Counting Boolean functions with faster points

Abstract

Duan and Lai introduced the notion of “fast point” for a Boolean function f as being a direction a so that the algebraic degree of the derivative of f in direction a is strictly lower than the expected $\deg (f)-1$. Their study was motivated by the fact that the existence of fast points makes many cryptographic differential attacks (such as the cube and AIDA attack) more efficient. The number of functions with fast points was determined by Duan et al. in some special cases and by Sălăgean and Mandache-Sălăgean in the general case. We generalise the notion of fast point, defining a fast point of order $\ell$ as being a fast point a so that the degree of the derivative of f in direction a is lower by at least $\ell$ than the expected degree. We determine an explicit formula for the number of functions of degree d in n variables which have fast points of order $\ell$. Furthermore, we determine the number of functions of degree d in n variables which have a given number of fast points of order $\ell$, and also the number of functions which have a given profile in terms of the number of fast points of each order. We apply our results to compute the probability of a function to have fast points of order $\ell$. We also compute the number of functions which admit linear structures (i.e. their derivative in a certain direction is constant); such functions have a long history of being used in the analysis of symmetric ciphers.

1 Introduction

Boolean functions used in cryptography are usually required to resist a range of attacks. They need to have a sufficiently high algebraic degree (i.e. the degree of the function written in its algebraic normal form) in order to resist algebraic attacks. Differential attacks on cryptographic functions typically exploit properties of the discrete derivative. The discrete derivative of a function f in the direction a is defined as $D_a f(x) = f(x+a)-f(x)$. The derivatives should also have a high degree; the highest that can be achieved is one less than the degree of the original function, i.e. $\deg (D_af)\le \deg (f)-1$. Higher order derivatives of order k are obtained by differentiating k times in several directions. The higher order derivatives should also have a sufficiently high degree (the maximum possible being $\deg (f)-k)$). For example, the cube attack of Dinur and Shamir [5] and the AIDA attack of Vielhaber [14], as well as further variants of these attacks, exploit the situation where a higher order derivative of the function has a very low degree (degree 1 in the original AIDA and cube attacks, degree 1 or 2 in [1] and [8] for example; cube testers introduced in [2] test for several non-randomness properties, one of which being low degree). Computing a higher order derivative of order k is computationally expensive as k increases ($2^k$ complexity) so the attacks work particularly well when the degree drops quicker than expected.

Motivated by these applications, Duan and Lai [6] introduced the notion of “fast point” for a cryptographic function: a is a fast point for a function f if the degree of $D_af$ drops more than expected, i.e. the degree is strictly lower than $\deg (f)-1$. The fast points of a function f form a linear space. Duan et al. [7] started computing the number of functions that admit fast points; explicit formulae were obtained for small degrees and very large degrees (close to the number of variables), and exhaustive search results were obtained for small numbers of variables.

Sălăgean and Mandache-Sălăgean [13] obtained a recurrence relation as well as an explicit formula for the number of functions that admit fast points, for any number of variables n and any degree d. This sequence of numbers (triangular sequence indexed by n and d for $1\le d \le n$) is given as sequence A316554 in OEIS (Online Encyclopedia of Integer Sequences, [12]) and it solves the cases left open by Duan et al. in [7]. Moreover, the counting is refined to functions of degree d in n variables which admit a particular number of fast points, i.e. their space of fast points has a particular dimension.

In this paper we define “faster points” i.e. points where the degree of the derivative drops by at least 2 more than expected. More generally, a fast point of order $\ell$ for a function f will be a point where the degree of $D_af$ is at most $\deg (f) - 1 - \ell$, i.e. it dropped $\ell$ more than expected. The fast points of order $\ell$ of a function f form a linear space. The dimensions of these spaces are affine invariants, i.e. they are invariant to invertible affine changes of coordinates.

In Sect. 3 we will count the number of functions of degree d in n variables which have a given space U as their space of fast points of order $\ell$. This number does not depend on the space itself, only on its dimension, so this allows us to count, for each fixed k, the number of functions which have exactly $2^k$ fast points of order $\ell$; also the number of functions which have no fast points of order $\ell$. For all these numbers we give both recurrence relations and explicit formulae, see Theorem 2 for fast points of order 2 and Theorem 3 for arbitrary order. The proofs use some techniques similar to the ones in [13], but also some different techniques, particularly a version of the inversion formulae of Carlitz [3], see Lemma 2.

As an application of these counting results, in Sect. 4 we determine the number of functions which have linear structures. The notion of linear structure was introduced by Chaum and Evertse in 1985 in [4] and has since been used widely in the analysis of cryptographic primitives. An element a is a linear structure for a function f if $D_a f$ is a constant function. With our definition, a linear structure for f is a fast point of order $\deg (f)-1$, so we can apply our results directly to compute the number of functions which have linear structures for each degree d and n variables.

A second application is to estimate the probability that a function picked uniformly at random has fast points of order $\ell$; also the probability that a function has fast points of order $\ell$ when we pick it from among the functions which do have fast points of order $\ell -1$. All these probabilities are extremely small (see Proposition 1).

We further refine our counting results in Sect. 5. For each fixed sequence of spaces $U_1\supseteq U_2 \supseteq \ldots \supseteq U_{\ell }$ we count the number of functions which have exactly those $U_i$ as their space of fast points of order i. Also, for $k_1\ge k_2\ge \ldots k_{\ell }$ we count the functions whose space of fast points of order i has dimension $k_i$, for $i=1, \ldots , \ell$. The new aspect here compared to the results in Sect. 3 is that we also need to count functions which do not have any fast points in a particular subspace. For all these numbers we give explicit formulae, see Theorem 4.

Note that although we count the number of functions for each set of given values of these affine invariants, this is different from counting the number of equivalence classes and the size of each class under the equivalence given by affine invertible changes of coordinates. For the latter, Hou [9] and Langevin and Leander [11] obtained results for up to 8 variables by a combination of theoretical results and computer search, and combining several invariants to discriminate each class. What we compute here is the sum of the cardinalities of those classes which share a particular value of the invariant defined as the dimensions of the space of fast points of each order (and there are several classes with the same value of this invariant).

2 Preliminaries

We denote by ${{\mathbb {F}}}_2$ the binary field. A Boolean function f with n-bits input and one bit output can be viewed as a function $f:{{\mathbb {F}}}_2^n \rightarrow {{\mathbb {F}}}_2$. Any such function can be represented in algebraic form as a polynomial function in n variables, of degree at most one in each variable. (More precisely, because $x^2=x$ when $x\in {{\mathbb {F}}}_2$, each function corresponds to an element in ${{\mathbb {F}}}_2[x_1,\ldots ,x_n]/\langle x_1^2+x_1, \ldots , x_n^2+x_n\rangle$; we identify each coset with its unique representative multivariate polynomial which has degree at most one in each variable.) The total degree of this multivariate polynomial is called the algebraic degree of the function f. In this paper we will call the algebraic degree of f simply the degree of f, denoted $\deg (f)$, with the usual convention that the degree of the zero function is $-\infty$. We will denote by ${\mathrm {BF}}(n)$ the set of Boolean functions in n variables, and by ${\mathrm {BF}}(n,d)$ the set of Boolean functions in n variables of degree exactly d, where $0 \le d \le n$.

