Cryptographic Boolean Functions in Lean

3.7. Algebraic immunity🔗

Definition3.7.1
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 3
Statement dependency previews
Preview
Definition 1.1.2
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
Used by 11
Reverse dependency previews
Preview
Theorem 3.7.2
Loading preview
Reverse dependency preview content is loaded from the rendered-fragment cache.
L∃∀N

Annihilators and algebraic immunity (Carlet, pp. 61--62). Pointwise multiplication satisfies \operatorname{supp}(fg) =\operatorname{supp}(f)\cap\operatorname{supp}(g). A nonzero g with fg=0 is an annihilator of f; all such annihilators together with zero form the ideal of multiples of f+1. Define \operatorname{AI}(f)= \min\{\deg(g):g\ne0,\ fg=0\text{ or }(f+1)g=0\}. Algebraic immunity is invariant under affine equivalence.

Lean code for Definition3.7.118 declarations
  • theoremdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunity.lean
    complete
    theorem CryptBoolean.support_mul {n : }
      (f g : CryptBoolean.BooleanFunction n) :
      CryptBoolean.support (f * g) =
        CryptBoolean.support f  CryptBoolean.support g
    theorem CryptBoolean.support_mul {n : }
      (f g : CryptBoolean.BooleanFunction n) :
      CryptBoolean.support (f * g) =
        CryptBoolean.support f 
          CryptBoolean.support g
    The support of a pointwise product is the intersection of the two supports. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunity.lean
    complete
    theorem CryptBoolean.booleanFunction_mul_self {n : }
      (f : CryptBoolean.BooleanFunction n) : f * f = f
    theorem CryptBoolean.booleanFunction_mul_self
      {n : }
      (f : CryptBoolean.BooleanFunction n) :
      f * f = f
    Every binary-valued function is idempotent under pointwise multiplication. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunity.lean
    complete
    theorem CryptBoolean.booleanFunction_mul_complement {n : }
      (f : CryptBoolean.BooleanFunction n) : f * (f + 1) = 0
    theorem CryptBoolean.booleanFunction_mul_complement
      {n : }
      (f : CryptBoolean.BooleanFunction n) :
      f * (f + 1) = 0
    A Boolean function and its complement have disjoint pointwise product. 
  • defdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunity.lean
    complete
    def CryptBoolean.IsAnnihilator {n : }
      (f g : CryptBoolean.BooleanFunction n) : Prop
    def CryptBoolean.IsAnnihilator {n : }
      (f g : CryptBoolean.BooleanFunction n) :
      Prop
    A nonzero Boolean function whose pointwise product with `f` vanishes. 
  • defdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunity.lean
    complete
    def CryptBoolean.annihilatorIdeal {n : }
      (f : CryptBoolean.BooleanFunction n) :
      Ideal (CryptBoolean.BooleanFunction n)
    def CryptBoolean.annihilatorIdeal {n : }
      (f : CryptBoolean.BooleanFunction n) :
      Ideal (CryptBoolean.BooleanFunction n)
    The ideal of all (possibly zero) annihilators of `f`, generated by its complement. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunity.lean
    complete
    theorem CryptBoolean.mem_annihilatorIdeal_iff {n : }
      (f g : CryptBoolean.BooleanFunction n) :
      g  CryptBoolean.annihilatorIdeal f  f * g = 0
    theorem CryptBoolean.mem_annihilatorIdeal_iff
      {n : }
      (f g : CryptBoolean.BooleanFunction n) :
      g  CryptBoolean.annihilatorIdeal f 
        f * g = 0
    Membership in the annihilator ideal is exactly vanishing of the pointwise product with `f`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunity.lean
    complete
    theorem CryptBoolean.isAnnihilator_iff_mem_annihilatorIdeal {n : }
      (f g : CryptBoolean.BooleanFunction n) :
      CryptBoolean.IsAnnihilator f g 
        g  0  g  CryptBoolean.annihilatorIdeal f
    theorem CryptBoolean.isAnnihilator_iff_mem_annihilatorIdeal
      {n : }
      (f g : CryptBoolean.BooleanFunction n) :
      CryptBoolean.IsAnnihilator f g 
        g  0 
          g  CryptBoolean.annihilatorIdeal f
    Nonzero elements of the annihilator ideal are precisely Carlet annihilators. 
  • defdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunity.lean
    complete
    def CryptBoolean.IsAlgebraicImmunityWitness {n : }
      (f g : CryptBoolean.BooleanFunction n) : Prop
    def CryptBoolean.IsAlgebraicImmunityWitness
      {n : }
      (f g : CryptBoolean.BooleanFunction n) :
      Prop
    A witness for algebraic immunity annihilates either `f` or its complement. 
  • defdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunity.lean
    complete
    def CryptBoolean.algebraicImmunityCandidates {n : }
      (f : CryptBoolean.BooleanFunction n) :
      Finset (CryptBoolean.BooleanFunction n)
    def CryptBoolean.algebraicImmunityCandidates
      {n : }
      (f : CryptBoolean.BooleanFunction n) :
      Finset (CryptBoolean.BooleanFunction n)
    The finite family over which algebraic immunity takes its minimum. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunity.lean
    complete
    theorem CryptBoolean.mem_algebraicImmunityCandidates {n : }
      (f g : CryptBoolean.BooleanFunction n) :
      g  CryptBoolean.algebraicImmunityCandidates f 
        CryptBoolean.IsAlgebraicImmunityWitness f g
    theorem CryptBoolean.mem_algebraicImmunityCandidates
      {n : }
      (f g : CryptBoolean.BooleanFunction n) :
      g 
          CryptBoolean.algebraicImmunityCandidates
            f 
        CryptBoolean.IsAlgebraicImmunityWitness
          f g
    Membership in the candidate family is the defining annihilator disjunction. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunity.lean
    complete
    theorem CryptBoolean.algebraicImmunityCandidates_nonempty {n : }
      (f : CryptBoolean.BooleanFunction n) :
      (CryptBoolean.algebraicImmunityCandidates f).Nonempty
    theorem CryptBoolean.algebraicImmunityCandidates_nonempty
      {n : }
      (f : CryptBoolean.BooleanFunction n) :
      (CryptBoolean.algebraicImmunityCandidates
          f).Nonempty
    Every Boolean function has a nonzero annihilator on one side of the complement pair. 
  • defdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunity.lean
    complete
    def CryptBoolean.algebraicImmunity {n : }
      (f : CryptBoolean.BooleanFunction n) : 
    def CryptBoolean.algebraicImmunity {n : }
      (f : CryptBoolean.BooleanFunction n) : 
    Algebraic immunity is the least algebraic degree of a nonzero annihilator of `f` or `f+1`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunity.lean
    complete
    theorem CryptBoolean.algebraicImmunity_le_functionAlgebraicDegree {n : }
      (f g : CryptBoolean.BooleanFunction n)
      (hg : CryptBoolean.IsAlgebraicImmunityWitness f g) :
      CryptBoolean.algebraicImmunity f  FABL.functionAlgebraicDegree g
    theorem CryptBoolean.algebraicImmunity_le_functionAlgebraicDegree
      {n : }
      (f g : CryptBoolean.BooleanFunction n)
      (hg :
        CryptBoolean.IsAlgebraicImmunityWitness
          f g) :
      CryptBoolean.algebraicImmunity f 
        FABL.functionAlgebraicDegree g
    Algebraic immunity is bounded by the degree of every annihilator witness. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunity.lean
    complete
    theorem CryptBoolean.exists_witness_functionAlgebraicDegree_eq_algebraicImmunity
      {n : } (f : CryptBoolean.BooleanFunction n) :
       g,
        CryptBoolean.IsAlgebraicImmunityWitness f g 
          FABL.functionAlgebraicDegree g = CryptBoolean.algebraicImmunity f
    theorem CryptBoolean.exists_witness_functionAlgebraicDegree_eq_algebraicImmunity
      {n : }
      (f : CryptBoolean.BooleanFunction n) :
       g,
        CryptBoolean.IsAlgebraicImmunityWitness
            f g 
          FABL.functionAlgebraicDegree g =
            CryptBoolean.algebraicImmunity f
    The finite witness family contains an annihilator attaining algebraic immunity. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunity.lean
    complete
    theorem CryptBoolean.IsAnnihilator.comp_affineEquiv {n : }
      {f g : CryptBoolean.BooleanFunction n}
      (h : CryptBoolean.IsAnnihilator f g)
