Lower bounds on the performance of hardware circuits computing the Möbius transform

The Möbius transform converts the truth table of a Boolean function to its algebraic normal form. It can be implemented efficiently by algorithms that operate similarly to the Fast Fourier Transform (FFT). It plays a useful role in cryptology, either to study properties of concrete Boolean functions, or in the implementation of cryptographic attacks that require building the truth table of Boolean functions given as low-degree polynomials. Because of this last application, Banik and Regazzoni presented hardware designs to implement the Möbius transform operation in TCHES, 2024(2). The proposed hardware implementations are claimed to compute the Möbius transform of <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mi>n</mml:mi> </mml:mrow> </mml:math> -bit Boolean functions with area-time product <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mi>A</mml:mi> <mml:mi>T</mml:mi> <mml:mo>=</mml:mo> <mml:mi>𝒪</mml:mi> <mml:mrow> <mml:mo stretchy="true" fence="true" form="prefix">(</mml:mo> <mml:mi>n</mml:mi> <mml:msup> <mml:mn>2</mml:mn> <mml:mi>n</mml:mi> </mml:msup> <mml:mo stretchy="true" fence="true" form="postfix">)</mml:mo> </mml:mrow> </mml:mrow> </mml:math> , where <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mi>A</mml:mi> </mml:mrow> </mml:math> is the area of the logic gates of the circuit and <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mi>T</mml:mi> </mml:mrow> </mml:math> is the runtime measured in clock cycles. We study the communication complexity of the Möbius transform, using a slightly non-standard notion of “best-case” communication complexity for functions with large inputs. This directly leads to an <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mi>A</mml:mi> <mml:msup> <mml:mi>T</mml:mi> <mml:mn>2</mml:mn> </mml:msup> </mml:mrow> </mml:math> lower bound for hardware circuits, and using standard arguments from one-way communication complexity, to an area lower bound. We conclude that <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mi>A</mml:mi> <mml:mi>T</mml:mi> <mml:mo>=</mml:mo> <mml:mi>Ω</mml:mi> <mml:mrow> <mml:mo stretchy="true" fence="true" form="prefix">(</mml:mo> <mml:msup> <mml:mn>2</mml:mn> <mml:mrow> <mml:mn>1.5</mml:mn> <mml:mi>n</mml:mi> </mml:mrow> </mml:msup> <mml:mo>/</mml:mo> <mml:msup> <mml:mi>n</mml:mi> <mml:mrow> <mml:mn>1.5</mml:mn> </mml:mrow> </mml:msup> <mml:mo stretchy="true" fence="true" form="postfix">)</mml:mo> </mml:mrow> </mml:mrow> </mml:math> for any circuit that computes the Möbius transform, where <mml:math xmlns:mml="http://www.w3.org/1998/Math/MathML"> <mml:mrow> <mml:mi>A</mml:mi> </mml:mrow> </mml:math> is the area of the circuit including wires. Thus, a circuit implementing the Möbius transform can be asymptotically larger than the area of just its logic cells. We also derive concrete version of these asymptotic statements, in which the constants are made explicit, based on physical properties of the circuit production process.