Let $f\in {\mathrm {BF}}(n,d)$ and $a=(a_1, \ldots , a_n) \in {{\mathbb {F}}}_2^n$, $a \ne {\mathbf {0}}$, where ${\mathbf {0}}$ denotes the all-zero vector. The derivative $D_af$ of f in direction a is defined as the Boolean function in n variables $x \mapsto f(x+a) - f(x)$. The degree of $D_af$ is lower than or equal to $d -1$ (see [10]), i.e. differentiation decreases the degree of the function by at least 1. Vectors a for which the degree of $D_af$ is strictly lower than $d - 1$ (i.e. the degree drops more than expected) are called “fast points” of f (see [6]). The set of fast points of f (including, by convention, ${\mathbf {0}}$ as a trivial fast point) is a linear subspace of ${{\mathbb {F}}}_2^n$ of dimension at most $n-d$ (see [6]).

Note that if f has degree d, then only its monomials of degree d matter when determining whether the degree of $D_af$ is equal to $d-1$ or strictly lower, and therefore determining whether a is a fast point. In other words, $a \in {{\mathbb {F}}}_2^n$ is a fast point of f if and only if a is a fast point of $f+g$, where g is an arbitrary Boolean function in n variables of degree at most $d-1$. Hence for counting Boolean functions having fast points, it is natural to define the following equivalence on ${\mathrm {BF}}(n)$: for $f_1,f_2 \in {\mathrm {BF}}(n)$

$$\begin{aligned} f_1 {\mathop {\sim }\limits ^{(i)}} f_2 \iff \deg (f_1-f_2) \le i. \end{aligned}$$

Then $[f]^{(i)}$ denotes the equivalence class of f with respect to the ${\mathop {\sim }\limits ^{(i)}}$ equivalence relation.

For deciding whether a function f of degree d has fast points, it suffices to consider f up to the equivalence ${\mathop {\sim }\limits ^{(d-1)}}$.

Next we formally define “faster points”.

Definition 1

Let $f\in B(n, d)$ and $1 \le \ell \le d$. An element $a\in {{\mathbb {F}}}_2^n$, $a\ne {\mathbf {0}}$ is called a fast point of order $\ell$ for f if $\deg (D_af) \le d-1 -\ell$. The set of fast points of order $\ell$ of f (including, by convention, ${\mathbf {0}}$) is denoted

$$\begin{aligned} {\mathrm {FP}}^{(\ell )}(f)=\{a \in {{\mathbb {F}}}_2^n\setminus \{{\mathbf {0}}\}: \deg (D_a f) \le d-1 -\ell \} \cup \{{\mathbf {0}}\}. \end{aligned}$$

(1)

Note the usual fast points are fast points of order 1. If $a_1,a_2 \in {\mathrm {FP}}^{(\ell )}(f)$, then

$$\begin{aligned} D_{a_1+a_2} f(x)= & {} f(x+a_1+a_2) - f(x) \\= & {} f(x+a_1+a_2) - f(x+a_1) + f(x+a_1) - f(x) \\= & {} D_{a_2} f(x+a_1) + D_{a_1} f(x). \end{aligned}$$

Hence $\deg ( D_{a_1+a_2} f) \le \max \{ \deg (D_{a_1} f), \deg (D_{a_2} f)\}$. This proves that ${\mathrm {FP}}^{(\ell )}(f)$ is a linear subspace of ${{\mathbb {F}}}_2^n$. The dimension of this space is at most $n-d$, since a fast point of order $\ell$ is also a fast point of order $\ell -1$ and $\dim ({\mathrm {FP}}^{(1)}(f)) \le n-d$. We have a filtration of linear subspaces:

$$\begin{aligned} {{\mathbb {F}}}_2^n \supseteq {\mathrm {FP}}^{(1)}(f) \supseteq {\mathrm {FP}}^{(2)}(f) \supseteq \cdots \supseteq {\mathrm {FP}}^{(d -1)}(f) \supseteq {\mathrm {FP}}^{(d)}(f) \supseteq \{{\mathbf {0}}\}. \end{aligned}$$

When determining whether a function f of degree d has fast points of order $\ell$ only the monomials of degree $d, d-1, \ldots , d - \ell +1$ matter, as they are the only ones that can produce polynomials of degree strictly above $d-1-\ell$ after differentiation; so we only need to consider the function f up to the equivalence ${\mathop {\sim }\limits ^{(d-\ell )}}$. The set of functions (up to the suitable equivalence) which have their space of fast points of order $\ell$ equal to a given subspace $U\subseteq {{\mathbb {F}}}_2^n$ will be denoted:

$$\begin{aligned} {\mathrm F}^{(\ell )}(n,d;U)=\{[f]^{(d-\ell )}: f \in {\mathrm {BF}}(n,d) \; \text{ and } \; {\mathrm {FP}}^{(\ell )}(f)=U\}. \end{aligned}$$

The set of functions (up to the suitable equivalence) for which the space of fast points of order $\ell$ has a given dimension k will be denoted:

$$\begin{aligned} {\mathrm F}^{(\ell )}(n,d;k)=\{[f]^{(d-\ell )}: f \in {\mathrm {BF}}(n,d) \; \text{ and } \; \dim ({\mathrm {FP}}^{(\ell )}(f))=k\}. \end{aligned}$$

In particular, ${\mathrm F}^{(\ell )}(n,d;0)$ is the set of functions (up to the suitable equivalence) which have no fast points of order $\ell$.

For integers $0 \le k \le n$ the Gaussian binomial coefficients (or q-binomial coefficients) are defined as

$$\begin{aligned} \genfrac[]{0.0pt}{}{n}{k}_q=\frac{(q^n-1)(q^{n-1}-1) \cdots (q^{n-k+1}-1)}{(q^k-1)(q^{k-1}-1) \cdots (q-1)}. \end{aligned}$$

(2)

Recall that the number of k dimensional ${{\mathbb {F}}}_q$-linear subspaces of ${{\mathbb {F}}}_q^n$ (when q is a power of a prime) is $\genfrac[]{0.0pt}{}{n}{k}_q$. We will mostly use these Gaussian binomial coefficients for $q=2$, and in this case we will omit the index and simply denote $\genfrac[]{0.0pt}{}{n}{k}=\genfrac[]{0.0pt}{}{n}{k}_2$.

For the cardinality of ${\mathrm F}^{(1)}(n,d;k)$ a recurrence relation as well as an explicit formula were computed by Sălăgean and Mandache-Sălăgean, [13]. The number of functions of degree d in n variables which have fast points was also computed (see sequence A316554 in OEIS, [12]). We recall the explicit formulae:

Theorem 1

([13, Theorem 6, Corollary 3]) Let integers n, d, k be such that $1 \le d \le n$ and $0 \le k \le n-d$. The number of functions of degree d in n variables which have fast points is:

$$\begin{aligned} \sum _{i=1}^{n -d} (-1)^{i-1} 2^{\frac{i(i-1)}{2}} \genfrac[]{0.0pt}{}{n }{i} \left( 2^{ \left( {\begin{array}{c}n-i\\ d\end{array}}\right) } -1 \right) . \end{aligned}$$

We have

$$\begin{aligned} |{\mathrm F}^{(1)}(n,d;k)| = \genfrac[]{0.0pt}{}{n}{k} \sum _{i=0}^{n-k -d} (-1)^i 2^{\frac{i(i-1)}{2}} \genfrac[]{0.0pt}{}{n - k}{i} \left( 2^{ \left( {\begin{array}{c}n-k-i\\ d\end{array}}\right) } -1 \right) . \end{aligned}$$

For $1 \le i \le n$ let $e_i=(0, \ldots , 0,1,0,\ldots ,0 ) \in {{\mathbb {F}}}_2^n$ be the vector which has 1 in its i-th position and zeroes elsewhere. The set $\{e_1, \ldots , e_n\}$ forms the standard basis (canonical basis) of ${{\mathbb {F}}}_{2}^n$ over ${{\mathbb {F}}}_2$.