      (L : FABL.F₂Cube n ≃ᵃ[FABL.𝔽₂] FABL.F₂Cube n) :
      CryptBoolean.IsAnnihilator (f  L) (g  L)
    theorem CryptBoolean.IsAnnihilator.comp_affineEquiv
      {n : }
      {f g : CryptBoolean.BooleanFunction n}
      (h : CryptBoolean.IsAnnihilator f g)
      (L :
        FABL.F₂Cube n ≃ᵃ[FABL.𝔽₂]
          FABL.F₂Cube n) :
      CryptBoolean.IsAnnihilator (f  L)
        (g  L)
    Affine input reindexing preserves the annihilator relation. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunity.lean
    complete
    theorem CryptBoolean.IsAlgebraicImmunityWitness.comp_affineEquiv {n : }
      {f g : CryptBoolean.BooleanFunction n}
      (h : CryptBoolean.IsAlgebraicImmunityWitness f g)
      (L : FABL.F₂Cube n ≃ᵃ[FABL.𝔽₂] FABL.F₂Cube n) :
      CryptBoolean.IsAlgebraicImmunityWitness (f  L) (g  L)
    theorem CryptBoolean.IsAlgebraicImmunityWitness.comp_affineEquiv
      {n : }
      {f g : CryptBoolean.BooleanFunction n}
      (h :
        CryptBoolean.IsAlgebraicImmunityWitness
          f g)
      (L :
        FABL.F₂Cube n ≃ᵃ[FABL.𝔽₂]
          FABL.F₂Cube n) :
      CryptBoolean.IsAlgebraicImmunityWitness
        (f  L) (g  L)
    Affine input reindexing transports algebraic-immunity witnesses. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunity.lean
    complete
    theorem CryptBoolean.algebraicImmunity_comp_affineEquiv_le {n : }
      (f : CryptBoolean.BooleanFunction n)
      (L : FABL.F₂Cube n ≃ᵃ[FABL.𝔽₂] FABL.F₂Cube n) :
      CryptBoolean.algebraicImmunity (f  L) 
        CryptBoolean.algebraicImmunity f
    theorem CryptBoolean.algebraicImmunity_comp_affineEquiv_le
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (L :
        FABL.F₂Cube n ≃ᵃ[FABL.𝔽₂]
          FABL.F₂Cube n) :
      CryptBoolean.algebraicImmunity
          (f  L) 
        CryptBoolean.algebraicImmunity f
    One half of affine invariance of algebraic immunity. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunity.lean
    complete
    theorem CryptBoolean.algebraicImmunity_comp_affineEquiv {n : }
      (f : CryptBoolean.BooleanFunction n)
      (L : FABL.F₂Cube n ≃ᵃ[FABL.𝔽₂] FABL.F₂Cube n) :
      CryptBoolean.algebraicImmunity (f  L) =
        CryptBoolean.algebraicImmunity f
    theorem CryptBoolean.algebraicImmunity_comp_affineEquiv
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (L :
        FABL.F₂Cube n ≃ᵃ[FABL.𝔽₂]
          FABL.F₂Cube n) :
      CryptBoolean.algebraicImmunity
          (f  L) =
        CryptBoolean.algebraicImmunity f
    Algebraic immunity is invariant under affine equivalence. 
Theorem3.7.2
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
uses 1used by 1L∃∀N

Low-degree relation equivalence (Carlet, p. 62). There exist g\ne0 and h such that fg=h, \qquad \deg(g)\le d, \qquad \deg(h)\le d if and only if there exists q\ne0 of degree at most d such that fq=0 or (f+1)q=0.

Lean code for Theorem3.7.21 theorem
  • theoremdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunity.lean
    complete
    theorem CryptBoolean.exists_lowDegreeRelation_iff_exists_algebraicImmunityWitness
      {n : } (f : CryptBoolean.BooleanFunction n) (d : ) :
      (∃ g h,
          g  0 
            FABL.functionAlgebraicDegree g  d 
              FABL.functionAlgebraicDegree h  d  f * g = h) 
         q,
          q  0 
            FABL.functionAlgebraicDegree q  d 
              (f * q = 0  (f + 1) * q = 0)
    theorem CryptBoolean.exists_lowDegreeRelation_iff_exists_algebraicImmunityWitness
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (d : ) :
      (∃ g h,
          g  0 
            FABL.functionAlgebraicDegree g 
                d 
              FABL.functionAlgebraicDegree h 
                  d 
                f * g = h) 
         q,
          q  0 
            FABL.functionAlgebraicDegree q 
                d 
              (f * q = 0  (f + 1) * q = 0)
    A nonzero low-degree relation `f*g=h` exists exactly when `f` or `f+1` has a nonzero
    annihilator of the same degree bound. 
