Construction of an S-Box Based on Chaotic and Bent Functions

: An S-box is the most important part of a symmetric encryption algorithm. Various schemes are put forward by using chaos theory. In this paper, a construction method of S-boxes with good cryptographic properties is proposed. The output of an S-box can be regarded as a group of Boolean functions. Therefore, we can use the different properties of chaos and Bent functions to generate a random Bent function with a high nonlinearity. By constructing a set of Bent functions as the output of an S-box, we can create an S-box with good cryptological properties. The nonlinearity, differential uniformity, strict avalanche criterion and the independence criterion of output bits are then analyzed and tested. A security analysis shows that the proposed S-box has excellent cryptographic


Introduction
With the rapid development of modern information technology, the popularity of computer and communication networks is more and more extensive. The problem of information security is becoming more and more prominent and is gradually becoming a problem that people cannot ignore. Information encryption technology plays an important role in modern information security communication, as a powerful weapon to protect the security of information. An S-box [1][2][3][4][5][6] is the only nonlinear component in many block cipher algorithms, which has the effect of scrambling the whole block cipher algorithm. Therefore, its cipher strength determines the security strength of the whole block cipher algorithm.
In recent years, many achievements have been made in the construction of chaotic S-boxes . In 2018, Eesa et al. [31] proposed a new method to construct a strong cryptographic bijective S-box based on the complex dynamics of a new hyperchaotic system. Lambić [32] proposed an S-box design method based on an improved one-dimensional discrete chaotic map, which took advantage of the special case of Lambić's chaotic map based on a permutation synthesis. In 2019, Zahid et al. [33] proposed an innovative technique to construct an S-box using cubic fractional transformation (CFT). Lu et al. [34] proposed a novel S-box design algorithm based on a new compound chaotic system, which was constructed by a concatenated Tent and Logistic chaotic system. In 2020, Chew et al. [35] proposed an S-box structure based on a linear fractional transformation and permutation function. Wang et al. [36] proposed a genetic algorithm for constructing biological S-boxes with a high nonlinearity. The main idea was to construct an S-box by combining the characteristics of a chaotic system and a swarm intelligence algorithm. Han et al. [37] superimposed the two chaotic maps Tent and Henon and introduced the idea of image scrambling into the design of the S-box, which enhanced the randomness of the key sequence of the ZUC stream cipher algorithm.
This paper presents an effective method to obtain chaotic S-boxes with important cryptographic properties. The principal innovation of this paper is to use a chaotic function to generate a chaotic Bent function [38][39][40][41]. This method considers that an S-box can be regarded as a group of Boolean functions. Therefore, we will design a finite number of random Bent functions by using the random distribution characteristics of logistic mapping. The output of several Bent functions then composes the S-box. In our research, the nonlinearity, differential uniformity, strict avalanche criterion and the independence criterion of output bits are analyzed and tested. A security analysis shows that the proposed S-box has important cryptographic properties.
Outline: in the second part, the definition and construction of the Bent function and the logistic discrete chaotic system are introduced. The third part introduces the construction method of the S-box based on the Bent function and logistic and the balancing method. The fourth part compares and analyzes the cryptographic characteristics of different S-box construction methods. Finally, in the fifth part, the paper is summarized. The algebraic normal form of an n-dimensional Boolean function:

Basic
If the set of all n-dimensional Boolean functions is recorded as B n , let x ∈ F n 2 . The number of f (x) = 1 is called the weight of the function f , which is recorded as W H ( f ). If an n-dimensional Boolean function f satisfies W H ( f ) = 2 n−1 , then the function is said to be balanced.
Let f , g ∈ B n , the Hamming distance of f and g, be defined as: where |A| represents the number of elements in set A.
It is easy to find: d( f , g) = W H ( f − g).

Definition of a Bent Function
Let f ∈ B n , the Fourier transform of function (−1) f (x) , be: where λ, x ∈ F n 2 , the inner product of λ, x, is defined as λ, Definition 2. Let f ∈ B n , if |F(λ)| = 1 for any λ ∈ F n 2 , then f (x) is called a Bent function.
Let f ∈ B n , then the Walsh transformation of f is: According to Definition 2 and Formula (4), if f satisfies W f (ω) = 2 n/2 , then f is a Bent function.

Maiorana MC Farland Type Multi Output Bent Function
The Maiorana MC Farland type Bent function is one of the most well-known basic construction types of Bent function. Rothaus [42], Maiorana, MC Farland [43] and Dillon [44] have made in-depth studies on the construction of this type of Bent function.
If n, m ≥ 1 are positive integers, then F : F n 2 → F m 2 functions can be expressed as a set of Boolean functions, F = ( f 1 , f 2 , . . . , f m ), f i ∈ B n , i = 1, 2, . . . , m and function F can be called multiple output Boolean functions, where f i , i = 1, 2, . . . , m is called the coordinate function of F.

Definition 3.
If the Boolean function f : F n/2 2 × F n/2 2 → F 2 has the form of Formula (5), then f is called the Maiorana MC Farland type Bent function.
where π is the permutation in F n/2 2 and g(x) is the Boolean function in any F n/2 2 .
where A is a state transition matrix of a n 2 level linear feedback shift register. If all f i , i = 1, 2, . . . , m are Maiorana MC Farland type Bent functions, F is called the Maiorana MC Farland type multi output Bent function.