Most properties we are interested in are invariant to linear (or affine) changes of variables (changes of coordinates). Recall that two functions $f_1, f_2: {{\mathbb {F}}}_2^n \rightarrow {{\mathbb {F}}}_2$ are called affine equivalent if there is an invertible affine map $\varphi :{{\mathbb {F}}}_2^n \rightarrow {{\mathbb {F}}}_2^n$ such that $f_1 = f_2 \circ \varphi$. Any function P (or a relation) defined over the set of Boolean function is called an affine invariant if $P(f_1) = P(f_2)$ for any two affine equivalent functions $f_1, f_2$. A few useful facts are collected below:

Lemma 1

Let $f, f_1, f_2: {{\mathbb {F}}}_2^n \rightarrow {{\mathbb {F}}}_2$ and $a\in {{\mathbb {F}}}_2^n$. Let $\varphi :{{\mathbb {F}}}_2^n \rightarrow {{\mathbb {F}}}_2^n$ be an invertible linear (or affine) map.

• (i) The degree of a function is an affine invariant, i.e. $\deg (f) = \deg (f \circ \varphi )$.

• (ii) $D_{a} (f\circ \varphi ) = (D_{\varphi (a)} f) \circ \varphi$.

• (iii) The property of a function having fast points of order $\ell$ is an affine invariant. More precisely, a is a fast point of order $\ell$ for f iff $\varphi ^{-1}(a)$ is a fast point of order $\ell$ for $f \circ \varphi$.

• (iv) $e_i$ is a fast point of order $\ell$ for f iff $x_i$ does not appear in any of the monomials of degree $d, d-1, \ldots , d-\ell +1$ of f.

• (v) $f_1 {\mathop {\sim }\limits ^{(i)}} f_2$ iff $f_1 \circ \varphi {\mathop {\sim }\limits ^{(i)}} f_2 \circ \varphi$.

3 Counting faster points

We will make extensive use of the following inversion formula, which is a variant of the result of Carlitz [3]:

Lemma 2

Let $S,T: {\mathbb {N}} \rightarrow {\mathbb {C}}$ be functions. Then

$$\begin{aligned} S(n) = \sum _{k=0}^{n}\genfrac[]{0.0pt}{}{n}{k}_q T(k) \text{ for } \text{ all } n\ge 0 \end{aligned}$$

(3)

if and only if

$$\begin{aligned} T(n) = \sum _{k=0}^{n}(-1)^k q^{\frac{k(k-1)}{2}}\genfrac[]{0.0pt}{}{n}{k}_q S(n-k) \text{ for } \text{ all } n\ge 0. \end{aligned}$$

(4)

Proof

We recall [3, Theorem 2]. Let $(a_i)$ and $(b_i)$ be sequences of complex numbers, and q a complex number such that $a_i+q^{-k}b_i\ne 0$ for all $i\ge 1$ and $k\ge 0$. Put $\psi (k, n, q) = \prod _{i=1}^{n}(a_i+q^{-k}b_i)$. The system of equations

$$\begin{aligned} f(n) = \sum _{k=0}^{n}(-1)^k q^{\frac{k(k-1)}{2}}\genfrac[]{0.0pt}{}{n}{k}_q\psi (k, n, q) g(k) \text{ for } \text{ all } n\ge 0 \end{aligned}$$

is equivalent to the system

$$\begin{aligned} g(n) = \sum _{k=0}^{n}(-1)^k q^{\frac{k(k+1)}{2}-kn}\genfrac[]{0.0pt}{}{n}{k}_q(a_{k+1} + q^{-k}b_{k+1})\frac{f(k)}{\psi (n, k+1, q)} \text{ for } \text{ all } n\ge 0. \end{aligned}$$

For the particular case $a_i=1, b_i=0$ for all i (and therefore $\psi (k, n, q)=1$), this becomes

$$\begin{aligned} f(n) = \sum _{k=0}^{n} (-1)^k q^{\frac{k(k-1)}{2}}\genfrac[]{0.0pt}{}{n}{k}_q g(k) \end{aligned}$$

(5)

if and only if

$$\begin{aligned} g(n) = \sum _{k=0}^{n} (-1)^k q^{\frac{k(k+1)}{2}-kn}\genfrac[]{0.0pt}{}{n}{k}_q f(k). \end{aligned}$$

(6)

Putting $S(n) = f(n)$ and $T(n)= (-1)^n q^{\frac{n(n-1)}{2}} g(n)$, Eq. (5) becomes (3) and Eq. (6) becomes

$$\begin{aligned} \frac{T(n)}{(-1)^n q^{\frac{n(n-1)}{2}}}= & {} \sum _{k=0}^{n} (-1)^k q^{\frac{k(k+1)}{2}-kn}\genfrac[]{0.0pt}{}{n}{k}_q S(k)\\ T(n)= & {} \sum _{k=0}^{n} (-1)^{n+k} q^{\frac{n(n-1)}{2}+\frac{k(k+1)}{2}-kn}\genfrac[]{0.0pt}{}{n}{k}_q S(k)\\= & {} \sum _{k=0}^{n} (-1)^{n-k} q^{\frac{(n-k)(n-k-1)}{2}}\genfrac[]{0.0pt}{}{n}{n-k}_q S(k). \end{aligned}$$

After replacing the index of summation k with $n-k$ in the last equation, we obtain precisely Eq. (4). $\square$

We will exploit invariance to linear (affine) invertible changes of coordinates:

Lemma 3

Let $f:{{\mathbb {F}}}_2^n \rightarrow {{\mathbb {F}}}_2$. The numbers $\dim ({\mathrm {FP}}^{(\ell )}(f))$, $\ell =1, 2, \ldots ,d$ are affine invariants, i.e. $\dim ({\mathrm {FP}}^{(\ell )}(f)) =\dim ({\mathrm {FP}}^{(\ell )}(f\circ \varphi ))$ for any $\varphi : {{\mathbb {F}}}_2^n \rightarrow {{\mathbb {F}}}_2^n$ which is an affine invertible change of coordinate.

