--- title: 'Polocolo: Inverse-Based Power-Residue S-boxes' url: https://www.emergentmind.com/topics/polocolo type: topic --- # Polocolo: Inverse-Based Power-Residue S-boxes Searching arXiv for “Polocolo”, “POLO policy-based optimization”, and “Procoli cosmological likelihoods” to ground the article in current papers. Polocolo denotes a cryptographic construction discussed in the context of power-residue S-boxes over prime fields, especially in relation to zero-knowledge-friendly hash design. In the recent literature, Polocolo is associated with an inverse-based power-residue S-box of the form $$ S(x)=x^{q-2}\cdot T\!\left(x^{(q-1)/m}\right), $$ where $q$ is a prime, $m\mid(q-1)$, and $T(y)\neq 0$ for $y\neq 0$. A 2025 analysis studies the Walsh spectrum of this class of S-boxes and proves the conjectured correlation bound for the Polocolo S-box [2507.06808]. The name also appears in practice as a source of ambiguity or misspelling, sometimes referring instead to the optimization library POLO [1810.03417] or the cosmology profiling package Procoli [2401.14225]. In the cryptographic literature, however, Polocolo is specifically tied to inverse-based power-residue S-boxes and their linear-cryptanalytic properties [2507.06808]. ## 1. Cryptographic definition Polocolo uses an inverse-based power-residue S-box with $m$ a power of two: $$ S(x)=x^{q-2}\cdot T\!\left(x^{(q-1)/m}\right), $$ with $m=2^n$ and $2^n\mid(q-1)$, where $T(y)\neq 0$ for $y\neq 0$ [2507.06808]. The construction is defined over a prime field $\mathbb{F}_q$, with $q\ge 3$. More generally, the analyzed family is $$ S(x)=x^d\cdot T\!\left(x^{(q-1)/m}\right), $$ for integers $d,m\ge 1$ such that $\gcd(d,q)=1$ and $m\mid(q-1)$ [2507.06808]. The term “power-residue S-box” refers to the use of the map $x\mapsto x^{(q-1)/m}$, which sends $\mathbb{F}_q^\times$ onto the unique subgroup of order $m$ in the multiplicative group. This induces a coset structure on $\mathbb{F}_q^\times$, and the factor $T(x^{(q-1)/m})$ assigns nonzero coset-dependent scalings. In the inverse-based case $d=q-2$, this yields piecewise-scaled inversion on multiplicative cosets [2507.06808]. The condition that $T(y)\neq 0$ for $y\neq 0$ prevents introducing additional zeros on $\mathbb{F}_q^\times$. The 2025 paper further states that Polocolo is designed so that $S$ is a permutation of $\mathbb{F}_q$, achieved by an appropriate choice of $T$ [2507.06808]. ## 2. Algebraic structure and subgroup decomposition The algebraic mechanism behind Polocolo is the subgroup decomposition induced by $x^{(q-1)/m}$. If $g$ is a generator of $\mathbb{F}_q^\times$, the multiplicative group decomposes into cosets $$ N_r=\{g^{r+km}:0\le k\le (q-1)/m-1\}, $$ for $r=0,\dots,m-1$ [2507.06808]. On each coset, the S-box acts as a constant multiple of a monomial; in the inverse-based case, it takes the form $$ S(x)=c_r\cdot x^{-1} $$ on the $r$-th coset, where $c_r=T(g^{r\cdot(q-1)/m})\neq 0$ [2507.06808]. This coset structure is central because it reduces Walsh-coefficient analysis to exponential sums over a subgroup. For a subgroup $G\le \mathbb{F}_q^\times$, the relevant object is the Kloosterman sum over a subgroup: $$ K(\psi,G,a,b)=\sum_{x\in G}\psi(ax+bx^{-1}), $$ where $\psi$ is a nontrivial additive character of $\mathbb{F}_q$ [2507.06808]. The paper gives a reduction formula expressing such sums as exponential sums over $\mathbb{F}_q^\times$ with rational-function arguments, enabling the use of generalized Weil-type bounds [2507.06808]. This suggests that Polocolo’s security analysis is inseparable from subgroup-exponential-sum theory: the power-residue factor organizes the state space into cosets, and the inverse map turns each coset contribution into a Kloosterman-type term. ## 3. Walsh transform, spectrum, and correlation bounds The Walsh transform of an S-box $S:\mathbb{F}_q\to\mathbb{F}_q$ is defined, for $a,b\in\mathbb{F}_q$, by $$ W_S(\psi,a,b)=\sum_{x\in\mathbb{F}_q}\psi(ax+bS(x)), $$ with $\psi$ a nontrivial additive character [2507.06808]. The Walsh spectrum is the multiset of all such values. In linear cryptanalysis, the associated correlation is obtained by normalizing the Walsh coefficient by $q$ [2507.06808]. The key theorem proved in the 2025 paper establishes the subgroup Kloosterman bound $$ |K(\psi,G,a,b)|\le 2q^{1/2} $$ when $ab\neq 0$ [2507.06808]. This sharpens the designers’ conjectural upper bound of $4q^{1/2}$ for Kloosterman sums over nontrivial subgroups [2507.06808]. For inverse power-residue S-boxes of the form $$ S(x)=x^{q-2}\cdot T\!\left(x^{(q-1)/m}\right), $$ the paper derives the following Walsh-spectrum bound: $$ |W_S(\psi,a,b)|\le \begin{cases} q,& a=b=0,\\ 0,& a\neq 0,\ b=0,\\ (m-1)q^{1/2}+2,& a=0,\ b\neq 0,\\ 2mq^{1/2}+1,& ab\neq 0. \end{cases} $$ [2507.06808] For Polocolo specifically, with $m=2^n$ and $S$ a permutation, this simplifies to $$ |W_S(\psi,a,b)|\le \begin{cases} q,& a=b=0,\\ 0,& a\neq 0,\ b=0,\\ 0,& a=0,\ b\neq 0,\\ 2^{n+1}q^{1/2}+1,& ab\neq 0. \end{cases} $$ [2507.06808] Consequently, $$ \max_{a,b}|CORR_S(\psi,\phi,a,b)|\le \frac{2^{n+1}}{q^{1/2}}+\frac{1}{q}, $$ which implies the designers’ conjectured inequality $$ \max |CORR_S|\le \frac{2^{n+2}}{q^{1/2}} $$ with margin to spare [2507.06808]. ## 4. Proof method and analytical framework The proof strategy proceeds by decomposing the Walsh sum over multiplicative cosets and reducing each inner sum to a subgroup Kloosterman sum [2507.06808]. In the inverse-based setting, each coset contributes a term of the form $$ \sum_{x\in G}\psi(Ax+Bx^{-1}), $$ which is exactly a Kloosterman sum over a subgroup [2507.06808]. The decisive analytical step is then to rewrite the subgroup sum as an exponential sum with rational-function argument and apply the generalized Weil bound for rational functions, attributed in the paper to Moreno–Moreno [2507.06808]. A necessary obstruction of Artin–Schreier type, namely whether the rational function can be written in the form $h^p-h$, is excluded by a degree argument [2507.06808]. For more general power-residue S-boxes with $1