# On the Modified Transparency Order ofn,m-Functions

Authors: Yu Zhou; Yongzhuang Wei; Hailong Zhang; Wenzheng Zhang
Journal: Security and Communication Networks
 (2021)

---

## Abstract

The concept of transparency order is introduced to measure the resistance ofn,m-functions against multi-bit differential power analysis in the Hamming weight model, including the original transparency order (denoted by TO), redefined transparency order (denoted by RTO), and modified transparency order (denoted by MTO). In this paper, we firstly give a relationship between MTO and RTO and show that RTO is less than or equal to MTO for any n,m-functions. We also give a tight upper bound and a tight lower bound on MTO for balanced n,m-functions. Secondly, some relationships between MTO and the maximal absolute value of the Walsh transform (or the sum-of-squares indicator, algebraic immunity, and the nonlinearity of its coordinates) for n,m-functions are obtained, respectively. Finally, we give MTO and RTO for (4,4) S-boxes which are commonly used in the design of lightweight block ciphers, respectively.


---

## Body

## 1. Introduction

Differential power analysis (DPA) was introduced by Kocher et al. in [1] and is a well-known and thoroughly studied threat for implementations of block ciphers, like DES and AES [2].Beierle et al. [3] validated the correlation power analysis attack through the Hamming distance power model. Fischer et al. [4] presented efficient differential power analysis of Gain and Trivium through carefully chosen IVs to eliminate the algorithmic noise. In 2005, Prouff [5] gave the model of the DPA resilience of the S-boxes and proposed the definition of the transparency order (denoted by TO) based on the autocorrelation coefficients for n,m-functions. He obtained that S-boxes with smaller TO have higher DPA resilience and deduced the tightness of the upper bound and the lower bound on the TO. In the same year, Carlet [6] obtained the lower bound on the transparency order and gave the relationship between the transparency order and the nonlinearity for Boolean functions. Next, Fan et al. [7] gave a fast method for calculating the transparency order by optimization cycle of the original algorithm.In 2012, Fei et al. [8] proposed the confusion coefficient and obtained some relations between the success rate and the cryptographic algorithm. For power analysis attacks, the side-channel characteristic of the physical implementation can be seen as the signal-to-noise ratio (denote by SNR) [9]. Experimental results of DPA on both DES or AES verified this model with high accuracy and demonstrated effectiveness of the algorithmic confusion analysis and SNR extraction. Experimental results shown that the algorithm has better anti-noise performance than the original algorithm for present.Chakraborty et al. [10] found the limitations of the definition in [5] and gave a redefined transparency order (denoted by RTO) based on the cross-correlation coefficients for n,m-functions. Then, they were able to theoretically capture DPA in the Hamming weight model for hardware implementation with precharge logic. Picek et al. [11] proposed a technique for constructions using the modified transparency order as a guiding metric. Wang and Stănică [12] obtained an upper bound on the redefined transparency order in terms of nonlinearity for Boolean functions and constructed two infinite class of balanced semibent Boolean functions with provably good transparency order.But in 2020, Li et al. [13] put up a flaw in original transparency order [10] and gave the modified transparency order denoted by MTO, obtained a lower bound on MTO based on the Walsh transform, and deduced the distribution of MTO values for sixteen optimal affine equivalent classes of (4,4) S-boxes.So far, little attempt has been made to study the relationship betweenRTO and MTO, and Li et al. [13] gave a lower bound on MTO for any n,m-functions based on Walsh spectrum, but not based on m. Moreover, how to further investigate the in-depth relationships between RTO and MTO with other cryptography indicators still appears to be an important issue.In this article, we focus on some unresolved problems related to bothRTO and MTO. Firstly, we give the relationship between MTO and RTO, and this result implies that MTOF≥RTOF for any n,m-functions F. We also obtain the upper bound and the lower bound on MTO. To design good S-boxes with respect to the MTO [13], we deduce some important connections between MTO and other cryptographic properties such as the sum-of-squares indicator, nonlinearity, the maximum absolute of Walsh transform, and algebraic immunity of the coordinate functions of S-boxes. In particular, it is shown that these results have a direct influence on the resistance to DPA attacks. More precisely, the smaller the sum-of-squares indicator (or the maximum absolute of Walsh transform) of the coordinate functions of a given n,m-function, the larger the MTO, whereas a higher nonlinearity (or algebraic immunity) of the coordinate functions of a given n,m-function also implies a larger MTO (not desirable). Furthermore, there is also a connection between the algebraic immunity and transparency order which essentially indicates (along with other trade-offs) that the design of cryptographically secure S-boxes is hardly achievable if the protection against DPA attacks is taken into account. Finally, we give the MTO and RTO for (4,4) S-boxes which are commonly used in some lightweight block ciphers, it implies that MTO is better than RTO from the perspective of information leakage.This paper is organized as follows. In Section2, we introduce the basic concepts and notions. In Section 3, the tightness of the upper bound and the lower bound on the modified transparency order of n,m-functions is derived. In Section 4, some relationships between MTOF and other cryptographic properties are derived. Section 5 gives some data analysis results for some 4,4 S-boxes. Section 6 concludes this paper.


## 2. Preliminaries

LetBn be the set of n-variable Boolean functions. We denote by ⊕ the addition modulo two performed in F2 and the vector space F2n. The support of a Boolean function f∈Bn is defined as suppf=x1,…,xn∈F2n|fx1,…,xn=1. The Hamming weight of f is denoted by wtf and corresponds to the cardinality of its support wtf=suppf. A Boolean function f is said to be balanced if its truth table contains equal number of ones and zeros, i.e., wtf=2n−1. The set of affine functions, whose algebraic degree degf≤1 is denoted by An. Especially, an affine function with the constant term equal to zero is called a linear function.In this paper, let0n=0,…,0︸n be the zero vector in F2n.Definition 1.
Letf∈Bn. The Walsh spectrum of f is defined by(1)ℱf⊕φα=∑x∈F2n−1fx⊕φαx,α∈F2n,where φαx=α⋅x=α1x1⊕⋯⊕αnxn, x = (x1,x2,…,xn), α=α1,α2,…,αn. The nonlinearity of f can be computed using(2)Nf=2n−1−12maxα∈F2nℱf⊕φα.
Letf,g∈Bn. The cross-correlation function between f and g is defined by(3)△f,gα=∑x∈F2n−1fx⊕gx⊕α,α∈F2n.
In particular, whenf=g, then the autocorrelation function of f∈Bn is given by(4)△fα=∑x∈F2n−1fx⊕fx⊕α,α∈F2n.
For more research on the autocorrelation function and the cross-correlation function of Boolean functions, refer to reference [14].
Two functionsf,g∈Bn are said to be perfectly uncorrelated if △f,gα=0, for any α∈F2n. From [15], if f and g are perfectly uncorrelated, then ℱf⊕φαℱg⊕φα=0 for any α∈F2n.Definition 2.
(see [16]). The two indicators capturing the global avalanche characteristics (GACs) of a Boolean function f∈Bn are given by(5)σf=∑α∈F2n△fα2,△f=maxα∈F2n,α≠0n△fα.
In 2010, Zhou et al. [17] generalized GAC and gave the global avalanche characteristics between two Boolean functions f,g∈Bn:(6)σf,g=∑α∈F2nΔf,gα2,Δf,g=maxα∈F2nΔf,gα.
For two positive integersn and m, a function F:F2n⟶F2m is called an n,m-function. Such a function F can be viewed as a collection of its coordinate Boolean functions, and thus F=f1,…,fm, where fi:F2n⟶F2. An n,m-function F is balanced if and only if its component functions are balanced, meaning that for every nonzero v∈F2m, the Boolean function v·F is balanced.
The original transparency order [5] and the redefining transparency order [10] are for balanced (n, m) functions. In this paper, in order to expand the research scope of n,m-function, we extend the balanced n,m-function to any n,m-function, which makes our results more universal (see Definition 3 and Definition 4).Definition 3.
(see [10]). Let F=f1,…,fm be an n,m-function. The redefined transparency order of F, based on the cross-correlation properties of F, is defined by(7)RTOF=maxβ∈F2mm−122n−2n∑a∈F2n∗∑j=1m∑i=1m−1βi⊕βj△fi,fja,where β=β1,β2,…,βm,βi∈F2.
In 2019, Li et al. gave the modified transparency order in [13].Definition 4.
(see [13]). Let F=f1,…,fm be an n,m-function. The modified transparency order of F, based on the cross-correlation properties of F, is defined by(8)MTOF=maxβ∈F2mm−122n−2n∑a∈F2n∗∑j=1m∑i=1m−1βi⊕βj△fi,fja.
Note that(9)−1βi⊕βj△fi,fja=△fi⊕βi,fj⊕βja,and for research convenience, let(10)ΓFβ=m−122n−2n∑a∈F2n∗∑j=1m∑i=1mΔfi⊕βi,fj⊕βja.
Thus,(11)MTOF=maxβ∈F2mΓFβ.