Logistic Discrete Chaotic System
The proposed algorithm is based on the Bent functions incorporating chaos. We employed a one-dimensional logistic chaotic map due to its simplicity. The difference iteration equation of the logistic chaotic map is expressed as: In the formula (7), the initial value x 0 ∈ (0, 1) and system parameter is µ ∈ (0, 4] of the logistic chaotic map. The dynamic behavior of the logistic chaotic map is closely related to the system parameter µ.
The bifurcation characteristics of a logistic chaotic map are shown in Figure 1, which shows the two-dimensional relationship between the numerical distribution of the iterative chaotic sequence and the system parameter µ. Previous studies have shown that when 3.56994568 ≤ µ ≤ 4, most of the Lyapunov exponents of logistic chaotic maps are greater than 0 and they are in a chaotic state. At this time, with the increase of the µ value, the complexity of its dynamic behavior increases and the logistic map reaches the chaotic state through periodic doubling. In this range, there are several times when the Lyapunov exponent is less than 0. In this case, a period window will appear; that is, the mapping oscillates between certain values. Only when the system parameter µ = 4 will the iterative values be mapped to the whole [0,1] interval, which is called the full mapping state. The two-dimensional phase diagram of a logistic chaotic map is shown in Figure 2. When 4 μ = , the logistic chaotic map is in the shape of a steel helmet and its iterative values are distributed in the [0,1] interval. As the number of iterations increases, the cha- The two-dimensional phase diagram of a logistic chaotic map is shown in Figure 2. When µ = 4, the logistic chaotic map is in the shape of a steel helmet and its iterative values are distributed in the [0,1] interval. As the number of iterations increases, the chaotic trajectory becomes unpredictable and spreads to the whole phase space. Therefore, based on the above characteristics of the logistic chaotic map, we chose µ = 4 to construct our discrete chaotic system. The two-dimensional phase diagram of a logistic chaotic map is shown in Figure  When 4 μ = , the logistic chaotic map is in the shape of a steel helmet and its iterativ values are distributed in the [0,1] interval. As the number of iterations increases, the ch otic trajectory becomes unpredictable and spreads to the whole phase space. Therefor based on the above characteristics of the logistic chaotic map, we chose 4 μ = to con struct our discrete chaotic system.

Randomness Test
The randomness of digital chaotic sequences is an important index. The special pub lication 800-22 test set published by NIST was used to detect the different properties o random sequences. The test set has become the basic standard of sequence randomnes testing and has been adopted by many chaotic sequence researchers. In this paper, th threshold quantization method was used to quantify the logistic chaotic system. The NIS randomness test was carried out on the generated digital chaotic sequence and the influ ence of system parameters and sequence length on the randomness performance wa studied so as to provide a theoretical support for the construction of a digital chaotic s quence in an S-box.
Every index of NIST testing was obtained through a certain testing algorithm Whether the [0,1] P ∈ value of each index was greater than or equal to 0.01 was taken a the test result. If the P value met the test requirements, the specific value would be di played. If the p value did not meet the test requirements, it would be displayed as " *".

Randomness Test
The randomness of digital chaotic sequences is an important index. The special publication 800-22 test set published by NIST was used to detect the different properties of random sequences. The test set has become the basic standard of sequence randomness testing and has been adopted by many chaotic sequence researchers. In this paper, the threshold quantization method was used to quantify the logistic chaotic system. The NIST randomness test was carried out on the generated digital chaotic sequence and the influence of system parameters and sequence length on the randomness performance was studied so as to provide a theoretical support for the construction of a digital chaotic sequence in an S-box.
Every index of NIST testing was obtained through a certain testing algorithm. Whether the P ∈ [0, 1] value of each index was greater than or equal to 0.01 was taken as the test result. If the P value met the test requirements, the specific value would be displayed. If the p value did not meet the test requirements, it would be displayed as " * ". A larger p value indicated a better randomness of the tested sequence. Considering the size of running memory and the speed of running, the sample size was 100 and the test length was 1000 and 10,000 bits, respectively. To avoid contingency, three parameters of the system were selected for the logistic chaotic mapping.
The NIST test results of the logistic chaotic map under three sets of system parameters are shown in Table 1. When µ = 4 and µ = 3.9999, digital chaotic sequences of 1000 and 10,000 bits could pass ten NIST tests; when µ = 3.9, digital chaotic sequences of 1000 bits could pass ten NIST tests while the digital chaotic sequences of 10,000 bits could only pass three NIST tests. A NIST test showed that the one-dimensional discrete chaotic map logistic could achieve a better quantization effect when it was close to the full map and its random performance gradually decreased with the decrease of system parameters and the increase of the sequence length. Therefore, this paper chose µ = 4 to construct a logistic discrete chaotic system, which could meet the requirement of the randomness of a digital sequence.

