3.7. Algebraic immunity
-
CryptBoolean.support_mul[complete] -
CryptBoolean.booleanFunction_mul_self[complete] -
CryptBoolean.booleanFunction_mul_complement[complete] -
CryptBoolean.IsAnnihilator[complete] -
CryptBoolean.annihilatorIdeal[complete] -
CryptBoolean.mem_annihilatorIdeal_iff[complete] -
CryptBoolean.isAnnihilator_iff_mem_annihilatorIdeal[complete] -
CryptBoolean.IsAlgebraicImmunityWitness[complete] -
CryptBoolean.algebraicImmunityCandidates[complete] -
CryptBoolean.mem_algebraicImmunityCandidates[complete] -
CryptBoolean.algebraicImmunityCandidates_nonempty[complete] -
CryptBoolean.algebraicImmunity[complete] -
CryptBoolean.algebraicImmunity_le_functionAlgebraicDegree[complete] -
CryptBoolean.exists_witness_functionAlgebraicDegree_eq_algebraicImmunity[complete] -
CryptBoolean.IsAnnihilator.comp_affineEquiv[complete] -
CryptBoolean.IsAlgebraicImmunityWitness.comp_affineEquiv[complete] -
CryptBoolean.algebraicImmunity_comp_affineEquiv_le[complete] -
CryptBoolean.algebraicImmunity_comp_affineEquiv[complete]
Annihilators and algebraic immunity (Carlet, pp. 61--62). Pointwise
multiplication satisfies
\operatorname{supp}(fg)
=\operatorname{supp}(f)\cap\operatorname{supp}(g).
A nonzero g with fg=0 is an annihilator of f; all such
annihilators together with zero form the ideal of multiples of f+1.
Define
\operatorname{AI}(f)=
\min\{\deg(g):g\ne0,\ fg=0\text{ or }(f+1)g=0\}.
Algebraic immunity is invariant under affine equivalence.
Lean code for Definition3.7.1●18 declarations
Associated Lean declarations
-
CryptBoolean.support_mul[complete]
-
CryptBoolean.booleanFunction_mul_self[complete]
-
CryptBoolean.booleanFunction_mul_complement[complete]
-
CryptBoolean.IsAnnihilator[complete]
-
CryptBoolean.annihilatorIdeal[complete]
-
CryptBoolean.mem_annihilatorIdeal_iff[complete]
-
CryptBoolean.isAnnihilator_iff_mem_annihilatorIdeal[complete]
-
CryptBoolean.IsAlgebraicImmunityWitness[complete]
-
CryptBoolean.algebraicImmunityCandidates[complete]
-
CryptBoolean.mem_algebraicImmunityCandidates[complete]
-
CryptBoolean.algebraicImmunityCandidates_nonempty[complete]
-
CryptBoolean.algebraicImmunity[complete]
-
CryptBoolean.algebraicImmunity_le_functionAlgebraicDegree[complete]
-
CryptBoolean.exists_witness_functionAlgebraicDegree_eq_algebraicImmunity[complete]
-
CryptBoolean.IsAnnihilator.comp_affineEquiv[complete]
-
CryptBoolean.IsAlgebraicImmunityWitness.comp_affineEquiv[complete]
-
CryptBoolean.algebraicImmunity_comp_affineEquiv_le[complete]
-
CryptBoolean.algebraicImmunity_comp_affineEquiv[complete]
-
CryptBoolean.support_mul[complete] -
CryptBoolean.booleanFunction_mul_self[complete] -
CryptBoolean.booleanFunction_mul_complement[complete] -
CryptBoolean.IsAnnihilator[complete] -
CryptBoolean.annihilatorIdeal[complete] -
CryptBoolean.mem_annihilatorIdeal_iff[complete] -
CryptBoolean.isAnnihilator_iff_mem_annihilatorIdeal[complete] -
CryptBoolean.IsAlgebraicImmunityWitness[complete] -
CryptBoolean.algebraicImmunityCandidates[complete] -
CryptBoolean.mem_algebraicImmunityCandidates[complete] -
CryptBoolean.algebraicImmunityCandidates_nonempty[complete] -
CryptBoolean.algebraicImmunity[complete] -
CryptBoolean.algebraicImmunity_le_functionAlgebraicDegree[complete] -
CryptBoolean.exists_witness_functionAlgebraicDegree_eq_algebraicImmunity[complete] -
CryptBoolean.IsAnnihilator.comp_affineEquiv[complete] -
CryptBoolean.IsAlgebraicImmunityWitness.comp_affineEquiv[complete] -
CryptBoolean.algebraicImmunity_comp_affineEquiv_le[complete] -
CryptBoolean.algebraicImmunity_comp_affineEquiv[complete]
-
theoremdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunity.leancomplete
theorem CryptBoolean.support_mul {n : ℕ} (f g : CryptBoolean.BooleanFunction n) : CryptBoolean.support (f * g) = CryptBoolean.support f ∩ CryptBoolean.support g
theorem CryptBoolean.support_mul {n : ℕ} (f g : CryptBoolean.BooleanFunction n) : CryptBoolean.support (f * g) = CryptBoolean.support f ∩ CryptBoolean.support g
The support of a pointwise product is the intersection of the two supports.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunity.leancomplete
theorem CryptBoolean.booleanFunction_mul_self {n : ℕ} (f : CryptBoolean.BooleanFunction n) : f * f = f
theorem CryptBoolean.booleanFunction_mul_self {n : ℕ} (f : CryptBoolean.BooleanFunction n) : f * f = f
Every binary-valued function is idempotent under pointwise multiplication.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunity.leancomplete
theorem CryptBoolean.booleanFunction_mul_complement {n : ℕ} (f : CryptBoolean.BooleanFunction n) : f * (f + 1) = 0
theorem CryptBoolean.booleanFunction_mul_complement {n : ℕ} (f : CryptBoolean.BooleanFunction n) : f * (f + 1) = 0
A Boolean function and its complement have disjoint pointwise product.