Proof

Using Lemma 1 we have that $a\in {\mathrm {FP}}^{(\ell )}(f)$ iff $\varphi ^{-1}(a) \in {\mathrm {FP}}^{(\ell )}(f\circ \varphi )$. Therefore ${\mathrm {FP}}^{(\ell )}(f\circ \varphi ) = \varphi ^{-1}({\mathrm {FP}}^{(\ell )}(f))$ hence $\dim ({\mathrm {FP}}^{(\ell )}(f\circ \varphi ))=\dim ({\mathrm {FP}}^{(\ell )}(f))$. $\square$

Corollary 1

Let $U\subseteq {{\mathbb {F}}}_2^n$ be a space of dimension k. The cardinality of ${\mathrm F}^{(\ell )}(n,d;U)$ depends on the dimension of U but not on the space U itself. In particular

$$\begin{aligned} |{\mathrm F}^{(\ell )}(n,d;U)| = |{\mathrm F}^{(\ell )}(n,d;\langle e_{n-k+1}, \ldots , e_n \rangle )|. \end{aligned}$$

The functions f in n variables for which the space of fast points of order $\ell$ is generated by vectors in the canonical basis, $\langle e_{n-k+1}, \ldots , e_n \rangle$ are, essentially, functions in fewer variables, i.e. they actually do not depend on $x_{n-k+1}, \ldots , x_n$. More precisely, we can do the following reduction:

Lemma 4

Let $0\le k\le n-d$. Then

$$\begin{aligned} |{\mathrm F}^{(\ell )}(n,d;\langle e_{n-k+1}, \ldots , e_n \rangle )| = |{\mathrm F}^{(\ell )}(n-k,d;\{{\mathbf {0}}\})| \end{aligned}$$

Proof

For an equivalence class $[g]^{(d-\ell )}$ we can pick a representative which only contains monomials of degree $d, d-1, \ldots , d-\ell +1$, where $d = \deg (g)$. Using Lemma 1(iv), we see that if $[g]^{(d-\ell )}\in {\mathrm F}^{(\ell )}(n,d;\langle e_{n-k+1}, \ldots , e_n \rangle )$ then the representative g which only contains monomials of degree $d, d-1, \ldots , d-\ell +1$ does not depend on any of the variables $x_{n-k+1}, \ldots , x_n$; in other words, g is a polynomial in the $n-k$ variables $x_1, \ldots , x_{n-k}$. Since the space of fast points of order $\ell$ of g is $\langle e_{n-k+1}, \ldots , e_n \rangle$, this means that g has no non-trivial fast points when viewed as a function in the $n-k$ variables $x_1, \ldots , x_{n-k}$, so we have $[g] ^{(d-\ell )}\in {\mathrm F}^{(\ell )}(n-k,d;\{{\mathbf {0}}\})$. Conversely, any function in $n-k$ variables in ${\mathrm F}^{(\ell )}(n-k,d;\{{\mathbf {0}}\})$ can be viewed as a function in n variables and it has the required fast points to be in ${\mathrm F}^{(\ell )}(n,d;\langle e_{n-k+1}, \ldots , e_n \rangle )$. $\square$

We are now ready to count the functions which have a given space U (or any space of given dimension k) as their space of fast points of order 2.

Theorem 2

Let $0 \le d \le n$. For the cardinality of ${\mathrm F}^{(2)}( . ,d,0)$ (the set of functions of degree d with no fast points of order 2) we have the recurrence formula

$$\begin{aligned} \sum _{k=0}^{n-d} \genfrac[]{0.0pt}{}{n}{k} |{\mathrm F}^{(2)}(n-k,d;0)| = (2^{\left( {\begin{array}{c}n\\ d\end{array}}\right) } -1)2^{\left( {\begin{array}{c}n\\ d-1\end{array}}\right) } \end{aligned}$$

(7)

and the explicit formula

$$\begin{aligned} | {\mathrm F}^{(2)}(n,d;0)| = \sum _{i=0}^{n -d} (-1)^i 2^{\frac{i(i-1)}{2}} \genfrac[]{0.0pt}{}{n }{i} \left( 2^{ \left( {\begin{array}{c}n-i\\ d\end{array}}\right) } -1 \right) 2^{ \left( {\begin{array}{c}n-i\\ d-1\end{array}}\right) }. \end{aligned}$$

(8)

We also have, for any $0\le k \le n-d$ and any space U of dimension k:

$$\begin{aligned} |{\mathrm F}^{(2)}(n,d;U)|= & {} \sum _{i=0}^{n-k -d} (-1)^i 2^{\frac{i(i-1)}{2}} \genfrac[]{0.0pt}{}{n - k}{i} \left( 2^{ \left( {\begin{array}{c}n-k-i\\ d\end{array}}\right) } -1 \right) 2^{ \left( {\begin{array}{c}n-k-i\\ d-1\end{array}}\right) }, \end{aligned}$$

(9)

$$\begin{aligned} |{\mathrm F}^{(2)}(n,d;k)|= & {} \genfrac[]{0.0pt}{}{n}{k} \sum _{i=0}^{n-k -d} (-1)^i 2^{\frac{i(i-1)}{2}} \genfrac[]{0.0pt}{}{n - k}{i} \left( 2^{ \left( {\begin{array}{c}n-k-i\\ d\end{array}}\right) } -1 \right) 2^{ \left( {\begin{array}{c}n-k-i\\ d-1\end{array}}\right) }. \end{aligned}$$

(10)

Proof

For the recurrence relation, consider the set of functions of degree d in n variables. This set can be partitioned into subsets according to their space of fast points of order 2, i.e. each function f belongs to the set ${\mathrm F}^{(2)}(n,d;U)$ where U is the space of fast points of order 2 of f. This means

$$\begin{aligned} \bigcup _{U} {\mathrm F}^{(2)}(n,d;U) = \{ [f]^{(d-2)} : f \in B(n,d) \} \end{aligned}$$

where the union is over U ranging over all subspaces of ${{\mathbb {F}}}_2^n$ of dimension at most $n-d$ (recall that spaces of fast points can have dimension at most $n-d$). The cardinality of the set on the right hand side is $(2^{\left( {\begin{array}{c}n\\ d\end{array}}\right) } -1)2^{\left( {\begin{array}{c}n\\ d-1\end{array}}\right) }$, since for any class we can pick the representative which only has monomials of degree d and $d-1$; there are $\left( {\begin{array}{c}n\\ d\end{array}}\right)$ monomials of degree d, and each of them can have a coefficient of 0 or 1; however, the situation of all-zero coefficients is excluded as the degree of f must be d. There are $\left( {\begin{array}{c}n\\ d-1\end{array}}\right)$ monomials of degree $d-1$, each with coefficient 0 or 1 (this time with the possibility of all coefficients being 0). For computing the cardinality of the set on the left hand side, using the fact that the sets are disjoint we have:

$$\begin{aligned} |\bigcup _{U} {\mathrm F}^{(2)}(n,d;U)| = \sum _{U} |{\mathrm F}^{(2)}(n,d;U)| = \sum _{k=0}^{n-d} \sum _{\dim (U)=k} |{\mathrm F}^{(2)}(n,d;U)|. \end{aligned}$$

Using Corollary 1 and Lemma 4 and the fact that there are $\genfrac[]{0.0pt}{}{n}{k}$ subspaces of each dimension k,we have

$$\begin{aligned} |\bigcup _{U} {\mathrm F}^{(2)}(n,d;U)| = \sum _{k=0}^{n-d} \genfrac[]{0.0pt}{}{n}{k} |{\mathrm F}^{(2)}(n-k,d;0)| \end{aligned}$$

which completes the proof of the recurrence relation (7).

