Summary: A perfect nonlinear S-box is a substitution transformation with evenly distributed directional derivatives. Since the method of differential cryptoanalysis presented by E. Biham and A. Shamir makes use of nonbalanced directional derivatives, the perfect nonlinear S-boxes are immune to this attack. The main result is that for a perfect nonlinear S-box the number of input variables is at least twice the number of output variables. Also two different construction methods are given. The first one is based on the Maiorana-McFarland construction of bent functions and is easy and efficient to implement. The second method generalizes Dillon’s construction of difference sets.
[For the entire collection see Zbl 0756.00008.]