-
defdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunity.leancomplete
def CryptBoolean.IsAnnihilator {n : ℕ} (f g : CryptBoolean.BooleanFunction n) : Prop
def CryptBoolean.IsAnnihilator {n : ℕ} (f g : CryptBoolean.BooleanFunction n) : Prop
A nonzero Boolean function whose pointwise product with `f` vanishes.
-
defdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunity.leancomplete
def CryptBoolean.annihilatorIdeal {n : ℕ} (f : CryptBoolean.BooleanFunction n) : Ideal (CryptBoolean.BooleanFunction n)
def CryptBoolean.annihilatorIdeal {n : ℕ} (f : CryptBoolean.BooleanFunction n) : Ideal (CryptBoolean.BooleanFunction n)
The ideal of all (possibly zero) annihilators of `f`, generated by its complement.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunity.leancomplete
theorem CryptBoolean.mem_annihilatorIdeal_iff {n : ℕ} (f g : CryptBoolean.BooleanFunction n) : g ∈ CryptBoolean.annihilatorIdeal f ↔ f * g = 0
theorem CryptBoolean.mem_annihilatorIdeal_iff {n : ℕ} (f g : CryptBoolean.BooleanFunction n) : g ∈ CryptBoolean.annihilatorIdeal f ↔ f * g = 0
Membership in the annihilator ideal is exactly vanishing of the pointwise product with `f`.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunity.leancomplete
theorem CryptBoolean.isAnnihilator_iff_mem_annihilatorIdeal {n : ℕ} (f g : CryptBoolean.BooleanFunction n) : CryptBoolean.IsAnnihilator f g ↔ g ≠ 0 ∧ g ∈ CryptBoolean.annihilatorIdeal f
theorem CryptBoolean.isAnnihilator_iff_mem_annihilatorIdeal {n : ℕ} (f g : CryptBoolean.BooleanFunction n) : CryptBoolean.IsAnnihilator f g ↔ g ≠ 0 ∧ g ∈ CryptBoolean.annihilatorIdeal f
Nonzero elements of the annihilator ideal are precisely Carlet annihilators.
-
defdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunity.leancomplete
def CryptBoolean.IsAlgebraicImmunityWitness {n : ℕ} (f g : CryptBoolean.BooleanFunction n) : Prop
def CryptBoolean.IsAlgebraicImmunityWitness {n : ℕ} (f g : CryptBoolean.BooleanFunction n) : Prop
A witness for algebraic immunity annihilates either `f` or its complement.
-
defdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunity.leancomplete
def CryptBoolean.algebraicImmunityCandidates {n : ℕ} (f : CryptBoolean.BooleanFunction n) : Finset (CryptBoolean.BooleanFunction n)
def CryptBoolean.algebraicImmunityCandidates {n : ℕ} (f : CryptBoolean.BooleanFunction n) : Finset (CryptBoolean.BooleanFunction n)
The finite family over which algebraic immunity takes its minimum.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunity.leancomplete
theorem CryptBoolean.mem_algebraicImmunityCandidates {n : ℕ} (f g : CryptBoolean.BooleanFunction n) : g ∈ CryptBoolean.algebraicImmunityCandidates f ↔ CryptBoolean.IsAlgebraicImmunityWitness f g
theorem CryptBoolean.mem_algebraicImmunityCandidates {n : ℕ} (f g : CryptBoolean.BooleanFunction n) : g ∈ CryptBoolean.algebraicImmunityCandidates f ↔ CryptBoolean.IsAlgebraicImmunityWitness f g
Membership in the candidate family is the defining annihilator disjunction.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunity.leancomplete
theorem CryptBoolean.algebraicImmunityCandidates_nonempty {n : ℕ} (f : CryptBoolean.BooleanFunction n) : (CryptBoolean.algebraicImmunityCandidates f).Nonempty
theorem CryptBoolean.algebraicImmunityCandidates_nonempty {n : ℕ} (f : CryptBoolean.BooleanFunction n) : (CryptBoolean.algebraicImmunityCandidates f).Nonempty
Every Boolean function has a nonzero annihilator on one side of the complement pair.
