---
title: 'Polocolo S-Box: Prime-Field Permutation'
url: https://www.emergentmind.com/topics/polocolo-s-box
type: topic
---

# Polocolo S-Box: Prime-Field Permutation

Searching arXiv for recent and foundational papers on Polocolo S-boxes and related S-box design.
The Polocolo S-box is an instance of a **power residue S-box** over a prime field \(\mathbb{F}_q\), written in the form
\[
S(x)=x^{q-2}\cdot T\!\left(x^{\frac{q-1}{2^n}}\right),
\]
with \(q\) prime, \(2^n\mid q-1\), \(T:\mathcal{G}\to\mathbb{F}_q^\times\) defined on the subgroup \(\mathcal{G}\subset\mathbb{F}_q^\times\) of order \(2^n\), and \(S\) chosen so that it is a permutation on \(\mathbb{F}_q\) [2507.06808]. In this construction, the inverse map \(x^{q-2}=x^{-1}\) is modulated by a multiplicative factor determined by the power-residue symbol \(x\mapsto x^{(q-1)/2^n}\). The resulting design is situated in the literature on zero-knowledge-friendly hash functions, and its principal cryptographic analysis in the supplied sources concerns the Walsh spectrum, correlation bounds, and comparison with other algebraically structured S-box families [2507.06808].

## 1. Definition and algebraic form

In the framework of power residue S-boxes, one considers functions
\[
S(x)=x^d\cdot T\!\left(x^{\frac{q-1}{m}}\right),
\]
where \(q\ge 3\) is prime, \(\gcd(d,q)=1\), \(m\mid(q-1)\), and \(T(x)\neq 0\) if \(x\neq 0\) [2507.06808]. The map
\[
x\mapsto x^{\frac{q-1}{m}}
\]
sends \(\mathbb{F}_q^\times\) onto the unique subgroup \(\mathcal{G}\subset\mathbb{F}_q^\times\) of order \(m\), and every element of \(\mathcal{G}\) has exactly \(\frac{q-1}{m}\) preimages under this map [2507.06808].

The Polocolo S-box is the special case with \(d=q-2\), hence \(x^d=x^{-1}\), and \(m=2^n\) [2507.06808]. The supplied source states the corresponding parameterization as follows:
\[
S(x)=x^{q-2}\cdot T\!\left(\#1{x}{q}_m\right),
\]
and, more specifically for Polocolo,
\[
S(x)=x^{q-2}\cdot T\!\left(x^{\frac{q-1}{2^n}}\right)
\]
with \(S\) chosen so that it is a permutation on \(\mathbb{F}_q\) [2507.06808].

This algebraic form places Polocolo within a broader class of finite-field S-boxes in which a monomial or inverse core is combined with a multiplicative selector depending on membership in multiplicative cosets. A plausible implication is that the design aims to preserve strong algebraic structure for proof-system efficiency while still admitting analytic control of linear-cryptanalytic quantities.

## 2. Walsh transform, spectrum, and correlation

The primary analytic object in the supplied treatment is the Walsh transform. For an S-box \(S:\mathbb{F}_q\to\mathbb{F}_q\) and a non-trivial additive character \(\psi\), it is given by
\[
\mathcal{W}_S(\psi,a,b)=\sum_{x\in\mathbb{F}_q}\psi\big(a x+b S(x)\big), \qquad a,b\in\mathbb{F}_q
\]
[2507.06808]. The Walsh spectrum is the multiset of all these values, and large \(|\mathcal{W}_S(a,b)|\) corresponds to strong linear correlation between the masks \(a\cdot x\) and \(b\cdot S(x)\) [2507.06808].

The same source states that modern linear cryptanalysis usually works with **correlation**:
\[
\operatorname{CORR}_F(\psi,\phi,\mathbf{a},\mathbf{b})=\frac{\mathcal{W}_F(\psi,\overline{\phi},\mathbf{a},\mathbf{b})}{q^n},
\]
so bounds on \(|\mathcal{W}_S|\) translate directly into bounds on \(|\operatorname{CORR}_S|\) up to a factor \(q^{-1}\) in the single-field-element case [2507.06808]. For Polocolo, the maximum absolute value of the Walsh spectrum therefore controls the best linear approximation and, in the language of the source, “the strength of linear cryptanalysis” [2507.06808].

The supplied paper emphasizes that this question was central because the Polocolo designers had conjectured a correlation bound but did not possess a general subgroup-Kloosterman estimate strong enough to prove it. The later analysis establishes such a bound and derives the conjectured Polocolo estimate as a corollary [2507.06808].

