Polocolo S-Box: Prime-Field Permutation

• Polocolo S-box is a prime-field permutation combining inversion with a power-residue selector to control its linear cryptanalytic properties.
• It leverages subgroup Kloosterman sums to derive explicit Walsh spectrum bounds that ensure strong resistance to linear attacks.
• The design clarifies common misconceptions by detailing the role of the multiplicative factor and contrasting with other S-box constructions.

Searching arXiv for recent and foundational papers on Polocolo S-boxes and related S-box design. The Polocolo S-box is an instance of a power residue S-box over a prime field $\mathbb{F}_q$, written in the form

$$S(x)=x^{q-2}\cdot T\!\left(x^{\frac{q-1}{2^n}}\right),$$

with $q$ prime, $2^n\mid q-1$, $T:\mathcal{G}\to\mathbb{F}_q^\times$ defined on the subgroup $\mathcal{G}\subset\mathbb{F}_q^\times$ of order $2^n$, and $S$ chosen so that it is a permutation on $\mathbb{F}_q$ (Steiner, 9 Jul 2025). In this construction, the inverse map $x^{q-2}=x^{-1}$ is modulated by a multiplicative factor determined by the power-residue symbol $$S(x)=x^{q-2}\cdot T\!\left(x^{\frac{q-1}{2^n}}\right),$$0. The resulting design is situated in the literature on zero-knowledge-friendly hash functions, and its principal cryptographic analysis in the supplied sources concerns the Walsh spectrum, correlation bounds, and comparison with other algebraically structured S-box families (Steiner, 9 Jul 2025).

1. Definition and algebraic form

In the framework of power residue S-boxes, one considers functions

$$S(x)=x^{q-2}\cdot T\!\left(x^{\frac{q-1}{2^n}}\right),$$1

where $$S(x)=x^{q-2}\cdot T\!\left(x^{\frac{q-1}{2^n}}\right),$$2 is prime, $$S(x)=x^{q-2}\cdot T\!\left(x^{\frac{q-1}{2^n}}\right),$$3, $$S(x)=x^{q-2}\cdot T\!\left(x^{\frac{q-1}{2^n}}\right),$$4, and $$S(x)=x^{q-2}\cdot T\!\left(x^{\frac{q-1}{2^n}}\right),$$5 if $$S(x)=x^{q-2}\cdot T\!\left(x^{\frac{q-1}{2^n}}\right),$$6 (Steiner, 9 Jul 2025). The map

$$S(x)=x^{q-2}\cdot T\!\left(x^{\frac{q-1}{2^n}}\right),$$7

sends $$S(x)=x^{q-2}\cdot T\!\left(x^{\frac{q-1}{2^n}}\right),$$8 onto the unique subgroup $$S(x)=x^{q-2}\cdot T\!\left(x^{\frac{q-1}{2^n}}\right),$$9 of order $q$0, and every element of $q$1 has exactly $q$2 preimages under this map (Steiner, 9 Jul 2025).

The Polocolo S-box is the special case with $q$3, hence $q$4, and $q$5 (Steiner, 9 Jul 2025). The supplied source states the corresponding parameterization as follows: $q$6 and, more specifically for Polocolo,

$q$7

with $q$8 chosen so that it is a permutation on $q$9 (Steiner, 9 Jul 2025).

This algebraic form places Polocolo within a broader class of finite-field S-boxes in which a monomial or inverse core is combined with a multiplicative selector depending on membership in multiplicative cosets. A plausible implication is that the design aims to preserve strong algebraic structure for proof-system efficiency while still admitting analytic control of linear-cryptanalytic quantities.

2. Walsh transform, spectrum, and correlation

The primary analytic object in the supplied treatment is the Walsh transform. For an S-box $2^n\mid q-1$0 and a non-trivial additive character $2^n\mid q-1$1, it is given by

$2^n\mid q-1$2

(Steiner, 9 Jul 2025). The Walsh spectrum is the multiset of all these values, and large $2^n\mid q-1$3 corresponds to strong linear correlation between the masks $2^n\mid q-1$4 and $2^n\mid q-1$5 (Steiner, 9 Jul 2025).

The same source states that modern linear cryptanalysis usually works with correlation: $2^n\mid q-1$6 so bounds on $2^n\mid q-1$7 translate directly into bounds on $2^n\mid q-1$8 up to a factor $2^n\mid q-1$9 in the single-field-element case (Steiner, 9 Jul 2025). For Polocolo, the maximum absolute value of the Walsh spectrum therefore controls the best linear approximation and, in the language of the source, “the strength of linear cryptanalysis” (Steiner, 9 Jul 2025).