-
defdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunity.leancomplete
def CryptBoolean.algebraicImmunity {n : ℕ} (f : CryptBoolean.BooleanFunction n) : ℕ
def CryptBoolean.algebraicImmunity {n : ℕ} (f : CryptBoolean.BooleanFunction n) : ℕ
Algebraic immunity is the least algebraic degree of a nonzero annihilator of `f` or `f+1`.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunity.leancomplete
theorem CryptBoolean.algebraicImmunity_le_functionAlgebraicDegree {n : ℕ} (f g : CryptBoolean.BooleanFunction n) (hg : CryptBoolean.IsAlgebraicImmunityWitness f g) : CryptBoolean.algebraicImmunity f ≤ FABL.functionAlgebraicDegree g
theorem CryptBoolean.algebraicImmunity_le_functionAlgebraicDegree {n : ℕ} (f g : CryptBoolean.BooleanFunction n) (hg : CryptBoolean.IsAlgebraicImmunityWitness f g) : CryptBoolean.algebraicImmunity f ≤ FABL.functionAlgebraicDegree g
Algebraic immunity is bounded by the degree of every annihilator witness.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunity.leancomplete
theorem CryptBoolean.exists_witness_functionAlgebraicDegree_eq_algebraicImmunity {n : ℕ} (f : CryptBoolean.BooleanFunction n) : ∃ g, CryptBoolean.IsAlgebraicImmunityWitness f g ∧ FABL.functionAlgebraicDegree g = CryptBoolean.algebraicImmunity f
theorem CryptBoolean.exists_witness_functionAlgebraicDegree_eq_algebraicImmunity {n : ℕ} (f : CryptBoolean.BooleanFunction n) : ∃ g, CryptBoolean.IsAlgebraicImmunityWitness f g ∧ FABL.functionAlgebraicDegree g = CryptBoolean.algebraicImmunity f
The finite witness family contains an annihilator attaining algebraic immunity.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunity.leancomplete
theorem CryptBoolean.IsAnnihilator.comp_affineEquiv {n : ℕ} {f g : CryptBoolean.BooleanFunction n} (h : CryptBoolean.IsAnnihilator f g) (L : FABL.F₂Cube n ≃ᵃ[FABL.𝔽₂] FABL.F₂Cube n) : CryptBoolean.IsAnnihilator (f ∘ ⇑L) (g ∘ ⇑L)
theorem CryptBoolean.IsAnnihilator.comp_affineEquiv {n : ℕ} {f g : CryptBoolean.BooleanFunction n} (h : CryptBoolean.IsAnnihilator f g) (L : FABL.F₂Cube n ≃ᵃ[FABL.𝔽₂] FABL.F₂Cube n) : CryptBoolean.IsAnnihilator (f ∘ ⇑L) (g ∘ ⇑L)
Affine input reindexing preserves the annihilator relation.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunity.leancomplete
theorem CryptBoolean.IsAlgebraicImmunityWitness.comp_affineEquiv {n : ℕ} {f g : CryptBoolean.BooleanFunction n} (h : CryptBoolean.IsAlgebraicImmunityWitness f g) (L : FABL.F₂Cube n ≃ᵃ[FABL.𝔽₂] FABL.F₂Cube n) : CryptBoolean.IsAlgebraicImmunityWitness (f ∘ ⇑L) (g ∘ ⇑L)
theorem CryptBoolean.IsAlgebraicImmunityWitness.comp_affineEquiv {n : ℕ} {f g : CryptBoolean.BooleanFunction n} (h : CryptBoolean.IsAlgebraicImmunityWitness f g) (L : FABL.F₂Cube n ≃ᵃ[FABL.𝔽₂] FABL.F₂Cube n) : CryptBoolean.IsAlgebraicImmunityWitness (f ∘ ⇑L) (g ∘ ⇑L)
Affine input reindexing transports algebraic-immunity witnesses.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunity.leancomplete
theorem CryptBoolean.algebraicImmunity_comp_affineEquiv_le {n : ℕ} (f : CryptBoolean.BooleanFunction n) (L : FABL.F₂Cube n ≃ᵃ[FABL.𝔽₂] FABL.F₂Cube n) : CryptBoolean.algebraicImmunity (f ∘ ⇑L) ≤ CryptBoolean.algebraicImmunity f
theorem CryptBoolean.algebraicImmunity_comp_affineEquiv_le {n : ℕ} (f : CryptBoolean.BooleanFunction n) (L : FABL.F₂Cube n ≃ᵃ[FABL.𝔽₂] FABL.F₂Cube n) : CryptBoolean.algebraicImmunity (f ∘ ⇑L) ≤ CryptBoolean.algebraicImmunity f
One half of affine invariance of algebraic immunity.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunity.leancomplete
theorem CryptBoolean.algebraicImmunity_comp_affineEquiv {n : ℕ} (f : CryptBoolean.BooleanFunction n) (L : FABL.F₂Cube n ≃ᵃ[FABL.𝔽₂] FABL.F₂Cube n) : CryptBoolean.algebraicImmunity (f ∘ ⇑L) = CryptBoolean.algebraicImmunity f
theorem CryptBoolean.algebraicImmunity_comp_affineEquiv {n : ℕ} (f : CryptBoolean.BooleanFunction n) (L : FABL.F₂Cube n ≃ᵃ[FABL.𝔽₂] FABL.F₂Cube n) : CryptBoolean.algebraicImmunity (f ∘ ⇑L) = CryptBoolean.algebraicImmunity f
Algebraic immunity is invariant under affine equivalence.
Low-degree relation equivalence (Carlet, p. 62). There exist g\ne0
and h such that
fg=h,
\qquad \deg(g)\le d,
\qquad \deg(h)\le d
if and only if there exists q\ne0 of degree at most d such that
fq=0 or (f+1)q=0.
Lean code for Theorem3.7.2●1 theorem
Associated Lean declarations
-
theoremdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunity.leancomplete
theorem CryptBoolean.exists_lowDegreeRelation_iff_exists_algebraicImmunityWitness {n : ℕ} (f : CryptBoolean.BooleanFunction n) (d : ℕ) : (∃ g h, g ≠ 0 ∧ FABL.functionAlgebraicDegree g ≤ d ∧ FABL.functionAlgebraicDegree h ≤ d ∧ f * g = h) ↔ ∃ q, q ≠ 0 ∧ FABL.functionAlgebraicDegree q ≤ d ∧ (f * q = 0 ∨ (f + 1) * q = 0)
theorem CryptBoolean.exists_lowDegreeRelation_iff_exists_algebraicImmunityWitness {n : ℕ} (f : CryptBoolean.BooleanFunction n) (d : ℕ) : (∃ g h, g ≠ 0 ∧ FABL.functionAlgebraicDegree g ≤ d ∧ FABL.functionAlgebraicDegree h ≤ d ∧ f * g = h) ↔ ∃ q, q ≠ 0 ∧ FABL.functionAlgebraicDegree q ≤ d ∧ (f * q = 0 ∨ (f + 1) * q = 0)
A nonzero low-degree relation `f*g=h` exists exactly when `f` or `f+1` has a nonzero annihilator of the same degree bound.
