Boomerang uniformity of a class of power maps

Abstract

We consider the boomerang uniformity of an infinite class of (locally-APN) power maps and show that their boomerang uniformity over the finite field $\mathbb {F}_{2^n}$ is 2 and 4, when $n \equiv 0 \pmod 4$ and $n \equiv 2 \pmod 4$, respectively. As a consequence, we show that for this class of power maps, the differential uniformity is strictly greater than their boomerang uniformity.

1 Introduction

Let $\mathbb {F}_q$ be the finite field with $q=2^n$ elements, where n is a positive integer. We denote the multiplicative group of nonzero elements of $\mathbb {F}_q$ by $\mathbb {F}_q^*$. Let f be a function from the finite field $\mathbb {F}_q$ to itself. It is well-known that any function from the finite field $\mathbb {F}_q$ to itself can be uniquely represented by a polynomial in $\mathbb {F}_q[x]$ of degree at most $q-1.$

Substitution boxes play a very crucial role in the design of secure cryptographic primitives, such as block ciphers. The differential attack, introduced by Biham and Shamir [1] is one of the most efficient attacks on block ciphers. To quantify the degree of security of a substitution box, used in a block cipher, against the differential attacks, Nyberg [12] introduced the notion of differential uniformity. For any $\epsilon \in \mathbb {F}_q$, the derivative of f in the direction of $\epsilon$ is given by $D_{\epsilon }f(x) = f(x+\epsilon )+f(x)$ for all $x\in \mathbb {F}_q.$ For any $a,b \in \mathbb {F}_q$, the Difference Distribution Table (DDT) entry at the point (a, b) of f is given by

$$\begin{aligned} \Delta _f(a,b) = |\{ x \in \mathbb {F}_q \mid D_{a}f(x)=b \} |, \end{aligned}$$

(1.1)

and the differential uniformity is $\Delta _f = \max \{\Delta _f(a,b) \mid a,b \in \mathbb {F}_q, a\ne 0\}$. When $\Delta _f=1,2$, then the function f is called perfect nonlinear (PN) function, almost perfect nonlinear (APN) function, respectively. It is easy to see that over finite fields of even characteristic, $\Delta _f$ is always even and hence APN functions give the optimal resistance against the differential attack.

Wagner [14] introduced a new cryptanalysis method against block ciphers, which became known as the boomerang attack. This attack may be thought of as an extension of the differential attack [1]. In order to analyze the boomerang attack in a better way, and analogously to the Difference Distribution Table (DDT) concerning differential attack, Cid et al. [7] introduced the notion of Boomerang Connectivity Table (BCT). Further, to quantify the resistance of a function against the boomerang attack, Boura and Canteaut [3] introduced the concept of boomerang uniformity, which is the maximum value in the BCT excluding the first row and first column. For effectively computing the entries in the BCT, Li et al. [8] proposed an equivalent formulation as described below. For any $a,b \in \mathbb {F}_q$, the Boomerang Connectivity Table (BCT) entry of the function f at point (a, b), denoted by $\mathcal {B}_f(a,b)$, is the number of solutions in $\mathbb {F}_q \times \mathbb {F}_q$ of the following system of equations

$$\begin{aligned} {\left\{ \begin{array}{ll} f(x)+f(y)=b,\\ f(x+a)+f(y+a)=b. \end{array}\right. } \end{aligned}$$

(1.2)

The boomerang uniformity of the function f, denoted by $\mathcal {B}_f$, is given by

$$\begin{aligned} \mathcal {B}_f = \max \{ \mathcal {B}_f(a,b) \mid a,b \in \mathbb {F}_q^* \}. \end{aligned}$$

