---
title: 'DLCT: Differential-Linear Connectivity Table'
url: https://www.emergentmind.com/topics/differential-linear-connectivity-table-dlct
type: topic
---

# DLCT: Differential-Linear Connectivity Table

The differential-linear connectivity table (DLCT) is a table-valued criterion for vectorial Boolean functions that quantifies, for each input difference \(u\) and output mask \(v\), how often the linear relation defined by \(v\) is preserved across the derivative \(F(x)+F(x+u)\). Introduced in the context of differential-linear cryptanalysis at EUROCRYPT'19 by Bar-On et al., it was subsequently characterized as an autocorrelation object rather than an isolated cryptanalytic construction. In particular, for an \((n,m)\)-function \(F:\mathbb F_2^n\to\mathbb F_2^m\), the 2019 characterization shows that the DLCT differs from the vectorial autocorrelation table only by a factor of \(2\), which immediately connects DLCT to Walsh analysis, the differential distribution table (DDT), equivalence theory, and family-specific spectral calculations [1908.07445].

## 1. Formal definition and basic parameters

For an \((n,m)\)-function \(F:\mathbb F_2^n\to\mathbb F_2^m\), the DLCT entry at \((u,v)\) is
\[
\mathrm{DLCT}_F(u,v)=\#\{x\in\mathbb F_2^n\mid v\cdot F(x)=v\cdot F(x+u)\}-2^{n-1},
\]
where \(u\in\mathbb F_2^n\) indexes the row and \(v\in\mathbb F_2^m\) indexes the column. Equivalently, with \(D_uF(x)=F(x)+F(x+u)\), the DLCT measures the correlation between the output difference \(D_uF(x)\) and the linear mask \(v\). In the attack setting, this statistic captures the dependency between the differential trail in an early subcipher and the linear approximation in a later subcipher, replacing the heuristic independence assumptions of classical differential-linear cryptanalysis [2508.01190].

The associated spectrum is the multiset
\[
\Gamma_F=\{\mathrm{DLCT}_F(u,v):u\in\mathbb F_{2^n}^\ast,\ v\in\mathbb F_{2^m}^\ast\},
\]
and the differential-linear uniformity is
\[
\mathrm{DLU}_F=\max_{u\in\mathbb F_{2^n}^\ast,\ v\in\mathbb F_{2^m}^\ast}\left|\mathrm{DLCT}_F(u,v)\right|.
\]
As immediate elementary properties, for \(u\neq 0\), \(\mathrm{DLCT}_F(u,v)\) is even; \(|\mathrm{DLCT}_F(u,v)|\le 2^{n-1}\); and if \(u=0\) or \(v=0\), then \(\mathrm{DLCT}_F(u,v)=2^{n-1}\) [1908.07445].

These definitions place DLCT alongside differential uniformity and nonlinearity as a criterion for S-box analysis, but its semantics are distinct: it is designed to track a mixed differential-linear dependency rather than a purely differential or purely linear effect.

## 2. Identification with vectorial autocorrelation

The central structural fact is that DLCT is exactly half of the vectorial additive autocorrelation. For a vectorial Boolean function \(F\), the autocorrelation at \((u,v)\) is
\[
A_F(u,v)=\sum_{x\in\mathbb F_2^n}(-1)^{v\cdot(F(x)+F(x+u))}.
\]
The basic identity is
\[
\mathrm{DLCT}_F(u,v)=\frac12\,A_F(u,v),
\]
equivalently
\[
A_F(u,v)=2\,\mathrm{DLCT}_F(u,v).
\]
Thus the DLCT spectrum is the autocorrelation spectrum scaled by \(1/2\), and
\[
\mathrm{DLU}_F=\frac12\,A_F^\ast
\]
where \(A_F^\ast\) is the absolute indicator [1908.07445].

This identification is the main conceptual re-framing of the subject. It means that the DLCT is not an ad hoc table specific to one attack paradigm; rather, it is a normalized autocorrelation table for vectorial Boolean functions. A direct consequence is that every general statement about vectorial autocorrelation translates immediately into a statement about the DLCT, up to the factor \(2\). This includes spectral identities, lower bounds, divisibility phenomena, and invariance properties.

A related characterization appears in the follow-up 2019 treatment under the terminology “generalized additive autocorrelation,” which also defines the autocorrelation spectrum, the absolute indicator, and the sum-of-squares indicator as the natural companions of DLCT-based analysis [1907.05986].

