CCZ-Classes: Cryptography & Quantum Codes

• CCZ-Classes are equivalence classes defined via an affine permutation on function graphs, preserving invariants like differential uniformity and nonlinearity.
• They enable the classification of cryptographically optimal functions such as APN and planar mappings, with applications in finite field theory and semifield isotopism.
• In quantum information, CCZ-classes extend to the design of CSS codes and CCZ gates, supporting transversal non-Clifford operations for fault-tolerant computing.

A CCZ-class is the equivalence class of a function with respect to Carlet–Charpin–Zinoviev (CCZ) equivalence, an affine-graph-based notion vital for the classification of vectorial Boolean and $p$-ary functions in cryptography, combinatorics, and quantum fault tolerance. CCZ-equivalence not only preserves key cryptographic invariants like differential uniformity and nonlinearity, but also defines the essential partition of S-boxes, almost perfect nonlinear (APN) mappings, perfect nonlinear and planar functions, and associated semifields and quantum codes. The structure and size of CCZ-classes underpin both finite field theory and the search for new cryptographically significant functions and codes.

1. Foundations of CCZ-Equivalence and CCZ-Classes

For functions $F, G : \mathbb{F}_{q}^n \to \mathbb{F}_{q}^n$, CCZ-equivalence is defined by the existence of an affine permutation $L$ on $\mathbb{F}_{q}^{2n}$ such that $L(\Gamma_F) = \Gamma_G$, where the graph $$\Gamma_F = \{ (x, F(x)) : x \in \mathbb{F}_{q}^n \}$$ (Sun, 2017, Jeong et al., 2023, Byrne et al., 2011). The resulting CCZ-class consists of all mappings equivalent in this sense. Importantly, CCZ-equivalence strictly generalizes extended-affine (EA) equivalence: EA-equivalent functions are always CCZ-equivalent, but the converse does not hold; CCZ-classes can contain functions of distinct algebraic degree and form.

CCZ-equivalence preserves the following key invariants:

• Differential spectrum (including differential uniformity)
• Walsh spectrum (nonlinearity, propagation characteristics)
• Nonlinearity profiles

For monomial functions $F(x) = x^d$ over finite fields, two functions are CCZ-equivalent if and only if their exponents are in the same orbit under the action generated by Frobenius automorphism ($d \mapsto 2^k d$) and inversion ($d \mapsto d^{-1}$) modulo $2^n-1$ or $p^n-1$ (Byrne et al., 2011, Andreoli et al., 2024, Fu et al., 2022).

2. CCZ-Classes in APN and Planar Function Classification

CCZ-classes underlie the modern classification of cryptographically optimal mappings, particularly almost perfect nonlinear (APN) and planar (perfect nonlinear) functions. For APN mappings $F: \mathbb{F}_{2^n} \to \mathbb{F}_{2^n}$, the CCZ-class constitutes the central object of interest because APNness is CCZ-invariant. In small dimension ($n=6$), the exhaustive computations confirm exactly fourteen CCZ-classes for 6-bit APNs, with no new classes found in exhaustive searches (Langevin, 16 Jan 2026, Gillot et al., 17 Jul 2025). For $n=6$ to $n=11$, the number of CCZ-classes from infinite APN families remains very small (2 to 13) (Sun, 2017).

In odd characteristic, for planar functions $F: \mathbb{F}_{p^n} \to \mathbb{F}_{p^n}$ (differential uniformity 1, i.e., perfect nonlinear), CCZ-equivalence provides the primary classification tool, with the further structure from semifield isotopism. Any isotopy class of a commutative presemifield can split into at most two CCZ-classes, as described by the Coulter–Henderson splitting criterion (Andreoli et al., 2024). For instance, in characteristic three, a full classification up to CCZ-equivalence for $n\le 11$ yields 96 CCZ-classes (Andreoli et al., 2024).

3. Structure, Rigidity, and Diversity Within CCZ-Classes

The structure of CCZ-classes can vary substantially:

• CCZ-class rigidity: For certain functions, the CCZ-class coincides with the EA-class. For example, the Gold APN function $x^{2^r+1}$ is CCZ-equivalent to another function if and only if they are EA-equivalent (Byrne et al., 2011). This is an exceptional rigidity property.
• CCZ-class richness: For most quadratics $F$ not within these rigid families (e.g., “good” quadratic APN mappings), the CCZ-class is large and contains many EA-inequivalent members, including those of higher algebraic degree (“twisted” constructions) (Jeong et al., 2023). Explicit constructions yield an infinite (exponential-sized) family of CCZ-equivalents that are pairwise EA-inequivalent, highlighting the nontrivial size and diversity of a typical CCZ-class.
• Sparse classes: For certain constrained settings (e.g., APN permutations in small even dimension with specific self-equivalence), CCZ-classes may be unique—such as the unique “Dublin” CCZ-class for 6-bit APN permutations with specified spectral moments (Gillot et al., 17 Jul 2025, Beierle et al., 2020).