-
CryptBoolean.extendLowDegreeCoefficients[complete] -
CryptBoolean.reedMullerAnfEquiv[complete] -
CryptBoolean.annihilatorEvaluationLinearMap[complete] -
CryptBoolean.mem_ker_annihilatorEvaluationLinearMap_iff[complete] -
CryptBoolean.annihilatorEvaluationLinearMap_domain_finrank[complete] -
CryptBoolean.annihilatorEvaluationLinearMap_codomain_finrank[complete]
Annihilator evaluation system (Carlet, p. 62). A function g of degree
at most d annihilates f exactly when its low-degree ANF coefficient
vector belongs to the kernel of evaluation on \operatorname{supp}(f).
The homogeneous system has
\sum_{i=0}^{d}\binom ni
unknown coefficients and w_H(f) equations.
Lean code for Theorem3.7.3●6 declarations
Associated Lean declarations
-
CryptBoolean.extendLowDegreeCoefficients[complete]
-
CryptBoolean.reedMullerAnfEquiv[complete]
-
CryptBoolean.annihilatorEvaluationLinearMap[complete]
-
CryptBoolean.mem_ker_annihilatorEvaluationLinearMap_iff[complete]
-
CryptBoolean.annihilatorEvaluationLinearMap_domain_finrank[complete]
-
CryptBoolean.annihilatorEvaluationLinearMap_codomain_finrank[complete]
-
CryptBoolean.extendLowDegreeCoefficients[complete] -
CryptBoolean.reedMullerAnfEquiv[complete] -
CryptBoolean.annihilatorEvaluationLinearMap[complete] -
CryptBoolean.mem_ker_annihilatorEvaluationLinearMap_iff[complete] -
CryptBoolean.annihilatorEvaluationLinearMap_domain_finrank[complete] -
CryptBoolean.annihilatorEvaluationLinearMap_codomain_finrank[complete]
-
defdefined in CryptBoolean/Carlet/Chapter03/ReedMuller.leancomplete
def CryptBoolean.extendLowDegreeCoefficients (r n : ℕ) (c : ↥(FABL.lowDegreeFourierFamily n r) → FABL.𝔽₂) : FABL.ANFCoefficients n
def CryptBoolean.extendLowDegreeCoefficients (r n : ℕ) (c : ↥(FABL.lowDegreeFourierFamily n r) → FABL.𝔽₂) : FABL.ANFCoefficients n
Extend a low-degree coefficient vector by zero to all square-free monomials.
-
defdefined in CryptBoolean/Carlet/Chapter03/ReedMuller.leancomplete
def CryptBoolean.reedMullerAnfEquiv (r n : ℕ) : ↥(CryptBoolean.reedMuller r n) ≃ₗ[FABL.𝔽₂] ↥(FABL.lowDegreeFourierFamily n r) → FABL.𝔽₂
def CryptBoolean.reedMullerAnfEquiv (r n : ℕ) : ↥(CryptBoolean.reedMuller r n) ≃ₗ[FABL.𝔽₂] ↥(FABL.lowDegreeFourierFamily n r) → FABL.𝔽₂
The canonical linear equivalence between a Reed--Muller word and its low-degree ANF coefficient vector.
-
defdefined in CryptBoolean/Carlet/Chapter04/AnnihilatorLinearSystem.leancomplete
def CryptBoolean.annihilatorEvaluationLinearMap {n : ℕ} (f : CryptBoolean.BooleanFunction n) (d : ℕ) : (↥(FABL.lowDegreeFourierFamily n d) → FABL.𝔽₂) →ₗ[FABL.𝔽₂] ↥(CryptBoolean.support f) → FABL.𝔽₂
def CryptBoolean.annihilatorEvaluationLinearMap {n : ℕ} (f : CryptBoolean.BooleanFunction n) (d : ℕ) : (↥(FABL.lowDegreeFourierFamily n d) → FABL.𝔽₂) →ₗ[FABL.𝔽₂] ↥(CryptBoolean.support f) → FABL.𝔽₂
Evaluation on `supp(f)`, with a degree-at-most-`d` Boolean function represented by its low-degree ANF coefficient vector.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/AnnihilatorLinearSystem.leancomplete
theorem CryptBoolean.mem_ker_annihilatorEvaluationLinearMap_iff {n d : ℕ} (f : CryptBoolean.BooleanFunction n) (c : ↥(FABL.lowDegreeFourierFamily n d) → FABL.𝔽₂) : c ∈ (CryptBoolean.annihilatorEvaluationLinearMap f d).ker ↔ f * ↑((CryptBoolean.reedMullerAnfEquiv d n).symm c) = 0
theorem CryptBoolean.mem_ker_annihilatorEvaluationLinearMap_iff {n d : ℕ} (f : CryptBoolean.BooleanFunction n) (c : ↥(FABL.lowDegreeFourierFamily n d) → FABL.𝔽₂) : c ∈ (CryptBoolean.annihilatorEvaluationLinearMap f d).ker ↔ f * ↑((CryptBoolean.reedMullerAnfEquiv d n).symm c) = 0