Theorem3.7.3
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 3
Statement dependency previews
Preview
Definition 1.1.2
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
Used by 5
Reverse dependency previews
Preview
Theorem 3.7.4
Loading preview
Reverse dependency preview content is loaded from the rendered-fragment cache.
L∃∀N

Annihilator evaluation system (Carlet, p. 62). A function g of degree at most d annihilates f exactly when its low-degree ANF coefficient vector belongs to the kernel of evaluation on \operatorname{supp}(f). The homogeneous system has \sum_{i=0}^{d}\binom ni unknown coefficients and w_H(f) equations.

Lean code for Theorem3.7.36 declarations
  • defdefined in CryptBoolean/Carlet/Chapter03/ReedMuller.lean
    complete
    def CryptBoolean.extendLowDegreeCoefficients (r n : )
      (c : (FABL.lowDegreeFourierFamily n r)  FABL.𝔽₂) :
      FABL.ANFCoefficients n
    def CryptBoolean.extendLowDegreeCoefficients
      (r n : )
      (c :
        (FABL.lowDegreeFourierFamily n r) 
          FABL.𝔽₂) :
      FABL.ANFCoefficients n
    Extend a low-degree coefficient vector by zero to all square-free monomials. 
  • defdefined in CryptBoolean/Carlet/Chapter03/ReedMuller.lean
    complete
    def CryptBoolean.reedMullerAnfEquiv (r n : ) :
      (CryptBoolean.reedMuller r n) ≃ₗ[FABL.𝔽₂]
        (FABL.lowDegreeFourierFamily n r)  FABL.𝔽₂
    def CryptBoolean.reedMullerAnfEquiv
      (r n : ) :
      (CryptBoolean.reedMuller r
            n) ≃ₗ[FABL.𝔽₂]
        (FABL.lowDegreeFourierFamily n r) 
          FABL.𝔽₂
    The canonical linear equivalence between a Reed--Muller word and its low-degree ANF
    coefficient vector. 
  • defdefined in CryptBoolean/Carlet/Chapter04/AnnihilatorLinearSystem.lean
    complete
    def CryptBoolean.annihilatorEvaluationLinearMap {n : }
      (f : CryptBoolean.BooleanFunction n) (d : ) :
      ((FABL.lowDegreeFourierFamily n d)  FABL.𝔽₂) →ₗ[FABL.𝔽₂]
        (CryptBoolean.support f)  FABL.𝔽₂
    def CryptBoolean.annihilatorEvaluationLinearMap
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (d : ) :
      ((FABL.lowDegreeFourierFamily n d) 
          FABL.𝔽₂) →ₗ[FABL.𝔽₂]
        (CryptBoolean.support f)  FABL.𝔽₂
    Evaluation on `supp(f)`, with a degree-at-most-`d` Boolean function represented by its
    low-degree ANF coefficient vector. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/AnnihilatorLinearSystem.lean
    complete
    theorem CryptBoolean.mem_ker_annihilatorEvaluationLinearMap_iff {n d : }
      (f : CryptBoolean.BooleanFunction n)
      (c : (FABL.lowDegreeFourierFamily n d)  FABL.𝔽₂) :
      c  (CryptBoolean.annihilatorEvaluationLinearMap f d).ker 
        f * ((CryptBoolean.reedMullerAnfEquiv d n).symm c) = 0
    theorem CryptBoolean.mem_ker_annihilatorEvaluationLinearMap_iff
      {n d : }
      (f : CryptBoolean.BooleanFunction n)
      (c :
        (FABL.lowDegreeFourierFamily n d) 
          FABL.𝔽₂) :
      c 
          (CryptBoolean.annihilatorEvaluationLinearMap
              f d).ker 
        f *
            ((CryptBoolean.reedMullerAnfEquiv
                    d n).symm
                c) =
          0
    A low-degree coefficient vector belongs to the evaluation kernel exactly when the
    corresponding Boolean function annihilates `f`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/AnnihilatorLinearSystem.lean
    complete
    theorem CryptBoolean.annihilatorEvaluationLinearMap_domain_finrank (n d : ) :
      Module.finrank FABL.𝔽₂
          ((FABL.lowDegreeFourierFamily n d)  FABL.𝔽₂) =
         i  Finset.range (d + 1), n.choose i
    theorem CryptBoolean.annihilatorEvaluationLinearMap_domain_finrank
      (n d : ) :