## 3. Harmonic and differential characterizations

The autocorrelation, and hence the DLCT, admits two complementary Fourier descriptions: one through the Walsh transform of component functions and one through the DDT. For the Walsh transform,
\[
W_F(u,v)^2=\sum_{\omega\in\mathbb F_2^n}(-1)^{u\cdot \omega}\,A_F(\omega,v),
\]
and therefore
\[
A_F(u,v)=\frac{1}{2^n}\sum_{\omega\in\mathbb F_2^n}(-1)^{u\cdot\omega}W_F(\omega,v)^2.
\]
The derived summation identities
\[
\sum_{u\in\mathbb F_2^n}A_F(u,v)=W_F(0,v)^2
\]
and
\[
\sum_{u\in\mathbb F_2^n}A_F(u,v)^2=\frac{1}{2^n}\sum_{\omega\in\mathbb F_2^n}W_F(\omega,v)^4
\]
show that autocorrelation is controlled by the distribution of squared Walsh coefficients. The same relation is written directly for DLCT in the follow-up paper as
\[
\mathrm{DLCT}_F(u,v)=2^{-n-1}\sum_{w\in\mathbb F_2^n}(-1)^{u\cdot w}W_F(w,v)^2,
\]
together with the identities
\[
\sum_{u\in\mathbb F_2^n}\mathrm{DLCT}_F(u,v)=W_F(0,v)^2
\]
and a fourth-moment expression for the sum of squared DLCT values [1908.07445].

The differential description is equally direct. If
\[
\mathrm{DDT}_F(u,\omega)=\#\{x\in\mathbb F_2^n:D_uF(x)=\omega\},
\]
then
\[
A_F(u,v)=\sum_{\omega\in\mathbb F_2^m}(-1)^{v\cdot \omega}\,\mathrm{DDT}_F(u,\omega),
\]
with inverse
\[
\mathrm{DDT}_F(u,v)=2^{-m}\sum_{\omega\in\mathbb F_2^m}(-1)^{v\cdot\omega}A_F(u,\omega).
\]
Accordingly, for fixed \(u\), the DLCT row is the Walsh transform across the output-mask variable of the corresponding DDT row. The identities
\[
\sum_{v\in\mathbb F_2^m}A_F(u,v)=2^m\,\mathrm{DDT}_F(u,0)
\]
and
\[
\sum_{v\in\mathbb F_2^m}A_F(u,v)^2=2^m\sum_{\omega\in\mathbb F_2^m}\mathrm{DDT}_F(u,\omega)^2
\]
make the second-moment relation explicit [1908.07445].

A useful interpretation follows directly from these formulas: the DLCT is a linearized transform of derivative distributions. This suggests that it interpolates between linear and differential criteria rather than replacing either of them.

## 4. Bounds, divisibility, and equivalence behavior

The 2019 theory establishes generic lower bounds on the maximum DLCT magnitude. If \(m\ge n-1\), then
\[
\mathrm{DLU}_F \ge \sqrt{\frac{2^{m+n+1}-2^{2n}}{4(2^m-1)}}.
\]
For the square case \(m=n\), this yields
\[
\mathrm{DLU}_F\ge 2^{n/2-1},
\]
and because \(\mathrm{DLU}_F\) is even when \(m=n\), the discussion gives the sharper corollary
\[
\mathrm{DLU}_F\ge 2^{n/2-1}+2 \qquad (n\ \text{even}).
\]
At the autocorrelation level, the corresponding statement is that for \((n,m)\)-functions with \(m\ge n\), the absolute indicator is bounded below, and in particular for \(m=n\), \(\Delta_F>2^{n/2}\) [1907.05986; 1908.07445].

A stronger row-wise statement precedes this global bound:
\[
\sum_{v\in\mathbb F_2^m}A_F(u,v)^2\ge 2^{n+m+1},
\]
with equality for all nonzero \(u\) if and only if \(F\) is APN. This makes APN functions extremal for a natural quadratic aggregate of DLCT values, not merely for ordinary differential uniformity [1908.07445].

The same paper proves a divisibility result: if \(\deg(F)\le d\) and \(n>2\), then for all \(u,v\),
\[
A_F(u,v)\ \text{is divisible by}\ 2^{\left\lceil\frac{n-1}{d-1}\right\rceil+1}.
\]
In particular, for an \((n,n)\)-permutation, all autocorrelation and DLCT entries are divisible by \(8\) [1908.07445].