A low-degree coefficient vector belongs to the evaluation kernel exactly when the corresponding Boolean function annihilates `f`.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/AnnihilatorLinearSystem.leancomplete
theorem CryptBoolean.annihilatorEvaluationLinearMap_domain_finrank (n d : ℕ) : Module.finrank FABL.𝔽₂ (↥(FABL.lowDegreeFourierFamily n d) → FABL.𝔽₂) = ∑ i ∈ Finset.range (d + 1), n.choose i
theorem CryptBoolean.annihilatorEvaluationLinearMap_domain_finrank (n d : ℕ) : Module.finrank FABL.𝔽₂ (↥(FABL.lowDegreeFourierFamily n d) → FABL.𝔽₂) = ∑ i ∈ Finset.range (d + 1), n.choose i
Carlet's number of low-degree ANF coefficient unknowns.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/AnnihilatorLinearSystem.leancomplete
theorem CryptBoolean.annihilatorEvaluationLinearMap_codomain_finrank {n : ℕ} (f : CryptBoolean.BooleanFunction n) : Module.finrank FABL.𝔽₂ (↥(CryptBoolean.support f) → FABL.𝔽₂) = CryptBoolean.hammingWeight f
theorem CryptBoolean.annihilatorEvaluationLinearMap_codomain_finrank {n : ℕ} (f : CryptBoolean.BooleanFunction n) : Module.finrank FABL.𝔽₂ (↥(CryptBoolean.support f) → FABL.𝔽₂) = CryptBoolean.hammingWeight f
Evaluation on `supp(f)` gives exactly `w_H(f)` scalar equations.
-
CryptBoolean.functionAlgebraicDegree_affineMap_coordinate_le_one_general[complete] -
CryptBoolean.functionAlgebraicDegree_anfMonomial_comp_affineMap_le_card_general[complete] -
CryptBoolean.functionAlgebraicDegree_comp_affineMap_le_general[complete] -
CryptBoolean.algebraicImmunity_comp_surjectiveAffineMap_le[complete] -
CryptBoolean.algebraicImmunity_le_ceiling_half[complete] -
CryptBoolean.HasSurjectiveAffineFactorization[complete] -
CryptBoolean.algebraicImmunity_le_ceiling_half_of_hasSurjectiveAffineFactorization[complete] -
CryptBoolean.hasSurjectiveAffineFactorization_of_hasSeparatedLinearStructureNormalForm[complete] -
CryptBoolean.algebraicImmunity_le_ceiling_half_add_one_of_hasSeparatedLinearStructureNormalForm[complete] -
CryptBoolean.algebraicImmunity_le_ceiling_half_add_one_of_linearKernel_finrank_ge[complete]
Upper bounds on algebraic immunity (Carlet, p. 62). Every
f:V_n\to\mathbb F_2 satisfies
\operatorname{AI}(f)\le\left\lceil\frac n2\right\rceil.
If f is affinely equivalent to a function on only k variables, then
\operatorname{AI}(f)\le\lceil k/2\rceil. If
\dim\ker_{\mathrm{lin}}(f)=n-k, then
\operatorname{AI}(f)\le\lceil k/2+1\rceil.
Lean code for Theorem3.7.4●10 declarations
Associated Lean declarations
-
CryptBoolean.functionAlgebraicDegree_affineMap_coordinate_le_one_general[complete]
-
CryptBoolean.functionAlgebraicDegree_anfMonomial_comp_affineMap_le_card_general[complete]
-
CryptBoolean.functionAlgebraicDegree_comp_affineMap_le_general[complete]
-
CryptBoolean.algebraicImmunity_comp_surjectiveAffineMap_le[complete]
-
CryptBoolean.algebraicImmunity_le_ceiling_half[complete]
-
CryptBoolean.HasSurjectiveAffineFactorization[complete]
-
CryptBoolean.algebraicImmunity_le_ceiling_half_of_hasSurjectiveAffineFactorization[complete]
-
CryptBoolean.hasSurjectiveAffineFactorization_of_hasSeparatedLinearStructureNormalForm[complete]
-
CryptBoolean.algebraicImmunity_le_ceiling_half_add_one_of_hasSeparatedLinearStructureNormalForm[complete]
-
CryptBoolean.algebraicImmunity_le_ceiling_half_add_one_of_linearKernel_finrank_ge[complete]
-
CryptBoolean.functionAlgebraicDegree_affineMap_coordinate_le_one_general[complete] -
CryptBoolean.functionAlgebraicDegree_anfMonomial_comp_affineMap_le_card_general[complete] -
CryptBoolean.functionAlgebraicDegree_comp_affineMap_le_general[complete] -