      Module.finrank FABL.𝔽₂
          ((FABL.lowDegreeFourierFamily n
                d) 
            FABL.𝔽₂) =
         i  Finset.range (d + 1), n.choose i
    Carlet's number of low-degree ANF coefficient unknowns. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/AnnihilatorLinearSystem.lean
    complete
    theorem CryptBoolean.annihilatorEvaluationLinearMap_codomain_finrank {n : }
      (f : CryptBoolean.BooleanFunction n) :
      Module.finrank FABL.𝔽₂ ((CryptBoolean.support f)  FABL.𝔽₂) =
        CryptBoolean.hammingWeight f
    theorem CryptBoolean.annihilatorEvaluationLinearMap_codomain_finrank
      {n : }
      (f : CryptBoolean.BooleanFunction n) :
      Module.finrank FABL.𝔽₂
          ((CryptBoolean.support f) 
            FABL.𝔽₂) =
        CryptBoolean.hammingWeight f
    Evaluation on `supp(f)` gives exactly `w_H(f)` scalar equations. 
Theorem3.7.4
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 3
Statement dependency previews
Preview
Proposition 3.6.2
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
Used by 3
Reverse dependency previews
Preview
Theorem 8.1.2
Loading preview
Reverse dependency preview content is loaded from the rendered-fragment cache.
L∃∀N

Upper bounds on algebraic immunity (Carlet, p. 62). Every f:V_n\to\mathbb F_2 satisfies \operatorname{AI}(f)\le\left\lceil\frac n2\right\rceil. If f is affinely equivalent to a function on only k variables, then \operatorname{AI}(f)\le\lceil k/2\rceil. If \dim\ker_{\mathrm{lin}}(f)=n-k, then \operatorname{AI}(f)\le\lceil k/2+1\rceil.

Lean code for Theorem3.7.410 declarations
  • theoremdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunityBounds.lean
    complete
    theorem CryptBoolean.functionAlgebraicDegree_affineMap_coordinate_le_one_general
      {m n : } (L : FABL.F₂Cube n →ᵃ[FABL.𝔽₂] FABL.F₂Cube m) (i : Fin m) :
      (FABL.functionAlgebraicDegree fun x => L x i)  1
    theorem CryptBoolean.functionAlgebraicDegree_affineMap_coordinate_le_one_general
      {m n : }
      (L :
        FABL.F₂Cube n →ᵃ[FABL.𝔽₂]
          FABL.F₂Cube m)
      (i : Fin m) :
      (FABL.functionAlgebraicDegree fun x =>
          L x i) 
        1
    Every coordinate of an affine map between binary cubes has algebraic degree at most one. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunityBounds.lean
    complete
    theorem CryptBoolean.functionAlgebraicDegree_anfMonomial_comp_affineMap_le_card_general
      {m n : } (L : FABL.F₂Cube n →ᵃ[FABL.𝔽₂] FABL.F₂Cube m)
      (S : Finset (Fin m)) :
      (FABL.functionAlgebraicDegree fun x => FABL.anfMonomial S (L x)) 
        S.card
    theorem CryptBoolean.functionAlgebraicDegree_anfMonomial_comp_affineMap_le_card_general
      {m n : }
      (L :
        FABL.F₂Cube n →ᵃ[FABL.𝔽₂]
          FABL.F₂Cube m)
      (S : Finset (Fin m)) :
      (FABL.functionAlgebraicDegree fun x =>
          FABL.anfMonomial S (L x)) 
        S.card
    Substituting affine coordinates of a different ambient dimension into an ANF monomial
    does not increase its degree. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunityBounds.lean
    complete
    theorem CryptBoolean.functionAlgebraicDegree_comp_affineMap_le_general {m n : }
      (f : CryptBoolean.BooleanFunction m)
      (L : FABL.F₂Cube n →ᵃ[FABL.𝔽₂] FABL.F₂Cube m) :
      FABL.functionAlgebraicDegree (f  L)  FABL.functionAlgebraicDegree f
    theorem CryptBoolean.functionAlgebraicDegree_comp_affineMap_le_general
      {m n : }
      (f : CryptBoolean.BooleanFunction m)
      (L :
        FABL.F₂Cube n →ᵃ[FABL.𝔽₂]
          FABL.F₂Cube m) :
      FABL.functionAlgebraicDegree (f  L) 
        FABL.functionAlgebraicDegree f