Equivalence theory is more nuanced than for differential uniformity. Affine equivalence preserves the autocorrelation spectrum; EA equivalence preserves the extended autocorrelation spectrum \(\{|A_F(u,v)|:u\neq 0,v\neq 0\}\) and therefore preserves DLU; but CCZ equivalence does not preserve the autocorrelation spectrum in general [1908.07445]. The follow-up paper makes the corresponding DLCT statements explicit: DLU is EA invariant, the DLCT spectrum is affine invariant, the spectrum is not EA invariant, and DLU is not CCZ invariant. Its counterexample uses the CCZ-equivalent pair \(x^{13}\) and \(x^{34}\) over \(\mathbb F_{2^6}\), for which the spectra and DLU values differ [1907.05986].

These results rule out a common overgeneralization: DLCT-based quantities do not align with the full invariance profile of differential uniformity under CCZ equivalence.

## 5. Special function classes and explicit structural formulas

Several standard classes of vectorial Boolean functions admit closed DLCT descriptions. For plateaued functions, if a component \(f_v\) has Walsh amplitude \(2^{r_v}\) and \(\widetilde f_v\) denotes the support indicator of its nonzero Walsh coefficients, then
\[
A_F(u,v)=-2^{2r_v-n-1}W_{\widetilde f_v}(u).
\]
For AB functions, where \(r_v=(n+1)/2\), this simplifies to
\[
A_F(u,v)=-W_{\widetilde f_v}(u).
\]
Accordingly, the autocorrelation, and hence the DLCT, is determined by the Walsh transform of a Boolean support indicator [1908.07445].

For APN permutations, define
\[
\gamma_u(x)=
\begin{cases}
1,& x\in \operatorname{Im}(D_uF),\\
0,& \text{otherwise}.
\end{cases}
\]
Then
\[
A_F(u,v)=-W_{\gamma_u}(v).
\]
Since \(\gamma_u\) is balanced, the paper derives the corollary that if there exists an APN function over \(\mathbb F_2^n\) with absolute indicator \(\Delta\), then there exists a balanced Boolean function of \(n\) variables with linearity \(\Delta\). This transfers lower bounds from balanced Boolean functions to APN vectorial functions [1908.07445].

Monomials are especially tractable. For \(F(x)=x^d\),
\[
\Lambda_F=\{A_F(1,v):v\in\mathbb F_{2^n}^\ast\},
\]
and if \(\gcd(d,2^n-1)=1\), then also
\[
\Lambda_F=\{A_F(u,1):u\in\mathbb F_{2^n}^\ast\}.
\]
Thus for monomial permutations the entire spectrum is determined by a single slice [1908.07445]. The 2025 construction paper uses the equivalent identity
\[
\mathrm{DLCT}_F(u,v)=\mathrm{DLCT}_F(1,u^dv)
\]
to reduce DLU estimation for power functions to the row \(u=1\) [2508.01190].

For quadratic and related low-degree families, the available statements are highly rigid. For general quadratic polynomials of the displayed form in the 2019 paper, \(A_F(u,v)\in\{0,\pm 2^n\}\) and \(\Delta_F=2^n\). The follow-up paper expresses the corresponding DLCT version for quadratic \((n,n)\)-functions as
\[
\mathcal T_F\subseteq\{-2^{n-1},0,2^{n-1}\},\qquad \mathrm{DLU}_F=2^{n-1}.
\]
For Gold functions \(x^{2^i+1}\), the spectrum depends on the parity of \(n/\gcd(i,n)\) [1908.07445; 1907.05986].

The inverse function and inverses of quadratic APN permutations form another major theme. For \(F(x)=x^{2^n-2}\), the spectrum is expressed through Kloosterman sums:
\[
\Lambda_F=\left\{K(v)-1+2(-1)^{\operatorname{Tr}(v)}:v\in\mathbb F_{2^n}^\ast\right\},
\]
and for even \(n\),
\[
\Delta_F=2^{n/2+1}.
\]
At the DLCT level, the follow-up paper states that for even \(n=2k\),
\[
\mathrm{DLU}_F=2^k.
\]
For odd \(n\), the 2019 characterization relates \(\Delta_F\) to the linearity \(\mathtt L(F)\) modulo \(8\) [1908.07445; 1907.05986].

