Christina Boura
email: christina.boura@uvsq.fr

Anne Canteaut
email: anne.canteaut@inria.fr

On the Boomerang Uniformity of Cryptographic Sboxes

Keywords: Sbox, Boomerang Connectivity Table, Boomerang attack, Boomerang uniformity

The boomerang attack is a cryptanalysis technique against block ciphers which combines two differentials for the upper part and the lower part of the cipher. The dependency between these two differentials then highly affects the complexity of the attack and all its variants. Recently, Cid et al. introduced at Eurocrypt'18 a new tool, called the Boomerang Connectivity Table (BCT) that permits to simplify this complexity analysis, by storing and unifying the different switching probabilities of the cipher's Sbox in one table. In this seminal paper a brief analysis of the properties of these tables is provided and some open questions are raised. It is being asked in particular whether Sboxes with optimal BCTs exist for even dimensions, where optimal means that the maximal value in the BCT equals the lowest known differential uniformity. When the dimension is even and differs from 6, such optimal Sboxes correspond to permutations such that the maximal value in their DDT and in their BCT equals 4 (unless APN permutations for such dimensions exist). We provide in this work a more in-depth analysis of boomerang connectivity tables, by studying more closely differentially 4-uniform Sboxes. We first completely characterize the BCT of all differentially 4-uniform permutations of 4 bits and then study these objects for some cryptographically relevant families of Sboxes, as the inverse function and quadratic permutations. These two families provide us with the first examples of differentially 4-uniform Sboxes optimal against boomerang attacks for an even number of variables, answering the above open question.

Introduction

The boomerang attack, introduced by Wagner in 1999 [START_REF] Wagner | The boomerang attack[END_REF] is an important cryptanalysis technique against block ciphers. These attacks can be seen as an extension of classical differential attacks [START_REF] Biham | Differential cryptanalysis of DES-like cryptosystems[END_REF]. Boomerang cryptanalysis can be applied in cases when it is not possible to find a high probability differential trail for the whole cipher and is based on the idea of combining differential properties of smallest parts of the cipher instead. More precisely, in a classical boomerang attack, a cipher E is seen as the composition of two sub-ciphers E 0 and E 1 , i.e. E = E 1 • E 0 . Boomerang attacks work by forming a quartet structure based on a differential a → d for E 0 of probability p and a differential c → b for E 1 of probability q, as depicted in Figure 1. Using the following estimate

Pr[E -1 (E(x) ⊕ b) ⊕ E -1 (E(x ⊕ a) ⊕ b) = a] = p 2 q 2 , ( 1
)
the attack consists in mounting a distinguisher with a data complexity corresponding to (pq) -2 adaptive chosen plaintexts/ciphertexts.

E 0 P P ⊕ a a Q Q ⊕ a b c E 0 E 0 a E 1 b c E 1 E 1 E 0 d d E(P ) E(P ⊕ a) E(Q) E(Q ⊕ a) E 0 P a Q c E 0 E 0 E 0 a E m x y E 1 E m x ⊕ d y ′ E 1 E m y ⊕ c E 1 E m x ′ ⊕ d y ′ ⊕ c E 1 c b b d d P ⊕ a Q ⊕ a E(P ) E(Q) E(P ⊕ a) E(Q ⊕ a)
x ′ Since Wagner's seminal paper, many improvements and variants of boomerang attacks have been proposed [KKS01, BDK01, BDK02, BDD03, BK09, DKS10, KHP + 12]. However, Murphy [START_REF] Murphy | The return of the cryptographic boomerang[END_REF] pointed out that the independence assumption used for establishing Eq. (1) may fail: he exhibited some counterexamples for which the probability in (1) is much smaller than this estimate, and some other ones for which this probability is much higher.

A rigorous analysis capturing all these variants has been provided in [START_REF] Orr Dunkelman | A practical-time related-key attack on the KASUMI cryptosystem used in GSM and 3G telephony[END_REF] through the notion of sandwich attack. In this case, the cipher is decomposed into three parts, E = E 1 • E m • E 0 , where the middle part E m is a simple transformation, typically one round (or one S-box layer) of the cipher (see right part of Figure 1). This transition through the middle sub-cipher then formalizes the dependence between the two involved differentials. More precisely, the probability in the previous statistical analysis has to be multiplied by

Pr

E -1 m (E m (x) ⊕ c) ⊕ E -1 m (E m (x ⊕ d) ⊕ c) = d . ( 2
)
For instance, the incompatibility exhibited by Murphy corresponds to the situation where this probability vanishes. The so-called Feistel switch [START_REF] Biham | Related-key boomerang and rectangle attacks[END_REF][START_REF] Biryukov | Related-key cryptanalysis of the full AES-192 and[END_REF] refers to the case where E m is a round of a Feistel cipher. Then, it is easy to see that the Feistel structure implies that the probability (2) is always equal to 1. Similarly, the ladder switch introduced by Biryukov and Khovratovich in [START_REF] Biryukov | Related-key cryptanalysis of the full AES-192 and[END_REF] refers to the case where E m corresponds to the parallel application of smaller transformations, typically to an Sbox layer. Then, if the input difference d i of the i-th Sbox S i vanishes, the corresponding contribution to the probability satisfies

Pr[S -1 i (S i (x i ) ⊕ c i ) ⊕ S -1 i (S i (x i ⊕ d i ) ⊕ c i ) = d i ] = 1 .
The same property obviously holds if the output difference c i of the i-th Sbox vanishes. These observations point out that the value (2) plays a key role when estimating the complexity of boomerang attacks and their generalizations. Recently, in [CHP + 18] the authors proposed a new method for evaluating this probability in a more systematic way than by running experiments. This approach consists in studying (2) for a single Sbox by a method which follows closely what is done for measuring the resistance of a cipher against differential cryptanalysis. Indeed, for differential cryptanalysis, a table called the difference distribution table (DDT) is created for the cipher's Sbox S by recording for each input difference a and for each output difference b the number of solutions of the equation S(x ⊕ a) ⊕ S(x) = b. The smaller the maximal value of the DDT, the better the resistance of the cipher against differential cryptanalysis. In order to evaluate the resistance of a cipher against boomerang attacks, the authors of [CHP + 18] introduce a similar table, called the Boomerang Connectivity Table (BCT), to keep for each a and b the number of solutions of the equation The values of the BCT then record the probability of generating boomerang quartets at the Sbox level (up to a factor 2 -n ) (see Figure 2). In particular, this representation permits to visualize in a single table both the ladder switch and the Sbox switch (see Figure 3). More importantly, it can reveal in some cases better possible switches. The smaller the maximal value β in the table (excluding the values for a or b = 0) the better the resistance of the cipher against boomerang-style attacks. Understanding the properties of such tables allows then designers and cryptanalysts to better evaluate the applicability of boomerang attacks and provides new criteria for designing Sboxes.

S -1 (S(x) ⊕ b) ⊕ S -1 (S(x ⊕ a) ⊕ b) = a. S x S(x) S x ⊕ a S(x ⊕ a) a S x ′ S(x) ⊕ b S x ′′ S(x ⊕ a) ⊕ b b b Pr[x ′ ⊕ x ′′ = a]
The introduction of the Boomerang Connectivity Tables in [CHP + 18] was accompanied by a preliminary analysis of their properties and especially of their link with the corresponding DDTs. The authors show notably that the maximum in the BCT, β, is at least equal to the differential uniformity of the Sbox. Moreover, for Almost Perfect Nonlinear (APN) permutations, that are the permutations offering an optimal resistance against differential attacks, the BCT and DDT tables coincide for all values with a, b = 0. In other words, for APN Sboxes, there are no other switching techniques than the ladder switch and the Sbox switch. On the other hand, it is experimentally shown that, for permutations of F 4 2 , a row in a DDT composed only of 0s and 4s leads to an entry equal to 16 in the corresponding row of the BCT. In these cases, there exist some efficient switches other than the ladder switch.

This preliminary analysis therefore raises many important open questions. The case of APN permutations, i.e. permutations with differential uniformity 2, is entirely settled and it was shown, as said before, that such permutations offer an optimal resistance to both differential and boomerang attacks. However, such permutations are only known to exist for odd dimensions, with the only exception being Dillon et al.'s permutation in dimension 6 [START_REF] Browning | An APN permutation in dimension six[END_REF]. While it is known that for n = 4 APN permutations do not exist, for other even dimensions n ≥ 8, the existence of APN permutations remains an open question, known as the Big APN Problem [START_REF] Browning | An APN permutation in dimension six[END_REF]. Therefore, in even dimensions, notably for n = 4 or n = 8, designers typically choose Sboxes that offer the next best Studying therefore the resistance of such Sboxes against boomerang attacks is an important task.

S x = x ′ S(x) = S(x ′ ) S x ⊕ a S(x ⊕ a) = S(x ′ ⊕ a) a b b (a) Ladder switch S x = x ′ ⊕ a S(x) = S(x ′ ⊕ a) S x ⊕ a = x ′ S(x ⊕ a) = S(x ′ ) a b a (b) Sbox switch
Notably, an open question raised in [CHP + 18] is whether optimal differentially 4uniform Sboxes exist against boomerang attacks, where optimal means that the maximal value in the BCT is 4.

Our contributions.

In this paper we study the properties of BCTs, solve some of the problems raised in [CHP + 18] and provide results for the BCTs of some important cryptographic families of Sboxes. First, we show that the multi-set composed of all values in the BCT is preserved under affine equivalence and inversion. This very simple result is useful as it restrains the study of BCTs in a given dimension to the study of the properties of a single representative of the affine equivalence class. We then provide a detailed study of the BCTs of all differentially 4-uniform 4-bit permutations and mathematically prove some of the results that were only experimentally verified in [CHP + 18]. Next, we entirely determine the boomerang properties for the inverse mapping. In odd dimension this permutation is known to be APN while in even dimension it is differentially 4-uniform. We show here that the maximal value in its BCT is 6 for n ≡ 0 mod 4 and equals 4 for n ≡ 2 mod 4. Therefore, this proves that the inverse mapping has an optimal BCT in such dimensions for a non-APN Sbox. In other words, this solves, for n ≡ 2 mod 4, the open problem raised in [CHP + 18]. Finally, we focus on quadratic permutations as these objects present a particular interest for cryptography. Indeed, because of their low multiplicative depth, such functions are good candidates for side-channel resistant and for FHE and MPC-friendly constructions. For example, the Sbox used inside the hash-standard SHA-3 [START_REF] Dworkin | SHA-3 Standard: Permutation-Based Hash and Extendable-Output Functions[END_REF] is a quadratic permutation of F 5 2 . We prove first that the maximal value in the BCT of differentially 4-uniform quadratic permutations is at most 12. Also we show that this maximal value is exactly 4 for quadratic power permutations over F 2 n when n ≡ 2 mod 4. Hence, the inverse function and the quadratic differentially 4-uniform power permutations for n ≡ 2 mod 4 provide us with the first examples of optimal non-APN functions against boomerang cryptanalysis.