For any permutation f, Cid et al. [7, Lemma 1] showed that $\mathcal {B}_f(a,b) \ge \Delta _f(a,b)$ for all $(a,b)\in \mathbb {F}_q \times \mathbb {F}_q$. Later, Mesnager et al. [11] showed that it holds for non-permutation functions as well. Cid et al. [7, Lemma 4] showed that for APN permutations, the BCT is the same as the DDT, except for the first row and the first column. Thus APN permutations offer an optimal resistance to both differential and boomerang attacks. However, over finite fields $\mathbb {F}_{2^n}$ with n even, which is the most interesting case in cryptography, the only known example of APN permutation is due to Dillon [4] over $\mathbb {F}_{2^6}$. The existence of APN permutations over $\mathbb {F}_{2^n}$, $n\ge 8$ even, is an open problem and often referred to as the Big APN Problem. Therefore, over $\mathbb {F}_{2^n}$, n even, the functions with differential and boomerang uniformity four offer the best (known) resistance to differential and boomerang attacks. So far, there are six classes of permutations over $\mathbb {F}_{2^n}$, $n\equiv 2 \pmod 4$ with boomerang uniformity 4 (see [3, 8,9,10,11, 13]).

In this paper, we consider the boomerang uniformity of an infinite class of locally-APN (see Definition 2.1) functions $f(x)=x^{2^m-1}$ over the finite field $\mathbb {F}_{2^n}$, where $n=2m$ with $m>1$. In Sect. 2, we recall some results concerning the differential uniformity of f. Section 3 will be devoted to the boomerang uniformity of this power map and we shall show that the power map f is boomerang 2-uniform when $n \equiv 0 \pmod 4$ (i.e. when m is even) and boomerang 4-uniform when $n \equiv 2 \pmod 4$ (i.e. when m is odd), respectively.

Cid et al. [7] (see also [11, Theorem 1]) showed that for permutation functions f, $\mathcal {B}_f \ge \Delta _f$. However, perhaps, due to lack of any explicit example in the case of non-permutations, in several follow up papers of Ref. [7] such as Ref. [5, 6, 9], the term “permutation" was not emphasized and it has been stated that for any function f, the differential uniformity is less than the boomerang uniformity. In this paper, we shall show that for non-permutations, the differential uniformity is not necessarily smaller than the boomerang uniformity. To the best of our knowledge, this is the first such example. Finally, we end with some concluding remarks in Sect. 4.

While one might wonder if investigating non-permutation is worthy, and we believe that these questions and their answers may reveal results of interests that do have applications to cryptography. With one exception [4], all APN functions on even dimension are non-permutations. In fact, even the known example from Ref. [4] is an APN permutation that is CCZ-equivalent to the known Kim (non-permutation) APN function. Moreover, it is known that the boomerang uniformity is not invariant under the CCZ or even extended affine equivalence, while the differential uniformity is invariant. There are many open questions asking whether by adding a linearized polynomial (or even monomial) to an APN non-permutation function might render a permutation (surely, APN) function. If we know exactly how the boomerang uniformity behaves under such small perturbations, then we can possibly answer some of these questions. For example, a simple consequence of our main results is that there is no permutation in the CCZ-equivalent class of $x^{2^m-1}$ over $\mathbb {F}_{2^{2m}}$ that has boomerang uniformity smaller than $2^m-2$.

2 Differential uniformity of $x\rightarrow x^{2^m-1}$

The differential properties of the power maps of the form $x^{2^t-1}$ over $\mathbb {F}_{2^n}$, $1< t <n$, have been considered in Ref. [2] where authors computed DDT entries $\Delta _f(1,b)$ by determining roots of linearized polynomials of the form $x^{2^t}+bx^2+(b+1)x=0$. In fact, in Ref. [2] authors introduced a new type of functions, called locally-APN functions, defined as follows.

Definition 2.1

Let f be a power map from $\mathbb {F}_{2^n}$ to itself. Then the function f is said to be locally-APN if

$$\begin{aligned} \Delta _f(1,b) \le 2,~\text{ for } \text{ all }~b \in \mathbb {F}_{2^n} \backslash \mathbb {F}_2. \end{aligned}$$

In Ref. [2] authors gave an infinite class of locally-APN functions by showing that the power map $x^{2^m-1}$ over $\mathbb {F}_{2^{2m}}$ is locally-APN.