CryptBoolean.algebraicImmunity_comp_surjectiveAffineMap_le[complete] -
CryptBoolean.algebraicImmunity_le_ceiling_half[complete] -
CryptBoolean.HasSurjectiveAffineFactorization[complete] -
CryptBoolean.algebraicImmunity_le_ceiling_half_of_hasSurjectiveAffineFactorization[complete] -
CryptBoolean.hasSurjectiveAffineFactorization_of_hasSeparatedLinearStructureNormalForm[complete] -
CryptBoolean.algebraicImmunity_le_ceiling_half_add_one_of_hasSeparatedLinearStructureNormalForm[complete] -
CryptBoolean.algebraicImmunity_le_ceiling_half_add_one_of_linearKernel_finrank_ge[complete]
-
theoremdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunityBounds.leancomplete
theorem CryptBoolean.functionAlgebraicDegree_affineMap_coordinate_le_one_general {m n : ℕ} (L : FABL.F₂Cube n →ᵃ[FABL.𝔽₂] FABL.F₂Cube m) (i : Fin m) : (FABL.functionAlgebraicDegree fun x => L x i) ≤ 1
theorem CryptBoolean.functionAlgebraicDegree_affineMap_coordinate_le_one_general {m n : ℕ} (L : FABL.F₂Cube n →ᵃ[FABL.𝔽₂] FABL.F₂Cube m) (i : Fin m) : (FABL.functionAlgebraicDegree fun x => L x i) ≤ 1
Every coordinate of an affine map between binary cubes has algebraic degree at most one.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunityBounds.leancomplete
theorem CryptBoolean.functionAlgebraicDegree_anfMonomial_comp_affineMap_le_card_general {m n : ℕ} (L : FABL.F₂Cube n →ᵃ[FABL.𝔽₂] FABL.F₂Cube m) (S : Finset (Fin m)) : (FABL.functionAlgebraicDegree fun x => FABL.anfMonomial S (L x)) ≤ S.card
theorem CryptBoolean.functionAlgebraicDegree_anfMonomial_comp_affineMap_le_card_general {m n : ℕ} (L : FABL.F₂Cube n →ᵃ[FABL.𝔽₂] FABL.F₂Cube m) (S : Finset (Fin m)) : (FABL.functionAlgebraicDegree fun x => FABL.anfMonomial S (L x)) ≤ S.card
Substituting affine coordinates of a different ambient dimension into an ANF monomial does not increase its degree.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunityBounds.leancomplete
theorem CryptBoolean.functionAlgebraicDegree_comp_affineMap_le_general {m n : ℕ} (f : CryptBoolean.BooleanFunction m) (L : FABL.F₂Cube n →ᵃ[FABL.𝔽₂] FABL.F₂Cube m) : FABL.functionAlgebraicDegree (f ∘ ⇑L) ≤ FABL.functionAlgebraicDegree f
theorem CryptBoolean.functionAlgebraicDegree_comp_affineMap_le_general {m n : ℕ} (f : CryptBoolean.BooleanFunction m) (L : FABL.F₂Cube n →ᵃ[FABL.𝔽₂] FABL.F₂Cube m) : FABL.functionAlgebraicDegree (f ∘ ⇑L) ≤ FABL.functionAlgebraicDegree f
Composition with an affine map between binary cubes cannot increase algebraic degree.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunityBounds.leancomplete
theorem CryptBoolean.algebraicImmunity_comp_surjectiveAffineMap_le {m n : ℕ} (f : CryptBoolean.BooleanFunction m) (L : FABL.F₂Cube n →ᵃ[FABL.𝔽₂] FABL.F₂Cube m) (hL : Function.Surjective ⇑L) : CryptBoolean.algebraicImmunity (f ∘ ⇑L) ≤ CryptBoolean.algebraicImmunity f
theorem CryptBoolean.algebraicImmunity_comp_surjectiveAffineMap_le {m n : ℕ} (f : CryptBoolean.BooleanFunction m) (L : FABL.F₂Cube n →ᵃ[FABL.𝔽₂] FABL.F₂Cube m) (hL : Function.Surjective ⇑L) : CryptBoolean.algebraicImmunity (f ∘ ⇑L) ≤ CryptBoolean.algebraicImmunity f
Pulling a Boolean function back along a surjective affine map cannot increase algebraic immunity.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunityBounds.leancomplete
theorem CryptBoolean.algebraicImmunity_le_ceiling_half {n : ℕ} (f : CryptBoolean.BooleanFunction n) : CryptBoolean.algebraicImmunity f ≤ (n + 1) / 2
theorem CryptBoolean.algebraicImmunity_le_ceiling_half {n : ℕ} (f : CryptBoolean.BooleanFunction n) : CryptBoolean.algebraicImmunity f ≤ (n + 1) / 2
Carlet's universal algebraic-immunity bound `AI(f) ≤ ⌈n/2⌉`.