Preliminaries

From now on, the terminology Sbox will refer to a vectorial Boolean function S : F n 2 → F n 2 . We introduce here the notions and definitions related to the differential properties of such functions.

Definition 1 (Derivative of a function). Let S be a function from F n 2 into F n 2 . The derivative of S with respect to a ∈ F n 2 is the function

∆ a S : x ∈ F n 2 → S(x ⊕ a) ⊕ S(x).
The multi-sets corresponding to the images of the derivatives of S are usually represented as a two-dimensional array called the difference distribution table.

Definition 2 (DDT and its characteristics). Let S be a function from

F n 2 into F n 2 . The difference distribution table (DDT) of S is the two-dimensional table defined by δ S (a, b) = #{x ∈ F n 2 : ∆ a S(x) = b} with a, b ∈ F n 2 .
The differential uniformity of S [START_REF] Nyberg | Differentially uniform mappings for cryptography[END_REF], denoted by δ S , is the highest value in the DDT, i.e.

δ S = max a,b∈F n 2 ,a =0 δ S (a, b). A function S with δ S = δ is called differentially δ-uniform. Finally, the differential spectrum of S is the multi-set {δ S (a, b), a ∈ F n 2 \ {0}, b ∈ F n 2 }.
Example 1. When F 2 4 is identified with F 4 2 by the primitive polynomial x 4 + x + 1, the inverse permutation over F 2 4 , S : x → x 14 has the following value table S = [0, 1, 9, 14, 13, 11, 7, 6, 15, 2, 12, 5, 10, 4, 3, 8] and its DDT is provided in Table 1. As it can be seen from this table, S is differentially 4-uniform, i.e. δ S = 4.

Table 1: DDT of the permutation x → x 2 n -2 for n = 4 0 1 2 3 4 5 6 7 8 9 a b c d e f 0 16 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 4 0 0 0 0 2 2 0 2 0 2 0 2 2 0 2 0 0 0 2 0 0 0 2 0 4 2 0 2 2 0 2 3 0 0 2 0 0 0 0 2 2 0 2 2 2 0 4 0 4 0 0 0 0 0 2 2 0 2 0 2 0 0 4 2 2 5 0 0 0 0 2 0 2 0 2 2 0 4 2 0 0 2 6 0 2 0 0 2 2 2 4 0 0 2 0 2 0 0 0 7 0 2 2 2 0 0 4 2 2 0 0 0 0 0 0 2 8 0 0 0 2 2 2 0 2 0 0 0 2 0 0 2 4 9 0 2 4 0 0 2 0 0 0 2 0 0 2 0 2 2 a 0 0 2 2 2 0 2 0 0 0 0 0 4 2 2 0 b 0 2 0 2 0 4 0 0 2 0 0 2 2 2 0 0 c 0 0 2 2 0 2 2 0 0 2 4 2 0 0 0 0 d 0 2 2 0 4 0 0 0 0 0 2 2 0 2 0 2 e 0 2 0 4 2 0 0 0 2 2 2 0 0 0 2 0 f 0 0 2 0 2 2 0 2 4 2 0 0 0 2 0 0

The lowest possible value for the differential uniformity of a function from F n 2 into itself is two and the functions with differential uniformity two are called almost perfect nonlinear (APN). While for n odd many families of APN permutations are known [START_REF] Blondeau | Perfect nonlinear functions and cryptography[END_REF],

for n even only one permutation (up to CCZ equivalence) for n = 6, discovered by Dillon et al. in 2009 [START_REF] Browning | An APN permutation in dimension six[END_REF], is known today. The problem of finding APN permutations for other even dimensions is open and is called The Big APN Problem. Therefore, for even dimensions n = 6, the best choice regarding the differential criterion is the differentially 4-uniform permutations. Such permutations, for both even and odd dimensions, are the object of our study in this article.

We provide now the definition of the Boomerang Connectivity Table (BCT) for a permutation of

F n 2 . Definition 3 ([CHP + 18]). Let S be a permutation of F n 2 . The Boomerang Connectivity Table (BCT) of S is the two-dimensional table defined by β S (a, b) = #{x ∈ F n 2 : S -1 (S(x) ⊕ b) ⊕ S -1 (S(x ⊕ a) ⊕ b) = a}, with a, b ∈ F n 2 .
The boomerang uniformity, denoted by β S , is the highest value in the BCT without considering the row and the column of index 0:

β S = max a,b∈F n 2 \{0} β S (a, b).
Example 2. The BCT of the inverse permutation over F 2 4 is provided in Table 2. It can be seen that β S = 6.

0 0 0 0 6 6 0 2 0 2 0 2 2 0 2 16 0 0 6 0 0 0 2 0 4 6 0 2 2 0 2 3 16 0 6 0 0 0 0 2 2 0 2 2 6 0 4 0 4 16 0 0 0 0 6 2 0 6 0 2 0 0 4 2 2 5 16 0 0 0 6 0 2 0 2 2 0 4 2 0 0 6 6 16 6 0 0 2 2 6 4 0 0 2 0 2 0 0 0 7 16 6 2 2 0 0 4 6 2 0 0 0 0 0 0 2 8 16 0 0 2 6 2 0 2 0 0 0 6 0 0 2 4 9 16 2 4 0 0 2 0 0 0 2 0 0 6 0 6 2 a 16 0 6 2 2 0 2 0 0 0 0 0 4 2 6 0 b 16 2 0 2 0 4 0 0 6 0 0 2 2 6 0 0 c 16 0 2 6 0 2 2 0 0 6 4 2 0 0 0 0 d 16 2 2 0 4 0 0 0 0 0 2 6 0 2 0 6 e 16 2 0 4 2 0 0 0 2 6 6 0 0 0 2 0 f 16 0 2 0 2 6 0 2 4 2 0 0 0 6 0 0

Invariance under some equivalence relations

We show that the multi-set composed of all values in the BCT is preserved under affine equivalence.

Proposition 1. Let F and G be two permutations of F n 2 which are affine-equivalent, i.e., there exist two affine permutations A 1 and A 2 such that

G = A 2 • F • A 1 .
Then, the BCT of F and G are related by

β G (a, b) = β F (L 1 (a), L -1 2 (b)), for all a, b ∈ F n 2 ,
where L 1 and L 2 denote the linear parts of A 1 and A 2 respectively. Proof. Let x ∈ F n 2 be a solution of the equation

G -1 (G(x) ⊕ b) ⊕ G -1 (G(x ⊕ a) ⊕ b) = a.
Equivalently,

(A 2 • F • A 1 ) -1 [(A 2 • F • A 1 )(x) ⊕ b] ⊕ (A 2 • F • A 1 ) -1 [(A 2 • F • A 1 )(x ⊕ a) ⊕ b] = a ⇔ F -1 • A -1 2 [(A 2 • F • A 1 )(x) ⊕ b] ⊕ F -1 • A -1 2 [(A 2 • F • A 1 )(x ⊕ a) ⊕ b] = L 1 (a)
(3) where this equality is obtained by using that, for any affine function A,

A(x 1 ) ⊕ A(x 2 ) = L(x 1 ⊕ x 2 )
where L is the linear part of A. Now, by writing

A 2 (x) = L 2 (x) ⊕ γ, we have that A -1 2 (x) = L -1 2 (x ⊕ γ). It follows that A -1 2 [(A 2 • F • A 1 )(x) ⊕ b] = L -1 2 [(L 2 • F • A 1 )(x) ⊕ γ ⊕ b ⊕ γ] = (F • A 1 )(x) ⊕ L -1
2 (b) . We then deduce that Equation (3) is equivalent to

F -1 F (A 1 (x)) ⊕ L -1 2 (b) ⊕ F -1 F (A 1 (x ⊕ a)) ⊕ L -1 2 (b) = L 1 (a)
. By setting y = A 1 (x) we get that y is a solution of

F -1 F (y) ⊕ L -1 2 (b) ⊕ F -1 F (y ⊕ L 1 (a)) ⊕ L -1 2 (b) = L 1 (a). In other words, x belongs to the set involved in β G (a, b) if and only if y = A 1 (x) belongs to the set involved in β F (L 1 (a), L -1 2 (b)
). A similar relation can be exhibited between the BCT of a permutation and the BCT of its inverse.

Proposition 2. Let S be a permutation of F n 2 . Then, the BCT of S and of S -1 are related by

β S -1 (a, b) = β S (b, a), for all a, b ∈ F n 2 . Proof. Let x ∈ F n 2 be a solution of S(S -1 (x ⊕ a) ⊕ b) ⊕ S(S -1 (x) ⊕ b) = a .
Equivalently,

S -1 (x ⊕ a) ⊕ b = S -1 S(S -1 (x) ⊕ b) ⊕ a which means that y = S -1 (x) is a solution of S -1 (S(y) ⊕ a) ⊕ b = S -1 (S(y ⊕ b) ⊕ a) .
In other words x belongs to the set involved in β S -1 (a, b) if and only if y = S -1 (x) belongs to the set involved in β S (b, a).

We have proved that the multi-set formed by all values in the BCT is invariant under affine equivalence and inversion. In other words, the behaviour of the BCT with respect to these two classes of transformations is exactly the same as the behaviour of the DDT. However, while the differential spectrum of a function is also preserved by the extendedaffine (EA) equivalence (i.e. all transformations of the form A 2 • F • A 1 ⊕ A 0 where A 1 , A 2 are affine permutations and A 0 is an affine function), this is not the case for the BCT. For instance, the two permutations G 4 and G 6 from [START_REF] Leander | On the Classification of 4 Bit S-Boxes[END_REF] are EA-equivalent, but their boomerang uniformities differ: β G4 = 10 and β G6 = 8. Another important equivalence notion between Sboxes is the so-called CCZ-equivalence [START_REF] Carlet | Codes, Bent Functions and Permutations Suitable For DES-like Cryptosystems[END_REF]. Two functions F and G are said to be CCZ-equivalent if and only if

{(x, G(x)), x ∈ F n 2 } = A{(x, F (x)), x ∈ F n 2 } for some affine permutation A of F n 2 × F n 2 .
As EA-equivalence is a special case of CCZequivalence, we deduce that the boomerang uniformity is also not always preserved under CCZ-equivalence.