The following lemma concerning the DDT entries of the power map $x^{2^m-1}$ over $\mathbb {F}_{2^{2m}}$ has already been proved in Ref. [2, Theorem 7]. However, we reproduce its proof here for the sake of convenience of the readers, as it will be used in computing the BCT entries in Sect. 3.

Lemma 2.2

Let $f(x)=x^{2^m-1}$ be a power map defined on the finite field $\mathbb {F}_{2^{2m}}$. Then $\Delta _f(1,0)= 2^m-2$, $\Delta _f(1,b)\le 2$ for all $b \in \mathbb {F}_{2^{2m}}\backslash \mathbb {F}_2$ and

$$\begin{aligned} \Delta _f(1,1)= {\left\{ \begin{array}{ll} 2 &{}~\text{ if } \text{ m } \text{ is } \text{ even, }\\ 4 &{}~\text{ if } \text{ m } \text{ is } \text{ odd }. \end{array}\right. } \end{aligned}$$

Proof

For any $b \in \mathbb {F}_{2^{2m}}$, consider the DDT entry at point (1, b), which is given by the number of solutions in $\mathbb {F}_{2^{2m}}$ of the following equation

$$\begin{aligned} (x+1)^{2^m-1}+x^{2^m-1} = b. \end{aligned}$$

(2.1)

We shall now split the analysis to find the number of solutions of the above equation in the following cases.

Case 1 Let $b=0$. It is easy to observe that $x=0,1$ are not solutions of the above Eq. (2.1). For $x \ne 0,1$, Eq. (2.1) reduces to

$$\begin{aligned} \left( \frac{x+1}{x}\right) ^{2^m-1}= 1. \end{aligned}$$

If we let $y = 1+x^{-1}$, then the above equation reduces to $y^{2^m-1}=1$. Since $\gcd (2^m-1, 2^{2m}-1) = 2^m-1$, this equation has exactly $2^m-2$ solutions in $\mathbb {F}_{2^{2m}} \backslash \mathbb {F}_2$ and hence $\Delta _f(1,0)= 2^m-2$.

Case 2 Let $b=1$. Notice that in this case $x=0$ and $x=1$ are solutions of Eq. (2.1). For $x\ne 0,1$, Eq. (2.1) is equivalent to

$$\begin{aligned} \begin{aligned} \frac{x^{2^m}+1}{x+1}+\frac{x^{2^m}}{x} = 1 \iff x^{2^m}+x^2 = 0. \end{aligned} \end{aligned}$$

With $x^2 = y$, the above equation becomes

$$\begin{aligned} y(y^{2^{m-1}-1}+1) = 0. \end{aligned}$$

(2.2)

Notice that when $m>1$ is odd then $\gcd (m-1, 2m) = 2$ and the above Eq. (2.2) can have at most 4 solutions, namely $0,1,\omega , \omega ^2$, where $\omega$ is a primitive cubic root of unity. Hence $\Delta _f(1,1)=4$. When $m>1$ is even then $\gcd (m-1, 2m) = 1$, thus 0, 1 are only solutions of the Eq. (2.2). Hence in this case $\Delta _f(1,1)=2$.

Case 3 Let $b \in \mathbb {F}_{2^{2m}} \backslash \mathbb {F}_2$. It is easy to see that in this case $x=0$ and $x=1$ are not solutions of Eq. (2.1). Therefore, the DDT entry at (1, b) is the number of solutions in $\mathbb {F}_{2^{2m}} \backslash \mathbb {F}_2$ of the following equivalent equation

$$\begin{aligned} x^{2^m}+bx^2+(b+1)x=0. \end{aligned}$$

(2.3)

Now, raising the above equation to the power $2^m$, we have

$$\begin{aligned} x^{2^{2m}}+b^{2^m}x^{2^{m+1}}+(b^{2^m}+1)x^{2^m}=0. \end{aligned}$$

