Differential-Linear Uniformity (DLU)

• Differential-Linear Uniformity (DLU) is defined as the maximum absolute bias in the Differential-Linear Connectivity Table (DLCT) of a vectorial Boolean function.
• It measures the largest imbalance in masked derivative outputs, integrating differential and linear analysis via autocorrelation and Walsh transform methods.
• DLU provides a distinct cryptographic metric for assessing hybrid attack resistance and guiding the design of low-DLU constructions.

Searching arXiv for core DLU/DLCT papers and adjacent background on differential, second-order differential, and boomerang-related notions. Differential-Linear Uniformity (DLU) is the extremal magnitude of the nontrivial entries of the Differential-Linear Connectivity Table (DLCT) of a vectorial Boolean function. For an $(n,m)$-function $F:\mathbb{F}_2^n\to\mathbb{F}_2^m$, it measures the largest imbalance of the event $v\cdot F(x)=v\cdot F(x+u)$ over all nonzero input differences $u$ and nonzero output masks $v$. In the DLCT framework introduced to capture the dependency between the two subciphers involved in differential-linear attacks, DLU is therefore a worst-case local indicator of differential-linear susceptibility, rather than a reformulation of ordinary differential uniformity or nonlinearity alone (Li et al., 2019).

1. Formal definition through the DLCT

For $F:\mathbb{F}_2^n\to\mathbb{F}_2^m$, the DLCT entry at $(u,v)\in \mathbb{F}_2^n\times \mathbb{F}_2^m$ is

$$\operatorname{DLCT}_F(u,v)=\#\{x\in\mathbb{F}_2^n: v\cdot F(x)=v\cdot F(x+u)\}-2^{n-1}.$$

Equivalently, it is a centered count of the equality event for the masked outputs under input difference $u$. The cryptographically meaningful part of the table is the subtable indexed by

$u\neq 0,\qquad v\neq 0,$

because $F:\mathbb{F}_2^n\to\mathbb{F}_2^m$0 when either $F:\mathbb{F}_2^n\to\mathbb{F}_2^m$1 or $F:\mathbb{F}_2^n\to\mathbb{F}_2^m$2.

The differential-linear uniformity is

$F:\mathbb{F}_2^n\to\mathbb{F}_2^m$3

Absolute values are essential: DLU is the maximum magnitude of a centered bias, not the maximum signed entry. For power functions $F:\mathbb{F}_2^n\to\mathbb{F}_2^m$4 over $F:\mathbb{F}_2^n\to\mathbb{F}_2^m$5, one has the reduction

$F:\mathbb{F}_2^n\to\mathbb{F}_2^m$6

so the entire DLU is determined by the values $F:\mathbb{F}_2^n\to\mathbb{F}_2^m$7 (Xie et al., 2 Aug 2025).

This definition places DLU alongside, but not within, the classical DDT and LAT criteria. Differential uniformity controls the worst fiber size of the derivative map $F:\mathbb{F}_2^n\to\mathbb{F}_2^m$8, while nonlinearity controls Walsh magnitudes of component functions. DLU instead measures the imbalance of a masked derivative component, and is therefore a mixed criterion.

2. Autocorrelation, Walsh, and DDT characterizations

The main theoretical characterization of DLU passes through generalized additive autocorrelation. For $F:\mathbb{F}_2^n\to\mathbb{F}_2^m$9 and $v\cdot F(x)=v\cdot F(x+u)$0,

$v\cdot F(x)=v\cdot F(x+u)$1

The key identity is

$v\cdot F(x)=v\cdot F(x+u)$2

hence

$v\cdot F(x)=v\cdot F(x+u)$3

where $v\cdot F(x)=v\cdot F(x+u)$4 is the absolute indicator

$v\cdot F(x)=v\cdot F(x+u)$5

This identifies DLU with a vectorial autocorrelation quantity rather than with a purely differential or purely linear one.

The same quantity admits two complementary spectral descriptions. First, with the Walsh transform

$v\cdot F(x)=v\cdot F(x+u)$6

one has

$v\cdot F(x)=v\cdot F(x+u)$7

and also

$v\cdot F(x)=v\cdot F(x+u)$8

Second, if

$v\cdot F(x)=v\cdot F(x+u)$9

then each DLCT row is the Fourier transform of the corresponding DDT row: $u$0 Rowwise energy is therefore controlled by

$u$1

These formulas show that DLU is simultaneously a Fourier object, a derivative-autocorrelation object, and a signed transform of differential transition counts. That trivalent description is the basic reason DLU is not reducible to differential uniformity or Walsh nonlinearity alone (Li et al., 2019).

