Abstract:Motivated by new applications such as secure Multi-Party Computation (MPC), Fully Homomorphic Encryption (FHE), and Zero-Knowledge proofs (ZK), many MPC-, FHE- and ZK-friendly symmetric-key primitives that minimize the< number of multiplications over Fp for a large prime p have been recently proposed in the literature. These symmetric primitives are usually defined via invertible functions, including (i) Feistel and Lai-Massey schemes and (ii) SPN constructions instantiated with invertible non-linear S-Boxes. However, the “invertibility” property is actually never required in any of the mentioned applications.In this paper, we discuss the possibility to set up MPC-/FHE-/ZK-friendly symmetric primitives instantiated with non-invertible bounded surjective functions. In contrast to one-to-one functions, each output of a l-bounded surjective function admits at most l pre-images. The simplest example is the square map x → x2 over Fp for a prime p ≥ 3, which is (obviously) 2-bounded surjective. When working over Fnp for n ≥ 2, we set up bounded surjective functions by re-considering the recent results proposed by Grassi, Onofri, Pedicini and Sozzi at FSE/ToSC 2022 as starting points. Given a quadratic local map F : Fmp → Fp for m ∈ {1, 2, 3}, they proved that the shift-invariant non-linear function over Fnp defined as SF (x0, x1, . . . , xn−1) = y0∥y1∥ . . . ∥yn−1 where yi := F(xi, xi+1) is never invertible for any n ≥ 2 · m − 1. Here, we prove that • the quadratic function F : Fmp → Fp for m ∈ {1, 2} that minimizes the probability of having a collision for SF over Fnp is of the form F(x0, x1) = x20 + x1 (or equivalent);• the function SF over Fnp defined as before via F(x0, x1) = x20 +x1 (or equivalent) is 2n-bounded surjective.As concrete applications, we propose modified versions of the MPC-friendly schemes MiMC, HadesMiMC, and (partially of) Hydra, and of the FHE-friendly schemes Masta, Pasta, and Rubato. By instantiating them with the bounded surjective quadratic functions proposed in this paper, we are able to improve the security and/or the performances in the target applications/protocols.

On CCZ-Equivalence of the Inverse Function

Cryptographic Functions with Interesting Properties from CCZ-equivalence

On the Functions Which are CCZ-equivalent but not EA-equivalent to Quadratic Functions over $\mathbb F_{p^n}$

On CCZ-equivalence Between the Bracken-Tan-Tan Function and Power Functions

A new multivariate primitive from CCZ equivalence

Representing the inverse map as a composition of quadratics in a finite field of characteristic $2$

The Explicit values of the UBCT, the LBCT and the DBCT of the inverse function

The second-order zero differential uniformity of the swapped inverse functions over finite fields

cc-differential uniformity, (almost) perfect cc-nonlinearity, and equivalences

Representing the inverse map as a composition of quadratics in a finite field of characteristic 2

Bounded Surjective Quadratic Functions over Fnp for MPC-/ZK-/FHE-Friendly Symmetric Primitives

On the Elementary Proof of the Inverse Erdős-Heilbronn Problem

An equivalence between inverse sumset theorems and inverse conjectures for the U^3 norm

Computing the Number of Affine Equivalent Classes on ℛ(s,n)/ℛ(k,n)

The Explicit Dual of Leander's Monomial Bent Function.

Impossibility of Indifferentiable Iterated Blockciphers from 3 or Less Primitive Calls.

On Enumeration of Polynomial Equivalence Classes

On a classification of planar functions in characteristic three

On the equivalence of linear cyclic and constacyclic codes

On the second-order zero differential properties of several classes of power functions over finite fields

On the Equivalent Keys in Multivariate Cryptosystems