## 3. Proven bounds for the Polocolo construction

For the inverse-type power-residue case \(d=q-2\), the supplied source proves the bound
\[
|\mathcal{W}_S(\psi,a,b)|\le
\begin{cases}
q, & a=b=0,\\[0.3em]
0, & a\neq 0,\ b=0,\\[0.3em]
0, & a=0,\ b\neq 0,\\[0.3em]
2^{n+1} q^{1/2}+1, & a\cdot b\neq 0,
\end{cases}
\]
for a Polocolo S-box \(S:\mathbb{F}_q\to\mathbb{F}_q\) that is a \((q-2,2^n,T)\) power residue S-box and also induces a permutation on \(\mathbb{F}_q\) [2507.06808]. The case \(a=0,b\neq 0\) vanishes because the S-box is assumed to be a permutation [2507.06808].

The same source records the Polocolo designers’ conjecture in correlation form:
\[
\max_{a,b\in\mathbb{F}_q}
|\operatorname{CORR}_S(\psi,\phi,a,b)|
\le \frac{2^{n+2}}{q^{1/2}},
\]
for any non-trivial additive characters \(\psi,\phi\) [2507.06808]. It then states that this inequality follows from the Walsh bound above, because
\[
\max_{a,b}|\operatorname{CORR}_S(\psi,\phi,a,b)|
= \frac{1}{q}\max_{a,b}|\mathcal{W}_S(\psi',a,b)|
\le \frac{2^{n+1}q^{1/2}+1}{q}
\approx \frac{2^{n+1}}{q^{1/2}},
\]
which is stronger than the conjectured \(\frac{2^{n+2}}{q^{1/2}}\) form [2507.06808].

This establishes a concrete linear-cryptanalytic guarantee at the single-S-box level. The source further notes that for large \(q\), “the best linear approximation” has bias at most about \(2^{n+1}/\sqrt{q}\), and that this is small in the large-prime-field regime used by zero-knowledge-friendly designs [2507.06808]. This suggests that Polocolo’s S-box is best understood not as a bit-oriented AES-style object, but as a prime-field permutation whose linear profile is controlled asymptotically by square-root cancellation.

## 4. Analytic mechanism: subgroup Kloosterman sums

The core technical device in the supplied analysis is reduction to Kloosterman sums over multiplicative subgroups. For a subgroup \(\mathcal{G}\subset\mathbb{F}_q^\times\), the paper defines
\[
K(\psi,\mathcal{G},a,b)=\sum_{x\in\mathcal{G}}\psi\bigl(a x+b x^{-1}\bigr)
\]
[2507.06808]. It then proves the bound
\[
|K(\psi,\mathcal{G},a,b)|\le 2\sqrt{q}\qquad\text{for }a\cdot b\neq 0,
\]
uniformly for any subgroup \(\mathcal{G}\subset\mathbb{F}_q^\times\) [2507.06808].

For the Polocolo S-box, the Walsh transform is partitioned over cosets of a subgroup \(N_0\) of order \(\frac{q-1}{m}\). Writing \(g\) for a generator of \(\mathbb{F}_q^\times\), the cosets are
\[
N_r=\{g^r,g^{m+r},g^{2m+r},\dots,g^{q-1-m+r}\},\quad r=0,\dots,m-1,
\]
and the Walsh transform becomes
\[
\mathcal{W}_S(\psi,a,b)
=1+\sum_{r=0}^{m-1}\sum_{x\in N_r}
\psi\bigl(a x+b x^{-1}T(\#1{x}{q}_m)\bigr)
\]
[2507.06808]. Each inner sum can be rewritten as a Kloosterman sum over \(N_0\), of the form
\[
K(\psi,N_0,a_r,b_r),
\]
after absorbing the coset representative into modified parameters \(a_r,b_r\) [2507.06808]. Summing at most \(m=2^n\) such contributions yields the factor \(2^{n+1}\sqrt{q}\) in the final Walsh bound [2507.06808].

The source explicitly identifies this subgroup-Kloosterman estimate as the “central tool” for Polocolo [2507.06808]. In methodological terms, the analysis places Polocolo within the classical program of bounding character sums via generalized Weil-type estimates, but specialized to subgroup-structured inverse maps.

## 5. Relation to other S-box families

The supplied material situates Polocolo alongside Grendel and other power-residue or power-based designs. In the same framework, Grendel’s S-box is written
\[
S(x)=x^d\cdot \#1{x}{q}_2=x^{d+\frac{q-1}{2}},
\]
which corresponds to \(m=2\) and \(T=\mathrm{id}\) [2507.06808]. For general \(d>1\) with \(d\cdot m<q\), the paper states the bound
\[
|\mathcal{W}_S(\psi,a,b)|\le
\begin{cases}
q, & a=b=0,\\[0.3em]
0, & a\neq 0,\ b=0,\\[0.3em]
(d m-1)\,q^{1/2}+2, & a=0,\ b\neq 0,\\[0.3em]
(d m-1)\,q^{1/2}+2, & a\cdot b\neq 0,
\end{cases}
\]
[2507.06808]. For inverse-type Polocolo, the constant is linear in \(m\); for general power-type constructions, it is linear in \(d m\) [2507.06808].

