{"id":"c8f70c25-3c42-452a-93e4-9d353ef3d1c0","arxiv_id":"1908.07445","paper_version":1,"verdict":"ACCEPT","confidence":"MODERATE","novelty_score":7.0,"correctness_risk":"low","formal_verification":"none","parameter_count":0,"one_line_summary":"The DLCT of a vectorial Boolean function is half its autocorrelation table, and this identification yields new bounds, divisibility rules, and exact spectra for important S-box families.","lead":"The paper shows that the differential-linear connectivity table, a tool for analyzing block cipher attacks, is exactly half the autocorrelation table of a vectorial Boolean function, and it uses that link to prove bounds and spectral properties. Cryptographers designing or evaluating S-boxes can use these results to estimate resistance to differential-linear attacks without simulating full ciphers.","discovery_kind":"first_principles","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Proposition 3's identity sum ACF = 2^{m+n} is false for non-permutation functions; Theorem 1 is unaffected but the DDT characterization needs qualification.","rationale":"I verified the paper's central claim: Proposition 1 (DLCT = ACT/2) is an immediate consequence of the definitions and is proven cleanly, and Theorem 1's lower bound on the absolute indicator follows correctly from Proposition 4's row-sum inequality. I found no error in these arguments. The reader's weakest assumption about the external Leander-Poschmann classification is a legitimate dependency for Table II, but it is not a correctness flaw in the DLCT-autocorrelation equivalence. My main concern is different: Proposition 3 contains a false identity. The paper states sum_{u,v} ACF(u,v) = 2^{m+n}, but for non-injective functions the total is 2^m * sum_z |F^{-1}(z)|^2, which generally differs from 2^{m+n}. This does not invalidate Theorem 1, but it is a concrete error in the paper's claimed characterization of the DLCT via the DDT. The fix is straightforward: restrict the identity to permutations or state the correct formula. Because the error is isolated and correctable, I recommend CONDITIONAL acceptance rather than rejection or unconditional acceptance.","tokens_in":21079,"tokens_out":19965,"duration_ms":182966,"concrete_test":"Verify the disputed identity with a two-line computation: take n=m=1 and F(x)=0. Compute ACF(u,v) = sum_x (-1)^{v(F(x)+F(x+u))} = 2 for all (u,v). The sum over u,v is 8, while 2^{m+n}=4. Confirm that the total equals 2^m * sum_z |F^{-1}(z)|^2, and thus Proposition 3 as stated holds only for permutations.","verdict_should_be":"CONDITIONAL","load_bearing_attack":"Proposition 3 claims that summing ACF(u,v) over all u and v gives 2^{m+n}. This is not true for general (n,m)-functions. From the preceding identity sum_v ACF(u,v) = 2^m DDT(u,0), the total sum equals 2^m sum_u DDT(u,0) = 2^m sum_{z in F_2^m} |F^{-1}(z)|^2. This equals 2^{m+n} only when every fiber has size 1, i.e., when F is a permutation. For a constant function F: F_2 -> F_2, each ACF entry is 2, so the total is 8, whereas 2^{m+n}=4. The error is isolated: the proofs of Proposition 1 and Theorem 1 do not use this total-sum identity. However, because the paper explicitly presents Proposition 3 as part of its characterization of the DLCT/autocorrelation via the DDT, the false statement is a genuine correctness defect that should be corrected by either restricting the identity to permutations or removing it.","agreement_with_reader":"partial"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper studies the differential-linear connectivity table (DLCT) of vectorial Boolean functions and proves that DLCT_F(u,v) = (1/2)AC_F(u,v), where AC_F is the autocorrelation function. It then characterizes the autocorrelation in terms of the Walsh transform and the DDT, derives a lower bound on the absolute indicator for (n,m)-functions with m≥n, establishes divisibility properties, and analyzes invariance under affine, EA, and CCZ equivalence. It exhaustively lists the autocorrelation spectra of optimal 4-bit S-boxes using the Leander–Poschmann classification. The paper also gives results for APN, plateaued, AB functions, and for specific