The supplied paper emphasizes that this question was central because the Polocolo designers had conjectured a correlation bound but did not possess a general subgroup-Kloosterman estimate strong enough to prove it. The later analysis establishes such a bound and derives the conjectured Polocolo estimate as a corollary (Steiner, 9 Jul 2025).

3. Proven bounds for the Polocolo construction

For the inverse-type power-residue case $T:\mathcal{G}\to\mathbb{F}_q^\times$0, the supplied source proves the bound

$T:\mathcal{G}\to\mathbb{F}_q^\times$1

for a Polocolo S-box $T:\mathcal{G}\to\mathbb{F}_q^\times$2 that is a $T:\mathcal{G}\to\mathbb{F}_q^\times$3 power residue S-box and also induces a permutation on $T:\mathcal{G}\to\mathbb{F}_q^\times$4 (Steiner, 9 Jul 2025). The case $T:\mathcal{G}\to\mathbb{F}_q^\times$5 vanishes because the S-box is assumed to be a permutation (Steiner, 9 Jul 2025).

The same source records the Polocolo designers’ conjecture in correlation form: $T:\mathcal{G}\to\mathbb{F}_q^\times$6 for any non-trivial additive characters $T:\mathcal{G}\to\mathbb{F}_q^\times$7 (Steiner, 9 Jul 2025). It then states that this inequality follows from the Walsh bound above, because

$T:\mathcal{G}\to\mathbb{F}_q^\times$8

which is stronger than the conjectured $T:\mathcal{G}\to\mathbb{F}_q^\times$9 form (Steiner, 9 Jul 2025).

This establishes a concrete linear-cryptanalytic guarantee at the single-S-box level. The source further notes that for large $\mathcal{G}\subset\mathbb{F}_q^\times$0, “the best linear approximation” has bias at most about $\mathcal{G}\subset\mathbb{F}_q^\times$1, and that this is small in the large-prime-field regime used by zero-knowledge-friendly designs (Steiner, 9 Jul 2025). This suggests that Polocolo’s S-box is best understood not as a bit-oriented AES-style object, but as a prime-field permutation whose linear profile is controlled asymptotically by square-root cancellation.

4. Analytic mechanism: subgroup Kloosterman sums

The core technical device in the supplied analysis is reduction to Kloosterman sums over multiplicative subgroups. For a subgroup $\mathcal{G}\subset\mathbb{F}_q^\times$2, the paper defines

$\mathcal{G}\subset\mathbb{F}_q^\times$3

(Steiner, 9 Jul 2025). It then proves the bound

$\mathcal{G}\subset\mathbb{F}_q^\times$4

uniformly for any subgroup $\mathcal{G}\subset\mathbb{F}_q^\times$5 (Steiner, 9 Jul 2025).

For the Polocolo S-box, the Walsh transform is partitioned over cosets of a subgroup $\mathcal{G}\subset\mathbb{F}_q^\times$6 of order $\mathcal{G}\subset\mathbb{F}_q^\times$7. Writing $\mathcal{G}\subset\mathbb{F}_q^\times$8 for a generator of $\mathcal{G}\subset\mathbb{F}_q^\times$9, the cosets are

$2^n$0

and the Walsh transform becomes

$2^n$1

(Steiner, 9 Jul 2025). Each inner sum can be rewritten as a Kloosterman sum over $2^n$2, of the form

$2^n$3

after absorbing the coset representative into modified parameters $2^n$4 (Steiner, 9 Jul 2025). Summing at most $2^n$5 such contributions yields the factor $2^n$6 in the final Walsh bound (Steiner, 9 Jul 2025).

The source explicitly identifies this subgroup-Kloosterman estimate as the “central tool” for Polocolo (Steiner, 9 Jul 2025). In methodological terms, the analysis places Polocolo within the classical program of bounding character sums via generalized Weil-type estimates, but specialized to subgroup-structured inverse maps.

5. Relation to other S-box families

The supplied material situates Polocolo alongside Grendel and other power-residue or power-based designs. In the same framework, Grendel’s S-box is written

$2^n$7

which corresponds to $2^n$8 and $2^n$9 (Steiner, 9 Jul 2025). For general $S$0 with $S$1, the paper states the bound

$S$2

(Steiner, 9 Jul 2025). For inverse-type Polocolo, the constant is linear in $S$3; for general power-type constructions, it is linear in $S$4 (Steiner, 9 Jul 2025).