    Composition with an affine map between binary cubes cannot increase algebraic degree. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunityBounds.lean
    complete
    theorem CryptBoolean.algebraicImmunity_comp_surjectiveAffineMap_le {m n : }
      (f : CryptBoolean.BooleanFunction m)
      (L : FABL.F₂Cube n →ᵃ[FABL.𝔽₂] FABL.F₂Cube m)
      (hL : Function.Surjective L) :
      CryptBoolean.algebraicImmunity (f  L) 
        CryptBoolean.algebraicImmunity f
    theorem CryptBoolean.algebraicImmunity_comp_surjectiveAffineMap_le
      {m n : }
      (f : CryptBoolean.BooleanFunction m)
      (L :
        FABL.F₂Cube n →ᵃ[FABL.𝔽₂]
          FABL.F₂Cube m)
      (hL : Function.Surjective L) :
      CryptBoolean.algebraicImmunity
          (f  L) 
        CryptBoolean.algebraicImmunity f
    Pulling a Boolean function back along a surjective affine map cannot increase
    algebraic immunity. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunityBounds.lean
    complete
    theorem CryptBoolean.algebraicImmunity_le_ceiling_half {n : }
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.algebraicImmunity f  (n + 1) / 2
    theorem CryptBoolean.algebraicImmunity_le_ceiling_half
      {n : }
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.algebraicImmunity f 
        (n + 1) / 2
    Carlet's universal algebraic-immunity bound `AI(f) ≤ ⌈n/2⌉`. 
  • defdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunityBounds.lean
    complete
    def CryptBoolean.HasSurjectiveAffineFactorization {n : }
      (f : CryptBoolean.BooleanFunction n) (k : ) : Prop
    def CryptBoolean.HasSurjectiveAffineFactorization
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (k : ) : Prop
    A function factors through at most `k` affine coordinates when it is the pullback of a
    `k`-variable Boolean function along a surjective affine map. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunityBounds.lean
    complete
    theorem CryptBoolean.algebraicImmunity_le_ceiling_half_of_hasSurjectiveAffineFactorization
      {n k : } (f : CryptBoolean.BooleanFunction n)
      (hf : CryptBoolean.HasSurjectiveAffineFactorization f k) :
      CryptBoolean.algebraicImmunity f  (k + 1) / 2
    theorem CryptBoolean.algebraicImmunity_le_ceiling_half_of_hasSurjectiveAffineFactorization
      {n k : }
      (f : CryptBoolean.BooleanFunction n)
      (hf :
        CryptBoolean.HasSurjectiveAffineFactorization
          f k) :
      CryptBoolean.algebraicImmunity f 
        (k + 1) / 2
    Carlet's `k`-variable refinement: affine factorization through `k` coordinates gives
    `AI(f) ≤ ⌈k/2⌉`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunityBounds.lean
    complete
    theorem CryptBoolean.hasSurjectiveAffineFactorization_of_hasSeparatedLinearStructureNormalForm
      {m k : } (f : CryptBoolean.BooleanFunction (m + k))
      (hf : CryptBoolean.HasSeparatedLinearStructureNormalForm f) :
      CryptBoolean.HasSurjectiveAffineFactorization f m 
        CryptBoolean.HasSurjectiveAffineFactorization f (m + 1)
    theorem CryptBoolean.hasSurjectiveAffineFactorization_of_hasSeparatedLinearStructureNormalForm
      {m k : }
      (f :
        CryptBoolean.BooleanFunction (m + k))
      (hf :
        CryptBoolean.HasSeparatedLinearStructureNormalForm
          f) :
      CryptBoolean.HasSurjectiveAffineFactorization
          f m 
        CryptBoolean.HasSurjectiveAffineFactorization
          f (m + 1)
    A separated linear-structure normal form with `m` nonlinear coordinates factors through
    `m` affine coordinates when its tail form vanishes, and through `m+1` otherwise. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunityBounds.lean
    complete