3. Bounds, spectra, and equivalence properties

A generic lower bound is available for $u$2 with $u$3: $u$4 For permutations $u$5, this yields

$u$6

and when $u$7 is even,

$u$8

These bounds are generic rather than tight, but they provide the benchmark against which “optimal” or “near-optimal” DLU is discussed in later construction papers.

Several structural divisibility facts refine the picture. For $u$9, all DLCT entries are even. More generally, if $v$0 is a $v$1-to-1 mapping, then $v$2 is a multiple of $v$3. At the opposite extreme, the vanishing condition

$v$4

for the nontrivial DLCT spectrum is equivalent to $v$5 being bent.

The invariance theory is notably asymmetric. DLU is invariant under EA equivalence, but not invariant under CCZ equivalence. The DLCT spectrum itself is affine-invariant, but not EA-invariant. The standard counterexample for failure of CCZ invariance is

$v$6

over $v$7, where the two functions are CCZ-equivalent but have different DLU values. The standard counterexample for failure of EA invariance of the full spectrum is

$v$8

over $v$9, which are EA-equivalent but have different DLCT spectra. A common misconception is therefore that DLU behaves like differential uniformity under all standard equivalences; it does not (Li et al., 2019).

Low-dimensional exhaustive classification further shows that DLU is not determined by classical criteria. Under affine equivalence, optimal $F:\mathbb{F}_2^n\to\mathbb{F}_2^m$0 S-boxes exhibit only two possible DLU values,

$F:\mathbb{F}_2^n\to\mathbb{F}_2^m$1

even though they are equally optimal under differential uniformity $F:\mathbb{F}_2^n\to\mathbb{F}_2^m$2 and nonlinearity $F:\mathbb{F}_2^n\to\mathbb{F}_2^m$3. Thus low differential uniformity and good nonlinearity do not force a unique DLU behavior (Li et al., 2019).

4. Exact values for major function classes

For monomials $F:\mathbb{F}_2^n\to\mathbb{F}_2^m$4 over $F:\mathbb{F}_2^n\to\mathbb{F}_2^m$5, DLU reduces to the additive autocorrelation of the Boolean trace function $F:\mathbb{F}_2^n\to\mathbb{F}_2^m$6. This converts vectorial DLU questions into classical Boolean autocorrelation questions and is one reason power functions remain central test cases.

Among APN monomials, the Kasami-Welch family is the canonical low-DLU class. If $F:\mathbb{F}_2^n\to\mathbb{F}_2^m$7 is odd, $F:\mathbb{F}_2^n\to\mathbb{F}_2^m$8, $F:\mathbb{F}_2^n\to\mathbb{F}_2^m$9, and

$(u,v)\in \mathbb{F}_2^n\times \mathbb{F}_2^m$0

then

$(u,v)\in \mathbb{F}_2^n\times \mathbb{F}_2^m$1

This value is treated as optimal with respect to the paper’s DLCT notion for odd dimension.

The inverse function over $(u,v)\in \mathbb{F}_2^n\times \mathbb{F}_2^m$2 is governed by binary Kloosterman sums. For even $(u,v)\in \mathbb{F}_2^n\times \mathbb{F}_2^m$3,

$(u,v)\in \mathbb{F}_2^n\times \mathbb{F}_2^m$4

This is one of the cleanest exact formulas in the literature and serves as the even-dimensional benchmark in later construction work.

Quadratic functions are extremal in the opposite direction. For any quadratic polynomial

$(u,v)\in \mathbb{F}_2^n\times \mathbb{F}_2^m$5

one has

$(u,v)\in \mathbb{F}_2^n\times \mathbb{F}_2^m$6

and in fact

$(u,v)\in \mathbb{F}_2^n\times \mathbb{F}_2^m$7

Gold functions $(u,v)\in \mathbb{F}_2^n\times \mathbb{F}_2^m$8 therefore have exact two- or three-valued DLCT spectra, but always with

$(u,v)\in \mathbb{F}_2^n\times \mathbb{F}_2^m$9

From the DLU viewpoint, that makes them very far from optimal despite their classical importance.