4. CCZ-Classes in Quantum Codes and Quantum Gates

The concept of CCZ-class extends to quantum information, where the "CCZ gate" refers to the three-qubit controlled-controlled-Z gate. Novel families of quantum codes—explicitly, CSS codes—are classified in terms of their ability to support transversal non-Clifford gates such as CCZ. Here, "CCZ-class" denotes families of codes permitting logical CCZ implementation by transversal application of physical CCZ gates (Nguyen, 2024, Golowich et al., 8 Oct 2025).

The relevant structures are as follows:

• A quantum CSS code $\mathrm{CSS}(C_1, C_2)$ over $\mathbb{F}_q$ admits transversal logical CCZ if $C_1$ satisfies a degree-2 multiplication property ($C_1^{\star 2} \subseteq C_1^\perp$) (Nguyen, 2024).
• Explicit constructions yield infinite families of binary quantum codes (CCZ-classes) of linear rate and distance with transversal CCZ, essential for fault-tolerant quantum computation and magic-state distillation with constant space overhead (Nguyen, 2024, Golowich et al., 8 Oct 2025).
• CCZ-classes of quantum codes are further stratified by parameters such as code distance, locality (parity-check weight), and alphabet size, offering a nuanced landscape for transversal implementation (Golowich et al., 8 Oct 2025).

5. CCZ-Classes and Generalizations: c-CCZ and Partial Equivalences

CCZ-equivalence admits generalizations, most notably $c$-CCZ equivalence, where the equivalence is twisted by a scalar parameter $c$ (Chung et al., 2023). This broader framework includes:

• $c$-CCZ, $c$-EA, and $c^1$-equivalence provide a lattice of equivalence relations capturing “twisted” S-box analysis.
• $c$-CCZ equivalence preserves $cc$-differential uniformity and spectrum, and strictly contains $c$-EA equivalence: there exist function pairs $F,G$ that are $c$-CCZ but not $c$-EA equivalent.
• For perfect nonlinear (PN) functions, $c$-CCZ always coincides with $c$-EA equivalence, reflecting rigidity analogous to certain APN cases.

This generalized notion is necessary to fully classify S-boxes and vectorial Boolean functions up to twist-invariant properties, especially in the context of advanced cryptanalytic criteria.

6. Computational Classification and Invariants for CCZ-Classes

Distinguishing CCZ-classes in practice requires efficient invariants and computational methods:

• CCZ-invariants include the full differential spectrum, extended Walsh spectrum, algebraic degree, and structural data from associated codes (e.g., automorphism group order, nuclei in planar case) (Sun, 2017, Langevin, 16 Jan 2026, Andreoli et al., 2024).
• For APN mappings, recent advances exploit spectral moment invariants, component-class invariants, and extendibility criteria to verify completeness of CCZ-classifications; e.g., the confirmation of exactly 14 CCZ-classes of 6-bit APN functions (Langevin, 16 Jan 2026, Gillot et al., 17 Jul 2025).
• For monomials, CCZ-inequivalence typically follows from exponent-orbit analysis under Frobenius and inversion, as well as resultant-based elimination for partially APN mappings (Fu et al., 2022, Man et al., 2022).
• For newly constructed APN or 0-APN families, computation of CCZ-invariants such as $\Gamma$-rank or code weight distributions confirms CCZ-inequivalence to prior classes (Li et al., 2021).

7. Open Questions and Ongoing Directions

While substantial progress has been made, several open questions regarding CCZ-classes remain:

• The total number and growth rate of CCZ-classes for APN and planar functions as $n$ increases are unknown; current evidence suggests slow growth for moderate $n$ (Sun, 2017, Andreoli et al., 2024).
• The existence of new, fundamentally distinct CCZ-classes of APN (or 0-APN) mappings in large $n$, especially outside monomial and existing multivariate families, is an active area of investigation (Fu et al., 2022, Li et al., 2021).
• In the quantum domain, the construction of new CCZ-classes of codes with improved parameters (e.g., locality, distance, alphabet reduction) is ongoing, guided by the algebraic multiplication property and subsystem product frameworks (Nguyen, 2024, Golowich et al., 8 Oct 2025).
• The possible existence and structure of APN permutations in even dimensions beyond $n=6$ (where only the Dillon permutation is known) remains a major unresolved issue (Gillot et al., 17 Jul 2025, Beierle et al., 2020).

CCZ-classes thus offer the mathematical and computational foundation upon which the classification and discovery of cryptographic and quantum-optimal functions are built, linking field theory, combinatorics, nonlinear analysis, and quantum information in a unified framework.