For the proof of the first explicit formula we rewrite (7) as

$$\begin{aligned} \sum _{k=0}^{n-d} \genfrac[]{0.0pt}{}{n}{k} |{\mathrm F}^{(2)}(n-k,d;0)|= & {} \sum _{k=0}^{n} \genfrac[]{0.0pt}{}{n}{n-k} |{\mathrm F}^{(2)}(n-k,d;0)|\\= & {} \sum _{k=0}^{n} \genfrac[]{0.0pt}{}{n}{k} |{\mathrm F}^{(2)}(k,d;0)|\\= & {} \big (2^{\left( {\begin{array}{c}n\\ d\end{array}}\right) } -1\big )2^{\left( {\begin{array}{c}n\\ d-1\end{array}}\right) } \end{aligned}$$

using the fact that $|{\mathrm F}^{(2)}(k,d;0)| = 0$ when $k<d$. This recurrence relation is of the type of equation (3) in Lemma 2, viewing d as fixed and putting $S(n) = \big (2^{\left( {\begin{array}{c}n\\ d\end{array}}\right) } -1\big )2^{\left( {\begin{array}{c}n\\ d-1\end{array}}\right) }$ and $T(n) = |{\mathrm F}^{(2)}(n,d;0)|$. Therefore, equation (4) in Lemma 2 gives the first explicit formula (8) in the theorem statement (with the summation going up to n, but then note that $S(n-i) =0$ for $n-d<i\le n$).

Alternatively, (8) could also be proven using the technique from the proof of [13, Theorem 6].

For the next explicit formula (9), we use Eq. (8), Corollary 1 and Lemma 4. Finally for the final formula (10) we use the fact that ${\mathrm F}^{(2)}(n,d;k) = \cup _U {\mathrm F}^{(2)}(n,d;U)$ where U ranges over all the $\genfrac[]{0.0pt}{}{n}{k}$ spaces of dimension k in ${{\mathbb {F}}}_2^n$ and the sets in the union are disjoint. $\square$

The Theorem above can be generalised to counting the functions which have a given space U (or any space of given dimension k) as their space of fast points of order $\ell$.

Theorem 3

Let $1\le \ell \le d$, $0\le k \le n-d$ and let U be a space of dimension k. Then

$$\begin{aligned} |{\mathrm F}^{(\ell )}(n,d;U)| = \sum _{i=0}^{n-k -d} (-1)^i 2^{\frac{i(i-1)}{2}} \genfrac[]{0.0pt}{}{n - k}{i} \left( 2^{ \left( {\begin{array}{c}n-k-i\\ d\end{array}}\right) } -1 \right) 2^{ \sum _{j=1}^{\ell -1}\left( {\begin{array}{c}n-k-i\\ d-j\end{array}}\right) } \end{aligned}$$

(11)

and

$$\begin{aligned} |{\mathrm F}^{(\ell )}(n,d;k)| = \genfrac[]{0.0pt}{}{n}{k} \sum _{i=0}^{n-k -d} (-1)^i 2^{\frac{i(i-1)}{2}} \genfrac[]{0.0pt}{}{n - k}{i} \left( 2^{ \left( {\begin{array}{c}n-k-i\\ d\end{array}}\right) } -1 \right) 2^{ \sum _{j=1}^{\ell -1}\left( {\begin{array}{c}n-k-i\\ d-j\end{array}}\right) }. \end{aligned}$$

(12)

Furthermore, the number of functions which have fast points of order $\ell$ (any number of non-trivial fast points of order $\ell$) is:

$$\begin{aligned}&|\{ [f]^{(d-\ell )} : f \in B(n,d), {\mathrm {FP}}^{(\ell )}(f) \ne \{\mathbf {0}\}\}| \nonumber \\&\quad = \sum _{i=1}^{n -d} (-1)^{i-1} 2^{\frac{i(i-1)}{2}} \genfrac[]{0.0pt}{}{n }{i} \left( 2^{ \left( {\begin{array}{c}n-i\\ d\end{array}}\right) } -1 \right) 2^{ \sum _{j=1}^{\ell -1}\left( {\begin{array}{c}n-i\\ d-j\end{array}}\right) }. \end{aligned}$$

(13)

Proof

As in the proof of Theorem 2, we have

$$\begin{aligned} \bigcup _{U} {\mathrm F}^{(\ell )}(n,d;U) = \{ [f]^{(d-\ell )} | f \in B(n,d) \} . \end{aligned}$$

as the set of functions of degree d in n variables can be partitioned into the sets ${\mathrm F}^{(\ell )}(n,d;U)$ with U ranging over all subspaces of ${{\mathbb {F}}}_2^n$ of dimension up to $n-d$. For the cardinality of the right hand side we have:

$$\begin{aligned} |\{ [f]^{(d-\ell )} : f \in B(n,d) \}| = \left( 2^{ \left( {\begin{array}{c}n\\ d\end{array}}\right) } -1 \right) 2^{ \sum _{j=1}^{\ell -1}\left( {\begin{array}{c}n\\ d-j\end{array}}\right) }. \end{aligned}$$

Using Corollary 1 and Lemma 4 for the cardinality of the left hand side we obtain:

$$\begin{aligned} |\bigcup _{U} {\mathrm F}^{(\ell )}(n,d;U)|= & {} \sum _{U} |{\mathrm F}^{(\ell )}(n,d;U)|\\= & {} \sum _{k=0}^{n-d} \sum _{\dim (U)=k} |{\mathrm F}^{(\ell )}(n,d;U)|\\= & {} \sum _{k=0}^{n-d} \genfrac[]{0.0pt}{}{n}{k} |{\mathrm F}^{(\ell )}(n-k,d;0)|. \end{aligned}$$

Putting these together we obtain the recurrence relation

$$\begin{aligned} \sum _{k=0}^{n-d} \genfrac[]{0.0pt}{}{n }{k} |{\mathrm F}^{(\ell )}(n-k,d;0)| = \left( 2^{ \left( {\begin{array}{c}n\\ d\end{array}}\right) } -1 \right) 2^{ \sum _{j=1}^{\ell -1}\left( {\begin{array}{c}n\\ d-j\end{array}}\right) } \end{aligned}$$

which we solve using Lemma 2 to obtain

$$\begin{aligned} |{\mathrm F}^{(\ell )}(n,d;0)| = \sum _{i=0}^{n -d} (-1)^i 2^{\frac{i(i-1)}{2}} \genfrac[]{0.0pt}{}{n }{i} \left( 2^{ \left( {\begin{array}{c}n-i\\ d\end{array}}\right) } -1 \right) 2^{ \sum _{j=1}^{\ell -1}\left( {\begin{array}{c}n-i\\ d-j\end{array}}\right) }. \end{aligned}$$

Using this formula and Lemma 4, we then obtain (11) and (12).