## 3. Bounds on the Modified Transparency Order

Based on Definition4, a lower bound on MTO was derived in [13] in terms of the Walsh spectrum of the coordinate functions of F, but this lower bound is very complex. In order to obtain a tight lower and upper bounds on MTO, we firstly give a relationship between MTO and MTO.Lemma 1 (see [17]).
Letf,g∈Bn. Then,(12)∑α∈F2nΔf,gα=2n−2wtf2n−2wtg.Theorem 1.
LetF=f1,…,fm be an n,m-function. Then,(13)MTOF≤MTOF.Proof.
By using the inequality∑i=1mai≤∑i=1mai for any ai∈ℝ, we have(14)∑j=1m∑i=1m−1βi⊕βjΔfi,fja≤∑j=1m∑i=1m−1βi⊕βjΔfi,fja,a∈F2n.
For anya∈F2n, we have(15)m−122n−2n∑a∈F2n∗∑j=1m∑i=1m−1βi⊕βjΔfi,fja≥m−122n−2n∑a∈F2n∗∑j=1m∑i=1m−1βi⊕βjΔfi,fja.
Based on the above equation, we haveMTOF≥RTOF.Remark 1.
From the proof process, we can know thatMTOF≥RTOF for any n,m-function F, including balanced functions and unbalanced functions.
Although at present we cannot theoretically give the condition onRTOF=MTOF of n,m-functions F=f1,f2,…,fm, we can give an example with RTOF=MTOF (see Example 1).
In the following, we give a tight upper bound and a tight lower bound onMTOF by using the perfectly uncorrelated functions.Theorem 2.
LetF=f1,…,fm be a balanced n,m-function. If the coordinate functions fi and fj are perfectly uncorrelated for 1≤i≠j≤m, then(16)0≤MTOF≤m.Proof.
On the one hand, from Definition4 and Lemma 1, we have(17)ΓFβ=m−122n−2n∑a∈F2n∗∑j=1m∑i=1mΔfi⊕βi,fj⊕βja=m−122n−2n∑a∈F2n∗∑j=1mΔf1⊕β1,fj⊕βja+⋯+△fm⊕βm,fj⊕βja≤m−122n−2n∑a∈F2n∗∑j=1mΔf1⊕β1,fj⊕βja+⋯+△fm⊕βm,fj⊕βja=m−122n−2n∑j=1m∑a∈F2n∗Δf1⊕β1,fj⊕βja+⋯+△fm⊕βm,fj⊕βja=m−122n−2n|∑j=1m−1β1⊕βj2n−2wtf12n−2wtfj−Δf1,fj0n+−1β2⊕βj2n−2wtf22n−2wtfj−Δf2,fj0n+⋯+−1βm⊕βj2n−2wtfm2n−2wtfj−Δfm,fj0n.
SinceF=f1,…,fm is a balanced n,m-function, then fk1≤k≤m and fi⊕fj1≤i<j≤m are balanced functions. That is, wtfk=wtfi⊕fj=2n−1 for any 1≤k≤m and 1≤i<j≤m. We have △fi,fj0n=2n−2wtfi⊕fj=0 and 2n−2wtfk=0 for any 1≤i<j≤m, 1≤k≤m.
Thus,ΓFβ≤m, that is, MTOF≤m.
On the other hand, if the coordinate functionsfi and fj are perfectly uncorrelated for 1≤i≠j≤m, then △fi,fjα=0 for any α∈F2n and 1≤i≠j≤m.
From Definition4, we have(18)ΓFβ=m−122n−2n∑a∈F2n∗∑j=1m∑i=1mΔfi⊕βi,fj⊕βja=m−122n−2n∑a∈F2n∗Δf1a+△f2a+⋯+Δfma≥m−122n−2n∑a∈F2n∗Δf1a+Δf2a+⋯+Δfma.
By Cauchy’s inequality and22n≤σfi=∑a∈F2nΔfia2≤23n for any 1≤i≤m in [16], we have(19)23n−22n≥σfi−Δfi0n=∑a∈F2n∗Δfia2≥∑a∈F2n∗Δfia22n−1.
Thus,(20)∑a∈F2n∗Δfia≤2n2n−1,1≤i≤m.
From equation (20), we have(21)ΓFβ≥m−m⋅2n2n−122n−2n=0.
That is,MTOF≥0.
In the following, we give two examples for reaching the upper and lower bounds onMTO, respectively.Example 1.
LetF=f1,f2 be an n,m-function m=2 and f be a bent function. Its coordinate functions are specified as(22)f1x=fx,f2x=fx⊕1.
Then,f1 and f2 are bent functions. We know Δfia=0 and Δfi,fja=0 for any a∈F2n∗ and 1≤i≠j≤m. We have(23)ΓFβ=m−122n−2n∑a∈F2n∗∑j=1m∑i=1mΔfi⊕βi,fj⊕βja=m−0=m,and thus MTOF=m=2. We also obtain RTOF=m=2.Example 2.
LetF=f1,f2 be a 4,2-function. Its coordinate functions are specified as(24)f1x=x1⊕x2,f2x=x3⊕x4.
Then,F is balanced (n=4,m=2). We know Δfia=2n and Δfi,fja=0 for any a∈F2n∗ and 1≤i≠j≤m. Then, we have(25)ΓFβ=m−122n−2n∑a∈F2n∗∑j=1m∑i=1mΔfi⊕βi,fj⊕βja=m−m2n2n−122n−2n=0,and thus MTOF=0.
In particular, we give the modified transparency order for anyn,1-function.Corollary 1.
Letf∈Bn. Then,(26)0≤MTOf≤1.Proof.
Ifm=1 in Definition 4, then(27)MTOf=1−122n−2n∑a∈F2n∗Δfa.
Note that0≤Δfa≤2n for any a∈F2n∗. Then, 0≤MTOf≤1. MTOf=0 if and only if Δfa=2n for any a∈F2n∗, that is, f is an affine function. MTOf=1 if and only if Δfa=0 for any a∈F2n∗, that is, f is a bent function.Remark 2.
Corollary1 is a special case of Theorem 2. It also shows that both the upper bound and the lower bound on MTO can be reached.


