differential uniformity solution of exponential box

BelT cipher uses a Pseudo-exponential substitution box. The $$\lambda$$ and z values selected for the the BelT gives a differential uniformity of 8. $$\begin{equation} exp_\lambda,_z (x) = \begin{cases} 0 & \text{if \overline{x} =z }\\ \lambda^{x\boxplus+1} & \text{if \overline{x}

in Belt Sbox , the $$\lambda= w^7+w^3+w$$ where $$w$$ is is the generator of the multiplicative group of $$F_2[𝑥]/(𝑥^8 + 𝑥^6 + 𝑥^5 + 𝑥 + 1)$$, $$z$$ = 10, $$\oplus$$ is addition modulo 2 (xor).

The differential uniformity is computed using using $$F(x) \oplus F(x\oplus a) = b$$. I need help in finding number of b solutions in $$exp_\lambda,_{10} (x) \oplus exp_\lambda,_{10} (x\oplus a)=b$$

• Which universe are $\lambda,z$ and $x$ living in? What is that strange character in the exponent of the second (middle) case? What is the meaning of $\oplus$ in your context? What does $\overline{x}$ mean here? AFAIK none of these are standard, so you should explain them. In the question body so that all the readers can see them. – Jyrki Lahtonen Feb 17 at 10:53
• modified to include values used in BelT sbox , ref : Exponential S-Boxes: a Link Between the S-Boxes of BelT and Kuznyechik/Streebog – hardyrama Feb 17 at 13:18
• So $x$ is an integer (given that appears in the exponent)? Yet we do bitwise XOR with it? And the function is defined piecewise. And I still don't know what that strange exponent. Apparently $\w$ is a zero of that octic. Anyway, bitwise XOR with integer exponents basically randomizes everything. That may be ok for crypto applications, desirable even. But it makes any algebraic analysis of differential uniformity impossible (AFAICT). I think that the fastest way is to brute force this. There are only 8 bits in the selection of each of $x$, $a$, $b$. Just crunch them out :-( – Jyrki Lahtonen Feb 17 at 14:59