    theorem CryptBoolean.algebraicImmunity_le_ceiling_half_add_one_of_hasSeparatedLinearStructureNormalForm
      {m k : } (f : CryptBoolean.BooleanFunction (m + k))
      (hf : CryptBoolean.HasSeparatedLinearStructureNormalForm f) :
      CryptBoolean.algebraicImmunity f  (m + 2) / 2
    theorem CryptBoolean.algebraicImmunity_le_ceiling_half_add_one_of_hasSeparatedLinearStructureNormalForm
      {m k : }
      (f :
        CryptBoolean.BooleanFunction (m + k))
      (hf :
        CryptBoolean.HasSeparatedLinearStructureNormalForm
          f) :
      CryptBoolean.algebraicImmunity f 
        (m + 2) / 2
    Carlet's linear-kernel refinement: `m` nonlinear coordinates and an affine tail give
    `AI(f) ≤ ⌈m/2+1⌉ = ⌈(m+1)/2⌉`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunityBounds.lean
    complete
    theorem CryptBoolean.algebraicImmunity_le_ceiling_half_add_one_of_linearKernel_finrank_ge
      {m k : } (f : CryptBoolean.BooleanFunction (m + k))
      (hk : k  Module.finrank FABL.𝔽₂ (CryptBoolean.linearKernel f)) :
      CryptBoolean.algebraicImmunity f  (m + 2) / 2
    theorem CryptBoolean.algebraicImmunity_le_ceiling_half_add_one_of_linearKernel_finrank_ge
      {m k : }
      (f :
        CryptBoolean.BooleanFunction (m + k))
      (hk :
        k 
          Module.finrank FABL.𝔽₂
            (CryptBoolean.linearKernel f)) :
      CryptBoolean.algebraicImmunity f 
        (m + 2) / 2
    If the linear kernel contains `k` independent directions in dimension `m+k`, then
    `AI(f) ≤ ⌈m/2+1⌉`. 

Depending on at most k affine coordinates is equivalent to factorization through a surjective affine map to V_k. The linear-kernel theorem has the slightly stronger hypothesis that a contained tail subspace of the stated dimension suffices, so equality of kernel dimension is an immediate specialization.

Definition3.7.5
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 2
Statement dependency previews
Preview
Definition 3.7.1
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
used by 0L∃∀N

Optimality against fast algebraic relations (Carlet, p. 63). If \sum_{i=0}^{e}\binom ni+ \sum_{i=0}^{d}\binom ni>2^n, equivalently e+d\ge n, then there exist g\ne0 and h with fg=h, \deg(g)\le e, and \deg(h)\le d. The function f is optimal against such relations when none exists with \deg(g)+\deg(h)<n. Whenever fg=h\ne0, one also has \deg(h)\ge\operatorname{AI}(f).

Lean code for Definition3.7.57 declarations
  • theoremdefined in CryptBoolean/Carlet/Chapter04/FastAlgebraic.lean
    complete
    theorem CryptBoolean.two_pow_lt_sum_choose_add_sum_choose_of_add_ge (n e d : )
      (hed : n  e + d) :
      2 ^ n <
         i  Finset.range (e + 1), n.choose i +
           i  Finset.range (d + 1), n.choose i
    theorem CryptBoolean.two_pow_lt_sum_choose_add_sum_choose_of_add_ge
      (n e d : ) (hed : n  e + d) :
      2 ^ n <
         i  Finset.range (e + 1),
            n.choose i +
           i  Finset.range (d + 1),
            n.choose i
    The two low-degree coefficient counts exceed the Boolean-function-space dimension whenever
    the two degree bounds add to at least the number of variables. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/FastAlgebraic.lean
    complete
    theorem CryptBoolean.sum_choose_add_sum_choose_gt_iff (n e d : ) :
      2 ^ n <
           i  Finset.range (e + 1), n.choose i +
             i  Finset.range (d + 1), n.choose i 
        n  e + d
    theorem CryptBoolean.sum_choose_add_sum_choose_gt_iff
      (n e d : ) :
      2 ^ n <
           i  Finset.range (e + 1),
              n.choose i +
             i  Finset.range (d + 1),
              n.choose i 
        n  e + d
    Carlet's equivalent numerical form of the dimension condition. 