## 4. The Relationships betweenMTO and Some Cryptographic Properties

In this section, we use the sum-of-squares indicator to establish some links betweenMTO and some cryptographic indicators. These links can help us understand MTO more deeply and lay a foundation for designing and analyzing S-boxes. In the following, we give a relationship between MTO and the sum-of-squares indicator, and this result is the basic of Corollaries 3 and 4.


### 4.1. The Relationships betweenMTO and the Sum-of-Squares Indicator

Theorem 3.
LetF=f1,…,fm be a balanced n,m-function. Then,(28)MTOF≥m1−∑i=1mσfi2n2n−1.Proof.
By using the Cauchy–Schwarz inequality and for anyβ=β1,β2,…,βm∈F2m, we have(29)∑j=1m∑i=1mΔfi⊕βi,fj⊕βja2≤m∑j=1m∑i=1mΔfi⊕βi,fj⊕βja2≤m∑j=1mm⋅∑i=1mΔfi⊕βi,fj⊕βj2a=m2∑j=1m∑i=1mΔfi⊕βi,fj⊕βj2a.
SinceF is a balanced n,m-function, fi⊕fj is balanced for 1≤i<j≤m, that is, Δfi,fj0n=0. Thus,(30)∑a∈F2n∗∑j=1m∑i=1mΔfi⊕βi,fj⊕βja≤2n−1∑a∈F2n∗∑j=1m∑i=1mΔfi⊕βi,fj⊕βja21/2≤2n−1m2∑a∈F2n∗∑j=1m∑i=1mΔfi⊕βi,fj⊕βj2a1/2=2n−1m2∑j=1m∑i=1m∑a∈F2n∗Δfi⊕βi,fj⊕βj2a1/2=2n−1m21/2∑j=1m∑i=1m∑a∈F2nΔfi⊕βi,fj⊕βj2a−Δfi⊕βi,fj⊕βj20n1/2=2n−1m2∑j=1m∑i=1mσfi,fj−Δfi⊕βi,fj⊕βj20n1/2=2n−1m2∑j=1m∑i=1mσfi,fj1/2.
Furthermore, we have(31)ΓFβ=m−122n−2n∑a∈F2n∗∑j=1m∑i=1mΔfi⊕βi,fj⊕βja≥m−122n−2n2n−1m2∑j=1m∑i=1mσfi,fj1/2=m1−∑j=1m∑i=1mσfi,fj2n2n−1.
Becauseσf,g≤σfσg for any f,g∈Bn [18], we have(32)ΓFβ≥m1−∑j=1m∑i=1mσfiσfj1/22n2n−1=m1−∑i=1mσfi2n2n−1.
From Definition4, we know that(33)MTOF=maxβ∈F2mΓFβ.
Thus,(34)MTOF≥ΓFβ≥m1−∑i=1mσfi2n2n−1.Remark 3.
Theorem3 gives one relationship between MTOF and σfi1≤i≤m, which implies that the smaller σfi1≤i≠j≤m, the bigger the MTOF.
Based on Theorem3, we give some lower bounds on MTO by nonlinearity and algebraic immunity.Corollary 2.
LetF=f1,…,fm be a balanced n,m-function. Then,(35)MTOF≥m1−∑i=1mℒfi2n2n−1.Proof.
Zheng and Zhang [19] obtained σf≤2nℒf2 for any f∈Bn, where ℒfi=maxα∈F2nℱfi⊕φα for any 1≤i≤m, and thus this result is easily proved.Corollary 3.
LetF=f1,…,fm be a balanced n,m-function. Then,(36)MTOF≥m1−∑i=1m2n−2Nfi2n2n−1.Proof.
Sinceℒfi=2n−2Nfi for 1≤i≤m, this result is easily proved.Corollary 4.
LetF=f1,…,fm be a balanced n,m-function. Then,(37)MTOF≥m1−12n2n−1AB,where A=∑i=1m2n−4∑k=0AIfi−2n−1k,B=∑j=1m2n−4∑k=0AIfj−2n−1k.Proof.
Carlet [20] obtained Nfi≥2∑i=0AIfi−2n−1i for 1≤i≤m , and thus this result is easily proved.Remark 4.
From Corollaries3 and 4, we have(1)
The larger theNfi (or AIfi) (1≤i≤m), the larger the MTOF.(2)
For the conventional attacks, S-boxes should have higher nonlinearity, algebraic immunity, good the sum-of-squares indicators, etc. For the differential power analysis, S-boxes should have lower the transparency order. Therefore, the trade-off among these indicators should be considered when designing cryptographic algorithm components in practice.


### 4.2. The Relationships betweenMTO and Hamming Weight

In this section, we give an upper bound onMTO by the Hamming weight of coordinate functions.Theorem 4.
LetF=f1,…,fm be an n,m-function and wtfi=2n−11≤i≤m. Then, for any β=β1,β2,…,βm∈F2m,(38)MTOF≤m−∑j=1m∑i=1m−1βi⊕βjwtfi⊕fj22n−2n.Proof.
Using the relation of absolute value inequality and Lemma1, since fi is a balanced function for 1≤i≤m, we have(39)ΓFβ=m−∑a∈F2n∗∑j=1m∑i=1mΔfi⊕βi,fj⊕βja22n−2n≤m−∑a∈F2n∗∑j=1m∑i=1mΔfi⊕βi,fj⊕βja22n−2n=m−∑j=1m∑i=1m∑a∈F2n∗Δfi⊕βi,fj⊕βja22n−2n=m−122n−2n∑j=1m∑i=1m∑a∈F2nΔfi⊕βi,fj⊕βja−Δfi⊕βi,fj⊕βj0n=m−122n−2n∑j=1m∑i=1m2n−2wtfi⊕βi2n−2wtfj⊕βj−Δfi⊕βi,fj⊕βj0n=m−∑j=1m∑i=1m−Δfi⊕βi,fj⊕βj0n22n−2n=m−∑j=1m∑i=1m−1βi⊕βjwtfi⊕fj22n−2n,which proves the result.Remark 5.
Ifwtfi⊕fj=2n−1 for any 1≤i≠j≤m, then MTOF≤m−m/2n−1. This implies that MTOF≤m−m/2n−1 for balanced n,m-functions F=f1,…,fm,fi∈Bn,1≤i≤m.Corollary 5.
LetF=f1,…,fm be a balanced n,m-function. Then,(40)0≤MTOF≤m−m2n−1.Wang and Stănică [12] gave a tight upper bound on the transparency order in terms of nonlinearity for a Boolean function and obtained a lower bound between transparency order and nonlinearity for a Boolean function. In the following, for a Boolean function, we also give one upper bound and some lower bounds on MTO.Corollary 6.
Letf∈Bn. Then,(1)
MTOf≥1−2n−1/22n−2nσf−22n.(2)
MTOf≥1−ℒf2−2n/22n−2n.(3)
MTOf≥1−2n−Nf2−2n/22n−2n.(4)
MTOf≤1−2n−2wtf2−2n/22n−2n.Remark 6.
In this section, we have the following facts.(1)
Theorem3 and Corollaries 2–5 are all about balanced Boolean functions, but Corollary 6 is about Boolean function (including balanced and unbalanced Boolean functions).(2)
Wang and Stănică [12] gave the upper bound on RTO by the nonlinearity of Boolean function; here we give the lower bounds on MTO by the nonlinearity, the sum-of-squares indicator, and the maximum absolute of Wash transform, respectively.(3)
These results show that the smaller the sum-of-squares indicator (or the maximal absolute value of Walsh spectrum) of its coordinate, the bigger the modified transparency order, and the bigger the nonlinearity (or the algebraic immunity) of its coordinate, the bigger the modified transparency order.