(2.4)

Combining (2.3) and (2.4), we have

$$\begin{aligned} \begin{aligned} b^{2^m+2}x^4+(b^{2^m+2}+b^{2^m+1}+b^{2^m}+b)x^2 +(b^{2^m+1}+b^{2^m}+b)x=0. \end{aligned} \end{aligned}$$

We note that the above equation can have at most 4 solutions in $\mathbb {F}_{2^{2m}}$, two of which are 0 and 1 and thus it can have at most two solutions in $\mathbb {F}_{2^{2m}} \backslash \mathbb {F}_2$. Therefore for $b \in \mathbb {F}_{2^{2m}} \backslash \mathbb {F}_2$, $\Delta _f(1,b) \le 2$. This completes the proof. $\square$

3 Boomerang uniformity of $x\rightarrow x^{2^m-1}$

In this section, we shall discuss the boomerang uniformity of the locally-APN functions given in the previous section. The boomerang uniformity of the power maps of the type $x^{2^t-1}$ over $\mathbb F_{2^n}$ has been considered in Ref. [15], where the authors give bounds on the boomerang uniformity in terms of the differential uniformity under the condition $\gcd (n,t)=1$ and also show that the power permutation $x^7$ has boomerang uniformity 10 over $\mathbb {F}_{2^n}$, where $n\ge 8$ is even and $\gcd (3, n) = 1$. The following theorem gives the boomerang uniformity of the power map $f(x)=x^{2^m-1}$ over $\mathbb {F}_{2^{2m}}$ where $m>1$ is odd.

Theorem 3.1

Let $f(x)=x^{2^m-1}$, $m>1$ odd, be a power map from the finite field $\mathbb {F}_{2^{2m}}$ to itself. Then, the boomerang uniformity of f is 4.

Proof

Recall that for any $b \in \mathbb {F}_q^*$, $q=2^{2m}$, the BCT entry $\mathcal {B}_f(1,b)$ at point (1, b) of f, is given by the number of solutions in $\mathbb {F}_q \times \mathbb {F}_q$ of the following system of equations

$$\begin{aligned} {\left\{ \begin{array}{ll} x^{2^m-1}+y^{2^m-1}=b,\\ (x+1)^{2^m-1}+(y+1)^{2^m-1}=b. \end{array}\right. } \end{aligned}$$

(3.1)

Notice that the above system (3.1) cannot have solutions of the form $(x_1,y_1)$ with $x_1=y_1$ as $b \ne 0$. Also it is easy to observe that if $(x_1,y_1)$ is a solution of the above system (3.1), then so are $(y_1,x_1), (x_1+1,y_1+1)$ and $(y_1+1,x_1+1)$. We shall split the analysis of the solutions of the system (3.1) in the following five cases.

Case 1 Let $x=0$. In this case, the system (3.1) reduces to

$$\begin{aligned} {\left\{ \begin{array}{ll} y^{2^m-1}=b,\\ (y+1)^{2^m-1}+y^{2^m-1}=1. \end{array}\right. } \end{aligned}$$

(3.2)

From Lemma 2.2, we know that the second equation of the above system has four solutions, namely $y= 0,1,\omega$ and $\omega ^2$. Also since m is odd, we have $2^m-1 \equiv 1 \pmod 3$. Since $b\ne 0$, $y=0$ cannot be a solution of the system (3.2) and $y= 1,\omega$ and $\omega ^2$ will be a solution of the system (3.2) when $b=1,\omega$ and $\omega ^2$, respectively. Equivalently, when $b=1,\omega , \omega ^2$ then $(0,1), (0,\omega ), (0,\omega ^2)$ are solutions of the system (3.1), respectively. When $b \in \mathbb {F}_q \backslash \mathbb {F}_{2^2}$ then there is no solution of the system (3.1) of the form (0, y).