For Eq. (13) we have:

$$\begin{aligned}&|\{ [f]^{(d-\ell )} : f \in B(n,d), {\mathrm {FP}}^{(\ell )}(f) \ne \{{\mathbf {0}}\}\}| \\&\quad = |\{ [f]^{(d-\ell )} : f \in B(n,d) \} \setminus {\mathrm F}^{(\ell )}(n,d;0) | \\&\quad = \left( 2^{ \left( {\begin{array}{c}n\\ d\end{array}}\right) } -1 \right) 2^{ \sum _{j=1}^{\ell -1}\left( {\begin{array}{c}n\\ d-j\end{array}}\right) } - \sum _{i=0}^{n -d} (-1)^i 2^{\frac{i(i-1)}{2}} \genfrac[]{0.0pt}{}{n }{i} \left( 2^{ \left( {\begin{array}{c}n-i\\ d\end{array}}\right) } -1 \right) 2^{ \sum _{j=1}^{\ell -1}\left( {\begin{array}{c}n-i\\ d-j\end{array}}\right) }\\&\quad = \sum _{i=1}^{n -d} (-1)^{i-1} 2^{\frac{i(i-1)}{2}} \genfrac[]{0.0pt}{}{n }{i} \left( 2^{ \left( {\begin{array}{c}n-i\\ d\end{array}}\right) } -1 \right) 2^{ \sum _{j=1}^{\ell -1}\left( {\begin{array}{c}n-i\\ d-j\end{array}}\right) }. \end{aligned}$$

$\square$

4 Applications

As a first application of these counting results, we can determine the number of functions which have linear structures. An element $a\in {{\mathbb {F}}}_2^n\setminus \{{\mathbf {0}}\}$ is a linear structure for a function f if $D_a f$ is a constant function. With our definition, a linear structure for f is a fast point of order $\deg (f)-1$. Therefore, applying Theorem 3 we have:

Corollary 2

The number of functions of degree d in n variables which have linear structures is:

$$\begin{aligned} \sum _{i=1}^{n -d} (-1)^{i-1} 2^{\frac{i(i-1)}{2}} \genfrac[]{0.0pt}{}{n }{i} \left( 2^{ \left( {\begin{array}{c}n-i\\ d\end{array}}\right) } -1 \right) 2^{ \sum _{j=1}^{d-2}\left( {\begin{array}{c}n-i\\ d-j\end{array}}\right) }. \end{aligned}$$

where the functions are counted up to addition of an affine function.

Example 1

Let $n=7, d=3$. We compute the number of functions of degree 3 in 7 variables which have fast points of order 2, i.e. they have linear structures. Using Corollary 2, this number is:

$$\begin{aligned} \sum _{i=1}^{4} (-1)^{i-1} 2^{\frac{i(i-1)}{2}} \genfrac[]{0.0pt}{}{7 }{i} \left( 2^{ \left( {\begin{array}{c}7-i\\ 3\end{array}}\right) } -1 \right) 2^{ \left( {\begin{array}{c}7-i\\ 2\end{array}}\right) } = 4{,}358{,}179{,}630{,}080. \end{aligned}$$

Note the counting is done up to equivalence ${\mathop {\sim }\limits ^{(1)}}$ i.e. up to addition of affine functions. The remaining

$$\begin{aligned} \left( 2^{ \left( {\begin{array}{c}7\\ 3\end{array}}\right) } -1 \right) 2^{ \left( {\begin{array}{c}7\\ 2\end{array}}\right) } - 4{,}358{,} 179{,}630{,}080= & {} 72{,}057{,}594{,}035{,}830{,}784 - 4{,}358{,}179{,}630{,}080 \\= & {} 72{,}053{,}235{,}856{,}200{,}704 \end{aligned}$$

functions have no linear structures. We can also compute the number of functions with no fast points of order 2 directly using Theorem 2:

$$\begin{aligned} |{\mathrm F}^{(2)}(7,3;0)|= & {} \sum _{i=0}^{4} (-1)^i 2^{\frac{i(i-1)}{2}} \genfrac[]{0.0pt}{}{7 }{i} \left( 2^{ \left( {\begin{array}{c}7-i\\ 3\end{array}}\right) } -1 \right) 2^{ \left( {\begin{array}{c}7-i\\ 2\end{array}}\right) } = 72{,}053{,}235{,}856{,}200{,}704. \end{aligned}$$

The proportion of functions which have linear structures out of all functions of degree 3 in 7 variables is

$$\begin{aligned} \frac{4{,}358{,}179{,}630{,}080}{72{,}057{,}594{,}035{,}830{,}784} \approx 0.000061035. \end{aligned}$$

In other words, if we pick a function of degree 3 in 7 variables uniformly at random, the probability that it has a linear structure is approximately 0.00006.

As a second application of our counting results we estimate various probabilities for functions to have faster points (in particular, to have linear structures), similar to the estimates in [13].

Proposition 1

Assume a function f is chosen uniformly at random among the functions of degree d in n variables. Let $1 \le \ell \le d$.

The probability that f has at least one fast point of order $\ell$ is

$$\begin{aligned}&\frac{|\{ [f]^{(d-\ell )} : f \in B(n,d), {\mathrm {FP}}^{(\ell )}(f) \ne \{{\mathbf {0}}\}\}|}{|\{ [f]^{(d-\ell )} : f \in B(n,d)\}|} \\&\quad = \sum _{i=1}^{n -d} (-1)^{i-1} 2^{\frac{i(i-1)}{2}} \genfrac[]{0.0pt}{}{n}{i} \frac{2^{\left( {\begin{array}{c}n-i\\ d\end{array}}\right) } -1}{2^{\left( {\begin{array}{c}n\\ d\end{array}}\right) } -1} 2^{ \sum _{j=1}^{\ell -1}\big (\left( {\begin{array}{c}n-i\\ d-j\end{array}}\right) - \left( {\begin{array}{c}n\\ d-j\end{array}}\right) \big )}. \end{aligned}$$

When $d-\ell \ge 2$ and $n- d \ge 3$, this can be approximated as

$$\begin{aligned} \frac{1}{2^{-n+\sum _{j=1}^{\ell }\left( {\begin{array}{c}n-1\\ d-j\end{array}}\right) }} \end{aligned}$$

(14)

The conditional probability that f has at least one fast point of order $\ell$ knowing that it does have fast points of order $\ell -1$ (for $\ell >1$) is

$$\begin{aligned}&\frac{|\{ [f]^{(d-\ell )} : f \in B(n,d), {\mathrm {FP}}^{(\ell )}(f) \ne \{{\mathbf {0}}\}\}|}{|\{ [f]^{(d-\ell )} : f \in B(n,d), {\mathrm {FP}}^{(\ell -1)}(f) \ne \{{\mathbf {0}}\}\}|} \\&\quad = \frac{\sum _{i=1}^{n -d} (-1)^{i-1} 2^{\frac{i(i-1)}{2}} \genfrac[]{0.0pt}{}{n }{i} \left( 2^{ \left( {\begin{array}{c}n-i\\ d\end{array}}\right) } -1 \right) 2^{ \sum _{j=1}^{\ell -1}\left( {\begin{array}{c}n-i\\ d-j\end{array}}\right) }}{2^{\left( {\begin{array}{c}n\\ d-\ell +1\end{array}}\right) }\sum _{i=1}^{n -d} (-1)^{i-1} 2^{\frac{i(i-1)}{2}} \genfrac[]{0.0pt}{}{n }{i} \left( 2^{ \left( {\begin{array}{c}n-i\\ d\end{array}}\right) } -1 \right) 2^{ \sum _{j=1}^{\ell -2}\left( {\begin{array}{c}n-i\\ d-j\end{array}}\right) }} \end{aligned}$$

When $d-\ell \ge 2$ and $n- d \ge 3$, this can be approximated as

$$\begin{aligned} \frac{1}{2^{\left( {\begin{array}{c}n-1\\ d-\ell \end{array}}\right) }} \end{aligned}$$

Proof

For the first equation, we use Theorem 3 and the fact that

$$\begin{aligned} |\{ [f]^{(d-\ell )} : f \in B(n,d)| = \left( 2^{\left( {\begin{array}{c}n\\ d\end{array}}\right) } -1\right) 2^{\sum _{j=1}^{\ell -1}\left( {\begin{array}{c}n\\ d-j\end{array}}\right) }. \end{aligned}$$

For the second equation, note that in the denominator we have equivalence classes $[f]^{(d-\ell )}$ for fast points of order $\ell -1$, so we need to multiply by $2^{\left( {\begin{array}{c}n\\ d-\ell +1\end{array}}\right) }$ the result obtained by replacing $\ell$ by $\ell -1$ in (13).