## 4.1. The Relationships betweenMTO and the Sum-of-Squares Indicator

Theorem 3.
LetF=f1,…,fm be a balanced n,m-function. Then,(28)MTOF≥m1−∑i=1mσfi2n2n−1.Proof.
By using the Cauchy–Schwarz inequality and for anyβ=β1,β2,…,βm∈F2m, we have(29)∑j=1m∑i=1mΔfi⊕βi,fj⊕βja2≤m∑j=1m∑i=1mΔfi⊕βi,fj⊕βja2≤m∑j=1mm⋅∑i=1mΔfi⊕βi,fj⊕βj2a=m2∑j=1m∑i=1mΔfi⊕βi,fj⊕βj2a.
SinceF is a balanced n,m-function, fi⊕fj is balanced for 1≤i<j≤m, that is, Δfi,fj0n=0. Thus,(30)∑a∈F2n∗∑j=1m∑i=1mΔfi⊕βi,fj⊕βja≤2n−1∑a∈F2n∗∑j=1m∑i=1mΔfi⊕βi,fj⊕βja21/2≤2n−1m2∑a∈F2n∗∑j=1m∑i=1mΔfi⊕βi,fj⊕βj2a1/2=2n−1m2∑j=1m∑i=1m∑a∈F2n∗Δfi⊕βi,fj⊕βj2a1/2=2n−1m21/2∑j=1m∑i=1m∑a∈F2nΔfi⊕βi,fj⊕βj2a−Δfi⊕βi,fj⊕βj20n1/2=2n−1m2∑j=1m∑i=1mσfi,fj−Δfi⊕βi,fj⊕βj20n1/2=2n−1m2∑j=1m∑i=1mσfi,fj1/2.
Furthermore, we have(31)ΓFβ=m−122n−2n∑a∈F2n∗∑j=1m∑i=1mΔfi⊕βi,fj⊕βja≥m−122n−2n2n−1m2∑j=1m∑i=1mσfi,fj1/2=m1−∑j=1m∑i=1mσfi,fj2n2n−1.
Becauseσf,g≤σfσg for any f,g∈Bn [18], we have(32)ΓFβ≥m1−∑j=1m∑i=1mσfiσfj1/22n2n−1=m1−∑i=1mσfi2n2n−1.
From Definition4, we know that(33)MTOF=maxβ∈F2mΓFβ.
Thus,(34)MTOF≥ΓFβ≥m1−∑i=1mσfi2n2n−1.Remark 3.
Theorem3 gives one relationship between MTOF and σfi1≤i≤m, which implies that the smaller σfi1≤i≠j≤m, the bigger the MTOF.
Based on Theorem3, we give some lower bounds on MTO by nonlinearity and algebraic immunity.Corollary 2.
LetF=f1,…,fm be a balanced n,m-function. Then,(35)MTOF≥m1−∑i=1mℒfi2n2n−1.Proof.
Zheng and Zhang [19] obtained σf≤2nℒf2 for any f∈Bn, where ℒfi=maxα∈F2nℱfi⊕φα for any 1≤i≤m, and thus this result is easily proved.Corollary 3.
LetF=f1,…,fm be a balanced n,m-function. Then,(36)MTOF≥m1−∑i=1m2n−2Nfi2n2n−1.Proof.
Sinceℒfi=2n−2Nfi for 1≤i≤m, this result is easily proved.Corollary 4.
LetF=f1,…,fm be a balanced n,m-function. Then,(37)MTOF≥m1−12n2n−1AB,where A=∑i=1m2n−4∑k=0AIfi−2n−1k,B=∑j=1m2n−4∑k=0AIfj−2n−1k.Proof.
Carlet [20] obtained Nfi≥2∑i=0AIfi−2n−1i for 1≤i≤m , and thus this result is easily proved.Remark 4.
From Corollaries3 and 4, we have(1)
The larger theNfi (or AIfi) (1≤i≤m), the larger the MTOF.(2)
For the conventional attacks, S-boxes should have higher nonlinearity, algebraic immunity, good the sum-of-squares indicators, etc. For the differential power analysis, S-boxes should have lower the transparency order. Therefore, the trade-off among these indicators should be considered when designing cryptographic algorithm components in practice.


## 4.2. The Relationships betweenMTO and Hamming Weight

In this section, we give an upper bound onMTO by the Hamming weight of coordinate functions.Theorem 4.
LetF=f1,…,fm be an n,m-function and wtfi=2n−11≤i≤m. Then, for any β=β1,β2,…,βm∈F2m,(38)MTOF≤m−∑j=1m∑i=1m−1βi⊕βjwtfi⊕fj22n−2n.Proof.
Using the relation of absolute value inequality and Lemma1, since fi is a balanced function for 1≤i≤m, we have(39)ΓFβ=m−∑a∈F2n∗∑j=1m∑i=1mΔfi⊕βi,fj⊕βja22n−2n≤m−∑a∈F2n∗∑j=1m∑i=1mΔfi⊕βi,fj⊕βja22n−2n=m−∑j=1m∑i=1m∑a∈F2n∗Δfi⊕βi,fj⊕βja22n−2n=m−122n−2n∑j=1m∑i=1m∑a∈F2nΔfi⊕βi,fj⊕βja−Δfi⊕βi,fj⊕βj0n=m−122n−2n∑j=1m∑i=1m2n−2wtfi⊕βi2n−2wtfj⊕βj−Δfi⊕βi,fj⊕βj0n=m−∑j=1m∑i=1m−Δfi⊕βi,fj⊕βj0n22n−2n=m−∑j=1m∑i=1m−1βi⊕βjwtfi⊕fj22n−2n,which proves the result.Remark 5.
Ifwtfi⊕fj=2n−1 for any 1≤i≠j≤m, then MTOF≤m−m/2n−1. This implies that MTOF≤m−m/2n−1 for balanced n,m-functions F=f1,…,fm,fi∈Bn,1≤i≤m.Corollary 5.
LetF=f1,…,fm be a balanced n,m-function. Then,(40)0≤MTOF≤m−m2n−1.Wang and Stănică [12] gave a tight upper bound on the transparency order in terms of nonlinearity for a Boolean function and obtained a lower bound between transparency order and nonlinearity for a Boolean function. In the following, for a Boolean function, we also give one upper bound and some lower bounds on MTO.Corollary 6.
Letf∈Bn. Then,(1)
MTOf≥1−2n−1/22n−2nσf−22n.(2)
MTOf≥1−ℒf2−2n/22n−2n.(3)
MTOf≥1−2n−Nf2−2n/22n−2n.(4)
MTOf≤1−2n−2wtf2−2n/22n−2n.Remark 6.
In this section, we have the following facts.(1)
Theorem3 and Corollaries 2–5 are all about balanced Boolean functions, but Corollary 6 is about Boolean function (including balanced and unbalanced Boolean functions).(2)
Wang and Stănică [12] gave the upper bound on RTO by the nonlinearity of Boolean function; here we give the lower bounds on MTO by the nonlinearity, the sum-of-squares indicator, and the maximum absolute of Wash transform, respectively.(3)
These results show that the smaller the sum-of-squares indicator (or the maximal absolute value of Walsh spectrum) of its coordinate, the bigger the modified transparency order, and the bigger the nonlinearity (or the algebraic immunity) of its coordinate, the bigger the modified transparency order.


