Английская Википедия:Branch number

Содержание

Текст

Текст

Текст

Текст

Текст

Текст

Текст

Текст

Текст

In cryptography, the branch number is a numerical value that characterizes the amount of diffusion introduced by a vectorial Boolean function Шаблон:Mvar that maps an input vector Шаблон:Mvar to output vector <math>F(a)</math>. For the (usualШаблон:Sfn) case of a linear Шаблон:Mvar the value of the differential branch number is produced by:

1. applying nonzero values of Шаблон:Mvar (i.e., values that have at least one non-zero component of the vector) to the input of Шаблон:Mvar;
2. calculating for each input value Шаблон:Mvar the Hamming weight <math>W</math> (number of nonzero components), and adding weights <math>W(a)</math> and <math>W(F(a))</math> together;
3. selecting the smallest combined weight across for all nonzero input values: <math>B_d(F) = \underset {a \ne 0} {\min} (W(a) + W(F(a)))</math>.

If both Шаблон:Mvar and <math>F(a)</math> have Шаблон:Mvar components, the result is obviously limited on the high side by the value <math>s+1</math> (this "perfect" result is achieved when any single nonzero component in Шаблон:Mvar makes all components of <math>F(a)</math> to be non-zero). A high branch number suggests higher resistance to the differential cryptanalysis: the small variations of input will produce large changes on the output and in order to obtain small variations of the output, large changes of the input value will be required.Шаблон:Sfn

The term was introduced by Daemen and Rijmen in early 2000s and quickly became a typical tool to assess the diffusion properties of the transformations.Шаблон:Sfn

Mathematics

The branch number concept is not limited to the linear transformations, Daemen and Rijmen provided two general metrics:Шаблон:Sfn

• differential branch number, where the minimum is obtained over inputs of Шаблон:Mvar that are constructed by independently sweeping all the values of two nonzero and unequal vectors Шаблон:Mvar, Шаблон:Mvar (<math>\oplus</math> is a component-by-component exclusive-or): <math>B_d(F) = \underset {a \ne b} {\min} (W(a \oplus b) + W(F(a) \oplus F(b))</math>;
• for linear branch number, the independent candidates <math>\alpha</math> and <math>\beta</math> are independently swept; they should be nonzero and correlated with respect to Шаблон:Mvar (the <math>LAT(\alpha,\beta)</math> coefficient of the linear approximation table of Шаблон:Mvar should be nonzero): <math>B_l(F) = \underset {\alpha \ne 0,\beta,LAT(\alpha,\beta) \ne 0} {\min} (W(\alpha) + W(\beta))</math>.

Sources

• Шаблон:Cite book
• Шаблон:Cite book
• Шаблон:Cite book