One issue that may arise when attempting to evaluate the security of a round function for a block cipher is that the analysis of the round function does not treat the round key space and the message space as merely sets but as more sophisticated structures. For example, if the message space is $\{0,1\}^{n}$, then the message space has extra mathematical structure since $\{0,1\}^{n}$ is always a Boolean algebra. Furthermore, the round function may not be treated as simply a function but as a circuit used to compute a function. This may be a problem since a block cipher may appear to be more or less secure than it really is simply because such a block cipher has been evaluated in the context of the additional structure on the round key space and the message space.
In what ways can one evaluate the round function of a block cipher while treating the round key space and message space as simply sets without any additional mathematical structure except for the round function itself?
Let $K,X$ be finite sets. Let $F:K\times X\rightarrow X$ be a function, and if $k\in K$, then let $F_{k}:X\rightarrow X$ be the function defined by $F_{k}(x)=F(k,x)$ whenever $x\in X$. Suppose that each $F_{k}$ is a bijection. Then we shall say that $F$ is a block cipher round function.
Suppose that $F_{i}:K_{i}\times X_{i}\rightarrow X_{i}$ is a block cipher round function for $i\in\{1,2\}$. Suppose that $\phi:K_{1}\rightarrow K_{2},\psi:X_{1}\rightarrow X_{2}$ are bijections. Then we say that $(\phi,\psi)$ is an isomorphism from $F_{1}$ to $F_{2}$ if $\psi(F_{1}(k,x))=F_{2}(\phi(k),\psi(x))$ whenever $k\in K_{1},x\in X_{1}$, and we say that $F_{1}$ and $F_{2}$ are isomorphic if there is some isomorphism from $F_{1}$ to $F_{2}$. We shall say that a function $M$ is round function invariant parameter if $M(F)=M(G)$ whenever $F,G$ are isomorphic block cipher round functions.
A round function invariant parameter $M$ is said to be an objective measure of security if $M(F)\in[-\infty,\infty]$ for each round function $F$ and where a higher value of $M(F)$ suggests that the round function $F$ is more secure.
What objective measures of security have been evaluated or estimated for modern round functions? Have any of these objective measures of security been taken into consideration when evaluating the cryptographic security of block ciphers, cryptographic hash functions, or other cryptographic objects (such as in the NIST cryptographic competitions)?
For this post, I am interested not only in block ciphers that are used for symmetric encryption but also in block ciphers that are used for other purposes such as constructing cryptographic hash functions using the Davies-Meyer construction.
Example
In some cases, one can recover some of the mathematical structure on $K,X$ from the round function $F$ and use this additional structure to obtain round function invariant parameters.
Suppose that $K,X$ are vector spaces over the field $F_{p}$ with $p$ elements for some prime $p$. Suppose that $\iota:K\rightarrow X$ is a vector space isomorphism. Let $P:X\rightarrow X$ be a permutation, and suppose that $F:K\times X\rightarrow X$ is the block cipher round function defined by letting $F(k,x)=\iota(k)+P(x)$. Define ternary operations $L,M$ on the sets $K,X$ such that $L(j,k,l)=j-k+l$ whenever $j,k,l\in K$ and $M(x,y,z)=x-y+z$ whenever $x,y,z\in M$. Then the operations $L,M$ are first order definable in the two sorted structure $(K,X,F)$. The operations $L,M$ should be thought of as operations that are similar to vector space operations but where the spaces $(K,L),(X,M)$ do not have a defined basepoint that one can set to be the origin.
Now, suppose that $s$ is a positive integer. To make our construction more convenient, suppose that $\dim(K)=\dim(X)=p^{N}-1$. Now, let $V$ be a uniform randomly selected $N$-dimensional affine subspace of $X$, and let $k_{1},\dots,k_{u}$ be uniform randomly selected elements of $K$. Then define $$\mathcal{R}_{s}=\dim(\{F_{k_{1}}\circ\dots\circ F_{k_{u}}(v)\mid v\in V\}).$$
One can therefore define a round function invariant parameter $M_{s}$ so that $M_{s}(F)=E(\mathcal{R}_{s})$ (and one can set $M_{s}(F)=0$ whenever the random variable $\mathcal{R}_{s}$ does not make sense for the block cipher round function $F$). Here a higher value of $M_{s}(F)$ suggests a higher level of non-linearity and cryptographic security for the block cipher round function $F$. One can define many other similar round function invariant parameters $N$ so that $N(F)$ is a measure of the non-linearity of the block cipher round function $F$.