## 5. Data Analysis of4,4 S-Boxes

In this section, we giveRTO or MTO of three types of 4-bit S-boxes: (1) some lightweight S-boxes used in some well-known encryption algorithms, (2) 16 classes of optimal 4,4 S-boxes, and (3) 302 affine equivalent 4,4 S-boxes. Thus, we give the analysis results of S-boxes in three subsections.


### 5.1.RTO and MTO of Some Known S-Boxes in Well-Known Encryption Algorithms

We give theRTO and MTO of S-boxes in some well-known encryption algorithms (such as Pride [21], Midori [22], Gift [23], MANTIS [3], SKINNY [3], PRESENT [24], Prince [25], Marvin [26], Piccolo [27], and Lblock [28]) in Table 1.Table 1
RTO and MTO of well-known S-boxes.
AlgorithmS-boxRTOMTOPride [21]048F15E927ACBD632.4666673.133333Midori [22]CAD3EBF7891502462.1666673.066667Gift [23]1A4C6F392DB7508E2.2000003.066667MANTIS [3]CAD3EBF7891502462.1666673.066667SKINNY [3]C6901A2B385D4E7F2.5666673.333333PRESENT [24]C56B90AD3EF847122.4666673.266667Prince [25]BF32AC916780E5D42.3333333.200000Marvin [26]021B83ED46F5C79A2.6666673.200000Piccolo [27]E4B238091A7F6C5D2.5666673.200000Lblock [28]E9F0D4AB128376C52.5666673.3333334BE9FD0A7C5628132.5666673.3333331E7CFD06B593248A2.5666673.333333768B0F3E9ACD52412.5666673.333333E5F072CD1849BA632.5666673.3333332DBCFE097A6318452.5666673.333333B94E0FAD6C5738122.5666673.333333DAF0E49B218375C62.5666673.33333387E5FD06BC9A24132.5666673.333333B5F0729D481CEA362.5666673.333333The data in Table1 show that RTO≤MTO for a given S-box. This is consistent with Theorem 1.