Case 2 Let $x=1$. In this case, the system (3.1) reduces to

$$\begin{aligned} {\left\{ \begin{array}{ll} y^{2^m-1}=b+1,\\ (y+1)^{2^m-1}+y^{2^m-1}=1. \end{array}\right. } \end{aligned}$$

(3.3)

Similar to the previous case, the second equation of the above system (3.3) has four solutions, namely $y= 0,1,\omega$ and $\omega ^2$. Since $b\ne 0$, $y=1$ cannot be a solution of (3.3) and $y= 0,\omega$ and $\omega ^2$ will be a solution of (3.3), when $b=1,\omega ^2$ and $\omega$, respectively. Equivalently, when $b=1,\omega , \omega ^2$ then $(1,0), (1,\omega ^2), (1,\omega )$ are solutions of the system (3.1), respectively. When $b \in \mathbb {F}_q \backslash \mathbb {F}_{2^2}$ then there is no solution of the system (3.1) of the form (1, y).

Case 3 Let $y=0$. Since the system (3.1) is symmetric in the variables x and y, this case directly follows from Case 1. That is, when $b=1,\omega , \omega ^2$ then $(1,0), (\omega ,0), (\omega ^2,0)$ are solutions of the system (3.1), respectively. When $b \in \mathbb {F}_q \backslash \mathbb {F}_{2^2}$ then there is no solution for (3.1) of the form (x, 0).

Case 4 Let $y=1$. This case directly follows from Case 2. That is, when $b=1,\omega , \omega ^2$ then $(0,1), (\omega ^2,1), (\omega ,1)$ are solutions of the system (3.1), respectively. When $b \in \mathbb {F}_q \backslash \mathbb {F}_{2^2}$ then there is no solution for (3.1) of the form (x, 1).

Case 5 Let $x,y \ne 0,1$. In this case system (3.1) reduces to

$$\begin{aligned} {\left\{ \begin{array}{ll} x^{2^m}y+xy^{2^m}=bxy,\\ (x+y)^{2^m}+(b+1)(x+y)+b=0. \end{array}\right. } \end{aligned}$$

(3.4)

Let $y=x+z$. Then, the above system becomes

$$\begin{aligned} {\left\{ \begin{array}{ll} x^{2^m}z+xz^{2^m}=bx(x+z),\\ z^{2^m}+(b+1)z+b=0. \end{array}\right. } \end{aligned}$$

(3.5)

Now, raising the second equation of the above system to the power $2^m$, we have

$$\begin{aligned} (b^{2^m}+1)z^{2^m}+z+b^{2^m} =0. \end{aligned}$$

(3.6)

Combining the second equation of (3.5) and (3.6), we obtain

$$\begin{aligned} ((b+1)^{2^m+1}+1)(z+1) =0. \end{aligned}$$

(3.7)

Therefore, the system (3.5) reduces to

$$\begin{aligned} {\left\{ \begin{array}{ll} x^{2^m}z+xz^{2^m}=bx(x+z),\\ ((b+1)^{2^m+1}+1)(z+1) =0. \end{array}\right. } \end{aligned}$$

(3.8)

Now, we shall consider following two cases.

Subcase 5.1 Let $(b+1)^{2^m+1} \ne 1$. In this case, the first equation of (3.8) reduces to

$$\begin{aligned} x^{2^m}+bx^2+(b+1)x=0, \end{aligned}$$

which is equivalent to

$$\begin{aligned} b^{2^m+2}x^4+(b^{2^m+2}+b^{2^m+1}+b^{2^m}+b)x^2 +(b^{2^m+1}+b^{2^m}+b)x=0. \end{aligned}$$

(3.9)

When $b=1$, the above equation becomes $x^4+x =0$, which has four solutions $x=0,1,\omega , \omega ^2$. Since we assumed $x,y \ne 0$, the only solutions we consider are $x=\omega$ and $\omega ^2$. Thus for $b=1$, $(\omega , \omega ^2)$ and $(\omega ^2, \omega )$ are solutions of the system (3.5). When $b \in \mathbb {F}_q \backslash \mathbb {F}_2$ with $(b+1)^{2^m+1}\ne 1$, by Lemma 2.2, Eq. (3.9) can have at most two solutions.

