Proof (of Proposition 8). The proposition clearly holds for i = 0 and i = r+ 1 (as the outputs of equivalent ciphers have to match for any x). Assume towards contradiction that x(0)i 6= x0i(0) for some i ∈ {1, . . . , r}. Recall that linear equivalence implies that (k0,S,L)≡(k0,S,L0) for anyk0,S. In particular, consider S∗ for which the only change from S is that S
i is modified to Si∗
and exchanges the output values of x0i(0) and some u(0)i (for u(0)i 6= x(0)i and u(0)i 6=x0i(0)), namely,S∗i(x0i(0)) =Si(u (0) i ) andS ∗ i(u (0) i ) =Si(x 0(0) i ). Since Si(x 0(0) i ) 6=Si∗(x 0(0)
i ), then E(k0,S,L0)(x) 6= E(k0,S∗,L0)(x). Indeed, the
state values up to thei’th non-linear layer match inE(k0,S,L0)(x) andE(k0,S∗,L0)(x),
but then diverge asSi(x0
(0)
i )6=S∗i(x
0(0)
i ). Since the remaining partial encryption
algorithm (consisting of L0i and rounds i+ 1, . . . , r) is a permutation which is identical in both ciphers, the state values cannot converge.
On the other handE(k0,S∗,L)(x) =E(k0,S,L)(x) asSi(x(0)i ) =Si∗(x(0)i ). There- fore, eitherE(k0,S,L)(x)6=E(k0,S,L0)(x) or
E(k0,S∗,L)(x) =E(k0,S,L)(x) =E(k0,S,L0)(x)6=E(k0,S∗,L0)(x), and in any caseL 6≡ L0 in contradiction.
Proof (of Proposition 9). Consider S∗ for which the only change from S is that Si is modified toSi∗ and exchanges the output values of x
(0) i and ¯x (0) i (in particular Si∗(¯x(0)i ) = Si(x (0)
i )). Consider E(k0,S∗,L)(¯x) and note that the state obtained afterirounds (that are unchanged from (k0,S,L)) is equal to
¯ xi = ¯x (0) i ,x¯ (1) i = ¯x (0) i , x (1) i .
After application ofS∗i, the 0 part of the state is modified toSi∗(¯x(0)i ) =Si(x
(0)
i ) =
yi(0). Hence, the full state ofE(k0,S∗,L)(¯x) afteriencryption rounds and the non-
linear layer application isyi(0), x(1)i =yi(0), yi(1)=yi.
Since the mappings fromyi to the output in the remainingi’th linear layer
and lastr−i+ 1 round functions in (k0,S∗,L) and (k0,S,L) are identical, we have
E(k0,S∗,L)(¯xi) =E(k0,S,L)(xi).
In other words, exchanging the non-linear layer values canceled the change caused the exchanging the plaintexts.
SinceL ≡ L0, then
E(k0,S∗,L0)(¯xi) =E(k0,S∗,L)(¯xi) =E(k0,S,L)(xi) =E(k0,S,L0)(xi).
Once again, the last r−i+ 1 round functions after applications of Si∗ and Si in (k0,S∗,L0) and (k0,S,L0) (respectively) are identical permutations and their outputs are identical by the above equality. Hence, the inputs to the final
rounds (obtained afteriencryption rounds and application of thei’th non-linear layer) are identical, and in particular the values of their part 1 of the state are identical. InE(k0,S∗,L0)(¯xi) it is ¯y0
(1)
i = ¯x
0(1)
i as the first r rounds ofE(k0,S∗,L0) andE(k0,S,L0)are identical. In E(k0,S,L0)(xi) is ity
0(1)
i =x
0(1)
i by definition. We
conclude that ¯x0i(1)=x0i(1) as claimed.
Proof (of Lemma 1). The proof is by induction ofr.
Forr= 1,Λ1 is the set of invertible matrices. We show that every different invertible matrixL= (L1) forms a linear equivalence class. Indeed, assume that for some K,S and all x, E(k0,S,(L1))(x) = E(k0,S,(L01))(x).
18 Then after adding k0 and applying S1 (which are the same for both schemes), we get L1(y1) = L01(y1). In particular, this holds for the n vectors of the standard basis y1 ∈ {e1, e2, . . . , en}which give (in matrix notation)L1·In =L01·In orL1=L01.
Assume correctness fori=rand add a round at the beginning, noticing that rounds 2, . . . , r+ 1 form anr-round scheme with zero initial round key.
Let (L1,L) 6= (L01,L0) ∈ Λr+1 such that L,L0 ∈ Λr. We need to prove
(L1,L)6≡(L01,L0). We divide the proof into three cases. IfL=L0 but L
16=L01, then for any corresponding ciphers, we have E(k0,S,(L1,L))(x)6=E(k0,S,(L0
1,L))(x)
on everyxfor which the outputs of the first round differs (since rounds 2, . . . , r+1 are identical).
If L 6= L0 and L
1 = L01, then by the induction hypothesis, L 6≡ L0. If we start with non-equivalent r-round ciphers and add an identical round at the beginning, clearly the schemes remain non-equivalent.
Finally, it remains to prove the induction step for the case that L 6= L0 and L1 6= L01. Assume towards contradiction that (L1,L) ≡ (L01,L0). We will prove that in this case,L1↔N L01. However, by the definition ofΛr+1, we select only one matrix from each normalized equivalence class and hence L1 =L01 in contradiction.
In order to derive L1 ↔N L01, fix a key k0, an (r+ 1)-tuple of non-linear layersS and pick some plaintext x∈ {0,1}n. Denote the state values for round
i of the first cipher E(k0,S,(L1,L))(x) by xi and yi and similarly, denote by x0i
andyi0 these values forE(k0,S,(L0
1,L0))(x). Since the initial round keys andS1are
identical,y1=y01and therefore,
x2=L1· y1(0) y1(1) ! , x02=L01· y1(0) y1(1) ! ,
for the encryption of anyx∈ {0,1}n. We consider the transformation
L01·(L1)−1(x2) =x02. 18
The definition of linear equivalence requires that E(k0,S,(L1))(x) = E(k0,S,(L01))(x) holds for anyk0,S, so it obviously must hold for an arbitrary choice ofk0,S.
Our goal is to show that L01·(L1)−1= Is 001 010C11 (6) for some invertible C11, which provesL1↔N L01by Proposition 2.
Since we assume (L1,L) ≡ (L01,L0), then by Proposition 8 we must have x02(0)=x(0)2 at the input of the second linear layer. By settingx2∈ {e1, e2, . . . , en}
to be the n standard basis vectors and using the equalityx02(0) =x(0)2 , we con- clude that the topsrows ofL01·(L1)−1 are of the form of (6).
It remains to prove that the bottom-left (n−s)×sblock ofL0
1·(L1)−1is equal to010. Equivalently, we need to show that changingx(0)
2 (without changingx (1) 2 ) at the input ofL01·(L1)−1does not changex
0(1)
2 at the output (but will obviously setx02(0) =x(0)2 ). Indeed, this property is directly implied by Proposition 9.