### 5.2. TheMTO of 16 Optimal 4,4 S-Boxes

In 2007, Leander et al. gave 16 different optimal balanced (4,4) S-boxes based on affine equivalence in [29]. The representatives of the truth table are given in Table 2.Table 2
Representatives for 16 optimal4,4 S-boxes [29].
Class4,4 S-boxesG00, 1, 2, 13, 4, 7, 15, 6, 8, 11, 12, 9, 3, 14, 10, 5G10, 1, 2, 13, 4, 7, 15, 6, 8, 11, 14, 3, 5, 9, 10, 12G20, 1, 2, 13, 4, 7, 15, 6, 8, 11, 14, 3, 10, 12, 5, 9G30, 1, 2, 13, 4, 7, 15, 6, 8, 12, 5, 3, 10, 14, 11, 9G40, 1, 2, 13, 4, 7, 15, 6, 8, 12, 9, 11, 10, 14, 5, 3G50, 1, 2, 13, 4, 7, 15, 6, 8, 12, 11, 9, 10, 14, 3, 5G60, 1, 2, 13, 4, 7, 15, 6, 8, 12, 11, 9, 10, 14, 5, 3G70, 1, 2, 13, 4, 7, 15, 6, 8, 12, 14, 11, 10, 9, 3, 5G80, 1, 2, 13, 4, 7, 15, 6, 8, 14, 9, 5, 10, 11, 3, 12G90, 1, 2, 13, 4, 7, 15, 6, 8, 14, 11, 3, 5, 9, 10, 12G100, 1, 2, 13, 4, 7, 15, 6, 8, 14, 11, 5, 10, 9, 3, 12G110, 1, 2, 13, 4, 7, 15, 6, 8, 14, 11, 10, 5, 9, 12, 3G120, 1, 2, 13, 4, 7, 15, 6, 8, 14, 11, 10, 9, 3, 12, 5G130, 1, 2, 13, 4, 7, 15, 6, 8, 14, 12, 9, 5, 11, 10, 3G140, 1, 2, 13, 4, 7, 15, 6, 8, 14, 12, 11, 3, 9, 5, 10G150, 1, 2, 13, 4, 7, 15, 6, 8, 14, 12, 11, 9, 3, 10, 5By Proposition 3 in [13], we know that MTO means affine invariant only under certain affine transformations which are based on S2x=S1A∘x⊕c⊕d, where S1,S2 are two n,n S-boxes, and A is an invertible n×n matrix, c,d∈F2n. This means that MTO may change under the different affine transformations S2x=A∘S1x, and we only consider this case in the following. From the finite field, we know that the number of the invertible n×n matrix in Fq is qnn−1/2∏i=1nqi−1. Thus, the number of the invertible 4×4 matrix in F2 is 20160, i.e., the number of the affine S-boxes (A∘G) of one S-boxes (G) is 20160, where G is a 4-bit S-box and A is an invertible 4×4 matrix.At the same time, bounds and the frequency distribution ofMTO are given for all affine transformations of 16 optimal classes in [13]. But from these data, we cannot find out what the distribution of Gi, i=0,1,…,15 is, and how many s boxes there are in each distribution value. For example, in the algorithm design, we want to know the exact value of MTO, not the range of MTO in [13]. Therefore, we need to give specific data values for every Gi (i=0,1,…,15), and Tables 3–6 provide support for us to select S-box. Meanwhile, these data further improve the data in [13].Table 3
The value ofMTO for A∘Gi.
ClassMTO (A∘Gi)NumberG02.6, 2.866667, 2.933333, 3.0, 3.066667, 3.133333, 3.2, 3.266667, 3.333333, 3.466667, 3.53333311G12.6, 2.866667, 2.933333, 3.0, 3.066667, 3.133333, 3.2, 3.266667, 3.333333, 3.466667, 3.53333311G22.866667, 2.933333, 3.0, 3.066667, 3.133333, 3.2, 3.266667, 3.333333, 3.466667, 3.53333310G33.133333, 3.2, 3.266667, 3.3333334G42.933333, 3.0, 3.066667, 3.133333, 3.2, 3.266667, 3.333333, 3.466667, 3.5333339G53.066667, 3.133333, 3.2, 3.266667, 3.333333, 3.466667, 3.5333337G63.0, 3.066667, 3.133333, 3.2, 3.266667, 3.333333, 3.466667, 3.5333338G72.933333, 3.0, 3.066667, 3.133333, 3.200000, 3.266667, 3.333333, 3.466667, 3.5333339G82.6, 2.866667, 2.933333, 3.0, 3.066667, 3.133333, 3.2, 3.266667, 3.333333, 3.466667, 3.53333311G92.933333, 3.0, 3.066667, 3.133333, 3.2, 3.266667, 3.333333, 3.466667, 3.5333339G102.933333, 3.0, 3.066667, 3.133333, 3.2, 3.266667, 3.333333, 3.466667, 3.5333339G112.933333, 3.066667, 3.133333, 3.2, 3.266667, 3.333333, 3.466667, 3.5333338G123.066667, 3.133333, 3.2, 3.266667, 3.333333, 3.466667, 3.5333337G132.933333, 3.0, 3.066667, 3.133333, 3.2, 3.266667, 3.333333, 3.466667, 3.5333339G142.933333, 3.0, 3.066667, 3.133333, 3.2, 3.266667, 3.333333, 3.466667, 3.5333339G152.6, 2.866667, 2.933333, 3.0, 3.066667, 3.133333, 3.2, 3.266667, 3.333333, 3.466667, 3.53333311Table 4
MTO of affine equivalent S-boxes of 16 optimal 4,4 S-boxes.
ClassMTO (Gi)Minimum ofMTO (A∘Gi)Maximum ofMTO (A∘Gi)MeanVarianceG03.2666672.6000003.5333333.2003170.021143G13.3333332.6000003.5333333.2138100.018169G23.3333332.8666673.5333333.2057140.015205G33.3333333.1333333.5333333.2297620.007448G43.4666672.9333333.5333333.2487300.013192G53.3333333.0666673.5333333.2595240.010838G63.3333333.0000003.5333333.2583330.011618G73.2666672.9333333.5333333.2579360.014580G83.2666672.6000003.5333333.1957140.018617G93.3333332.9333333.5333333.2458730.014255G103.2666672.9333333.5333333.2460320.014029G113.3333332.9333333.5333333.2642860.013222G123.4666673.0666673.5333333.2559520.013404G133.3333332.9333333.5333333.2610320.012915G143.2666672.9333333.5333333.2430160.012393G153.3333332.6000003.5333333.2419840.015301Table 5
Distribution ofMTO of affine equivalent S-boxes of G0.
ClassMTO (A∘G0)NumberPer%12.600000960.47619022.8666671440.71428632.9333338164.04761943.00000014407.14285753.06666711525.71428663.133333412820.47619073.200000508825.23809583.266667369618.33333393.33333316808.333333103.4666679604.761905113.5333339604.761905Table 6
Distribution ofMTO of affine equivalent S-boxes of G3.
ClassMTO (A∘G3)NumberPer%13.133333720035.71428623.200000396019.64285733.26666718008.92857143.333333720035.714286In Table3, we calculate MTO of 20160 S-boxes A∘Gi for Gi0≤i≤15. We find the following facts:(1)
TheMTO of A∘Gi has 11 values, if i=0,1,8,15.(2)
TheMTO of A∘Gi has 10 values, if i=2.(3)
TheMTO of A∘Gi has 9 values, if i=4,7,9,10,13,14.(4)
TheMTO of A∘Gi has 8 values, if i=6,11.(5)
TheMTO of A∘Gi has 7 values, if i=5,12.(6)
TheMTO of A∘Gi has 4 values, if i=3.Furthermore, we give the corresponding mean and variance in each optimal class in Table4.The mean value ofMTO for A∘Gi (i=0,1,2,…,15) belongs to the range of [3.195714, 3.264286], and the variance belongs to range of [0.007448, 0.021143]. The distribution of its value is concentrated in a relatively small interval.Especially, we get the detailed distribution ofMTO of A°G0 and A°G3 in Tables 5 and 6, respectively. The calculation results of other Gii=1,2,4,5,…,15 are similar to Table 5, which is ignored due to the limited length of this paper.


### 5.3. TheRTO and MTO of 302 Affine Equivalent 4,4 S-Boxes

There are 302 affine equivalence classes of 4-bit S-boxes [30]. We compute MTO and RTO of all 302 S-boxes of size 4×4. Our simulations show that the modified transparency order is confined within the range 2.666667≤MTOF≤3.533333, but 0≤RTOF≤2.766667 in Table 7–9. We summarize the comparison of modified transparency order and the redefined transparency order in Tables 7–9 and find that MTO≥RTO, and these data show that Theorem 1 is correct.Table 7
Comparison ofRTO and MTO of 4,4 S-boxes (III).
RTONumberMTONumber2.63333392.86666722.93333323.06666733.13333313.20000012.66666772.66666722.93333333.06666713.20000012.70000013.20000012.73333313.33333312.76666713.4666671Table 8
Comparison ofRTO and MTO of 4,4 S-boxes (I).
RTONumberMTONumber0.00000013.26666710.46666713.46666710.80000013.26666711.06666713.06666711.13333313.46666711.26666713.33333311.33333333.13333313.26666721.40000013.46666711.53333313.46666711.60000013.46666711.73333323.26666713.46666711.80000043.13333313.26666713.33333313.46666711.83333313.13333311.86666753.13333313.26666723.46666721.90000013.33333311.93333383.13333323.20000023.26666713.33333323.53333311.96666733.20000013.26666713.46666712.00000023.26666713.33333312.03333313.20000012.06666733.13333323.26666712.10000023.26666713.46666712.13333363.13333323.20000013.26666713.33333313.46666712.16666723.33333313.46666712.20000023.13333313.46666712.23333313.13333312.26666763.06666713.33333333.46666722.30000053.13333313.20000013.4666673Table 9
Comparison ofRTO and MTO of 4,4 S-boxes (II).
RTONumberMTONumber2.333333223.06666743.13333323.20000023.26666723.33333373.46666752.366667153.06666713.13333323.20000023.26666763.33333333.46666712.400000223.06666713.13333323.20000043.26666753.33333343.46666762.433333213.06666713.13333323.20000033.26666763.33333323.46666763.53333312.466667303.06666723.133333103.20000063.26666743.33333353.46666723.53333312.500000313.06666753.133333103.20000053.26666753.33333333.46666732.533333303.06666763.13333373.20000033.26666743.33333353.46666752.566667263.06666773.133333113.20000053.26666723.33333312.600000202.93333313.06666773.13333393.20000023.2666671Remark 7.
In Table10, the number of affine equivalence classes whose modified transparency order lies in the range MTO4,4=3.066667,3.466667 is equal to 287=40+69+40+49+41+47, which corresponds to about 95.03% of their total number. This simply means that for a randomly selected 4,4 S-box, the probability that its transparency order is in the range MTO4,4 is approximately 95.03%, which is quite high. This again questions the whole idea of embedding the protection against DPA attacks directly in the design of S-boxes, since a more natural option is to implement such a protection through some masking technique.Table 10
Distribution ofMTO of 4,4 S-boxes.
MTONumberPer%2.66666751.6562.86666720.6622.93333361.9873.0666674013.2453.1333336922.8483.2000004013.2453.2666674916.2253.3333334113.5763.4666674715.5633.53333330.993