An alternative formulation

Let us define the following two sets of F n 2 :

U S a,b = {x ∈ F n 2 : S(x) ⊕ S(x ⊕ a) = b}, V S a,b = {S(x) ∈ F n 2 : S(x) ⊕ S(x ⊕ a) = b}
For the sake of simplicity, Parameter S will be omitted in this notation if the involved mapping is clear from the context. A simple remark is that

V S a,b = U S -1 b,a . Indeed, V S a,b = {S(x) ∈ F n 2 : S(x) ⊕ S(x ⊕ a) = b} = {y ∈ F n 2 : y ⊕ S(S -1 (y) ⊕ a) = b} = {y ∈ F n 2 : S -1 (y) ⊕ S -1 (y ⊕ b) = a} = U S -1 b,a .
We now provide an alternative formula for computing the entries in a BCT of a permutation.

Proposition 3. For any permutation S of F n

2 , for all a, b ∈ F n 2 , we have

β S (a, b) = δ S (a, b) + γ =0,b # V S a,γ ∩ (V S a,γ ⊕ b) . (4) Proof. β S (a, b) = #{x ∈ F n 2 : S -1 (S(x) ⊕ b) ⊕ S -1 (S(x ⊕ a) ⊕ b) = a} = γ =0 #{x : S(x) ⊕ S(x ⊕ a) = γ and S -1 (S(x) ⊕ b) ⊕ S -1 (S(x ⊕ a) ⊕ b) = a} = γ =0 #{x : S(x) ⊕ S(x ⊕ a) = γ and S -1 (S(x) ⊕ b) ⊕ S -1 (S(x) ⊕ b ⊕ γ) = a}
When γ = b, any x satisfying the first equation satisfies the second one too. Indeed, if x ∈ U a,b , then

S -1 (S(x) ⊕ b) ⊕ S -1 (S(x)) = S -1 (S(x ⊕ a)) ⊕ S -1 (S(x)) = a .
We then deduce that

β S (a, b) = δ S (a, b) + γ =0,b #{x ∈ U S a,γ and S(x) ⊕ b ∈ U S -1 γ,a } = δ S (a, b) + γ =0,b #{y ∈ V S a,γ and y ⊕ b ∈ U S -1 γ,a } = δ S (a, b) + γ =0,b #{y ∈ V S a,γ and y ⊕ b ∈ V S a,γ } = δ S (a, b) + γ =0,b V S a,γ ∩ (V S a,γ ⊕ b) .
We directly recover from Eq. (4) the following two observations from [CHP + 18], corresponding to the ladder switch and to the Sbox switch respectively:

β S (a, 0) = 2 n and β S (a, b) ≥ δ S (a, b) ,
for all a, b ∈ F n 2 . Most notably, the highest entry in the BCT β S is larger than or equal to the differential uniformity of the Sbox. It follows that the lowest possible value for β S is two, and it is achieved if and only if S is APN. Since no APN permutation of F n 2 is known for even n = 6, an optimal BCT in this case corresponds to β S = 4, and can only be achieved for differentially 4-uniform Sboxes.

Case of planar permutations. In most practical cases, the Sboxes used in symmetric primitives are planar in the sense of the following definition introduced by Daemen

β S (a, b) = γ =0:b∈V S a,γ δ S (a, γ) ,
where V S a,γ is the linear space associated to the affine space V S a,γ .

Proof. Proposition 3 involves the cardinality of the intersection

V S a,γ ∩ (V S a,γ ⊕ b) .
When S is planar, V S a,γ is an affine subspace, V S a,γ = v a,γ ⊕ V S a,γ . Then, only two situations may occur:

• either b ∈ V S a,γ , which equivalently means that (V S a,γ ⊕ b) = V S a,γ , • or b ∈ V S a,γ , which means that (V S a,γ ⊕ b) is a coset of V S a,γ different from V S a,γ .
In this case, the intersection between the two cosets of the same linear space is empty.

It follows that V S a,γ ∩ (V S a,γ ⊕ b) equals δ S (a, γ) when b ∈ V S
a,γ and 0 otherwise. Then,

β S (a, b) = δ S (a, b) + γ ∈{0,b}:b∈V S a,γ δ S (a, γ) ,
and the result directly follows from the fact that b ∈ V S a,γ .

Example 3. We illustrate Propositions 3 and 4 by using the Sbox S introduced in Example 1. Let a = 1. It can be checked that

V S 1,1 = {0, 1, 6, 7}, V S 1,6 = {11, 13}, V S 1,7 = {9, 14}, V S 1,9 = {5, 12}, V S 1,11 = {3, 8}, V S 1,13 = {2, 15}, V S 1,14 = {4, 10} and V S 1,γ = ∅ for all other γ ∈ F 4 2 .
For the respective linear spaces we have that V S 1,1 = {0, 1, 6, 7}, V S 1,γ = {0, γ} for γ ∈ {6, 7, 9, 11, 13, 14} and V S 1,γ = ∅ for all other γ ∈ F 4 2 . Let b = 6. We see that (V S 1,γ ∩ (V S 1,γ ⊕ 6)) = ∅ only for γ = 1. In this case, we have (V S 1,γ ⊕ 6) = V S 1,γ . Therefore, Proposition 3 leads to

β S (1, 6) = δ S (1, 6) + #(V S 1,1 ∩ (V S 1,1 ⊕ 6)) = 2 + 4 = 6.
Alternatively, as S is planar since it has differential uniformity 4, Proposition 4 gives:

β S (1, 6) = δ S (1, 6) + δ S (1, 1) = 2 + 4 = 6.

BCT tables for 4-bit permutations

BCT of all 4-bit permutations with δ S = 4

We have shown that the maximum value in the BCT is preserved under affine equivalence. It is then sufficient to study the BCT for one representative of the affine equivalence class. For n = 4 full classifications exist, see for example [START_REF] Decannière | Analysis and Design of Symmetric Encryption Algorithms[END_REF] or [START_REF] Leander | On the Classification of 4 Bit S-Boxes[END_REF]. Following the classification by De Cannière, we show in Table 3 the spectrum of the BCT for all classes of 4-bit permutations with δ S = 4, i.e., the values n i corresponding to the number of times the value i appears in the BCT. This classification includes all optimal permutations with δ S = 4 and optimal linearity L(S) = 8 listed in [START_REF] Leander | On the Classification of 4 Bit S-Boxes[END_REF], and also permutations with δ S = 4 and a higher linearity.

A first important observation from Table 3 is that all 4-bit permutations with δ S = 4 have boomerang uniformity at least 6. This then proves that 4-bit Sboxes with boomerang uniformity 4 do not exist, as conjectured in [CHP + 18, Section 6.1].

Another remark is that the inverse of Permutation 11 in Table 3 belongs to the affine-equivalence class of Permutation 10, implying that their BCTs contain the same values as shown by Proposition 2. Similarly, the inverse of Permutation 16 belongs to the affine-equivalence class of Permutation 13. Then, any two 4-bit permutations with δ S = 4 that are not related by inversion or affine equivalence have different BCT spectra.

We also notice that for all permutations with δ S = 4 in four variables n 12 = 0 and n 14 = 0, meaning that the values 12 and 14 never appear in the BCT table.

Understanding the results

The previous table confirms several observations on 4-bit Sboxes reported in [CHP + 18], which have been obtained experimentally by examining all Sboxes having specific properties. Most of these phenomena can actually be deduced from the following lemma which is very specific to the case of mappings over F 4 2 .

Lemma 1. Let S be a permutation on (DDT) of the PRESENT Sbox 0 1 2 3 4 5 6 7 8 9 a b c d e f 0 16 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 1 0 0 0 4 0 0 0 4 0 4 0 0 0 4 0 0 2 0 0 0 2 0 4 2 0 0 0 2 0 2 2 2 0 3 0 2 0 2 2 0 4 2 0 0 2 2 0 0 0 0 4 0 0 0 0 0 4 2 2 0 2 2 0 2 0 2 0 5 0 2 0 0 2 0 0 0 0 2 2 2 4 2 0 0 6 0 0 2 0 0 0 2 0 2 0 0 4 2 0 0 4 7 0 4 2 0 0 0 2 0 2 0 0 0 2 0 0 4 8 0 0 0 2 0 0 0 2 0 2 0 4 0 2 0 4 9 0 0 2 0 4 0 2 0 2 0 0 0 2 0 4 0 a 0 0 2 2 0 4 0 0 2 0 2 0 0 2 2 0 b 0 2 0 0 2 0 0 0 4 2 2 2 0 2 0 0 c 0 0 2 0 0 4 0 2 2 2 2 0 0 0 2 0 d 0 2 4 2 2 0 0 2 0 0 2 2 0 0 0 0 e 0 0 2 2 0 0 2 2 2 2 0 0 2 2 0 0 f 0 4 0 0 4 0 0 0 0 0 0 0 0 0 4 4

F 4 2 such that there exist a, b 1 , b 2 ∈ F 4 2 satisfying δ S (a, b 1 ) = δ S (a, b 2 ) = 4. Then, V a,b1 ∩ V a,b2 = {0} . Proof. Since δ S (a, b 1 ) = δ S (a, b 2 ) = 4, V a,b1 and V a,b2 are two affine subspaces of dimen- sion 2. Let V a,b1 = c 1 ⊕ b 1 , γ 1 and V a,b2 = c 2 ⊕ b 2 , γ 2 . By definition, V a,b1 and V a,b2 are disjoint. This means that c 2 ∈ c 1 ⊕ b 2 , γ 2 , b 1 , γ 1 . However, if V a,b1 ∩ V a,b2 = {0}, then b 1 , γ 1 , b 2 ,
The previous lemma implies a strong relationship between the boomerang uniformity of a 4-bit Sbox and the number of values 4 in a row of its DDT. This relationship explains for instance the fact observed in [CHP + 18, Lemma 3]: if the DDT of a 4-bit Sbox S has a row with entries 0 and 4 only, then β S = 16. Proposition 5. Let S be a permutation of F 4 2 with δ s = 4. Then,

• If its DDT has a row with at least two values 4, then β S ≥ 8;

• If each row in its DDT has at most two values 4, then β S ≤ 10;

• If its DDT has a row with four values 4, then β S = 16. Proof. We know from Proposition 4 that, for any Sbox with differential uniformity 4,

β S (a, b) = γ =0:b∈Va,γ δ S (a, γ), for all a, b ∈ F n 2 .
Suppose that the row of index a in the DDT of S is such that there exist γ 1 and γ 2 with δ S (a, γ 1 ) = δ S (a, γ 2 ) = 4. We then deduce from Lemma 1 that there exists a nonzero b in V a,γ1 ∩ V a,γ2 . Thus, β S (a, b) ≥ δ S (a, γ 1 ) + δ S (a, γ 2 ) = 8 .