For the Bracken-Leander power mapping

$$\operatorname{DLCT}_F(u,v)=\#\{x\in\mathbb{F}_2^n: v\cdot F(x)=v\cdot F(x+u)\}-2^{n-1}.$$0

the DLCT spectrum is three-valued and

$$\operatorname{DLCT}_F(u,v)=\#\{x\in\mathbb{F}_2^n: v\cdot F(x)=v\cdot F(x+u)\}-2^{n-1}.$$1

The resulting pattern is again coarse: a large exact DLU together with a very restricted spectrum.

Plateaued, AB, and APN functions admit structural DLCT descriptions rather than uniform numerical formulas. For APN permutations, each DLCT row is minus half the Walsh spectrum of a balanced Boolean function defined by the image of the derivative map. For plateaued and AB functions, the DLCT is expressed through Walsh transforms of dual-related Boolean functions. These descriptions make DLU a derived Walsh invariant for these classes rather than a stand-alone combinatorial count (Li et al., 2019).

5. Explicit low-DLU constructions

A later construction program develops new infinite families of $$\operatorname{DLCT}_F(u,v)=\#\{x\in\mathbb{F}_2^n: v\cdot F(x)=v\cdot F(x+u)\}-2^{n-1}.$$2-functions with low DLU by refining exponential sums and by perturbing functions with known DLU. Two classes of power functions are central. The first is

$$\operatorname{DLCT}_F(u,v)=\#\{x\in\mathbb{F}_2^n: v\cdot F(x)=v\cdot F(x+u)\}-2^{n-1}.$$3

The proved bounds are

$$\operatorname{DLCT}_F(u,v)=\#\{x\in\mathbb{F}_2^n: v\cdot F(x)=v\cdot F(x+u)\}-2^{n-1}.$$4

and

$$\operatorname{DLCT}_F(u,v)=\#\{x\in\mathbb{F}_2^n: v\cdot F(x)=v\cdot F(x+u)\}-2^{n-1}.$$5

For $$\operatorname{DLCT}_F(u,v)=\#\{x\in\mathbb{F}_2^n: v\cdot F(x)=v\cdot F(x+u)\}-2^{n-1}.$$6, this becomes

$$\operatorname{DLCT}_F(u,v)=\#\{x\in\mathbb{F}_2^n: v\cdot F(x)=v\cdot F(x+u)\}-2^{n-1}.$$7

The computational data for $$\operatorname{DLCT}_F(u,v)=\#\{x\in\mathbb{F}_2^n: v\cdot F(x)=v\cdot F(x+u)\}-2^{n-1}.$$8 suggest that these bounds are often tight.

The second power-function family is the Dillon-type class

$$\operatorname{DLCT}_F(u,v)=\#\{x\in\mathbb{F}_2^n: v\cdot F(x)=v\cdot F(x+u)\}-2^{n-1}.$$9

over $u$0 with

$u$1

Here the DLCT is computed explicitly through Kloosterman sums, and the DLU is determined by the maximum Kloosterman value $u$2: $u$3

A broader polynomial class is obtained by adding an arbitrary quadratic term: $u$4 The same upper bound as for the cubic monomial survives: $u$5 Thus quadratic perturbations need not destroy low-DLU behavior, even though they can alter the DLCT spectrum.

A general perturbative principle is given by finite-point modification. If $u$6 differs from $u$7 on a set $u$8, then

$u$9

The one-point case gives

$u\neq 0,\qquad v\neq 0,$0

Two applications are particularly important. For even $u\neq 0,\qquad v\neq 0,$1, a one-point modification of the inverse function can satisfy

$u\neq 0,\qquad v\neq 0,$2

and when the modified point is $u\neq 0,\qquad v\neq 0,$3,

$u\neq 0,\qquad v\neq 0,$4

This matches the inverse-function benchmark. For odd $u\neq 0,\qquad v\neq 0,$5, one-point modifications of the Kasami APN permutation satisfy

$u\neq 0,\qquad v\neq 0,$6

which is near-optimal relative to the Kasami benchmark $u\neq 0,\qquad v\neq 0,$7.

