International Association
for Cryptologic Research

It has been pointed out that an $n$-variable Boolean function $f$ has optimal resistance against fast algebraic attacks if and only if there does not exist a nonzero $n$-variable Boolean function $g$ of degree lower than $\\frac{n}{2}$ such that $fg=h$ and $\\mathrm{deg}(g)+\\mathrm{deg}(h)