Subcase 5.2 Let $(b+1)^{2^m+1} = 1$. It is more convenient, now, to work with (3.4). We then raise the first equation of the system (3.4) to the $2^m$-th power obtaining

$$\begin{aligned} x^{2^{2m}} y^{2^m}+y^{2^{2m}} x^{2^m}=b^{2^m} x^{2^m}y^{2^m}, \end{aligned}$$

which is equivalent to

$$\begin{aligned} x y^{2^m}+y x^{2^m}=b^{2^m} x^{2^m}y^{2^m}. \end{aligned}$$

Combining this with the first equation of (3.4), we infer that

$$\begin{aligned} b^{2^m} x^{2^m}y^{2^m}=bxy, \end{aligned}$$

and so, $bxy=\alpha \in \mathbb {F}_{2^m}^*$. Using $y=\frac{\alpha }{bx}$ in the first equation of (3.4), we obtain

$$\begin{aligned} x^{2^m-1}\frac{1}{b}+x^{1-2^m} \frac{1}{b^{2^m}}=1. \end{aligned}$$

(3.10)

Label $T=x^{2^m-1}$. Then the above equation reduces to

$$\begin{aligned} \begin{aligned} \frac{T}{b}+ \frac{T^{-1}}{b^{2^m}}&= 1\\ \iff \frac{T^2}{b}+ \frac{1}{b^{2^m}}&= T\\ \iff T^2b^{2^m}+b&= Tb^{2^m+1}. \end{aligned} \end{aligned}$$

Since, $(b+1)^{2^m+1} = 1$, by expansion, we get $b^{2^m+1}+b^{2^m}+b=0$, and so, $b^{2^m+1}=b^{2^m}+b$. The previous equation becomes

$$\begin{aligned} T^2b^{2^m}+b = Tb^{2^m} +Tb\iff (Tb^{2^m}+b)(T+1) =0. \end{aligned}$$

If $T=1$, then $x\in \mathbb {F}_{2^m}$ and so, $by\in \mathbb {F}_{2^m}$. Taking this back into (3.4), we then obtain

$$\begin{aligned} {\left\{ \begin{array}{ll} y^{2^m}+(b+1)y=0,\\ y^{2^m}+(b+1)y=(x+1)b, \end{array}\right. } \end{aligned}$$

which is inconsistent with $x\ne 1$ and $b \in \mathbb {F}_q^*.$ If $Tb^{2^m}+b=0$, then we have

$$\begin{aligned} \begin{aligned} Tb^{2^m}+b&=0 \\ \iff Tb^{2^m-1}+1&=0\\ \iff (bx)^{2^m-1}&=1. \end{aligned} \end{aligned}$$

Therefore $bx \in \mathbb {F}_{2^m}$ and hence $\frac{\alpha }{bx}= y \in \mathbb {F}_{2^m}$. Taking this back into (3.4), we then obtain

$$\begin{aligned} {\left\{ \begin{array}{ll} x^{2^m}+(b+1)x=0,\\ x^{2^m}+(b+1)x=(y+1)b, \end{array}\right. } \end{aligned}$$

which is inconsistent with $y \ne 1$ and $b \in \mathbb {F}_q^*.$ This completes the proof. $\square$

Example 3.2

As an example, we checked by SageMath that the differential uniformity of the non-permutation power map $x^7$ over $\mathbb F_{2^6}$ is 6, whereas its boomerang uniformity is 4.

The following theorem gives the boomerang uniformity of the power map $f(x)=x^{2^m-1}$ over $\mathbb {F}_{2^{2m}}$ , where $m>1$ is even.