Let us now assume that the row of index a contains exactly two values 4, i.e. δ S (a, γ) ≤ 2 for all γ ∈ {γ 1 , γ 2 }. Then, for all γ ∈ {γ 1 , γ 2 }, V a,γ is either empty, or equal to {0, γ}, implying that b ∈ V a,γ when γ ∈ {0, b}. Then, the set of all γ = 0 such that b ∈ V a,γ is always included in {b, γ 1 , γ 2 }. We deduce that, if b ∈ {γ 1 , γ 2 }, β S (a, b) = 8. Otherwise,

β S (a, b) ≤ δ S (a, b) + δ S (a, γ 1 ) + δ S (a, γ 2 ) ≤ 10 .
Now we assume that all entries in the row of index a equal 4, i.e. there exist γ 0 , γ 1 , γ 2 , γ 3 such that δ S (a, γ i ) = 4 for all 0 ≤ i ≤ 3, and δ S (a, γ) = 0 otherwise. We will show now that in this special case the above spaces have not only non-trivial pairwise intersections, but on top of that their joint intersection is not trivial

i.e. V a,γ0 ∩ V a,γ1 ∩ V a,γ2 ∩ V a,γ3 = {0}, which directly implies that the BCT uniformity is 16. Indeed, let b ∈ V a,γ0 ∩ V a,γ1 ∩ V a,γ2 ∩ V a,γ3 , then by Proposition 4, β(a, b) = δ(a, γ 0 ) + δ(a, γ 1 ) + δ(a, γ 2 ) + δ(a, γ 3 ) = 4 • 4 = 16.
For proving that the above intersection is non-trivial, we first show that any three of these sets have a non-trivial intersection. By contradiction, suppose w.l.o.g. that V a,γ0 ∩ V a,γ1 ∩ V a,γ2 = {0}. From Lemma 1, we know that V a,γ0 = γ 0 , b and V a,γ1 = γ 1 , b for some nonzero b. When γ 1 = γ 0 ⊕b, a trivial intersection between the 3 sets cannot occur: otherwise, V a,γ0 = V a,γ1 and the intersection between the three sets equals V a,γ0 ∩ V a,γ2 which is non-trivial by Lemma 1. Let us now focus on the case where γ 1 = γ 0 ⊕ b. Since b does not belong to V a,γ2 , V a,γ2 must be one of the following spaces:

γ 0 , γ 1 , γ 0 , b ⊕ γ 1 , b ⊕ γ 0 , γ 1 or b ⊕ γ 0 , b ⊕ γ 1 . In other words, V a,γ2 is a 2-dimensional space α, β ⊂ γ 0 , γ 1 , b which differs from γ 0 , b and from γ 1 , b . Moreover, by definition, the three affine subspaces V a,γ0 = c 0 ⊕ γ 0 , b , V a,γ1 = c 1 ⊕ γ 1 , b and V a,γ2 = c 2 ⊕ α, β are disjoint. This means that c 0 ∈ c 1 ⊕ γ 0 , b, γ 1
where ω is any element in F 4 \ F 2 , i.e. any element1 in F 2 n \ F 2 such that ω 3 = 1.

Proof. Since the inverse mapping on an even number of variables has differential uniformity 4, we use the equivalent formula given in Proposition 4 for computing the BCT entries:

β S (a, b) = γ =0:b∈Va,γ δ S (a, γ).
As for each row of the DDT there is exactly one 4 per row, there is exactly one γ a such that δ S (a, γ a ) = 4. Then, for all γ = γ a , V a,γ is either empty, or equal to {0, γ}, implying that b ∈ V a,γ when γ ∈ {0, b}. It follows that,

β S (a, b) =      δ S (a, b) if b ∈ V a,γa 4 if b = γ a δ S (a, b) + 4 if b ∈ V a,γa \ {0, γ a } .
From this, we see already that the boomerang uniformity is at most 6. We will prove now that, for any a = 0 and any b ∈ V a,γa \ {0, γ a }, δ S (a, b) = 0 if n ≡ 2 mod 4 and 2 if n ≡ 0 mod 4.

We first recall that in the case of the inverse function, for any a, γ = 0, δ(a, γ) = δ(1, aγ). Indeed, consider the equation:

(X ⊕ a) 2 n -2 ⊕ X 2 n -2 = γ.

This equation, by setting

Y = a -1 X, is equivalent to (Y ⊕ 1) 2 n -2 ⊕ Y 2 n -2 = aγ, which proves that δ(a, γ) = δ(1, aγ).
Consider the case of a = 1. It is well-known that the equation

(X ⊕ 1) 2 n -2 ⊕ X 2 n -2 = 1
has exactly four solutions. First, X = 0 and X = 1 are solutions of this equation. The other two solutions are α 2 n -1 3 and α2 2 n -1

3
where α is a primitive element of F 2 n . If we denote ω = α 2 n -1 3 then the four solutions are {0, 1, ω, ω 2 } which means that

U 1,1 = F 4 = {0, 1, ω, ω 2 } = ω, 1 .
By taking now into account that δ(a, γ a ) = δ(1, aγ a ), this means that δ(a, γ a ) = 4 if and only if aγ a = 1, or equivalently γ a = a -1 . By using that U a,γ = aU 1,aγ and applying it to γ = a -1 , we deduce that U a,a -1 = aU 1,1 = a, aω and then V a,a -1 = U a -1 ,a = a -1 , a -1 ω .

We then need to consider b ∈ a -1 , a -1 ω \ {0, a -1 }, i.e. b = a -1 ω and b = a -1 (ω ⊕ 1). We look at the value of δ(a, b), which is equivalent to looking at the value δ(1, ab) = δ(1, ω) or δ(1, ω ⊕ 1).

When X ∈ {0, 1}, the equations

(X ⊕ 1) 2 n -2 ⊕ X 2 n -2 = ω (X ⊕ 1) 2 n -2 ⊕ X 2 n -2 = ω ⊕ 1 are equivalent to the equations X 2 ⊕ X ⊕ ω = 0 X 2 ⊕ X ⊕ ω ⊕ 1 = 0
and these last equations have two solutions if Tr(ω) = 0 (see e.g. [START_REF] Mceliece | Finite Fields for Computer Scientists and Engineers[END_REF]Page 108]).

Tr(ω) = ω ⊕ ω 2 ⊕ ω 4 ⊕ ω 8 ⊕ • • • ⊕ ω 2 n-2 ⊕ ω 2 n-1 = (ω ⊕ ω 2 ) ⊕ (ω 4 ⊕ ω 8 ) ⊕ • • • ⊕ (ω 2 n-2 ⊕ ω 2 n-1 ) = 1 ⊕ 1 ⊕ • • • ⊕ 1, implying Tr(ω) = 1 if and only if n ≡ 2 mod 4 . ( 5
)
This means that δ(1, ω) = 0 and δ(1, ω ⊕ 1) = 0 if n ≡ 2 mod 4 and δ(1, ω) = 2 and δ(1, ω ⊕ 1) = 2 if n ≡ 0 mod 4. This completes the proof.

BCT of quadratic permutations with differential uniformity 4

In this section we concentrate on quadratic permutations that are differentially 4-uniform.

For an even number of variables, APN quadratic permutations do not exist [START_REF] Nyberg | S-boxes and round functions with controllable linearity and differential uniformity[END_REF]. Therefore, δ S = 4 is the lowest differential uniformity that a quadratic permutation can achieve in this case. Here, we provide an upper bound on the boomerang uniformity of such permutations. More importantly, we exhibit quadratic permutations with optimal BCT, i.e. which have differential uniformity and boomerang uniformity equal to 4. We first emphasize a behaviour of differentially 4-uniform quadratic permutations that is central in the proofs of the results in this section.

Lemma 2. Let S be a differentially 4-uniform quadratic permutation and let ∆ a S be a derivative whose differential spectrum is {0, 4}. Then, for all γ ∈ Im(∆ a S), the affine spaces U a,γ are cosets of the same linear space a, α :

U a,γ = x γ ⊕ a, α for some x γ ∈ F n 2 .
Proof. If S is a quadratic permutation, then all its derivatives have degree at most 1. Since ∆ a S is an affine (or constant) function, all equations ∆ a S(x) = γ are of the form L a (x) = (γ ⊕ c a ) for a given linear function L a and a given constant c a . Then, for any γ, the set of solutions of ∆ a S(x) = γ is either empty, or a coset of the linear space U = ker L a of dimension d a . Obviously, d a ∈ {1, 2} when S has differential uniformity 4. This implies that the affine subspaces U a,γ obtained for the different values of γ are all cosets of the same linear space U . The result directly follows from the fact that a ∈ U .

We now prove a general bound on β S for differentially 4-uniform quadratic permutations.

Proposition 7. Let S be a quadratic permutation of F n 2 with differential uniformity 4. Then β S ≤ 12.

Proof. The previous lemma implies that the differential spectrum of a derivative ∆ a S, a = 0, is either {0, 2} or {0, 4}, depending on the value of a. For a derivative ∆ a S whose differential spectrum is {0, 2}, we have that for all b ∈ F n 2 , β(a, b) ∈ {0, 2}. We then concentrate on derivatives ∆ a S whose differential spectrum is {0, 4}. Let γ i , 0 ≤ i < 2 n-2 denote the elements in Im ∆ a S. Then, from the previous lemma, we have U a,γi = x i ⊕ a, α and V a,γi = y i ⊕ γ i , β i .

We now show that

{β i , β i ⊕ γ i : 0 ≤ i < 2 n-2 } = Im ∆ α S ∪ Im ∆ a⊕α S
where this equality is an equality between multi-sets (i.e. on elements and their multiplicities). The form of U a,γi and V a,γi implies that

S(x i ) ⊕ S(x i ⊕ a) = γ i S(x i ⊕ α) ⊕ S(x i ⊕ α ⊕ a) = γ i ,
and

β i = S(x i ) ⊕ S(x i ⊕ α), leading to S(x i ) ⊕ S(x i ⊕ α) = β i S(x i ⊕ a) ⊕ S(x i ⊕ a ⊕ α) = β i and S(x i ) ⊕ S(x i ⊕ α ⊕ a) = γ i ⊕ β i S(x i ⊕ a) ⊕ S(x i ⊕ α) = γ i ⊕ β i . This means that V a,γi = V α,βi = V a⊕α,γi⊕βi and U a,γi = U α,βi = U a⊕α,γi⊕βi .
It follows that, for each γ i in the image set of ∆ a S, the corresponding β i and γ i ⊕ β i belong to the image set of ∆ α S and to the image set of ∆ a⊕α S respectively. Since all U a,γi for 0 ≤ i < 2 n-2 , are disjoint, all V α,βi are disjoint which implies that all β i are distinct. The same holds obviously for all the β i ⊕ γ i .