For the approximations, we note that in the sum (13), the terms have alternating signs and decrease rapidly in absolute value, so the sum can be approximated by its first term. Namely, the ratio of the absolute values of term $i+1$ to the term i is:

$$\begin{aligned} \frac{2^{\frac{i(i+1)}{2}} \genfrac[]{0.0pt}{}{n }{i+1} \left( 2^{ \left( {\begin{array}{c}n-i-1\\ d\end{array}}\right) } -1 \right) 2^{ \sum _{j=1}^{\ell -1}\left( {\begin{array}{c}n-i-1\\ d-j\end{array}}\right) }}{2^{\frac{i(i-1)}{2}} \genfrac[]{0.0pt}{}{n }{i} \left( 2^{ \left( {\begin{array}{c}n-i\\ d\end{array}}\right) } -1 \right) 2^{ \sum _{j=1}^{\ell -1}\left( {\begin{array}{c}n-i\\ d-j\end{array}}\right) }}= & {} \frac{2^i(2^{n-i}-1) \big (2^{\left( {\begin{array}{c}n-i-1\\ d\end{array}}\right) }-1\big )}{(2^{i+1}-1)\big (2^{\left( {\begin{array}{c}n-i\\ d\end{array}}\right) }-1\big ) 2^{ \sum _{j=1}^{\ell -1}\big (\left( {\begin{array}{c}n-i\\ d-j\end{array}}\right) -\left( {\begin{array}{c}n-i-1\\ d-j\end{array}}\right) \big )}} \\= & {} \frac{2^i(2^{n-i}-1) \big (2^{\left( {\begin{array}{c}n-i-1\\ d\end{array}}\right) }-1\big )}{(2^{i+1}-1)\big (2^{\left( {\begin{array}{c}n-i\\ d\end{array}}\right) }-1\big ) 2^{ \sum _{j=1}^{\ell -1}\left( {\begin{array}{c}n-i-1\\ d-j-1\end{array}}\right) }} \\\approx & {} \frac{1}{2^{-n+i+1+\sum _{j=0}^{\ell -1}\left( {\begin{array}{c}n-i-1\\ d-j-1\end{array}}\right) }} \end{aligned}$$

which is negligible provided $d-\ell \ge 2$ and $n- d \ge 3$. $\square$

Example 2

For the computation in Example 1 above, if we use instead Proposition 1 (14) to estimate the probability of a function of degree 3 in 7 variables to have a linear structure we obtain:

$$\begin{aligned} \frac{1}{2^{-7+\left( {\begin{array}{c}6\\ 2\end{array}}\right) +\left( {\begin{array}{c}6\\ 1\end{array}}\right) }} = \frac{1}{2^{14}} \end{aligned}$$

which has an error of less than 1% compared to the precise value computed in Example 1.

5 Counting the number of functions with a given profile of fast points of different orders

Next we will refine the counting so that we can count functions where the spaces of fast points of each order are specified. For ${{\mathbb {F}}}_2$-linear subspaces of the form ${{\mathbb {F}}}_2^n \supseteq U_1 \supseteq U_2 \cdots \supseteq U_{\ell } \supseteq \{{\mathbf {0}}\}$ with $1\le \ell \le d$ we denote

$$\begin{aligned} {\mathrm F}^{(\ell )}(n,d;U_1, U_2, \ldots , U_{\ell })=\{[f]^{(d-\ell )}: f \in {\mathrm {BF}}(n,d), \; {\mathrm {FP}}^{(i)}(f)=U_i \; \text{ for } \; 1 \le i \le \ell \}. \end{aligned}$$

More generally, keeping in mind that the dimensions of the spaces of fast points of each order for a function f are affine invariants (see Lemma 3), we define for integers $n - d \ge k_1 \ge k_2 \ge \cdots \ge k_{\ell } \ge 0$:

$$\begin{aligned} {\mathrm F}^{(\ell )}(n,d;k_1, k_2, \ldots , k_{\ell }) = \{[f]^{(d-\ell )}: f \in {\mathrm {BF}}(n,d), \; \dim ({\mathrm {FP}}^{(i)}(f))=k_i \; \text{ for } \; 1 \le i \le \ell \}. \end{aligned}$$

We will determine the cardinalities of the sets above. Similarly to Corollary 1 we have

$$\begin{aligned} |{\mathrm F}^{(\ell )}(n,d;U_1, U_2, \ldots , U_{\ell })| = |{\mathrm F}^{(\ell )}(n,d;W_{k_1}, W_{k_2}, \ldots , W_{k_\ell })| \end{aligned}$$

(15)

where $k_i = \dim (U_i)$ and $W_{k_i} =\langle e_{n-k_i+1}, \ldots e_n\rangle$, with $e_i$ being the canonical basis vectors and $W_0=\{{\mathbf {0}}\}$ by convention.

Let us examine an element $f\in {\mathrm F}^{(\ell )}(n,d;W_{k_1}, W_{k_2}, \ldots , W_{k_\ell })$. We can assume that the representative f only contains monomials of degree $d, d-1, \ldots , d-\ell +1$. Write $f = f_d + f_{d-1} + \ldots f_{d-\ell +1}$, with each $f_i$ containing only monomials of degree i (i.e. $f_i$ is the homogeneous part of degree i of f). Using Lemma 1(iv) we see that $f_d$ does not contain any of the variables $x_{n-k_1+1}, \ldots , x_n$; $f_{d-1}$ does not contain any of the variables $x_{n-k_2+1}, \ldots , x_n$ etc. Moreover $f_d$ does not have any fast points (of any order) when viewed as a function in $n-{k_1}$ variables. For $f_{d-1}$ the situation is less straightforward; when viewed as a function in $n-k_2$ variables, it can have fast points, but any such points have to be outside $\langle e_{n-k_1+1}, \ldots e_{n-k_2} \rangle$.

We will therefore need to count functions which do not have fast points within a certain specified space. We define $X_k(n,d)$ with $0\le k \le d\le n$ as the set of functions f of degree d in n variables such that none of the non-zero elements of the space $W_k$ is a fast point for f (note that f may have non-trivial fast points, but only if they are outside $W_k$). We also include $f=0$ in the set $X_k(n,d)$. More precisely:

$$\begin{aligned} X_k(n,d) = \{[f]^{(d-1)}: f \in {\mathrm {BF}}(n,d) \; \text{ and } \; {\mathrm {FP}}^{(1)}(f) \cap W_k = \{ {\mathbf {0}} \}\}\cup \{[0]^{(d-1)}\}. \end{aligned}$$

The cardinality of the set $X_k(n,d)$ would remain the same if in the definition of $X_k(n,d)$ we replace the space $W_k$ by any space U of dimension k:

$$\begin{aligned} |X_k(n,d)|= |\{[f]^{(d-1)}: f \in {\mathrm {BF}}(n,d) \; \text{ and } \; {\mathrm {FP}}^{(1)}(f) \cap U = \{ {\mathbf {0}} \}\}\cup \{[0]^{(d-1)}\}|. \end{aligned}$$