A second point of comparison arises from classical S-box design over binary extension fields. The Dobbertin–Bracken–Leander power mapping

$S$5

has differential uniformity $S$6, nonlinearity

$S$7

and is a permutation if and only if $S$8 is odd (0901.1824). The source states that, from the perspective of linear and differential cryptanalysis, this function has “the same resistance to both the linear and differential attacks as the inverse function” (0901.1824). Although this construction does not mention Polocolo, it provides a contrasting paradigm: highly nonlinear differentially $S$9-uniform permutations on binary fields rather than prime-field power residue permutations.

A third comparison comes from 8×8 bijective S-box construction from non-bijective power functions. The method of Mamadolimov et al. starts from $\mathbb{F}_q$0 over $\mathbb{F}_q$1, uses the binomial

$\mathbb{F}_q$2

and then replaces duplicate outputs by missing values to obtain bijective S-boxes with $\mathbb{F}_q$3 and $\mathbb{F}_q$4 (Mamadolimov et al., 2013). In that design, the objective is explicit 8×8 bijection over $\mathbb{F}_q$5; in Polocolo, the supplied discussion instead focuses on prime-field permutation structure and Walsh-correlation control (Mamadolimov et al., 2013, Steiner, 9 Jul 2025).

6. Design interpretation and common misconceptions

A common misconception is to treat the Polocolo S-box as if it were simply a direct analogue of the AES S-box. The supplied sources do not support that identification. AES is described in the supplied binary-field literature as using the inverse mapping over $\mathbb{F}_q$6, with differential uniformity $\mathbb{F}_q$7 and optimal known nonlinearity for 8-bit permutations (0901.1824, Mamadolimov et al., 2013). By contrast, Polocolo is described over a prime field $\mathbb{F}_q$8, uses the inverse map $\mathbb{F}_q$9 multiplied by a power-residue-dependent factor, and is analyzed primarily through Walsh-spectrum bounds rather than bit-level differential uniformity tables (Steiner, 9 Jul 2025).

A second misconception is that the multiplicative factor $x^{q-2}=x^{-1}$0 is an arbitrary perturbation with no structural role. The supplied analysis shows the opposite: the field is partitioned into cosets of a subgroup, and this factor is constant on the fibers of the power-residue map, which is exactly what permits the reduction of the Walsh transform to subgroup Kloosterman sums (Steiner, 9 Jul 2025). This suggests that the construction is designed so that the added flexibility remains compatible with explicit harmonic analysis.

A third misconception is that the proved bounds determine the exact Walsh spectrum. The supplied source does not claim this. It gives upper bounds, notes that the theoretical bound is not tight numerically, and identifies sharper constants or exact Walsh spectra for specific parameter choices as an open direction (Steiner, 9 Jul 2025). Thus the current state, within the supplied material, is one of rigorous asymptotic and explicit worst-case control rather than complete spectral classification.

7. Significance, constraints, and open directions

Within the supplied literature, the main significance of the Polocolo S-box is that it provides a prime-field permutation with a provable correlation bound of order

$x^{q-2}=x^{-1}$1

thereby verifying and slightly improving the conjectured Polocolo linear-correlation estimate (Steiner, 9 Jul 2025). The source characterizes this as establishing resistance to linear cryptanalysis “at the single S-box level” (Steiner, 9 Jul 2025).

The same analysis also records a limitation of the method: the estimates are nontrivial when the relevant subgroup size exceeds $x^{q-2}=x^{-1}$2, that is, when $x^{q-2}=x^{-1}$3 is not too large relative to $x^{q-2}=x^{-1}$4 (Steiner, 9 Jul 2025). In the Polocolo setting, $x^{q-2}=x^{-1}$5 is said to be far smaller than $x^{q-2}=x^{-1}$6, so the resulting bounds are significantly better than the trivial subgroup-size bound (Steiner, 9 Jul 2025).

The supplied source identifies several research directions. One is improvement for smaller subgroups, where refined methods from works of Ostafe may be needed (Steiner, 9 Jul 2025). Another is extending the framework from monomials $x^{q-2}=x^{-1}$7 to general polynomials $x^{q-2}=x^{-1}$8 in constructions of the form

$x^{q-2}=x^{-1}$9

under suitable degree conditions (Steiner, 9 Jul 2025). A further direction is to obtain sharper constants or exact Walsh spectra for specific parameter sets (Steiner, 9 Jul 2025).

Taken together, the supplied material presents the Polocolo S-box as a mathematically structured prime-field permutation whose defining feature is not merely inversion, but inversion modulated by a power-residue selector in a way that preserves analytic tractability. Its current rigorous profile, in the supplied sources, is therefore anchored less in classical binary-field criteria such as differential $$S(x)=x^{q-2}\cdot T\!\left(x^{\frac{q-1}{2^n}}\right),$$00-uniformity than in subgroup character-sum analysis and explicit linear-correlation bounds (Steiner, 9 Jul 2025).