Theorem 3.3

Let $f(x)=x^{2^m-1}$, $m>1$ even, be a power map from the finite field $\mathbb {F}_{2^{2m}}$ to itself. Then, the boomerang uniformity of f is 2.

Proof

Following similar arguments as in the proof of Theorem 3.1, it is straightforward to see that when $b=1$, (0, 1) and (1, 0) are the only solutions of the system (3.1) with either of the coordinates x, y being 0 or 1. On the other hand, when $b \in \mathbb {F}_{2^{2m}} \backslash \mathbb {F}_{2}$, there is no solution of the system (3.1) with either of the coordinates $x,y \in \{0,1\}$.

We now consider the case when $x,y \ne 0,1$. In this case, the system (3.1) reduces to

$$\begin{aligned} {\left\{ \begin{array}{ll} x^{2^m}y+xy^{2^m}=bxy,\\ (x+y)^{2^m}+(1+b)(x+y)+b=0. \end{array}\right. } \end{aligned}$$

(3.11)

Let $y=x+z$. Now, raising the second equation of the above system to the power $2^m$ and adding it to the second equation of the above system, we have

$$\begin{aligned} {\left\{ \begin{array}{ll} x^{2^m}z+xz^{2^m}=bx(x+z),\\ ((b+1)^{2^m+1}+1)(z+1) =0. \end{array}\right. } \end{aligned}$$

(3.12)

Now, we shall consider the following two cases.

Case 1 Let $(b+1)^{2^m+1} \ne 1$. In this case, the system (3.12) reduces to

$$\begin{aligned} x^{2^m}+bx^2+(b+1)x=0, \end{aligned}$$

which is equivalent to

$$\begin{aligned} b^{2^m+2}x^4+(b^{2^m+2}+b^{2^m+1}+b^{2^m}+b)x^2 +(b^{2^m+1}+b^{2^m}+b)x=0. \end{aligned}$$

(3.13)

When $b=1$, the above equation becomes $x^4+x =0$, which has two solutions $x=0,1$, as m is even. Since we assumed $x,y \ne 0,1$, we do not get any solution of the system (3.13) in this case. When $b \in \mathbb {F}_{2^{2m}} \backslash \mathbb {F}_2$ with $(b+1)^{2^m+1}\ne 1$, by Lemma 2.2, Eq. (3.13) can have at most two solutions.

Case 2 Let $(b+1)^{2^m+1} = 1$, the argument is similar to Subcase 5.2 of Theorem 3.1 and in this case the system (3.1) will have no solution. $\square$

Example 3.4

The differential uniformity of the non-permutation power map $x^{15}$ over $\mathbb F_{2^8}$ is 14, whereas its boomerang uniformity is 2.

In the following we shall focus on APN functions. First, we recall two lemmas which give a connection between the DDT and BCT entries of arbitrary permutation functions, respectively, APN permutations.

Lemma 3.5

[7, Lemma 1] If f is a permutation function on $\mathbb {F}_q$, then $\Delta _f(a,b) \le \mathcal {B}_f(a,b)$, for all $(a,b)\in \mathbb {F}_q \times \mathbb {F}_q.$

Lemma 3.6

[7, Lemma 4] For any permutation with 2-uniform DDT, the BCT entries equal the DDT entries, except for the first row and the first column.

From Lemmas 3.5 and 3.6, we can deduce (surely, known) that APN permutations have boomerang uniformity 2. Of course, it is rather easy to see that the converse is also true.

Proposition 3.7

Let f be a permutation on $\mathbb {F}_q$. If the boomerang uniformity of f is 2, then it is APN.