-
defdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunityBounds.leancomplete
def CryptBoolean.HasSurjectiveAffineFactorization {n : ℕ} (f : CryptBoolean.BooleanFunction n) (k : ℕ) : Prop
def CryptBoolean.HasSurjectiveAffineFactorization {n : ℕ} (f : CryptBoolean.BooleanFunction n) (k : ℕ) : Prop
A function factors through at most `k` affine coordinates when it is the pullback of a `k`-variable Boolean function along a surjective affine map.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunityBounds.leancomplete
theorem CryptBoolean.algebraicImmunity_le_ceiling_half_of_hasSurjectiveAffineFactorization {n k : ℕ} (f : CryptBoolean.BooleanFunction n) (hf : CryptBoolean.HasSurjectiveAffineFactorization f k) : CryptBoolean.algebraicImmunity f ≤ (k + 1) / 2
theorem CryptBoolean.algebraicImmunity_le_ceiling_half_of_hasSurjectiveAffineFactorization {n k : ℕ} (f : CryptBoolean.BooleanFunction n) (hf : CryptBoolean.HasSurjectiveAffineFactorization f k) : CryptBoolean.algebraicImmunity f ≤ (k + 1) / 2
Carlet's `k`-variable refinement: affine factorization through `k` coordinates gives `AI(f) ≤ ⌈k/2⌉`.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunityBounds.leancomplete
theorem CryptBoolean.hasSurjectiveAffineFactorization_of_hasSeparatedLinearStructureNormalForm {m k : ℕ} (f : CryptBoolean.BooleanFunction (m + k)) (hf : CryptBoolean.HasSeparatedLinearStructureNormalForm f) : CryptBoolean.HasSurjectiveAffineFactorization f m ∨ CryptBoolean.HasSurjectiveAffineFactorization f (m + 1)
theorem CryptBoolean.hasSurjectiveAffineFactorization_of_hasSeparatedLinearStructureNormalForm {m k : ℕ} (f : CryptBoolean.BooleanFunction (m + k)) (hf : CryptBoolean.HasSeparatedLinearStructureNormalForm f) : CryptBoolean.HasSurjectiveAffineFactorization f m ∨ CryptBoolean.HasSurjectiveAffineFactorization f (m + 1)
A separated linear-structure normal form with `m` nonlinear coordinates factors through `m` affine coordinates when its tail form vanishes, and through `m+1` otherwise.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunityBounds.leancomplete
theorem CryptBoolean.algebraicImmunity_le_ceiling_half_add_one_of_hasSeparatedLinearStructureNormalForm {m k : ℕ} (f : CryptBoolean.BooleanFunction (m + k)) (hf : CryptBoolean.HasSeparatedLinearStructureNormalForm f) : CryptBoolean.algebraicImmunity f ≤ (m + 2) / 2
theorem CryptBoolean.algebraicImmunity_le_ceiling_half_add_one_of_hasSeparatedLinearStructureNormalForm {m k : ℕ} (f : CryptBoolean.BooleanFunction (m + k)) (hf : CryptBoolean.HasSeparatedLinearStructureNormalForm f) : CryptBoolean.algebraicImmunity f ≤ (m + 2) / 2
Carlet's linear-kernel refinement: `m` nonlinear coordinates and an affine tail give `AI(f) ≤ ⌈m/2+1⌉ = ⌈(m+1)/2⌉`.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/AlgebraicImmunityBounds.leancomplete
theorem CryptBoolean.algebraicImmunity_le_ceiling_half_add_one_of_linearKernel_finrank_ge {m k : ℕ} (f : CryptBoolean.BooleanFunction (m + k)) (hk : k ≤ Module.finrank FABL.𝔽₂ ↥(CryptBoolean.linearKernel f)) : CryptBoolean.algebraicImmunity f ≤ (m + 2) / 2
theorem CryptBoolean.algebraicImmunity_le_ceiling_half_add_one_of_linearKernel_finrank_ge {m k : ℕ} (f : CryptBoolean.BooleanFunction (m + k)) (hk : k ≤ Module.finrank FABL.𝔽₂ ↥(CryptBoolean.linearKernel f)) : CryptBoolean.algebraicImmunity f ≤ (m + 2) / 2
If the linear kernel contains `k` independent directions in dimension `m+k`, then `AI(f) ≤ ⌈m/2+1⌉`.
Depending on at most k affine coordinates is equivalent to factorization
through a surjective affine map to V_k. The linear-kernel theorem has the
slightly stronger hypothesis that a contained
tail subspace of the stated dimension suffices, so equality of kernel dimension
is an immediate specialization.
-
CryptBoolean.two_pow_lt_sum_choose_add_sum_choose_of_add_ge[complete] -
CryptBoolean.sum_choose_add_sum_choose_gt_iff[complete] -
CryptBoolean.fastAlgebraicRelationLinearMap[complete] -
CryptBoolean.exists_fastAlgebraicRelation_of_add_ge[complete] -
CryptBoolean.IsFastAlgebraicallyOptimal[complete] -
CryptBoolean.isFastAlgebraicallyOptimal_iff_no_lowDegreeRelation[complete] -
CryptBoolean.algebraicImmunity_le_degree_of_mul_eq_of_ne_zero[complete]
Optimality against fast algebraic relations (Carlet, p. 63). If
\sum_{i=0}^{e}\binom ni+
\sum_{i=0}^{d}\binom ni>2^n,
equivalently e+d\ge n, then there exist g\ne0 and h with
fg=h, \deg(g)\le e, and \deg(h)\le d. The function f is optimal
against such relations when none exists with
\deg(g)+\deg(h)<n. Whenever fg=h\ne0, one also has
\deg(h)\ge\operatorname{AI}(f).