  • defdefined in CryptBoolean/Carlet/Chapter04/FastAlgebraic.lean
    complete
    def CryptBoolean.fastAlgebraicRelationLinearMap {n : }
      (f : CryptBoolean.BooleanFunction n) (e d : ) :
      (CryptBoolean.reedMuller e n) ×
          (CryptBoolean.reedMuller d n) →ₗ[FABL.𝔽₂]
        CryptBoolean.BooleanFunction n
    def CryptBoolean.fastAlgebraicRelationLinearMap
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (e d : ) :
      (CryptBoolean.reedMuller e n) ×
          (CryptBoolean.reedMuller d
              n) →ₗ[FABL.𝔽₂]
        CryptBoolean.BooleanFunction n
    The linear map whose kernel consists of bounded-degree relations `f*g=h`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/FastAlgebraic.lean
    complete
    theorem CryptBoolean.exists_fastAlgebraicRelation_of_add_ge {n e d : }
      (f : CryptBoolean.BooleanFunction n) (hed : n  e + d) :
       g h,
        g  0 
          FABL.functionAlgebraicDegree g  e 
            FABL.functionAlgebraicDegree h  d  f * g = h
    theorem CryptBoolean.exists_fastAlgebraicRelation_of_add_ge
      {n e d : }
      (f : CryptBoolean.BooleanFunction n)
      (hed : n  e + d) :
       g h,
        g  0 
          FABL.functionAlgebraicDegree g  e 
            FABL.functionAlgebraicDegree h 
                d 
              f * g = h
    Carlet's dimension argument: if `e+d≥n`, there is a nonzero `g` of degree at most `e`
    whose product with `f` has degree at most `d`. 
  • defdefined in CryptBoolean/Carlet/Chapter04/FastAlgebraic.lean
    complete
    def CryptBoolean.IsFastAlgebraicallyOptimal {n : }
      (f : CryptBoolean.BooleanFunction n) : Prop
    def CryptBoolean.IsFastAlgebraicallyOptimal
      {n : }
      (f : CryptBoolean.BooleanFunction n) :
      Prop
    Optimality against fast algebraic attacks: every nonzero multiplicand relation has total
    degree at least `n`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/FastAlgebraic.lean
    complete
    theorem CryptBoolean.isFastAlgebraicallyOptimal_iff_no_lowDegreeRelation {n : }
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.IsFastAlgebraicallyOptimal f 
        ¬ g h,
            g  0 
              f * g = h 
                FABL.functionAlgebraicDegree g +
                    FABL.functionAlgebraicDegree h <
                  n
    theorem CryptBoolean.isFastAlgebraicallyOptimal_iff_no_lowDegreeRelation
      {n : }
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.IsFastAlgebraicallyOptimal
          f 
        ¬ g h,
            g  0 
              f * g = h 
                FABL.functionAlgebraicDegree
                      g +
                    FABL.functionAlgebraicDegree
                      h <
                  n
    The quantified lower-bound definition is equivalent to absence of a subcritical relation. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/FastAlgebraic.lean
    complete
    theorem CryptBoolean.algebraicImmunity_le_degree_of_mul_eq_of_ne_zero {n : }
      (f g h : CryptBoolean.BooleanFunction n) (hrelation : f * g = h)
      (hh : h  0) :
      CryptBoolean.algebraicImmunity f  FABL.functionAlgebraicDegree h
    theorem CryptBoolean.algebraicImmunity_le_degree_of_mul_eq_of_ne_zero
      {n : }
      (f g h : CryptBoolean.BooleanFunction n)
      (hrelation : f * g = h) (hh : h  0) :
      CryptBoolean.algebraicImmunity f 
        FABL.functionAlgebraicDegree h
    A nonzero product in a fast algebraic relation has degree at least the algebraic immunity.