## 5.1.RTO and MTO of Some Known S-Boxes in Well-Known Encryption Algorithms

We give theRTO and MTO of S-boxes in some well-known encryption algorithms (such as Pride [21], Midori [22], Gift [23], MANTIS [3], SKINNY [3], PRESENT [24], Prince [25], Marvin [26], Piccolo [27], and Lblock [28]) in Table 1.Table 1
RTO and MTO of well-known S-boxes.
AlgorithmS-boxRTOMTOPride [21]048F15E927ACBD632.4666673.133333Midori [22]CAD3EBF7891502462.1666673.066667Gift [23]1A4C6F392DB7508E2.2000003.066667MANTIS [3]CAD3EBF7891502462.1666673.066667SKINNY [3]C6901A2B385D4E7F2.5666673.333333PRESENT [24]C56B90AD3EF847122.4666673.266667Prince [25]BF32AC916780E5D42.3333333.200000Marvin [26]021B83ED46F5C79A2.6666673.200000Piccolo [27]E4B238091A7F6C5D2.5666673.200000Lblock [28]E9F0D4AB128376C52.5666673.3333334BE9FD0A7C5628132.5666673.3333331E7CFD06B593248A2.5666673.333333768B0F3E9ACD52412.5666673.333333E5F072CD1849BA632.5666673.3333332DBCFE097A6318452.5666673.333333B94E0FAD6C5738122.5666673.333333DAF0E49B218375C62.5666673.33333387E5FD06BC9A24132.5666673.333333B5F0729D481CEA362.5666673.333333The data in Table1 show that RTO≤MTO for a given S-box. This is consistent with Theorem 1.


## 5.2. TheMTO of 16 Optimal 4,4 S-Boxes

In 2007, Leander et al. gave 16 different optimal balanced (4,4) S-boxes based on affine equivalence in [29]. The representatives of the truth table are given in Table 2.Table 2
Representatives for 16 optimal4,4 S-boxes [29].
Class4,4 S-boxesG00, 1, 2, 13, 4, 7, 15, 6, 8, 11, 12, 9, 3, 14, 10, 5G10, 1, 2, 13, 4, 7, 15, 6, 8, 11, 14, 3, 5, 9, 10, 12G20, 1, 2, 13, 4, 7, 15, 6, 8, 11, 14, 3, 10, 12, 5, 9G30, 1, 2, 13, 4, 7, 15, 6, 8, 12, 5, 3, 10, 14, 11, 9G40, 1, 2, 13, 4, 7, 15, 6, 8, 12, 9, 11, 10, 14, 5, 3G50, 1, 2, 13, 4, 7, 15, 6, 8, 12, 11, 9, 10, 14, 3, 5G60, 1, 2, 13, 4, 7, 15, 6, 8, 12, 11, 9, 10, 14, 5, 3G70, 1, 2, 13, 4, 7, 15, 6, 8, 12, 14, 11, 10, 9, 3, 5G80, 1, 2, 13, 4, 7, 15, 6, 8, 14, 9, 5, 10, 11, 3, 12G90, 1, 2, 13, 4, 7, 15, 6, 8, 14, 11, 3, 5, 9, 10, 12G100, 1, 2, 13, 4, 7, 15, 6, 8, 14, 11, 5, 10, 9, 3, 12G110, 1, 2, 13, 4, 7, 15, 6, 8, 14, 11, 10, 5, 9, 12, 3G120, 1, 2, 13, 4, 7, 15, 6, 8, 14, 11, 10, 9, 3, 12, 5G130, 1, 2, 13, 4, 7, 15, 6, 8, 14, 12, 9, 5, 11, 10, 3G140, 1, 2, 13, 4, 7, 15, 6, 8, 14, 12, 11, 3, 9, 5, 10G150, 1, 2, 13, 4, 7, 15, 6, 8, 14, 12, 11, 9, 3, 10, 5By Proposition 3 in [13], we know that MTO means affine invariant only under certain affine transformations which are based on S2x=S1A∘x⊕c⊕d, where S1,S2 are two n,n S-boxes, and A is an invertible n×n matrix, c,d∈F2n. This means that MTO may change under the different affine transformations S2x=A∘S1x, and we only consider this case in the following. From the finite field, we know that the number of the invertible n×n matrix in Fq is qnn−1/2∏i=1nqi−1. Thus, the number of the invertible 4×4 matrix in F2 is 20160, i.e., the number of the affine S-boxes (A∘G) of one S-boxes (G) is 20160, where G is a 4-bit S-box and A is an invertible 4×4 matrix.At the same time, bounds and the frequency distribution ofMTO are given for all affine transformations of 16 optimal classes in [13]. But from these data, we cannot find out what the distribution of Gi, i=0,1,…,15 is, and how many s boxes there are in each distribution value. For example, in the algorithm design, we want to know the exact value of MTO, not the range of MTO in [13]. Therefore, we need to give specific data values for every Gi (i=0,1,…,15), and Tables 3–6 provide support for us to select S-box. Meanwhile, these data further improve the data in [13].Table 3
The value ofMTO for A∘Gi.
ClassMTO (A∘Gi)NumberG02.6, 2.866667, 2.933333, 3.0, 3.066667, 3.133333, 3.2, 3.266667, 3.333333, 3.466667, 3.53333311G12.6, 2.866667, 2.933333, 3.0, 3.066667, 3.133333, 3.2, 3.266667, 3.333333, 3.466667, 3.53333311G22.866667, 2.933333, 3.0, 3.066667, 3.133333, 3.2, 3.266667, 3.333333, 3.466667, 3.53333310G33.133333, 3.2, 3.266667, 3.3333334G42.933333, 3.0, 3.066667, 3.133333, 3.2, 3.266667, 3.333333, 3.466667, 3.5333339G53.066667, 3.133333, 3.2, 3.266667, 3.333333, 3.466667, 3.5333337G63.0, 3.066667, 3.133333, 3.2, 3.266667, 3.333333, 3.466667, 3.5333338G72.933333, 3.0, 3.066667, 3.133333, 3.200000, 3.266667, 3.333333, 3.466667, 3.5333339G82.6, 2.866667, 2.933333, 3.0, 3.066667, 3.133333, 3.2, 3.266667, 3.333333, 3.466667, 3.53333311G92.933333, 3.0, 3.066667, 3.133333, 3.2, 3.266667, 3.333333, 3.466667, 3.5333339G102.933333, 3.0, 3.066667, 3.133333, 3.2, 3.266667, 3.333333, 3.466667, 3.5333339G112.933333, 3.066667, 3.133333, 3.2, 3.266667, 3.333333, 3.466667, 3.5333338G123.066667, 3.133333, 3.2, 3.266667, 3.333333, 3.466667, 3.5333337G132.933333, 3.0, 3.066667, 3.133333, 3.2, 3.266667, 3.333333, 3.466667, 3.5333339G142.933333, 3.0, 3.066667, 3.133333, 3.2, 3.266667, 3.333333, 3.466667, 3.5333339G152.6, 2.866667, 2.933333, 3.0, 3.066667, 3.133333, 3.2, 3.266667, 3.333333, 3.466667, 3.53333311Table 4
MTO of affine equivalent S-boxes of 16 optimal 4,4 S-boxes.
ClassMTO (Gi)Minimum ofMTO (A∘Gi)Maximum ofMTO (A∘Gi)MeanVarianceG03.2666672.6000003.5333333.2003170.021143G13.3333332.6000003.5333333.2138100.018169G23.3333332.8666673.5333333.2057140.015205G33.3333333.1333333.5333333.2297620.007448G43.4666672.9333333.5333333.2487300.013192G53.3333333.0666673.5333333.2595240.010838G63.3333333.0000003.5333333.2583330.011618G73.2666672.9333333.5333333.2579360.014580G83.2666672.6000003.5333333.1957140.018617G93.3333332.9333333.5333333.2458730.014255G103.2666672.9333333.5333333.2460320.014029G113.3333332.9333333.5333333.2642860.013222G123.4666673.0666673.5333333.2559520.013404G133.3333332.9333333.5333333.2610320.012915G143.2666672.9333333.5333333.2430160.012393G153.3333332.6000003.5333333.2419840.015301Table 5
Distribution ofMTO of affine equivalent S-boxes of G0.
ClassMTO (A∘G0)NumberPer%12.600000960.47619022.8666671440.71428632.9333338164.04761943.00000014407.14285753.06666711525.71428663.133333412820.47619073.200000508825.23809583.266667369618.33333393.33333316808.333333103.4666679604.761905113.5333339604.761905Table 6
Distribution ofMTO of affine equivalent S-boxes of G3.
ClassMTO (A∘G3)NumberPer%13.133333720035.71428623.200000396019.64285733.26666718008.92857143.333333720035.714286In Table3, we calculate MTO of 20160 S-boxes A∘Gi for Gi0≤i≤15. We find the following facts:(1)
TheMTO of A∘Gi has 11 values, if i=0,1,8,15.(2)
TheMTO of A∘Gi has 10 values, if i=2.(3)
TheMTO of A∘Gi has 9 values, if i=4,7,9,10,13,14.(4)
TheMTO of A∘Gi has 8 values, if i=6,11.(5)
TheMTO of A∘Gi has 7 values, if i=5,12.(6)
TheMTO of A∘Gi has 4 values, if i=3.Furthermore, we give the corresponding mean and variance in each optimal class in Table4.The mean value ofMTO for A∘Gi (i=0,1,2,…,15) belongs to the range of [3.195714, 3.264286], and the variance belongs to range of [0.007448, 0.021143]. The distribution of its value is concentrated in a relatively small interval.Especially, we get the detailed distribution ofMTO of A°G0 and A°G3 in Tables 5 and 6, respectively. The calculation results of other Gii=1,2,4,5,…,15 are similar to Table 5, which is ignored due to the limited length of this paper.