Lean code for Definition3.7.5●7 declarations
Associated Lean declarations
-
CryptBoolean.two_pow_lt_sum_choose_add_sum_choose_of_add_ge[complete]
-
CryptBoolean.sum_choose_add_sum_choose_gt_iff[complete]
-
CryptBoolean.fastAlgebraicRelationLinearMap[complete]
-
CryptBoolean.exists_fastAlgebraicRelation_of_add_ge[complete]
-
CryptBoolean.IsFastAlgebraicallyOptimal[complete]
-
CryptBoolean.isFastAlgebraicallyOptimal_iff_no_lowDegreeRelation[complete]
-
CryptBoolean.algebraicImmunity_le_degree_of_mul_eq_of_ne_zero[complete]
-
CryptBoolean.two_pow_lt_sum_choose_add_sum_choose_of_add_ge[complete] -
CryptBoolean.sum_choose_add_sum_choose_gt_iff[complete] -
CryptBoolean.fastAlgebraicRelationLinearMap[complete] -
CryptBoolean.exists_fastAlgebraicRelation_of_add_ge[complete] -
CryptBoolean.IsFastAlgebraicallyOptimal[complete] -
CryptBoolean.isFastAlgebraicallyOptimal_iff_no_lowDegreeRelation[complete] -
CryptBoolean.algebraicImmunity_le_degree_of_mul_eq_of_ne_zero[complete]
-
theoremdefined in CryptBoolean/Carlet/Chapter04/FastAlgebraic.leancomplete
theorem CryptBoolean.two_pow_lt_sum_choose_add_sum_choose_of_add_ge (n e d : ℕ) (hed : n ≤ e + d) : 2 ^ n < ∑ i ∈ Finset.range (e + 1), n.choose i + ∑ i ∈ Finset.range (d + 1), n.choose i
theorem CryptBoolean.two_pow_lt_sum_choose_add_sum_choose_of_add_ge (n e d : ℕ) (hed : n ≤ e + d) : 2 ^ n < ∑ i ∈ Finset.range (e + 1), n.choose i + ∑ i ∈ Finset.range (d + 1), n.choose i
The two low-degree coefficient counts exceed the Boolean-function-space dimension whenever the two degree bounds add to at least the number of variables.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/FastAlgebraic.leancomplete
theorem CryptBoolean.sum_choose_add_sum_choose_gt_iff (n e d : ℕ) : 2 ^ n < ∑ i ∈ Finset.range (e + 1), n.choose i + ∑ i ∈ Finset.range (d + 1), n.choose i ↔ n ≤ e + d
theorem CryptBoolean.sum_choose_add_sum_choose_gt_iff (n e d : ℕ) : 2 ^ n < ∑ i ∈ Finset.range (e + 1), n.choose i + ∑ i ∈ Finset.range (d + 1), n.choose i ↔ n ≤ e + d
Carlet's equivalent numerical form of the dimension condition.
-
defdefined in CryptBoolean/Carlet/Chapter04/FastAlgebraic.leancomplete
def CryptBoolean.fastAlgebraicRelationLinearMap {n : ℕ} (f : CryptBoolean.BooleanFunction n) (e d : ℕ) : ↥(CryptBoolean.reedMuller e n) × ↥(CryptBoolean.reedMuller d n) →ₗ[FABL.𝔽₂] CryptBoolean.BooleanFunction n
def CryptBoolean.fastAlgebraicRelationLinearMap {n : ℕ} (f : CryptBoolean.BooleanFunction n) (e d : ℕ) : ↥(CryptBoolean.reedMuller e n) × ↥(CryptBoolean.reedMuller d n) →ₗ[FABL.𝔽₂] CryptBoolean.BooleanFunction n
The linear map whose kernel consists of bounded-degree relations `f*g=h`.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/FastAlgebraic.leancomplete
theorem CryptBoolean.exists_fastAlgebraicRelation_of_add_ge {n e d : ℕ} (f : CryptBoolean.BooleanFunction n) (hed : n ≤ e + d) : ∃ g h, g ≠ 0 ∧ FABL.functionAlgebraicDegree g ≤ e ∧ FABL.functionAlgebraicDegree h ≤ d ∧ f * g = h
theorem CryptBoolean.exists_fastAlgebraicRelation_of_add_ge {n e d : ℕ} (f : CryptBoolean.BooleanFunction n) (hed : n ≤ e + d) : ∃ g h, g ≠ 0 ∧ FABL.functionAlgebraicDegree g ≤ e ∧ FABL.functionAlgebraicDegree h ≤ d ∧ f * g = h
Carlet's dimension argument: if `e+d≥n`, there is a nonzero `g` of degree at most `e` whose product with `f` has degree at most `d`.
-
defdefined in CryptBoolean/Carlet/Chapter04/FastAlgebraic.leancomplete
def CryptBoolean.IsFastAlgebraicallyOptimal {n : ℕ} (f : CryptBoolean.BooleanFunction n) : Prop
def CryptBoolean.IsFastAlgebraicallyOptimal {n : ℕ} (f : CryptBoolean.BooleanFunction n) : Prop
Optimality against fast algebraic attacks: every nonzero multiplicand relation has total degree at least `n`.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/FastAlgebraic.leancomplete
theorem CryptBoolean.isFastAlgebraicallyOptimal_iff_no_lowDegreeRelation {n : ℕ} (f : CryptBoolean.BooleanFunction n) : CryptBoolean.IsFastAlgebraicallyOptimal f ↔ ¬∃ g h, g ≠ 0 ∧ f * g = h ∧ FABL.functionAlgebraicDegree g + FABL.functionAlgebraicDegree h < n
theorem CryptBoolean.isFastAlgebraicallyOptimal_iff_no_lowDegreeRelation {n : ℕ} (f : CryptBoolean.BooleanFunction n) : CryptBoolean.IsFastAlgebraicallyOptimal f ↔ ¬∃ g h, g ≠ 0 ∧ f * g = h ∧ FABL.functionAlgebraicDegree g + FABL.functionAlgebraicDegree h < n
The quantified lower-bound definition is equivalent to absence of a subcritical relation.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/FastAlgebraic.leancomplete
theorem CryptBoolean.algebraicImmunity_le_degree_of_mul_eq_of_ne_zero {n : ℕ} (f g h : CryptBoolean.BooleanFunction n) (hrelation : f * g = h) (hh : h ≠ 0) : CryptBoolean.algebraicImmunity f ≤ FABL.functionAlgebraicDegree h
theorem CryptBoolean.algebraicImmunity_le_degree_of_mul_eq_of_ne_zero {n : ℕ} (f g h : CryptBoolean.BooleanFunction n) (hrelation : f * g = h) (hh : h ≠ 0) : CryptBoolean.algebraicImmunity f ≤ FABL.functionAlgebraicDegree h
A nonzero product in a fast algebraic relation has degree at least the algebraic immunity.