polynomial families including Gold, Kasami, Welch, Bracken–Leander, quadratic, and inverse functions.","tokens_in":21220,"tokens_out":31187,"duration_ms":244928,"significance":"The equivalence between DLCT and autocorrelation is a clean and useful bridge that lets cryptanalysts transfer the extensive autocorrelation theory to differential-linear attacks. The lower bound Δ_F ≥ sqrt((2^{m+n+1}-2^{2n})/(2^m-1)) for m≥n is a new generic result, and the exhaustive table of autocorrelation spectra for optimal 4-bit S-boxes is a practical reference. The connections for APN and AB functions to Walsh transforms of balanced or dual Boolean functions are elegant and likely to stimulate further work. The paper does not provide machine-checked proofs or code, but the derivations are standard and reproducible. The main theoretical claims are sound, although a few local errors need correction.","major_comments":[],"minor_comments":[{"comment":"The displayed identity ∑_{u∈F2^n,v∈F2^m} ACF(u,v) = 2^{m+n} is not true for a general (n,m)-function. Summing the preceding identity ∑_v ACF(u,v) = 2^m DDT(u,0) over all u yields 2^m ∑_{z∈Im F}|F^{-1}(z)|^2, which equals 2^{m+n} only when every fiber of F has size 1, i.e., when F is a permutation. For the constant function F: F2 → F2, every ACF entry is 2 and the total sum is 8, not 4. Please restrict the identity to permutations or remove it; this error does not affect the proofs of Theorem 1 or Proposition 4.","section":"Section 3-B, Proposition 3"},{"comment":"In the first displayed formula, the term ACF(u,v) inside the sum should be ACF(ω,v); the proof correctly uses ACF(ω,v). Please correct the statement.","section":"Section 3-A, Proposition 2"},{"comment":"The formulas ACF(u,v) = -2^{2r_v-n-1} W_{\\tilde f_v}(u) and ACF(u,v) = -W_{γ_u}(v) are derived under the assumption u≠0 and v≠0, respectively, using the fact that the total Walsh sum is zero. For u=0 or v=0 the formulas fail. Since the autocorrelation spectrum excludes u=0 and v=0, please state the restriction explicitly.","section":"Section 3-F, Propositions 7 and 8"},{"comment":"The exponent in the statement appears as 2^{n+d(u,v)/2}; from the proof it should be 2^{(n+d(u,v))/2}. Also, the definition of d(u,v) should clarify that the nonzero case corresponds to the derivative being identically zero on the subspace, and the role of the constant c should be specified precisely.","section":"Section 3-D, Proposition 6"},{"comment":"The proof states that φ_v is linear on ker(L_v) 'by direct computations'. This is a key step, and the paper should either provide the computation or give a reference, so that the reader can verify the linearity claim.","section":"Section 4-A, Theorem 3"},{"comment":"The cited divisibility theorem for Walsh transforms is stated as 'degree d ... divisible by 2^{⌈ n/(d−1) ⌉}', but the subsequent application uses 2^{⌈ (n−1)/(d−1) ⌉} for a function of degree at most d−1, which suggests the exponent in the theorem statement should be corrected (likely 2^{⌈ n/d ⌉}). Please check the original source and fix the typo.","section":"Section 3-D, Proposition 5"},{"comment":"The notation for the spectra (e.g., '-860') is not defined; please clarify that the subscripts indicate multiplicities, or reformat the table for readability.","section":"Table II"},{"comment":"The exhaustive claim for optimal 4-bit S-boxes depends on the completeness of the Leander–Poschmann classification [27]; the paper should explicitly state that the completeness is cited rather than re-derived, and that the spectra were computed from the listed representatives.","section":"Section 3-E"}],"recommendation":"minor_revision","confidential_remarks":"The paper is a merged version of two preprints (eprint 2019/848 and arXiv:1907.05986), which the authors disclose. The main theoretical claims are sound, and the DLCT–autocorrelation equivalence is the central contribution. The false identity in Proposition 3 is a genuine error but is local and does not affect the main theorems; it must be corrected before acceptance. The other issues are presentation or precision problems. A minor revision is appropriate."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Colleague, this paper is worth a serious referee. The central identification DLCT = ACT/2 is simple but useful, and it lets the authors pull in the existing autocorrelation machinery. The new bound Δ_F ≥ sqrt(...) for m≥n, the divisibility by 8 for permutations, and the exact spectra for Gold, Kasami, Bracken-Leander and inverses of quadratic APN permutations are genuine additions. The disclosure that it merges two preprints is honest, and the derivations are mostly clean and self-contained.\n\nSoft spots, in order of size. First, Proposition 3's total-sum identity is false for non-permutations. The identity sum_v ACF(u,v) = 2^m DDT(u,0) is correct, but summing over u gives 2^m * sum_z |F^{-1}(z)|^2, not 2^{m+n}, unless F is a permutation. For a constant (1,1)-function the total is 8, not 4. This is a genuine defect in the text, though it is isolated: none of the main theorems (Theorem 1, divisibility, spectra) rely on it. It should be fixed by either restricting the statement to permutations or removing the line.\n\nSecond, Proposition 2 has a subscript typo: the Fourier identity should have ACF(ω,v), not ACF(u,v), in the sum. Clearly a typo, but confusing.\n\nThird, Theorem 3's proof invokes 'direct computations' to show φ_v is linear on ker(L_v). That is a real gap, but given the rest of the proof and the small example, I suspect it is fillable; a referee should ask for the details.\n\nThe reliance on the Leander-Poschmann classification for the exhaustive Table II is fine; that classification is well established. The paper also honestly notes that some results are merged from the authors' own preprints, so novelty is scoped correctly.\n\nOverall the math is sound where it matters. The paper is a solid contribution to symmetric cryptanalysis theory, and it will be useful to anyone working with differential-linear attacks or autocorrelation spectra of vectorial Boolean functions. It deserves peer review, with the Proposition 3 issue flagged as a required correction.","headline":"Solid theory paper connecting DLCT to autocorrelation; main results hold, but Proposition 3 contains a real (if isolated) error that should be corrected.","tokens_in":21773,"tokens_out":2855,"would_cite":true,"duration_ms":24810,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["94A60","06E30","11T71"],"pacs":[],"model":"deepseek-v4-flash","headline":"The DLCT is half the autocorrelation table of the cryptographic S-box.","keywords":["differential-linear connectivity table","autocorrelation table","absolute indicator","vectorial Boolean functions","Walsh transform","differential distribution table","S-box classification","APN functions"],"falsifier":"Compute the DLCT and autocorrelation tables directly from the definitions for any explicit S-box, for instance the inverse map $x\\mapsto x^{-1}$ on $\\mathbb F_{2^8}$; if any entry fails $DLCT_F(u,v)=\\frac12 AC_F(u,v)$, Proposition 1 is false. To test the lower bound, search exhaustively or by large random sampling among $(6,6)$-permutations for one whose absolute indicator is $8$; since the theorem requires $\\Delta_F>2^{6/2}=8$, such a permutation would refute it.","tokens_in":20861,"feed_emoji":"🧮","tokens_out":10778,"duration_ms":100130,"temperature":0.7,"pith_summary":"The paper's central claim is that the differential-linear connectivity table (DLCT), introduced as a cryptanalytic tool for differential-linear attacks, is not a new table at all: for every input difference $u$ and output mask $v$, the entry $DLCT_F(u,v)$ equals half the autocorrelation coefficient $AC_F(u,v)=\\sum_x (-1)^{v\\cdot(F(x)+F(x+u))}$ of the same vectorial Boolean function $F$. This identification makes the largest DLCT entry equal to half the classical absolute indicator, and the paper proves a generic lower bound on that indicator for any function with at least as many output bits as input bits. For permutations the bound is strictly above $2^{n/2}$, and the table entries are constrained by a divisibility law. The paper then maps the table's behaviour under the standard equivalence relations, gives the complete list of DLCT spectra for optimal 4-bit S-boxes, and expresses the table of APN, plateaued, and almost-bent functions through Walsh transforms of auxiliary Boolean functions. The payoff is that differential-linear correlations can be studied with the existing autocorrelation theory rather than as a separate phenomenon.","feed_headline":"The DLCT is half the autocorrelation table","feed_subtitle":"A cryptanalytic tool for differential-linear attacks turns out to be a classical object, so old bounds apply.","key_machinery":"The carrying object is the autocorrelation table of a vectorial Boolean function, defined by $AC_F(u,v)=\\sum_{x\\in\\mathbb F_2^n}(-1)^{v\\cdot(F(x)+F(x+u))}$, whose entries the DLCT matches up to the factor $1/2$. The two workhorse identities are the Fourier relation between $AC_F$ and the squared Walsh transform $W_F(\\omega,v)^2$, and the Fourier duality between each row of the autocorrelation table and the corresponding row of the differential distribution table. These identities let the paper convert known autocorrelation bounds into DLCT bounds, force divisibility of the entries from the algebraic degree, and express the tables of APN, plateaued, and AB functions as Walsh transforms of auxiliary Boolean functions.","core_discovery":"On its own terms, the paper establishes that the DLCT is the autocorrelation table up to a constant factor: $DLCT_F(u,v) = \\frac{1}{2}AC_F(u,v)$ for all $(u,v)$, so $\\max_{u\\neq 0, v\\neq 0}|DLCT_F(u,v)|=\\Delta_F/2$ where $\\Delta_F$ is the absolute indicator. It proves the Fourier identity $AC_F(u,v)=2^{-n}\\sum_{\\omega\\in\\mathbb F_2^n}(-1)^{u\\cdot\\omega}W_F(\\omega,v)^2$ and the dual relation with the differential distribution table, and from these derives $\\Delta_F \\ge \\sqrt{(2^{m+n+1}-2^{2n})/(2^m-1)}$ whenever $m\\ge n$; for $(n,n)$-permutations this says $\\Delta_F>2^{n/2}$. It also shows that for permutations the autocorrelation entries are divisible by $8$, hence DLCT entries by $4$, that the autocorrelation spectrum is affine-invariant and its absolute version EA-invariant but not CCZ-invariant, and that the optimal 4-bit S-boxes have exactly three possible DLCT spectra. For APN, plateaued, and AB functions the autocorrelation is shown to be, up to sign and a power of two, the Walsh transform of a balanced Boolean function attached to the function.","pith_inferences":["Not stated in the paper: the classical global-avalanche-characteristics criteria for Boolean functions can be reinterpreted, column by column, as design criteria for differential-linear resistance of S-boxes.","Not stated in the paper: because the DLCT spectrum is not CCZ-invariant while differential uniformity and nonlinearity are, the table can distinguish some CCZ-equivalent S-boxes, making it a candidate invariant for S-box classification.","Not stated in the paper: combining the lower bound with the divisibility law suggests the true minimal absolute indicator for small permutations is larger than the generic bound, and an exhaustive search at $n=6$ would give the exact value.","A testable extension beyond the paper: compute DLCT spectra for the known optimal 6-bit and 8-bit S-box families directly from autocorrelation, avoiding new attack simulations."],"forward_implications":["Any known bound or construction for the absolute indicator of vectorial Boolean functions transfers directly to the largest DLCT entry, so the DLCT inherits a mature theory instead of starting from scratch.","Every $(n,n)$-permutation has some nonzero input difference and output mask with $|DLCT|>2^{n/2-1}$, and every such entry is divisible by $4$; both facts constrain what differential-linear distinguishers can achieve.","The DLCT spectrum is affine-invariant and its absolute spectrum is EA-invariant, so it can be used as a fingerprint in S-box classification, while two CCZ-equivalent functions may have different tables.","For APN functions, the DLCT is determined by the Walsh transform of the indicator of the image of the derivative; hence the question of how small the DLCT can be for an APN function is the same as the question of the linearity of balanced Boolean functions.","For quadratic functions the DLCT