFT 7,993 7, ,666 28, ,22 Fast ANFT 5,357 6,699 8,985,925 2,893 Ratio: 32,8: 25,494: 26,7: 25,662: 28,7: Table: Experimental results about the byte-wise ANFT and the fast ANFT The theoretical time complexity for the fast ANFT shows that it is at least 8 times faster than the byte-wise ANFT. The experimental results show that the fast ANFT is at least 2 times faster for smaller input files and this ratio grows when the file size increases. As Table 3 shows, the fast ANFT is more than 25 times faster than the byte-wise ANFT for the largest test file. V. Bakoev (FMI, VTU) Fast Implementation of the ANFT OCRT, / 29

44 4. Experimental results and conclusions We recall that our main goal is the fast computing of the algebraic degree of S-boxes. The first step fast computing of the ANFs of Boolean functions was represented here. Its natural continuation a parallel implementation is already done by Dushan Bikov in his PhD thesis (its defense will be soon). The second step is the fast computing of the algebraic degree of an S-box. Now we work on some ideas by applying bitwise representations and operations to do this faster. V. Bakoev (FMI, VTU) Fast Implementation of the ANFT OCRT, / 29

45 Thanks! Thank you for your attention! V. Bakoev (FMI, VTU) Fast Implementation of the ANFT OCRT, / 29