These constructions clarify two distinct points. First, low DLU is compatible with nontrivial perturbations of benchmark functions. Second, equality of DLU does not imply equality of finer DLCT data: for example, a modified inverse-like function and the inverse over $u\neq 0,\qquad v\neq 0,$8 can have the same nonlinearity, differential uniformity, boomerang uniformity, and DLU, while still having different DLCT spectra (Xie et al., 2 Aug 2025).

6. Relation to neighboring notions and recurrent misconceptions

DLU sits within a dense neighborhood of cryptographic invariants, but should not be conflated with any of them. Ordinary differential uniformity remains an essential input, and exact differential spectra can materially constrain later differential-linear analysis. For the power mapping

$u\neq 0,\qquad v\neq 0,$9

the full differential spectrum is known exactly, with possible normalized multiplicities

$F:\mathbb{F}_2^n\to\mathbb{F}_2^m$00

and differential uniformity

$F:\mathbb{F}_2^n\to\mathbb{F}_2^m$01

Such data are highly relevant as input to any later DLU analysis, but they are not DLU results in themselves (Li et al., 2020).

Higher-order differential structure is nearby but still distinct. A second-order analogue of differential uniformity is

$F:\mathbb{F}_2^n\to\mathbb{F}_2^m$02

with

$F:\mathbb{F}_2^n\to\mathbb{F}_2^m$03

For fixed admissible degree $F:\mathbb{F}_2^n\to\mathbb{F}_2^m$04, generic polynomials asymptotically have maximal $F:\mathbb{F}_2^n\to\mathbb{F}_2^m$05, and the inversion mapping satisfies

$F:\mathbb{F}_2^n\to\mathbb{F}_2^m$06

but

$F:\mathbb{F}_2^n\to\mathbb{F}_2^m$07

This establishes that good first-order differential behavior does not imply equally good higher-order behavior. It suggests structured higher-order nonrandomness, but no linear-mask correlation is computed, so no direct DLU theorem follows (Aubry et al., 2017).

Boomerang and $F:\mathbb{F}_2^n\to\mathbb{F}_2^m$08-differential frameworks are also adjacent rather than identical. In odd characteristic, for odd APN functions,

$F:\mathbb{F}_2^n\to\mathbb{F}_2^m$09

and for odd APN permutations, boomerang uniformity equals $F:\mathbb{F}_2^n\to\mathbb{F}_2^m$10-differential uniformity. This is a bridge between BCT and a generalized DDT, not between boomerang uniformity and DLU. Likewise, piecewise constructions with low $F:\mathbb{F}_2^n\to\mathbb{F}_2^m$11-differential uniformity, including product formulas of the form

$F:\mathbb{F}_2^n\to\mathbb{F}_2^m$12

for coordinatewise concatenations, are structurally relevant but remain purely differential (Pal et al., 2023, Bartoli et al., 2021).

Finally, the differential side alone can already exclude whole function families from serious DLU consideration. For degrees

$F:\mathbb{F}_2^n\to\mathbb{F}_2^m$13

every sufficiently large binary extension field forces

$F:\mathbb{F}_2^n\to\mathbb{F}_2^m$14

for degree-$F:\mathbb{F}_2^n\to\mathbb{F}_2^m$15 polynomials with nonzero second leading coefficient. Such families are asymptotically maximally bad from the differential viewpoint before any linear analysis begins (Aubry et al., 2022). A related example in odd characteristic is the Niho-type family

$F:\mathbb{F}_2^n\to\mathbb{F}_2^m$16

for which the differential spectrum is completely determined and a nontrivial $F:\mathbb{F}_2^n\to\mathbb{F}_2^m$17-differential upper bound

$F:\mathbb{F}_2^n\to\mathbb{F}_2^m$18

is known, together with a six-valued distribution of Walsh-like exponential sums. This supplies exact differential data and separate correlation-side data, but not the combined differential-linear object (Cui et al., 2024).

The central misconception is therefore twofold: first, DLU is not determined by differential uniformity or nonlinearity alone; second, neighboring invariants such as $F:\mathbb{F}_2^n\to\mathbb{F}_2^m$19, boomerang uniformity, and $F:\mathbb{F}_2^n\to\mathbb{F}_2^m$20-differential uniformity may be highly informative without being DLU. In the current literature, DLU is best understood as a DLCT extremal statistic with its own spectral theory, its own invariance behavior, and its own construction problems.