We now prove the bound on the β S of such permutations. From Proposition 4, we get that β S (a, b) = γ =0:b∈Va,γ δ S (a, γ) , which in our case can be equivalently written as

β S (a, b) = 4#{i : b ∈ {γ i , β i , γ i ⊕ β i }} .
Using that It is worth noticing that this result does not contradict Theorem 5 which states that if the DDT of a 4-bit permutation with δ S = 4 has a row with four values 4, then β S = 16. The reason is that it can easily be checked from Table 3 that quadratic permutations of F 4 2 with differential uniformity 4 do not exist.

{γ i , β i , γ i ⊕ β i , 0 ≤ i < 2 n-2 } = Im ∆ a S ∪ Im ∆ α S ∪ Im ∆ a⊕α S β S is
For n = 5 there are three differentially 4-uniform quadratic permutations up to affine equivalence [START_REF] Bozilov | A Note on 5-bit Quadratic Permutations' Classification[END_REF]. For two of them, β S = 12 while for the third one β S = 8. We now show that some of the so-called Gold power permutations [START_REF] Gold | Maximal recursive sequences with 3-valued recursive crosscorrelation functions[END_REF], which are differentially 4-uniform quadratic permutations of F n 2 , also have an optimal BCT when n ≡ 2 mod 4, i.e. they satisfy β S = 4. Proposition 8. Let n ≡ 2 mod 4 and let t be an even integer such that gcd(t, n) = 2. Then S : x → x 2 t +1 over F 2 n is a differentially 4-uniform permutation and satisfies β S = 4. It follows that, when gcd(t, n) = 2, x 2 t +1 is a permutation of F 2 n if and only if n ≡ 2 mod 4.

It is also known from [BCC10, Lemma 4] that, for any nonzero a and b, the set U a,b is either empty or a coset of aF 4 = a, aω where ω is an element in F 4 \ F 2 . Then, by applying the same technique as in the proof of the previous proposition, we have that max b =0 β S (a, b) = 4 if and only if Im ∆ a S, Im ∆ aω S and Im ∆ a(ω⊕1) are disjoint.

Each set Im ∆ a S is an affine subspace of codimension 2. We now describe it as a coset of the orthogonal of a 2-dimensional subspace. To this purpose, we use that, for any nonzero λ ∈ F 2 n Tr(λ∆ a S(x)) = Tr λ(x ⊕ a)

λa 2 t +1 2 t -1 = 1 .
Since gcd(2 t -1, 2 n -1) = 2 gcd(t,n) -1 = 3, this occurs if and only if λa 2 t +1 ∈ F * 4 . It follows that, for every λ = a -(2 t +1) β with β ∈ F 4 and every x ∈ F 2 n , Tr(λ∆ a S(x)) = Tr(λa 2 t +1 ) = Tr(β) .

For β = ω ∈ F 4 \ F 2 , we have Tr(ω) = 1 when n ≡ 2 mod 4 (see (5)), implying that Im ∆ a S = {x ∈ F 2 n : Tr(a -(2 t +1) x) = 0 and Tr(a -(2 t +1) ωx) = 1} . Now, we observe that, since t is even, ω 2 t +1 = ω 2 × ω 2 t -1 = ω 2 . Thus (aω) -(2 t +1) = a -(2 t +1) (ω 2 ) -1 = a -(2 t +1) ω , and we obtain that Im ∆ aω S = {x ∈ F 2 n : Tr(a -(2 t +1) ωx) = 0 and Tr(a -(2 t +1) ω 2 x) = 1} = {x ∈ F 2 n : Tr(a -(2 t +1) ωx) = 0 and Tr(a -(2 t +1) x) = 1} .

Similarly, Im ∆ a(ω⊕1) S = {x ∈ F 2 n : Tr(a -(2 t +1) x) = 1 and Tr(a -(2 t +1) ωx) = 1} . Therefore, for any nonzero a, Im ∆ a S, Im ∆ aω S and Im ∆ a(ω⊕1) S are three different cosets of the same linear space, and are then disjoint. We eventually deduce that β S = 4.

As an example of the previous proposition, we get that S : x → x 5 over F 2 n with n ≡ 2 mod 4 is an Sbox with optimal BCT in the sense of [CHP + 18] since it satisfies δ S = β S = 4. It is worth noticing that, for these dimensions, these quadratic differentially 4uniform permutations have the same behaviour as the inverse mapping studied in Section 6, while their DDTs are very different. Indeed, the DDTs of the quadratic mappings in Proposition 8 consist of 0 and 4 only, while the DDT of the inverse mapping has a single 4 in each row.

Conclusion

Boomerang connectivity tables are newly introduced objects for measuring the resistance of a block cipher against boomerang attacks. Apart from a brief analysis of their properties provided in the introductory paper, very little was known about these tables. In this paper we exhibited some new BCT properties, by showing for example that the boomerang uniformity is invariant up to affine equivalence and inversion and we used this result to entirely determine the value of the boomerang uniformity for all differentially 4-uniform permutations of F 4 2 . More importantly, we answered an open question from [CHP + 18] on the existence of differentially 4-uniform permutations with optimal boomerang uniformity in even dimensions. Indeed, we exhibited two different families of permutations in F n 2 , with n ≡ 2 mod 4 that are both differentially 4-uniform and have boomerang uniformity 4. These two families then provide a positive answer to the problem in dimensions n ≡ 2 mod 4. However, while we proved that the best possible boomerang uniformity for n = 4 is 6, the problem remains open for larger n multiple of 4, notably for n = 8. Another open problem is to determine whether the BCT spectrum determines the function up to some simple equivalence. A similar question has been raised for the DDT in [START_REF] Boura | Two notions of differential equivalence on Sboxes. Designs, Codes and Cryptography[END_REF]. Here, we showed that, for n = 4, differentially 4-uniform Sboxes that are not affine equivalent or inverse of each other have different BCT spectra. But what happens for higher dimensions remains unclear.

Figure 1 :

 1 Figure 1: Basic boomerang attack (left) and sandwich attack (right)

Figure 2 :

 2 Figure 2: A quartet at the Sbox level

Figure 3 :

 3 Figure 3: Ladder and Sbox switch at the Sbox level

  and Rijmen. Definition 4. [DR07] A mapping S from F n 2 into F n 2 is called planar if and only if, for all a and b in F n 2 , both sets U a,b and V a,b are affine subspaces. Differentially 4-uniform permutations form an important family of planar mappings. Indeed, since U S a,b consists of at most 2 pairs of elements of the form (x, x ⊕ a), it is an affine subspace of dimension at most 2. Also, the concatenation of several Sboxes with differential uniformity 4 is planar, implying that the substitution layers in the AES [AES01], in Serpent [BAK98], in Present [BKL + 07], Prince [BCG + 12] and in many other lightweight ciphers are planar. For any planar mapping S, we can write U S a,b and V S a,b as U S a,b = u a,b ⊕ U S a,b V S a,b = v a,b ⊕ V S a,b , where U S a,b and V S a,b are linear spaces and u a,b and v a,b are some constants such that u a,b ∈ U S a,b and v a,b ∈ V S a,b . Moreover, if δ S (a, b) = 0, we obviously have that a ∈ U S a,b and b ∈ V S a,b . In the special case of a planar permutation, Proposition 3 can be formulated in a simpler way showing that any entry within Row a in the BCT corresponds to a sum of some entries within Row a in the DDT. Proposition 4. For any planar permutation S of F n 2 , for all a, b ∈ F n 2 , we have

  maximized when b belongs to each one of the three sets Im ∆ a S, Im ∆ α S and Im ∆ a⊕α S. Then for such a b, β(a, b) = 12.

Table 2 :

 2 BCT of the permutation x → x 2 n -2 for n = 4

	0	1	2	3	4	5	6	7	8	9	a	b	c	d	e	f
	0 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16
	1 16 4

Table 3 :

 3 Spectrum of the BCT for all 4-bit permutations with differential uniformity 4. Column 4 mentions the link with the functions of Table5.2 in[START_REF] Decannière | Analysis and Design of Symmetric Encryption Algorithms[END_REF]. For the first 16 permutations, we also mention the corresponding equivalence class in the Leander-Poschmann classification[START_REF] Leander | On the Classification of 4 Bit S-Boxes[END_REF].

