<figure><img src="image_1.png" /></figure>

HAL
open science

# Statistical properties of Butterfly-like constructions

Clémence Bouvier

► To cite this version:

Clémence Bouvier. Statistical properties of Butterfly-like constructions. Fq16 - International Conference on Finite Fields and Their Applications 2025, Jul 2025, Sao Carlos, Brazil. hal-05419184

HAL Id: hal-05419184

https://inria.hal.science/hal-05419184v1

Submitted on 16 Dec 2025

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_2.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
Statistical properties of Butterfly-like constructions

Clémence Bouvier

UNIVERSITÉ DE LORRAINE, CNRS, INRIA, LORIA

The Butterfly construction [5] was originally introduced over binary fields $F_{2^n}$ for odd $n$. Since then, various variants have been explored, including the Flystel [4], defined over both binary and prime fields, and proposed as a non-linear building block in Anemoi, a family of hash functions designed for zero-knowledge applications. In this context, understanding the differential and linear properties of internal components is crucial to assess the resistance of the overall construction to statistical attacks. While a bound was established for the differential properties of the Flystel construction, its linear behavior remained a conjecture. A recent breakthrough [1, 2] showed that bounds on exponential sums can provide valuable insights into the resistance of Flystel-like constructions to linear cryptanalysis, solving the conjecture. In this talk, we present a classification of Butterfly-like constructions based on their statistical properties. This work extends initial investigations from [3], and offers new perspectives on the cryptographic potential and limitations of these designs.

**Keywords:** Butterfly, differential cryptanalysis, linear cryptanalysis, exponential sums

References

[1] T. BEYNE AND C. BOUVIER, Linear approximations of the Flystel construction, *Cryptology ePrint Archive* (2024), Paper 2024/1465.

[2] T. BEYNE AND C. BOUVIER, Exponential sums in linear cryptanalysis, *Cryptology ePrint Archive* (2024), Paper 2024/1755.

[3] C. BOUVIER, Cryptanalysis and design of symmetric primitives defined over large finite fields, PhD thesis, Sorbonne Université (2023).

[4] C. BOUVIER, P. BRIAUD, P. CHAIDOS, L. PERRIN, R. SALEN, V. VELICHKOV, AND D. WILLEMS, New design techniques for efficient arithmetization-oriented hash functions: Anemoi permutations and Jive compression mode, *CRYPTO 2023, Part III, Vol. 14083 of Lecture Notes in Computer Science*, pages 507–539.

[5] L. PERRIN, A. UDOVENKO, AND A. BIRYUKOV, Cryptanalysis of a theorem: Decomposing the only known solution to the big APN problem, *CRYPTO 2016, Part II, Vol. 9815 of Lecture Notes in Computer Science*, pages 93-122.