Proof

Since the boomerang uniformity of the permutation f is 2, we have

$$\begin{aligned} \Delta _f(a,b) \le \mathcal {B}_f(a,b) \le 2, \end{aligned}$$

for all $(a,b)\in \mathbb {F}_q^* \times \mathbb {F}_q^*.$ Also notice that for any $a \in \mathbb {F}_q^*$,

$$\begin{aligned} \begin{aligned} \Delta _f(a,0)&= |\{ x\in \mathbb {F}_q \mid f(x+a)+f(x)=0\} |\\&=0. \end{aligned} \end{aligned}$$

Thus $\Delta _f(a,b) \le 2$ for all $(a,b) \in \mathbb {F}_q^* \times \mathbb {F}_q$ and hence f is APN. $\square$

By providing an extension of the boomerang uniformity to the case of arbitrary functions, Mesnager et al. [11] observed that for any arbitrary function f, $\Delta _f(a,b) \le \mathcal {B}_f(a,b)$, for all $(a,b)\in \mathbb {F}_q \times \mathbb {F}_q.$ In the following, we shall show that the boomerang uniformity of any arbitrary APN function f is 2.

Theorem 3.8

Let f be an arbitrary APN function over $\mathbb {F}_q$. Then the boomerang uniformity of f is 2.

Proof

Recall that the BCT entry $\mathcal {B}_f(a,b)$ of f at ponint (a, b) is given by

$$\begin{aligned} \mathcal {B}_f(a,b) = \left|\left\{ (x,y)\in \mathbb {F}_q \times \mathbb {F}_q \mid {\left\{ \begin{array}{ll} f(x)+f(y)=b \\ f(x+a)+f(y+a) =b \end{array}\right. } \right\} \right|. \end{aligned}$$

Let $y=x+\gamma$, then the above equation becomes

$$\begin{aligned} \begin{aligned} \mathcal {B}_f(a,b)&= \left|\left\{ (x,\gamma )\in \mathbb {F}_q \times \mathbb {F}_q \mid {\left\{ \begin{array}{ll} f(x+\gamma )+f(x)=b \\ f(x+a+\gamma )+f(x+a)=b \end{array}\right. } \right\} \right|\\&= \sum _{\gamma \in \mathbb {F}_q} \left|\left\{ x\in \mathbb {F}_q \mid {\left\{ \begin{array}{ll} f(x+\gamma )+f(x)=b \\ f(x+a+\gamma )+f(x+a)=b \end{array}\right. } \right\} \right|. \end{aligned} \end{aligned}$$

Also observe that for any $(a,b)\in \mathbb {F}_q^* \times \mathbb {F}_q^*$, we have

$$\begin{aligned} \mathcal {B}_f(a,b) = \sum _{\gamma \in \mathbb {F}_q^*} \left|\left\{ x\in \mathbb {F}_q \mid {\left\{ \begin{array}{ll} f(x+\gamma )+f(x)=b \\ f(x+a+\gamma )+f(x+a)=b \end{array}\right. } \right\} \right|. \end{aligned}$$

Since f is an APN function, therefore, for any $(a,b)\in \mathbb {F}_q^* \times \mathbb {F}_q^*$, the quantity under summation will contribute only if $a=\gamma$. Now for $\gamma =a$, $\mathcal {B}_f(a,b)=\Delta _f(a,b) \le 2$ and hence the boomerang uniformity of f is 2. $\square$

Remark 3.9

The converse of the above Theorem 3.8 is not necessarily true and counterexamples can be easily constructed. For instance, the boomerang uniformity of the power map $x^{15}$ over $\mathbb {F}_{2^8}$ is 2, though it is not an APN function.

4 Concluding remarks

In this note we compute the boomerang uniformity of the power map $x^{2^m-1}$ over $\mathbb {F}_{2^{2m}}$. As an immediate consequence, we find that the differential uniformity is not necessarily smaller than the boomerang uniformity (for non-permutations), as it was previously shown for permutations. The presented class is not just an isolated example. Our computer programs reveal quickly some other like-functions, for instance, $x\mapsto x^{45}$ on $\mathbb {F}_{2^8}$, which is locally-APN, has differential uniformity 14, and boomerang uniformity 2. We could not extrapolate an infinite class out of all these examples, though. It would be interesting to construct some new (infinite) classes of functions for which the boomerang uniformity is strictly smaller than the differential uniformity.