		Representative	L(S) [DeC07] [LP07] n 0 n 2 n 4 n 6 n 8 n 10 n 16 β S
	1	[8, 0, 1, 12, 15, 5, 6, 7, 4, 3, 10, 11, 9, 13, 14, 2]	8	3	G 3	120 60 15 30 0	0	0	6
	2	[2, 0, 1, 8, 3, 11, 6, 7, 4, 9, 10, 15, 12, 13, 14, 5]	8	6	G 5	108 72 27 18 0	0	0	6
	3	[8, 0, 1, 12, 2, 5, 6, 9, 4, 3, 10, 11, 7, 13, 14, 15]	8	2	G 6	104 80 27 10 4	0	0	8
	4	[8, 0, 1, 9, 2, 5, 13, 7, 4, 6, 10, 11, 12, 3, 14, 15]	8	8	G 11	100 85 30 5	5	0	0	8
	5	[4, 0, 1, 15, 2, 11, 6, 7, 3, 9, 10, 5, 12, 13, 14, 8]	8	1	G 13	105 78 28 11 2	1	0	10
	6	[2, 0, 1, 8, 3, 13, 6, 7, 4, 9, 10, 5, 12, 11, 14, 15]	8	4	G 4	112 72 23 14 0	4	0	10
	7	[2, 0, 1, 8, 3, 15, 6, 7, 4, 9, 5, 11, 12, 13, 14, 10]	8	5	G 7	105 80 30 5	0	5	0	10
	8	[4, 8, 1, 2, 3, 11, 6, 7, 0, 9, 10, 14, 12, 13, 5, 15]	8	7	G 12	110 75 25 10 0	5	0	10
	9	[8, 14, 1, 2, 3, 5, 6, 7, 4, 12, 10, 11, 9, 13, 0, 15]	8	9	G 9	108 69 28 14 5	1	0	10
	10 [8, 14, 1, 2, 3, 5, 6, 7, 4, 9, 15, 11, 12, 13, 0, 10]	8	10	G 14	108 70 27 13 6	1	0	10
	11 [8, 15, 1, 2, 3, 5, 12, 7, 4, 9, 10, 11, 6, 13, 14, 0]	8	11	G 15	108 70 27 13 6	1	0	10
	12 [8, 15, 1, 2, 3, 5, 6, 13, 4, 9, 10, 11, 12, 7, 14, 0]	8	12	G 10	108 69 30 12 3	3	0	10
	13 [12, 0, 1, 9, 3, 5, 4, 7, 6, 2, 10, 11, 8, 13, 14, 15]	8	13	G 2	107 64 32 8 12	0	2	16
	14 [12, 11, 1, 2, 3, 5, 4, 7, 6, 9, 10, 0, 8, 13, 14, 15]	8	14	G 1	107 60 36 12 8	0	2	16
	15 [12, 9, 1, 2, 3, 5, 4, 7, 6, 0, 10, 11, 8, 13, 14, 15]	8	15	G 8	103 72 32 0 16	0	2	16
	16 [8, 14, 1, 2, 3, 5, 4, 7, 6, 9, 10, 0, 12, 13, 11, 15]	8	16	G 0	107 64 32 8 12	0	2	16
	17 [8, 15, 1, 2, 3, 12, 6, 7, 4, 9, 10, 11, 5, 13, 14, 0]	12	34	-	112 57 35 14 0	7	0	10
	18 [8, 0, 1, 12, 2, 5, 11, 7, 4, 9, 10, 6, 3, 13, 14, 15]	12	35	-	109 60 34 15 4	3	0	10
	19 [8, 0, 1, 12, 2, 5, 13, 7, 4, 9, 10, 11, 3, 6, 14, 15]	12	36	-	109 60 34 15 4	3	0	10
	20 [12, 0, 1, 2, 3, 15, 6, 7, 4, 9, 10, 11, 8, 13, 14, 5]	12	37	-	110 58 30 14 12	0	1	16
	21 [12, 0, 1, 2, 3, 5, 6, 13, 4, 9, 10, 11, 8, 7, 14, 15]	12	38	-	106 62 36 8 10	2	1	16

Table 4 :

 4 γ 2 covers the whole space F 4 2 , which contradicts the previous property. We illustrate Lemma 1 on the PRESENT [BKL + 07] Sbox. The DDT of this Sbox S is shown in Table4while its BCT is shown in Table5. Let the input difference be a = 8. As it can be seen from Table4, δ S (8, b) = δ S (8, f) = 4. It is easy to check that V 8,b = {1, 5, a, e} and V 8,f = {2, 3, c, d}. The corresponding linear spaces are V 8,b = {0, 4, b, f} and V 8,f = {0, 1, e, f} and we see that V 8,b ∩ V 8,d = {0, f} = {0}, as expected by Lemma 1. Difference Distribution Table

	Example 4.

Table 5 :

 5 Boomerang Connectivity Table of the PRESENT Sbox

	0	1	2	3	4	5	6	7	8	9	a	b	c	d	e	f
	0 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16 16
	1 16 0	4	4	0 16 4	4	4	4	0	0	4	4	0	0
	2 16 0	0	6	0	4	6	0	0	0	2	0	2	2	2	0
	3 16 2	0	6	2	4	4	2	0	0	2	2	0	0	0	0
	4 16 0	0	0	0	4	2	2	0	6	2	0	6	0	2	0
	5 16 2	0	0	2	4	0	0	0	6	2	2	4	2	0	0
	6 16 4	2	0	4	0	2	0	2	0	0	4	2	0	4	8
	7 16 4	2	0	4	0	2	0	2	0	0	4	2	0	4	8
	8 16 4	0	2	4	0	0	2	0	2	0	4	0	2	4	8
	9 16 4	2	0	4	0	2	0	2	0	0	4	2	0	4	8
	a 16 0	2	2	0	4	0	0	6	0	2	0	0	6	2	0
	b 16 2	0	0	2	4	0	0	4	2	2	2	0	6	0	0
	c 16 0	6	0	0	4	0	6	2	2	2	0	0	0	2	0
	d 16 2	4	2	2	4	0	6	0	0	2	2	0	0	0	0
	e 16 0	2	2	0	0	2	2	2	2	0	0	2	2	0	0
	f 16 8	0	0	8	0	0	0	0	0	0	8	0	0	8 16

  Proof. It is well-known that the power function with Gold exponent x 2 t +1 over F 2 n has differential uniformity 2 d where d = gcd(t, n) [Nyb94, Prop. 3]. Moreover, this mapping is bijective if and only if gcd(2 t + 1, 2 n -1) = 1. Recall that (see e.g. [McE87, Lemma 11.1]) gcd 2 t + 1, 2 n -1 = 1 if and only if gcd(t, n) = gcd(2t, n) .

  2 t +1 ⊕ λx 2 t +1 = Tr λax 2 t ⊕ λa 2 t x ⊕ λa 2 t +1 = Tr x 2 t (λa ⊕ λ 2 t a 2 2t ) ⊕ Tr(λa 2 t +1 ) .It follows that x → Tr(λ∆ a S(x)) is constant if and only if

	λa ⊕ λ 2 t	a 2 2t	= 0
	which equivalently means that

It is worth noticing that there are two elements in F 4 \ F

, ω and ω = ω ⊕ 1, and both of them obviously lead to the same condition.

and c 0 ∈ c 2 ⊕ γ 0 , b, α, β = c 2 ⊕ γ 0 , b, γ 1 .

The linear space γ 0 , γ 1 , b has dimension 3 since b ∈ {γ 0 , γ 1 } and γ 1 = γ 0 ⊕ b. Moreover, the two cosets of γ 0 , γ 1 , b defined by c 1 and c 2 are disjoint since V a,γ1 and V a,γ2 are disjoint. Therefore, these two cosets cover the whole space F 4 2 , which leads to a contradiction. This proves that any three sets among V a,γ0 , V a,γ1 , V a,γ2 and V a,γ3 have a nontrivial intersection.

Then, the only situation where V a,γ0 ∩ V a,γ1 ∩ V a,γ2 ∩ V a,γ3 = {0} corresponds to the case where there are two distinct nonzero elements b 0 and b 1 which respectively belong to (V a,γ0 ∩ V a,γ1 ∩ V a,γ2 ) and (V a,γ0 ∩ V a,γ1 ∩ V a,γ3 ). This means that (V a,γ0 ∩ V a,γ1 ) contains two nonzero elements, implying that V a,γ0 = V a,γ1 . But in this case, the intersection between the four subspaces equals the intersection between the last three subspaces, which is known to be nontrivial, a contradiction.

Example 5. We illustrate Proposition 5 on the PRESENT [BKL + 07] Sbox. From Table 4 we first observe that the row corresponding to the input difference a = 6 contains two values 4. Then, we can check from Table 5 that β S (6, 15) = 8. On the other hand, the row corresponding to a = 1 has four values 4. Then, as seen from Table 5, β S (1, 5) = 16 and thus β S = 16. This result does not hold anymore for higher even dimensions. For instance, we will exhibit in Section 7 permutations of F n 2 with differential uniformity 4, for n ≡ 2 mod 4, such that there is a row in their DDT with entries in {0, 4} while their boomerang uniformity equals 4.

Proposition 5 also implies that the values 12 and 14 never appear in the BCT of differentially 4-uniform permutations of F 4 2 , as observed in Table 3. Indeed, the DDT of any such permutation does not contain any row with exactly 3 entries equal to 4 (and 2 entries equal to 2). Therefore, the nonzero entries in the BCT belong to {2, 4, 6, 8, 10, 16}.

BCT of the inverse mapping over F 2 n

We have proved that the lowest boomerang uniformity that can be achieved for 4-bit permutations is β S = 6. This minimum is obtained for the inverse mapping x → x 14 over F 2 4 , which is affine equivalent to the Sbox in the first row of Table 3. We now investigate the properties of the BCT of the inverse mapping S : x → x 2 n -2 over F 2 n for larger values of n. It is well-known that the inverse mapping over F 2 n is APN if n is odd. If n is even, then its DDT has exactly one 4 and (2 n-1 -2) 2's per row [START_REF] Nyberg | Differentially uniform mappings for cryptography[END_REF]. We show here that if n ≡ 0 mod 4 then β S = 6 and this value is 4 if n ≡ 2 mod 4. This then solves the open problem raised in [CHP + 18] on the existence of Sboxes S such that β S = δ S = 4. Proposition 6. Let S be the inverse mapping over F 2 n for n even. Then:

Moreover,

• If n ≡ 2 mod 4, for any nonzero a, b, we have


Nicolas Gachon

Students of the Dream: Resegregation in a Southern City

la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d'enseignement et de recherche français ou étrangers, des laboratoires publics ou privés.

Ruth Carbonette Yow, Students of the Dream: Resegregation in a Southern City

Nicolas Gachon

Ruth Carbonette Yow, Students of the Dream: Resegregation in a Southern City, Cambridge, MA & London: Harvard University Press, 2017, 272 pages, ISBN 9780674971905, $ 39.95, £ 31.95, € 36.00 1 With eloquence and passion, Ruth Carbonette Yow presents a challenging picture of school integration in the United States in the wake of the U.S. Supreme Court's 1954 decision in Brown v. Board of Education of Topeka. Her work adds to the growing scholarship on the issue of resegregation, the re-institution of segregation after the court-ordered desegregation in the 1960s. It was in the late 1980s that researchers really began to identify a distinctive trend toward resegregation in American public schools, a trend that has intensified steadily into the 21 st century. Over the years scholars have studied and measured the tendency of white residents to "gerrymander" [START_REF] Chang | School segregation didn't go away. It just evolved[END_REF] the borders of school districts integrated by minority families out of fear of "a decrease in property values and school quality" (Kridel, 2010, 744). While a number of works have taken a comprehensive approach to explore the quagmire of race relations in the United States [START_REF] Chang | Be Alright. Notes on Race and Resegregation[END_REF], others have adopted a more quantitative approach [START_REF] Qiu | A National Survey of School Desegregation Orders[END_REF].

2

Students of the Dream: Race and Inequality in the Resegregating South stems from Ruth Carbonette Yow's research on historical desegregation, contemporary resegregation, and the future of integrated schooling in the City of Marietta, Georgia. The Marietta City School district was established in 1892 with two main high schools: Marietta High School for white students, and Lemon Street High School for black students. In the late 1960s, the Marietta City School System merged the two schools, allowing all students in Marietta to attend Marietta High School. The specificity of Students of the Dream lies in the more than one hundred interviews conducted over a two-year period with white, black, and Latino graduates across five decades, as well as with teachers, coaches, school board members, education activists, and city officials. Students of the Dream is almost a longitudinal study in the sense that the arc from desegregation to integration and resegregation is traced at one same high school over sixty years. The desegregation and resegregation of Marietta's schools is examined through lived experiences, in an approach that melds ethnography and oral history. As stated by Ruth Carbonette Yow herself, "[t]his book is an 'ethnographic history'" (16).

3

Students of the Dream opens with an introduction that sets the intellectual framework of Yow's research around the issue of school integration: "[t]hrough the history of one Southern city and its flagship high school, [the book] explore[s] integration's role-past, present, and future-in shaping students into citizens who demand more of their schools, their communities, and by extension, their democracy" ( 5). Yet "just as the rumbling of the Civil Rights Movement shook the foundations of [segregation] in the 1960s, so too does resegregation threaten to unmoor the Marietta High of the twenty-first century" (9). From that standpoint, the book seeks "to look to the desegregation of Marietta high in 1964 and trace its trajectory toward resegregation in the twenty-first century" (9).

4

After the intellectual framework provided by the book's introduction, chapter 1, "Blue Devil Pride: Marietta Football in the Long Integration Era," sets the real-life context of Ruth Carbonette Yow's study of resegregation through the case Marietta High School. It is arguably the real introduction of the book, based on the interviews of numerous black and white graduates about the importance and meaning of football culture in the desegregation process: "[f]ootball had always been an arena for negotiating identity and status, and after desegregation, black players had a stake in that formerly all-white social calculus at MHS" (25); "[w]hite graduates testify that football built bridges across race and class difference, even as they insist that there were no difference to bridge" (26). In that sense, such testimonies as that of coach James "Friday" Richards, whose "life and career follow the arc of integration" (20), are very significant. Coach Richards "spent all but six years of his adult life at Marietta High School; a black graduate of 1972, he returned to coach at MHS in 1979 and served as head coach from 1995 until 2010" (20-21).

5

Chapter 2, "Fifty Years of 'Freedom': School Choice and Structural Inequality in Marietta High Schools," deals with the period extending from 1954 to 2004 and focuses on the issue of school choice, which Ruth Carbonette Yow describes as "a last-ditch attempt at evading Brown", denouncing the fact that "[s]seventy-five percent of school districts in the South adopted freedom of choice plans in the mid-sixties because such plans followed the letter of the law but led to a mere trickle of black students into white schools" (43). The chapter comprises two case studies: that of West Side Elementary, one that illustrates the fact that "[c]hoice as a dominating ideal in the school system and in [American] culture naturalizes the prioritizing of the individual over the group, the family's interests over those of the community" (56), and the success stories of Latino graduates at Marietta High School (Diana Rios, who was admitted to Kennesaw State University, and Lauren Garcia, who ended up at a private university in Kentucky). Yow describes how all "minority" students are impacted by the desegregation dynamics in spite of the supposedly desegregating force of school choice: "[a]lthough high-income families bring much needed resources, they also want public education on their terms-that is, tailored around the interests of their children rather than those of a diverse group of students" (63).

Chapter 3, "Some Kinds of Blue: Tracking at Marietta High," exposes tracking, i.e., the assigning of students to a curricular track, to argue that "[t]here is perhaps no greater betrayal of the legacy of Brown v. Board of Education than educational disenfranchisement of black students in order to make desegregation more palatable for whites" (74). Tracking is described as "a mechanism that bestow[s] further advantages on already privileged, high-achieving students and condemn[s] low-income minority students to the academic dregs," as "a regression to the unequal opportunities of the pre-Brown era" (75). This dimension is illustrated by the story of Tiffany Turner's family in a section entitled "The Jim Crow Present" (78-65), then in "Betraying Brown to Staunch Resegregation: The Paradoxes of the [International Baccalaureate]" (85-101). Ruth Carbonette Yow is very critical of the International Baccalaureate: "[a]t Marietta High, the tracking of highachieving white students may be detrimental to community, but the tracking of struggling students of color threatens community and the success of the student" (91). The International Baccalaureate, a United Nations-endorsed curriculum, "was brought into existence in Marietta to stop white flight," in the words of Ken Sprague, a teacher interviewed by Ruth Carbonette Yow, who "assesse[s] the IB program as yet another disenfranchisement of Marietta's black students" (87). The title of the final section of Chapter 3 gives fuller sense of the advocacy inherent to Yow's work: "Contemplating the Master's Tools: Curriculum, Community, and What the IB Could Be" (101-113).

Chapter 4, "The New Integrators: Latino Students," relies on "Latino Students' Visions of Revisions of Citizenship" (130) to show how politics in the United States has failed the integration progress: "[t]he Bush administration's No Child Left Behind Act and President Obama's Race to the Top […] have their parallel in neoliberal economic policies of deregulation, privatization, and contraction of the social safety net"; "market-oriented education reform-embodied in federal policies and flourishing across in local districtsdoes not prioritize the struggles of marginalized students or the formulation of creative and progressive policies that might bring them greater justice and opportunity" (119). This final chapter contains stern condemnations of what is presented as the underachievement of political institutions in the United States: "[i]t is through the 'stolen' benefits of public education that undocumented children discover the meaning of citizenship, like a photographic negative-taking shape in the dark room of classes, clubs, sports, and college applications-that proves for certain their place outside the frame" (137).

8

Students of the Dream ends with a conclusion entitled "Reclaiming Brown: Integration Is Not a Policy Goal -It's a Movement" (153), calling for a collective endorsement of the integration issue: "[r]esegregation is a numerical, demographic reality in Marietta and many other cities and suburbs across the county. Resegregation is also a cultural movement, a kind of test in a test-obsessed era, for communities and for schools and city leaders"; "[r]esisting resegregation is about memory as much as about school reform policy" (153).

Students of the Dream: Resegregation in a Southern City is a must-read for anyone interested in the complex issue of racial integration and desegregation in the United States, and in American public education at a time when non-white students outnumber whites nationally in public schools. The book is well-written and Ruth Carbonette Yow's perspectives are all the more interesting as she herself grew up in Cobb County, Georgia,


Hamilton was resarching for ways to extend the complex numbers (which they could be assimilated to a point of a plane) to a higher dimension of the Euclidean space R n . He couldn't do it for three dimensions, but the four dimensions produced the quaterions (1) .

Kantor and Solodovnikov define the hypercomplex number as an algebra actual unit element (not necessarily associative)

(1)www.fr.wikipedia.org/wiki/Nombre_hypercomplexe

Introduction

our work is specially intersted in the hypercomplex numbers in a three dimensional space so we are going to define an algebra (A, +,., ×) on a commutative field K equiped by a binary opération (×) in other words the A Two elements product is an element of A which is bilinear it means for any element x, y, z of A and all elements α, β of K:

 (x+y) × z = (x × z) + (y × z)  x × (y+z) = (x × y) + (x × z)  (α.x) × (β.y) = (α. β) (x × y)
Definition: the hypercomplex numbers in three dimensions set marked Ŝ is algebra no associative and not unital on the field of real number R.

Any item of Ŝ is written in unique way under the form: s = x + yi + zj with x, y, z real numbers and i, j purely imaginary numbers such as: × is bilinear and we notes that (Ŝ, +, . , ×) is an R-algebra

The imerssion of R in Ŝ

Designate by Ʈ = , the application f: R Ʈ that at any x it associates element is R bijection in Ʈ and also an isomorphisme of the addition and the multiplication We imerssion R in Ŝ taking R = Ʈ, so we can combine for any x element of R, (x, 0, 0) = x.

But the particular points J (0, 1,0) and K (0, 0,1) are the images of pure imaginary numbers i and j successively, we deduce: i 2 = i × i = (0, 1,0) × (0, 1,0) = (-1, 0,0) = -1 j 2 = j × j = (0, 0,1) × (0, 0,1) = (-1, 0,0) = -1 i × j = (0, 1,0) × (0, 0,1) = (0, 0,0) = 0 Note: the algebra base Ŝ on the commutative field R is the elements constitud 1, i, j.

The following multiplication talble is:

4) s × s` = (x x` -y y`-z z`) + (x y` + x`y) i +(x z` + x`z) j

Definition: if s Є Ŝ such as: s = x +y i +z j, then Re (s) = x is the real side of s and Im (s) = y i +z j is the imaginary side of S.

Note: we can consider Im (s) =

in the base 4. The hypercomplex number in three dimensional space conjugate Definition: if s Є Ŝ such as: s = x +y i +z j, then the number s = x -y i -z j is called the conjugate of S.

.

1 i j 1 1 i j i i -1 0 j j 0 - 1
Note: If s, s` Є Ŝ such as: s = x +y i +z j and s` = x`+y`i +z`j, then:

1) s + s = 2 Re (s),

2) s -s = 2 Im (s),

3) s × s = x 2 + y 2 + z 2 Properties: if s, s` Є Ŝ such as: s = x +y i +z j and s` = x`+y`i +z`j, then: The Methodology to find the square roots in the hypercomlex number in three dimensional spaces:

1) = s 2) ( s + s ` ) = s + ` 3) ( s × s ` ) = s × ` 4) ( s n ) = ( s ) n , n Є N- 5) ( 1 / s ) = 1/ ( s ) , s ‡0 6) ( s
If s Є Ŝ such as: s = x + y i + z j is a given number we have two opposite square roots: Bibliographie :

i 2 = j 2 = 2 .

 222 -1 and i j = j i =0 1. Construction of the set Ŝ.1.1 we equiped Ŝ of the addition and the external law (.) successively defined by: We equiped Ŝ with binairy opération × defined by;

3 .

