This paper proposed a new attack on the initial white-box AES implementation of Chow et al.

In order to determine the good solution, we use the particular structure of the function $S_{0}$.

$S^{-1} \circ S_{0} \left( \cdot \right) = P_{0}\left( \cdot \right)\oplus k_{0} $

By definition of $P_{0}$, the above function has algebraic degree at most 4.

According to this paper, $P_{0}$ denotes bijective mapping on the vector space $\mathbb{F}_{2}^{8}$, which is the combination of two 4-bit input encodings and one 8 $\times $ 8-bit mixing bijection.

Given the next proposed Lemma 2 in this paper, I know the algebraic degree is about boolean function, then I study the boolean function and high-order derivations of Lai 1994.

But I still can't understand why the algebraic degree at most 4 by definition of $P_{0}$?



Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy