DLCT: Differential-Linear Connectivity Table

• DLCT is a table-valued criterion for vectorial Boolean functions that quantifies the preservation of linear relations across derivatives.
• It is identified as half the vectorial autocorrelation table, thereby connecting Walsh analysis, the differential distribution table, and spectral methods.
• DLCT provides actionable insights into S-box analysis and function equivalence with clear bounds, divisibility properties, and explicit formulas for various function classes.

The differential-linear connectivity table (DLCT) is a table-valued criterion for vectorial Boolean functions that quantifies, for each input difference $u$ and output mask $v$, how often the linear relation defined by $v$ is preserved across the derivative $F(x)+F(x+u)$. Introduced in the context of differential-linear cryptanalysis at EUROCRYPT'19 by Bar-On et al., it was subsequently characterized as an autocorrelation object rather than an isolated cryptanalytic construction. In particular, for an $(n,m)$-function $F:\mathbb F_2^n\to\mathbb F_2^m$, the 2019 characterization shows that the DLCT differs from the vectorial autocorrelation table only by a factor of $2$, which immediately connects DLCT to Walsh analysis, the differential distribution table (DDT), equivalence theory, and family-specific spectral calculations (Canteaut et al., 2019).

1. Formal definition and basic parameters

For an $(n,m)$-function $F:\mathbb F_2^n\to\mathbb F_2^m$, the DLCT entry at $(u,v)$ is

$v$0

where $v$1 indexes the row and $v$2 indexes the column. Equivalently, with $v$3, the DLCT measures the correlation between the output difference $v$4 and the linear mask $v$5. In the attack setting, this statistic captures the dependency between the differential trail in an early subcipher and the linear approximation in a later subcipher, replacing the heuristic independence assumptions of classical differential-linear cryptanalysis (Xie et al., 2 Aug 2025).

The associated spectrum is the multiset

$v$6

and the differential-linear uniformity is

$v$7

As immediate elementary properties, for $v$8, $v$9 is even; $v$0; and if $v$1 or $v$2, then $v$3 (Canteaut et al., 2019).

These definitions place DLCT alongside differential uniformity and nonlinearity as a criterion for S-box analysis, but its semantics are distinct: it is designed to track a mixed differential-linear dependency rather than a purely differential or purely linear effect.

2. Identification with vectorial autocorrelation

The central structural fact is that DLCT is exactly half of the vectorial additive autocorrelation. For a vectorial Boolean function $v$4, the autocorrelation at $v$5 is

$v$6

The basic identity is

$v$7

equivalently

$v$8

Thus the DLCT spectrum is the autocorrelation spectrum scaled by $v$9, and

$F(x)+F(x+u)$0

where $F(x)+F(x+u)$1 is the absolute indicator (Canteaut et al., 2019).

This identification is the main conceptual re-framing of the subject. It means that the DLCT is not an ad hoc table specific to one attack paradigm; rather, it is a normalized autocorrelation table for vectorial Boolean functions. A direct consequence is that every general statement about vectorial autocorrelation translates immediately into a statement about the DLCT, up to the factor $F(x)+F(x+u)$2. This includes spectral identities, lower bounds, divisibility phenomena, and invariance properties.

A related characterization appears in the follow-up 2019 treatment under the terminology “generalized additive autocorrelation,” which also defines the autocorrelation spectrum, the absolute indicator, and the sum-of-squares indicator as the natural companions of DLCT-based analysis (Li et al., 2019).

3. Harmonic and differential characterizations

The autocorrelation, and hence the DLCT, admits two complementary Fourier descriptions: one through the Walsh transform of component functions and one through the DDT. For the Walsh transform,

$F(x)+F(x+u)$3

and therefore

$F(x)+F(x+u)$4

The derived summation identities

$F(x)+F(x+u)$5

and

$F(x)+F(x+u)$6

show that autocorrelation is controlled by the distribution of squared Walsh coefficients. The same relation is written directly for DLCT in the follow-up paper as

$F(x)+F(x+u)$7

together with the identities

$F(x)+F(x+u)$8

and a fourth-moment expression for the sum of squared DLCT values (Canteaut et al., 2019).

The differential description is equally direct. If

$F(x)+F(x+u)$9

then

$(n,m)$0

with inverse

$(n,m)$1

Accordingly, for fixed $(n,m)$2, the DLCT row is the Walsh transform across the output-mask variable of the corresponding DDT row. The identities

$(n,m)$3

and

$(n,m)$4

make the second-moment relation explicit (Canteaut et al., 2019).

A useful interpretation follows directly from these formulas: the DLCT is a linearized transform of derivative distributions. This suggests that it interpolates between linear and differential criteria rather than replacing either of them.

4. Bounds, divisibility, and equivalence behavior

The 2019 theory establishes generic lower bounds on the maximum DLCT magnitude. If $(n,m)$5, then

$(n,m)$6

For the square case $(n,m)$7, this yields

$(n,m)$8

and because $(n,m)$9 is even when $F:\mathbb F_2^n\to\mathbb F_2^m$0, the discussion gives the sharper corollary

$F:\mathbb F_2^n\to\mathbb F_2^m$1

At the autocorrelation level, the corresponding statement is that for $F:\mathbb F_2^n\to\mathbb F_2^m$2-functions with $F:\mathbb F_2^n\to\mathbb F_2^m$3, the absolute indicator is bounded below, and in particular for $F:\mathbb F_2^n\to\mathbb F_2^m$4, $F:\mathbb F_2^n\to\mathbb F_2^m$5 (Li et al., 2019, Canteaut et al., 2019).

A stronger row-wise statement precedes this global bound: $F:\mathbb F_2^n\to\mathbb F_2^m$6 with equality for all nonzero $F:\mathbb F_2^n\to\mathbb F_2^m$7 if and only if $F:\mathbb F_2^n\to\mathbb F_2^m$8 is APN. This makes APN functions extremal for a natural quadratic aggregate of DLCT values, not merely for ordinary differential uniformity (Canteaut et al., 2019).

The same paper proves a divisibility result: if $F:\mathbb F_2^n\to\mathbb F_2^m$9 and $2$0, then for all $2$1,

$2$2

In particular, for an $2$3-permutation, all autocorrelation and DLCT entries are divisible by $2$4 (Canteaut et al., 2019).

Equivalence theory is more nuanced than for differential uniformity. Affine equivalence preserves the autocorrelation spectrum; EA equivalence preserves the extended autocorrelation spectrum $2$5 and therefore preserves DLU; but CCZ equivalence does not preserve the autocorrelation spectrum in general (Canteaut et al., 2019). The follow-up paper makes the corresponding DLCT statements explicit: DLU is EA invariant, the DLCT spectrum is affine invariant, the spectrum is not EA invariant, and DLU is not CCZ invariant. Its counterexample uses the CCZ-equivalent pair $2$6 and $2$7 over $2$8, for which the spectra and DLU values differ (Li et al., 2019).

These results rule out a common overgeneralization: DLCT-based quantities do not align with the full invariance profile of differential uniformity under CCZ equivalence.

5. Special function classes and explicit structural formulas

Several standard classes of vectorial Boolean functions admit closed DLCT descriptions. For plateaued functions, if a component $2$9 has Walsh amplitude $(n,m)$0 and $(n,m)$1 denotes the support indicator of its nonzero Walsh coefficients, then

$(n,m)$2

For AB functions, where $(n,m)$3, this simplifies to

$(n,m)$4

Accordingly, the autocorrelation, and hence the DLCT, is determined by the Walsh transform of a Boolean support indicator (Canteaut et al., 2019).

For APN permutations, define

$(n,m)$5

Then

$(n,m)$6

Since $(n,m)$7 is balanced, the paper derives the corollary that if there exists an APN function over $(n,m)$8 with absolute indicator $(n,m)$9, then there exists a balanced Boolean function of $F:\mathbb F_2^n\to\mathbb F_2^m$0 variables with linearity $F:\mathbb F_2^n\to\mathbb F_2^m$1. This transfers lower bounds from balanced Boolean functions to APN vectorial functions (Canteaut et al., 2019).

Monomials are especially tractable. For $F:\mathbb F_2^n\to\mathbb F_2^m$2,

$F:\mathbb F_2^n\to\mathbb F_2^m$3

and if $F:\mathbb F_2^n\to\mathbb F_2^m$4, then also

$F:\mathbb F_2^n\to\mathbb F_2^m$5

Thus for monomial permutations the entire spectrum is determined by a single slice (Canteaut et al., 2019). The 2025 construction paper uses the equivalent identity

$F:\mathbb F_2^n\to\mathbb F_2^m$6

to reduce DLU estimation for power functions to the row $F:\mathbb F_2^n\to\mathbb F_2^m$7 (Xie et al., 2 Aug 2025).

For quadratic and related low-degree families, the available statements are highly rigid. For general quadratic polynomials of the displayed form in the 2019 paper, $F:\mathbb F_2^n\to\mathbb F_2^m$8 and $F:\mathbb F_2^n\to\mathbb F_2^m$9. The follow-up paper expresses the corresponding DLCT version for quadratic $(u,v)$0-functions as

$(u,v)$1

For Gold functions $(u,v)$2, the spectrum depends on the parity of $(u,v)$3 (Canteaut et al., 2019, Li et al., 2019).

The inverse function and inverses of quadratic APN permutations form another major theme. For $(u,v)$4, the spectrum is expressed through Kloosterman sums: $(u,v)$5 and for even $(u,v)$6,

$(u,v)$7

At the DLCT level, the follow-up paper states that for even $(u,v)$8,

$(u,v)$9

For odd $v$00, the 2019 characterization relates $v$01 to the linearity $v$02 modulo $v$03 (Canteaut et al., 2019, Li et al., 2019).

Finally, if $v$04 is a quadratic APN permutation in odd dimension and $v$05 is defined by

$v$06

then

$v$07

Hence $v$08 is the linearity of $v$09, and for inverses of Gold APN permutations the absolute indicator is strictly larger than $v$10 when $v$11 (Canteaut et al., 2019).

6. Exhaustive small-dimension results and later low-DLU constructions

The complete affine-equivalence classification of optimal $v$12 S-boxes by Leander and Poschmann yields a finite benchmark for DLCT behavior. Under affine equivalence, the 16 optimal classes split into three autocorrelation spectrum types: $v$13

$v$14

and

$v$15

Equivalently, at the DLCT level, the same 16 classes fall into two spectrum types,

$v$16

and

$v$17

Thus optimal $v$18-bit S-boxes occupy only a very small number of DLCT-spectrum classes (Canteaut et al., 2019, Li et al., 2019).

The 2025 work extends the subject from characterization to construction. For the cubic power family

$v$19

with $v$20, it proves

$v$21

and

$v$22

For $v$23, this becomes

$v$24

and the table for $v$25 over $v$26 gives the computed values

$v$27

The proof strategy is to square the relevant character sum and bound the kernel of an induced linearized operator (Xie et al., 2 Aug 2025).

A second family is the Dillon-type monomial

$v$28

Here the DLCT is transformed into a character sum over the unit circle $v$29, leading to an explicit DLU formula in terms of the maximum binary Kloosterman sum $v$30. The paper reports the experimental DLU values for $v$31, $v$32, as

$v$33

matching the theorem (Xie et al., 2 Aug 2025).

The same paper shows that adding an arbitrary quadratic function to the cubic family does not worsen the DLU upper bound: $v$34 satisfies the same parity-dependent estimate as the base cubic function. It also proves a general perturbation principle for generalized cyclotomic mappings: if a function is modified on $v$35 points, then

$v$36

with the one-point corollary

$v$37

Applied to the inverse function in even dimension, this gives $v$38, and if the modified point is $v$39, then $v$40, exactly the optimal DLU of the inverse itself (Xie et al., 2 Aug 2025).

These later constructions also clarify a methodological point already implicit in the 2019 theory: DLU is only a coarse worst-case statistic. The 2025 examples $v$41 and $v$42 over $v$43 have the same DLU $v$44 but different DLCT multiplicity distributions, showing that the full DLCT spectrum carries finer information than a single uniformity value (Xie et al., 2 Aug 2025).