 3 Properties If s and s` two elements of Ŝ such as: s = x +y i +z j and s` = x`+y`i +z`j, then 1) s = 0 <=> x = y = z = 0 2) s = s` <=> (x = x`) et (y = y`) et (z = z`) 3) s+ s` = (x+ x`) + (y+ y`) i + (z+ z`) j

Note: 1) │s│= 2 )

 2 The hypercomplex number in a three dimensional space module Definition: If s Є Ŝ such as: s = x +y i +z j, then: │s│= is called the module of s. In the orthonormal reference system (O, I, J, K) of the space, if M(x, y, z) is the image number s = x +y i +z j, then: │s│= OM Properties: for any numbers s and s` of Ŝ like s = x +y i +z j and s` = x`+y`i +z`j, we have: M(x, y, z) the image number of s = x +y i +z j in the orthonormal reference system (O, I, J, K) of space, then the cylindrical coordinations are in the form of: hypercomplex number in three dimensional space square roots Definition: if s Є Ŝ like s = x + y i + z j, we call the square roots of the s number, the number δ = a + bi + cj such as: = δ2


D Collet
email: david.collet@ifpen.fr

M Alamir

Di Domenico

G Sabiron

A machine learning approach for online IPC controller selection based on wind features

Keywords: Control systems, fatigue, machine learning, LiDAR, O&M

Introduction

The wind energy production has been exponentially growing in the last decades, with about 539 GW globally installed in 2017 out of 94 in 2007. In order to achieve the COP21 objectives in terms of CO2 emissions, the growth of the wind energy industry is expected to develop even further. Thus, there is a need for reducing turbine CAPital EXpenditure (CAPEX) and OPerational EXpenditure (OPEX). Wind turbine control aims at firstly regulating the wind turbine rotational speed and power, and secondly, minimizing wind turbine mechanical strains, and therefore the OPEX. A three bladed Horizontal Axis Wind Turbine (HAWT) is equipped with five actuators, the yaw actuator, the electrical generator, and the three blade pitch actuators which can spin the blades on their longitudinal axis. Nowadays the two most studied pitch control strategies are the Collective Pitch Control (CPC) and the Individual Pitch Control (IPC) on which the focus is set in this study. To this day, many works have been conducted, using various control techniques going from Proportional Integral (PI) controller [1] to advanced Model Predictive Control (MPC) [START_REF] Mirzaei | Proceedings of the 2013 European Control Conference[END_REF] and Nonlinear Model Predictive Control (NMPC) [START_REF] Raach | Proceedings of the 2004 American Control Conference[END_REF], including H ∞ [START_REF] Schlipf | [END_REF]. The recent advances in Light Detection And Ranging (LiDAR) and Wind Field Reconstruction (WFR) have led to use its enhanced information on the inflow wind field to anticipate the control action. This makes control strategies such as feedforward [START_REF] Schlipf | [END_REF], MPC [START_REF] Mirzaei | Proceedings of the 2013 European Control Conference[END_REF] or even NMPC [START_REF] Raach | Proceedings of the 2004 American Control Conference[END_REF] particularly interesting. Another research track regarding wind turbines is to predict HAWT components fatigue from wind, with statistical and machine learning solutions [START_REF] Schröder | [END_REF]6]. The main objective of the study is to reduce fatigue cost on the wind turbine by designing a supervisory layer which selects online the best suited controller for the current wind conditions, among a discrete set of controllers. This is performed by using machine learning regression, to predict for each controller the expected wind turbine fatigue cost under the current wind conditions.

Pitch control

Above rated wind speed, the generator torque is at its maximum, and the blades are pitched, in order to regulate the rotor aerodynamic torque and wind turbine power at their rated values, and thus keep the turbine in its operating range. Usually the blades are all pitched towards the same angle, this is called CPC, but wind is not uniformly spatially distributed. Thus, wind speed and direction vary over the whole rotor area, so does the loads on each individual blade. Yet, IPC strategy allows the blade pitch angle to be varied with the blade azimuth, in order to cancel the unbalanced tilt and yaw rotor loads. A feature of IPC is the tradeoff between pitch activity increase and blade fatigue load reduction, which needs to be weighted. The IPC controllers designed in this study are usual PI controllers, similar to the one in [1], but more elaborate controllers could be used in future works.

Fatigue and cost function

Fatigue is usually evaluated using Palmgrem-Miner's rule, where hysteresis load cycles are counted using RainFlow Counting (RFC) algorithm. Damage Rate (DR) for one component load case can be evaluated using the following equation:

𝐷𝑅 = 𝛾 ∑ 𝑛 𝑖 ( 1 2 𝐿 𝑖 𝑅 ) 𝑚 𝑖
Where m is the Wöhler exponent whose value depends on the component material (m = 4 for steel and 10 for glass fiber), γ is constant for the component, 𝑛 𝑖 is the number of hysteresis cycles at range 𝐿 𝑖 𝑅 counted by the RFC. As 𝑚 > 2, one can see that load variance does not faithfully reflect components fatigue, which is basically used function in the optimal control community. Consequently there is a need for a more accurate fatigue based cost function derivation for control. The cost function developed here is a weighted sum of the main turbine components DR and their replacement costs. This objective function gives accurate representation of the costs induced for a wind turbine controlled by one specific controller under a given wind.

Machine learning based supervisory layer

In order to synthesize an efficient regression function, it is necessary to simulate the wind turbine in a wide range of meteorological conditions. 588 realistic three-dimensional wind fields are generated, and the closed loop is simulated with each controller in the set of candidate controllers. The fatigue based cost function is evaluated for each simulation. Each wind/controller combinations is associated to a scalar called target value.

The winds are defined by eleven characteristic features, that are computed with recent WFR algorithms (e.g. rotor averaged speed, direction, shear, turbulence intensity). From the wind features and target values, supervised machine learning regression algorithms will synthesize a predictive function which is able to estimate fatigue cost of the wind turbine under the current wind if it were controlled by each controller in the set. To minimize fatigue cost, this algorithm allows to take efficiently the decision to whether or not switch from one controller to another, considering a high amount of WFR data.

Conclusion

An innovative method combining machine learning and control systems tools is proposed to minimize a fatigue based cost function. The results are encouraging since the method allows to efficiently adapt the controller to decrease fatigue cost. Even though usual PI controllers were used, future works will aim at using advanced controllers, and achieve further fatigue reductions. Another track to be pursued is the switching strategy between controllers that needs to be smoothen in order to avoid additional switching transient induced fatigue.

  14 th EAWE PhD Seminar on Wind Energy 18-20 September 2018 Vrije Universiteit Brussel, Belgium


Elise Bannier

Giulio Gambarota

Jean-Christophe Ferré

Tobias Kober

Anca Nica

Stephan Chabardes

Claire Haegelen

FLAWS imaging improves depiction of the thalamic subregions for DBS planning in epileptic patients

Accurate localization of the thalamic subregions is of paramount importance for Deep Brain Stimulation (DBS) planning. Current MRI protocols use T2 and Gadolinium-enhanced T1 images, to visualize both the basal ganglia and the vessels, in order to define the electrode trajectory and target. This study shows the usefulness of Fluid and White Matter Suppression, i.e. FLAWS imaging, in eleven drug-resistant epileptic patients for preoperative Deep Brain Stimulation planning and anterior thalamic nucleus targeting.

Introduction

Accurate localization of the thalamic subregions is of paramount importance for Deep Brain Stimulation (DBS) preoperative planning in movement disorders treatment and recently in epilepsy surgery . In particular, DBS of the anterior thalamic nucleus (ATN) was associated with a 69% reduction in seizure frequency in drug-resistant patients with epilepsy in the USA. The ATN is implicated in the limbic circuit and is poorly visible on T1 and T2 MR images. Current DBS MRI protocols use T2 and Gadolinium-enhanced T1 images, to visualize both the basal ganglia and the vessels, in order to define the electrode trajectory and target. In recent years, FLAWS (Fluid and White Matter Suppression) imaging -which is a variant of the MP2RAGE sequence -providing in a single sequence both FGATIR and MPRAGE images, has been proposed for improved visualization of brain structures and of basal ganglia in particular. As such, it could be of interest for applications such as DBS. The usefulness of FLAWS imaging was evaluated here for the first time in patients in the context of drug resistant epilepsy and preoperative DBS planning.

Material & Methods

After approval from the IRB, eleven drug-resistant epileptic patients referred for DBS surgery as part of a national study were scanned at 3T (MAGNETOM Verio, Siemens Healthcare, Erlangen, Germany) with the M2PRAGE prototype sequence adapted for 3D FLAWS imaging (TR/TE=5000/2.68ms, TI1/TI2=409/1300ms, alpha1/alpha2=5/5°, voxel size 1mm , acquisition time 11min). 3D Gadolinium enhanced T1 imaging was also performed for vessel visualization (TR/TE/TI=1900/2.26/900ms, voxel size 1mm , acquisition time 4min30s). The division image of the two FLAWS images was also computed. Brain/tissue contrast and contrast-to-noise values were measured with FGATIR-like (FLAWS1) and MPRAGE-like (FLAWS2) images. Regions of interest were drawn using ImageJ (1.46r) in the corpus callosum (splenium) for WM, caudate nucleus (head) for GM, and ventricles for CSF. Contrast-to-noise was computed as described in 2. Before DBS surgery, the 3D datasets were fed into in the PyDBS pipeline allowing registration to an atlas of the basal ganglia, fusion and 3D visualization for preoperative planning of electrode trajectories.

Results

Example images for FLAWS1, FLAWS2 and division image are shown in Figure 1 and a zoomed excerpt is shown in Figure 2. Contrast-to-noise values obtained for FLAWS1 and FLAWS2 images in patients are reported in Figure 3. The values obtained in the original study in healthy subjects are also reported for comparison. The FLAWS images were used in the PyDBS pipeline and the basal ganglia atlas was registered with the FLAWS data as shown in Figure 4, here on the division image.

Discussion

Previous studies on DBS targeting have employed FGATIR, which is a modification of the MPRAGE sequence. The FGATIR sequence provides images where the WM signal is suppressed, just like FLAWS1. In the same acquisition time, FLAWS provides both FGATIR-like images and standard, anatomical MPRAGE-like images. Thus, no additional anatomical imaging, i.e. acquisition time is necessary. Quantitative Susceptibility Mapping is another promising surrogate as demonstrated for the subthalamic nuclei but still gives poor contrast in the thalamus.

Conclusion

The objective to use FLAWS data was to better visualize the thalamic nuclei, especially the ATN to treat epilepsy. Excellent depiction of the thalamic subregions and the ATN on FLAWS images was reported by the neurosurgeon. This qualitative assessment was confirmed by tissue contrast and contrast-to-noise values, which were in agreement with the values reported in the original study in healthy subjects. The FLAWS images could smoothly be used in the PyDBS pipeline for the neurosurgeon to visualize the basal ganglia delineation extraction from the atlas, superimposed on FLAWS data. The visualization of thalamus subregions allowed confident definition of target and electrode trajectory before surgery. Postoperative results on reduction of seizure frequency need to be evaluated at a few years distance and are not available yet.

Figures

  Figures

Acknowledgements

MRI data acquisition was supported by the Neurinfo MRI research facility from the University of Rennes I. Neurinfo is granted by the the European Union (FEDER), the French State, the Brittany Council, Rennes Metropole, Inria, Inserm and the University Hospital of Rennes.