Finally, if \(F\) is a quadratic APN permutation in odd dimension and \(\pi\) is defined by
\[
\operatorname{Im}(D_uF)=\mathbb F_2^n\setminus \langle \pi(u)\rangle^\perp,\qquad \pi(0)=0,
\]
then
\[
A_{F^{-1}}(u,v)=-W_\pi(v,u).
\]
Hence \(\Delta_{F^{-1}}\) is the linearity of \(\pi\), and for inverses of Gold APN permutations the absolute indicator is strictly larger than \(2^{(n+1)/2}\) when \(n>5\) [1908.07445].

## 6. Exhaustive small-dimension results and later low-DLU constructions

The complete affine-equivalence classification of optimal \(4\times 4\) S-boxes by Leander and Poschmann yields a finite benchmark for DLCT behavior. Under affine equivalence, the 16 optimal classes split into three autocorrelation spectrum types:
\[
\{-8^{60},\,0^{135},\,8^{30}\},
\]
\[
\{-16^{6},\,-8^{48},\,0^{144},\,8^{24},\,16^{3}\},
\]
and
\[
\{-16^{2},\,-8^{56},\,0^{138},\,8^{28},\,16^{1}\}.
\]
Equivalently, at the DLCT level, the same 16 classes fall into two spectrum types,
\[
\{-4,0,4\}\quad\text{with}\quad \mathrm{DLU}=4,
\]
and
\[
\{-8,-4,0,4,8\}\quad\text{with}\quad \mathrm{DLU}=8.
\]
Thus optimal \(4\)-bit S-boxes occupy only a very small number of DLCT-spectrum classes [1908.07445; 1907.05986].

The 2025 work extends the subject from characterization to construction. For the cubic power family
\[
F(x)=x^{2^{2k}+2^k+1},
\]
with \(e=\gcd(k,n)\), it proves
\[
\mathrm{DLU}_F\le 2^{(n+3e)/2-1}\quad\text{if }n\text{ is odd},
\]
and
\[
\mathrm{DLU}_F\le 2^{(n+4e)/2-1}\quad\text{otherwise}.
\]
For \(e=1\), this becomes
\[
\mathrm{DLU}_F\le 2^{(n+1)/2}\quad(n\text{ odd}),\qquad \mathrm{DLU}_F\le 2^{n/2+1}\quad(n\text{ even}),
\]
and the table for \(x^7\) over \(3\le n\le 18\) gives the computed values
\[
4,4,4,16,16,32,32,64,64,128,128,256,256,512,512,1024.
\]
The proof strategy is to square the relevant character sum and bound the kernel of an induced linearized operator [2508.01190].

A second family is the Dillon-type monomial
\[
F(x)=x^{l(2^m-1)}\quad\text{over }\mathbb F_{2^n},\qquad n=2m,\ \gcd(l,2^m+1)=1.
\]
Here the DLCT is transformed into a character sum over the unit circle \(\mu_{2^m+1}\), leading to an explicit DLU formula in terms of the maximum binary Kloosterman sum \(K_{\max}(m)\). The paper reports the experimental DLU values for \(x^{2^m-1}\), \(2\le m\le 9\), as
\[
8,16,32,72,128,240,512,1056,
\]
matching the theorem [2508.01190].

The same paper shows that adding an arbitrary quadratic function to the cubic family does not worsen the DLU upper bound:
\[
G(x)=x^{2^{2k}+2^k+1}+Q(x)
\]
satisfies the same parity-dependent estimate as the base cubic function. It also proves a general perturbation principle for generalized cyclotomic mappings: if a function is modified on \(t\) points, then
\[
\mathrm{DLU}_f\le \mathrm{DLU}_F+2t,
\]
with the one-point corollary
\[
\mathrm{DLU}_f\le \mathrm{DLU}_F+2.
\]
Applied to the inverse function in even dimension, this gives \(\mathrm{DLU}_f\le 2^m+2\), and if the modified point is \(\xi=0\), then \(\mathrm{DLU}_f=2^m\), exactly the optimal DLU of the inverse itself [2508.01190].

These later constructions also clarify a methodological point already implicit in the 2019 theory: DLU is only a coarse worst-case statistic. The 2025 examples \(x^7\) and \(x^7+w x^3\) over \(\mathbb F_{2^8}\) have the same DLU \(=32\) but different DLCT multiplicity distributions, showing that the full DLCT spectrum carries finer information than a single uniformity value [2508.01190].

Source: https://www.emergentmind.com/topics/differential-linear-connectivity-table-dlct