The Construction of a Multi Output Bent Function Based on a Logistic Chaotic System
The main idea of this method was to construct a pseudo-random sequence generator by using the advantages of logistic mapping such as a high complexity, large parameter space and sensitivity to initial values. A large number of pseudo-random sequences with a good performance and great difference could be obtained by slightly changing the initial values and parameters. The pseudo-random sequence was quantized into a binary sequence to construct the Maiorana MC Farland type Bent function and then the highly nonlinear S-box was constructed.
The threshold quantization method was used in the selection of the value quantization method of the chaotic sequence. The specific quantization method can be expressed as the chaotic value in the interval (0,0.5) is quantized as 0 and the value in the interval [0.5,1) is quantized as 1. In Section 2.2.1, we tested the digital sequence generated by the threshold quantization method with NIST and the results showed that the sequence generated when µ = 4 met the requirement of randomness. The quantized binary sequence was taken as the constants and coefficients of g(x) in Equation (8).
Based on the Boolean function constructed by a chaotic sequence, eight Bent functions were constructed as the output of an 8 * 8 S-box.

Balancing Method
The S-box constructed in Section 3.1 did not meet the balance requirements. Therefore, the S-box needed to be processed.
The first step was to traverse all of the elements in the S-box. All duplicate outputs were found and all elements with the same output except the first element were replaced with 256.
The second step was to store the elements that did not exist in the S-box in the array B. B i was the i element in B.
Finally, we filled the elements in array B into the elements containing 256 in turn.

Construction of Chaotic S-Boxes with a High Nonlinearity
The structure of an S-box module based on an Maiorana MC Farland type Bent function and a discrete chaotic system is shown in Figure 3. According to the above method, the S-box generated based on a logistic chaotic system and a Bent function output is shown in Table 2. When the input was 00101000, the first four bits 0010 were 2 and the last four bits 1000 were 8. The corresponding output was the second row and the eighth column in the Table. The output data 1E were converted into the 8-bit binary number 00011110.  According to the above method, the S-box generated based on a logistic chaotic system and a Bent function output is shown in Table 2. When the input was 00101000, the first four bits 0010 were 2 and the last four bits 1000 were 8. The corresponding output was the second row and the eighth column in the Table. The output data 1E were converted into the 8-bit binary number 00011110.

Nonlinearity
The nonlinearity of the Boolean function refers to the distance between the Boolean function and the affine function. In order to resist the attack of linear cryptography, the distance between the Boolean function and the affine function should be as large as possible. The nonlinearity represented by the Walsh cyclic spectrum is defined as: It can be seen from the results in Table 3 that Ni was the nonlinearity of the Boolean function corresponding to each bit of the S-box. Compared with the S-box constructed by other chaotic systems, the proposed method had a higher than average nonlinearity. It could better resist the attack of optimal linear approximation.

Differential Uniformity
The uniformity of differential distribution is an important security index of the cryptographic function. The success of a differential cryptoanalysis is realized by the nonuniformity of the differential distribution of the Boolean function. The better the uniformity of difference, the stronger the ability to resist a differential attack. The index used to describe the uniformity of the differential distribution of the Boolean function is the differential uniformity. Generally, the differential approximation probability DP f is used to describe the input/output XOR distribution of f .
The smaller the difference uniformity DP f , the higher the security of the S-box. The following conclusion can be drawn from Table 4. It can be seen from Table 4a that the maximum value was 10 except in the first row and first column in the difference distribution table of the S-box in this paper. As can be seen from Table 4b, compared with other chaotic S-boxes, the differential approximation probability of the S-box in this paper was moderate, which showed that the S-box had a strong ability to resist a differential attack.

Strict Avalanche Criterion
The strict avalanche criterion is used to measure the randomness of the input change of an S-box to the output change. The avalanche characteristics indicates that if any bit in the input vector is flipped, the probability of the output bit flipping is close to 0.5 and then the S-box satisfies the strict avalanche criterion.
The following conclusions can be drawn from Table 5. Table 5a shows that there was no case where the input changed but the output did not change. As can be seen from Table 5b, compared with other chaotic S-boxes, the average value of the correlation matrix was closer to 0.5 so the S-boxes proposed in this paper satisfied more strict avalanche criteria than the others.

Independence Criterion of Output Bits
The method of measuring the output bit independence of an S-box was first proposed by Adams [45]. The definition of correlation is as follows. For the two output bits f i and f j (i = j, 1 ≤ i, j ≤ n) of an S-box. If f i ⊕ f j is highly nonlinear and satisfies the correlation requirement of the strict avalanche effect, the correlation coefficient of each output bit pair is close to 0 when one input bit is reversed. Therefore, the BIC performance of an S-box can be measured by calculating the nonlinearity of f i ⊕ f j and its satisfaction to SAC.

Conclusions
In this paper, we proposed the chaotic S-boxes to be used in symmetric encryption algorithms. The logistic chaotic map was employed along with Bent functions to give the elements of the S-boxes. This method made full use of the properties of chaotic functions. Logistic mapping was mainly used to generate Bent functions with high nonlinear values. We verified several security analyses such as nonlinearity, difference uniformity, strict avalanche criterion and the independence criterion of output bits. The results of the obtained S-box showed that all of the criteria for a good S-box were approximately fulfilled.