A second point of comparison arises from classical S-box design over binary extension fields. The Dobbertin–Bracken–Leander power mapping
\[
f(x)=x^{2^{2k}+2^k+1}\quad\text{on }\mathbb{F}_{2^{4k}}
\]
has differential uniformity \(4\), nonlinearity
\[
NL(f)=2^{4k-1}-2^{2k-1},
\]
and is a permutation if and only if \(k\) is odd [0901.1824]. The source states that, from the perspective of linear and differential cryptanalysis, this function has “the same resistance to both the linear and differential attacks as the inverse function” [0901.1824]. Although this construction does not mention Polocolo, it provides a contrasting paradigm: highly nonlinear differentially \(4\)-uniform permutations on binary fields rather than prime-field power residue permutations.

A third comparison comes from 8×8 bijective S-box construction from non-bijective power functions. The method of Mamadolimov et al. starts from \(x^3\) over \(\mathbb{F}_{2^8}\), uses the binomial
\[
F_{a,b}(x)=a x^3+b x^4,
\]
and then replaces duplicate outputs by missing values to obtain bijective S-boxes with \(\delta(S)=8\) and \(NL(S)=102\) [1301.4723]. In that design, the objective is explicit 8×8 bijection over \(\mathbb{F}_{2^8}\); in Polocolo, the supplied discussion instead focuses on prime-field permutation structure and Walsh-correlation control [1301.4723, 2507.06808].

## 6. Design interpretation and common misconceptions

A common misconception is to treat the Polocolo S-box as if it were simply a direct analogue of the AES S-box. The supplied sources do not support that identification. AES is described in the supplied binary-field literature as using the inverse mapping over \(\mathbb{F}_{2^8}\), with differential uniformity \(4\) and optimal known nonlinearity for 8-bit permutations [0901.1824, 1301.4723]. By contrast, Polocolo is described over a **prime field** \(\mathbb{F}_q\), uses the inverse map \(x^{q-2}\) multiplied by a power-residue-dependent factor, and is analyzed primarily through Walsh-spectrum bounds rather than bit-level differential uniformity tables [2507.06808].

A second misconception is that the multiplicative factor \(T\!\left(x^{(q-1)/2^n}\right)\) is an arbitrary perturbation with no structural role. The supplied analysis shows the opposite: the field is partitioned into cosets of a subgroup, and this factor is constant on the fibers of the power-residue map, which is exactly what permits the reduction of the Walsh transform to subgroup Kloosterman sums [2507.06808]. This suggests that the construction is designed so that the added flexibility remains compatible with explicit harmonic analysis.

A third misconception is that the proved bounds determine the exact Walsh spectrum. The supplied source does not claim this. It gives upper bounds, notes that the theoretical bound is not tight numerically, and identifies sharper constants or exact Walsh spectra for specific parameter choices as an open direction [2507.06808]. Thus the current state, within the supplied material, is one of rigorous asymptotic and explicit worst-case control rather than complete spectral classification.

## 7. Significance, constraints, and open directions

Within the supplied literature, the main significance of the Polocolo S-box is that it provides a prime-field permutation with a provable correlation bound of order
\[
O\!\left(\frac{2^n}{\sqrt{q}}\right),
\]
thereby verifying and slightly improving the conjectured Polocolo linear-correlation estimate [2507.06808]. The source characterizes this as establishing resistance to linear cryptanalysis “at the single S-box level” [2507.06808].

The same analysis also records a limitation of the method: the estimates are nontrivial when the relevant subgroup size exceeds \(\sqrt{q}\), that is, when \(m\) is not too large relative to \(\sqrt{q}\) [2507.06808]. In the Polocolo setting, \(m=2^n\) is said to be far smaller than \(q^{1/2}\), so the resulting bounds are significantly better than the trivial subgroup-size bound [2507.06808].

The supplied source identifies several research directions. One is improvement for smaller subgroups, where refined methods from works of Ostafe may be needed [2507.06808]. Another is extending the framework from monomials \(x^d\) to general polynomials \(f(x)\) in constructions of the form
\[
S(x)=f(x)\cdot T\!\left(x^{\frac{q-1}{m}}\right)
\]
under suitable degree conditions [2507.06808]. A further direction is to obtain sharper constants or exact Walsh spectra for specific parameter sets [2507.06808].

Taken together, the supplied material presents the Polocolo S-box as a mathematically structured prime-field permutation whose defining feature is not merely inversion, but inversion modulated by a power-residue selector in a way that preserves analytic tractability. Its current rigorous profile, in the supplied sources, is therefore anchored less in classical binary-field criteria such as differential \(4\)-uniformity than in subgroup character-sum analysis and explicit linear-correlation bounds [2507.06808].

Source: https://www.emergentmind.com/topics/polocolo-s-box