pub fn boomerang_uniformity(sbox: &[u32]) -> Option<u32>Expand description
The boomerang uniformity of an S-box permutation — the third cryptanalytic pillar after
differential and linear. BCT[a][b] = #{x : S⁻¹(S(x)⊕b) ⊕ S⁻¹(S(x⊕a)⊕b) = a}; the uniformity is the
maximum over a≠0, b≠0 and measures resistance to the boomerang attack (lower is stronger; 2 is
optimal, attained exactly by APN permutations). None if sbox is not a permutation.