entries lie in $\\{0,\\pm 2^n\\}$, or smaller subsets for Gold monomials, which means these functions either have no differential-linear correlation for a given pair or have the maximum possible one."],"supporting_citations":[{"why":"introduces the DLCT definition that Proposition 1 rewrites as half the autocorrelation coefficient.","marker":"[1]"},{"why":"defines the autocorrelation table for vectorial Boolean functions, the object the DLCT is shown to equal up to a factor 2.","marker":"[44]"},{"why":"supplies the absolute indicator for Boolean functions, whose vectorial extension the paper uses to bound the DLCT maximum.","marker":"[43]"},{"why":"defines differential uniformity, the quantity used in the Cauchy-Schwarz argument that yields the absolute-indicator lower bound.","marker":"[35]"},{"why":"provides the completeness of the 16-class optimal 4-bit S-box classification that the paper's exhaustive DLCT spectrum table depends on.","marker":"[27]"}],"fun_headline_variants":["DLCT = half the autocorrelation table, so old bounds apply","Autocorrelation table halved yields the DLCT","DLCT is autocorrelation scaled by one half","Differential-linear table: half of autocorrelation table","Old bounds apply: DLCT is just halved autocorrelation"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The exhaustive DLCT spectra claimed for optimal 4-bit S-boxes inherit the completeness of the external classification that every optimal 4-bit S-box is equivalent to one of sixteen representatives; the paper computes autocorrelation spectra from those representatives but does not re-derive the classification itself.","fun_headline_variants_meta":{"raw":{"variants":["DLCT = half the autocorrelation table, so old bounds apply","Autocorrelation table halved yields the DLCT","DLCT is autocorrelation scaled by one half","Differential-linear table: half of autocorrelation table","Old bounds apply: DLCT is just halved autocorrelation"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000539,"raw_usage":{"total_tokens":2694,"prompt_tokens":1164,"completion_tokens":1530,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":780,"completion_tokens_details":{"reasoning_tokens":1450}},"tokens_in":780,"tokens_out":1530,"duration_ms":10124,"temperature":1.0,"reasoning_tokens":1450,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T12:52:25.691512+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Compute the DLCT and autocorrelation tables directly from the definitions for any explicit S-box, for instance the inverse map $x\\mapsto x^{-1}$ on $\\mathbb F_{2^8}$; if any entry fails $DLCT_F(u,v)=\\frac12 AC_F(u,v)$, Proposition 1 is false. To test the lower bound, search exhaustively or by large random sampling among $(6,6)$-permutations for one whose absolute indicator is $8$; since the theorem requires $\\Delta_F>2^{6/2}=8$, such a permutation would refute it.","supporting_citations":[{"cited_title":"DLCT: A new tool for differential-linear cryptanal ysis","cited_arxiv_id":null,"evidence_quote":"introduces the DLCT definition that Proposition 1 rewrites as half the autocorrelation coefficient."},{"cited_title":"Relatin g differential distribution tables to other properties of o f substitution boxes","cited_arxiv_id":null,"evidence_quote":"defines the autocorrelation table for vectorial Boolean functions, the object the DLCT is shown to equal up to a factor 2."},{"cited_title":"GAC — the criterion for global avalanche characteristics of cryptographic functi ons","cited_arxiv_id":null,"evidence_quote":"supplies the absolute indicator for Boolean functions, whose vectorial extension the paper uses to bound the DLCT maximum."},{"cited_title":"Differentially uniform mappings for cry ptography","cited_arxiv_id":null,"evidence_quote":"defines differential uniformity, the quantity used in the Cauchy-Schwarz argument that yields the absolute-indicator lower bound."},{"cited_title":"On the classificatio n of 4 bit S-boxes","cited_arxiv_id":null,"evidence_quote":"provides the completeness of the 16-class optimal 4-bit S-box classification that the paper's exhaustive DLCT spectrum table depends on."}],"review_version":1}