## 5.3. TheRTO and MTO of 302 Affine Equivalent 4,4 S-Boxes

There are 302 affine equivalence classes of 4-bit S-boxes [30]. We compute MTO and RTO of all 302 S-boxes of size 4×4. Our simulations show that the modified transparency order is confined within the range 2.666667≤MTOF≤3.533333, but 0≤RTOF≤2.766667 in Table 7–9. We summarize the comparison of modified transparency order and the redefined transparency order in Tables 7–9 and find that MTO≥RTO, and these data show that Theorem 1 is correct.Table 7
Comparison ofRTO and MTO of 4,4 S-boxes (III).
RTONumberMTONumber2.63333392.86666722.93333323.06666733.13333313.20000012.66666772.66666722.93333333.06666713.20000012.70000013.20000012.73333313.33333312.76666713.4666671Table 8
Comparison ofRTO and MTO of 4,4 S-boxes (I).
RTONumberMTONumber0.00000013.26666710.46666713.46666710.80000013.26666711.06666713.06666711.13333313.46666711.26666713.33333311.33333333.13333313.26666721.40000013.46666711.53333313.46666711.60000013.46666711.73333323.26666713.46666711.80000043.13333313.26666713.33333313.46666711.83333313.13333311.86666753.13333313.26666723.46666721.90000013.33333311.93333383.13333323.20000023.26666713.33333323.53333311.96666733.20000013.26666713.46666712.00000023.26666713.33333312.03333313.20000012.06666733.13333323.26666712.10000023.26666713.46666712.13333363.13333323.20000013.26666713.33333313.46666712.16666723.33333313.46666712.20000023.13333313.46666712.23333313.13333312.26666763.06666713.33333333.46666722.30000053.13333313.20000013.4666673Table 9
Comparison ofRTO and MTO of 4,4 S-boxes (II).
RTONumberMTONumber2.333333223.06666743.13333323.20000023.26666723.33333373.46666752.366667153.06666713.13333323.20000023.26666763.33333333.46666712.400000223.06666713.13333323.20000043.26666753.33333343.46666762.433333213.06666713.13333323.20000033.26666763.33333323.46666763.53333312.466667303.06666723.133333103.20000063.26666743.33333353.46666723.53333312.500000313.06666753.133333103.20000053.26666753.33333333.46666732.533333303.06666763.13333373.20000033.26666743.33333353.46666752.566667263.06666773.133333113.20000053.26666723.33333312.600000202.93333313.06666773.13333393.20000023.2666671Remark 7.
In Table10, the number of affine equivalence classes whose modified transparency order lies in the range MTO4,4=3.066667,3.466667 is equal to 287=40+69+40+49+41+47, which corresponds to about 95.03% of their total number. This simply means that for a randomly selected 4,4 S-box, the probability that its transparency order is in the range MTO4,4 is approximately 95.03%, which is quite high. This again questions the whole idea of embedding the protection against DPA attacks directly in the design of S-boxes, since a more natural option is to implement such a protection through some masking technique.Table 10
Distribution ofMTO of 4,4 S-boxes.
MTONumberPer%2.66666751.6562.86666720.6622.93333361.9873.0666674013.2453.1333336922.8483.2000004013.2453.2666674916.2253.3333334113.5763.4666674715.5633.53333330.993


## 6. Conclusion

This paper further studies some unresolved problems related to the modified transparency order forn,m-functions. Our result implies that RTO is less than or equal to MTO for any n,m-function. In addition, a useful characterization of the modified transparency order is derived in terms of its tight bounds and its relation to other important cryptographic properties. These results show that the smaller the sum-of-squares indicator (or the nonlinearity and the algebraic immunity) of its coordinate, the bigger the modified transparency order. Although some results of MTO have been given in this paper, there are still few studies on MTO. The design of n,m-functions with small modified transparent order and good cryptographic indicators remains an open problem. At the same time, we will focus on the experimental verification of 8,8-functions for differential power attack and investigate the relationship between transparency order and confusion coefficient.



---

*Source: 6640099-2021-08-03.xml*