(16)

One can generalise this further by fixing two spaces $U_1\subseteq U_0$ and considering the functions f with the property that the points in $U_1$ are fast points of f but no other points of $U_0$ are fast points of f. Note that we do not care how many fast points f has outside $U_0$. The cardinality of this set can be expressed using the sets $X_k(n,d)$ as follows:

Lemma 5

Let $U_1\subseteq U_0$ be two subspaces of ${{\mathbb {F}}}_2^n$ of dimension $k_1$ and $k_0$ respectively.

$$\begin{aligned} |\{[f]^{(d-1)}: f \in {\mathrm {BF}}(n,d) \; \text{ and } \; {\mathrm {FP}}^{(1)}(f) \cap U_0 = U_1\}\cup \{[0]^{(d-1)}\}| = |X_{k_0-k_1}(n-k_1,d)| \end{aligned}$$

Proof

Let us first consider the particular case $U_0 = W_{k_0}$ and $U_1 = W_{k_0}$. Let f be a function such that ${\mathrm {FP}}^{(1)}(f) \cap U_0 = U_1$. Since we are only interested in the equivalence class $[f]^{(d-1)}$, we can assume f only contains monomials of degree d. Since the elements of $U_1$ are fast points for f, by Lemma 1(iv) this means f does not contain any of the variables $x_{n-k_1+1}, \ldots , x_{n}$; it is a polynomial in the remaining $n-k_1$ variables $x_1, \ldots , x_{n-k_1}$. We now determine ${\mathrm {FP}}^{(1)}(f) \cap V$ where $V = \langle e_{n-k_0+1}, \ldots e_{n-k_1}\rangle$. Since we have ${\mathrm {FP}}^{(1)}(f) \cap V \subseteq {\mathrm {FP}}^{(1)}(f) \cap U_0 = U_1$, we deduce ${\mathrm {FP}}^{(1)}(f) \cap V \subseteq U_1\cap V = \{ {\mathbf {0}} \}$. Hence $[f]^{(d-1)}\in X_{k_0-k_1}(n-k_1,d)$.

Conversely, let f be such that $[f]^{(d-1)}\in X_{k_0-k_1}(n-k_1,d)$. We can view f as a function in n variables, i.e. we can define a function g as $g(x_1,\ldots , x_n) = f(x_1, \ldots , x_{n-k_1})$. Since g does not depend on $x_{n-k_1+1}, \ldots , x_{n}$, we have that $U_1 \subseteq {\mathrm {FP}}^{(1)}(g)$. On the other hand, ${\mathrm {FP}}^{(1)}(g)\cap V = \{ {\mathbf {0}}\}$ because $[f]^{(d-1)}\in X_{k_0-k_1}(n-k_1,d)$. Therefore ${\mathrm {FP}}^{(1)}(g) \cap U_0 = U_1$.

For the general case, consider a basis $a_{n-k_0+1}, \ldots , a_{n}$ for $U_0$ such that $a_{n-k_1+1}, \ldots , a_{n}$ is a basis for $U_1$. Consider an affine transformation $\varphi : {{\mathbb {F}}}_2^n \rightarrow {{\mathbb {F}}}_2^n$ such that $\varphi (e_i) = a_i$ for $i=n-k_0+1, \ldots , n$. Let f be such that ${\mathrm {FP}}^{(1)}(f) \cap U_0 = U_1$. By Lemma 1, this happens iff $f\circ \varphi$ is such that ${\mathrm {FP}}^{(1)}(f\circ \varphi ) \cap \varphi ^{-1}(U_0) = \varphi ^{-1}(U_1)$, i.e. ${\mathrm {FP}}^{(1)}(f\circ \varphi ) \cap W_{k_0} = W_{k_1}$. We then use the first part of the proof. $\square$

Proposition 2

The following formula holds:

$$\begin{aligned} \displaystyle \sum _{i=0}^{k} \genfrac[]{0.0pt}{}{k}{i} |X_{k-i}(n-i,d)| = \displaystyle 2^{\genfrac(){0.0pt}{}{n}{d}}. \end{aligned}$$

Therefore for each fixed d we can obtain $|X_k(n,d)|$ by the following recursive formulae (recursion on both k and n):

$$\begin{aligned} |X_k(n,d)| = 2^{\genfrac(){0.0pt}{}{n}{d}} - \sum _{i=1}^{k} \genfrac[]{0.0pt}{}{k}{i} |X_{k-i}(n-i,d)| \end{aligned}$$

with initial conditions $|X_0(n,d)| =2^{\genfrac(){0.0pt}{}{n}{d}}$.

Proof

For $k=0$, we obviously have $X_0(n,d) = \{[f]^{(d-1)}: f \in {\mathrm {BF}}(n,d)\}\cup \{0\}$ so $|X_0(n,d)|=2^{\genfrac(){0.0pt}{}{n}{d}}$. For arbitrary k we have:

$$\begin{aligned}&\{[f]^{(d-1)}: f \in {\mathrm {BF}}(n,d)\cup \{0\}\} \\&\quad = \bigcup _{V\subseteq W_k} \{[f]^{(d-1)}: f \in {\mathrm {BF}}(n,d) \; \text{ and } \; {\mathrm {FP}}^{(1)}(f) \cap W_k = V\}\cup \{[0]^{(d-1)}\} \end{aligned}$$

where V ranges over all subspaces of $W_k$; for each dimension i there are $\genfrac[]{0.0pt}{}{k}{i}$ such spaces. Note that the sets in the union are pairwise disjoint and by Lemma 5 they have $|X_{k-\dim (V)}(n- \dim (V), d)|$ elements each, so

$$\begin{aligned} 2^{\genfrac(){0.0pt}{}{n}{d}} = \sum _{i=0}^{k} \genfrac[]{0.0pt}{}{k}{i} |X_{k-i}(n-i,d)|. \end{aligned}$$

$\square$

Proposition 3

The following explicit formulae for $|X_k(n,d)|$ hold:

$$\begin{aligned} |X_k(n,d)| = \sum _{i=0}^k (-1)^{i} 2^{\frac{i(i-1)}{2}} \genfrac[]{0.0pt}{}{k}{i} 2^{\left( {\begin{array}{c}n-i\\ d\end{array}}\right) } \end{aligned}$$

(17)

and

$$\begin{aligned} |X_k(n,d)| = \sum _{i=0}^{n-k} 2^{ik} \genfrac[]{0.0pt}{}{n-k}{i} |{\mathrm F}^{(1)}(n-i,d,0)| \end{aligned}$$

(18)

Proof

For the first formula, the recurrence relation from Proposition 2 becomes, after replacing the index of summation by $j = k - i$

$$\begin{aligned} \displaystyle \sum _{j=0}^{k} \genfrac[]{0.0pt}{}{k}{j} |X_{j}(n-k+j,d)| = \displaystyle 2^{\genfrac(){0.0pt}{}{n-k+k}{d}}. \end{aligned}$$

It then satisfies the conditions from Eq. (3) in Lemma 2, considering d and $n-k$ fixed and putting $T(j) = |X_{j}(n-k+j, d)|$ and $S(j) = 2^{\genfrac(){0.0pt}{}{n-k+j}{d}}$. Equation (4) in Lemma 2 gives then the first explicit formula.

Alternatively, we could have used the same technique as in the proof of [13, Theorem 6].

For the second formula in the theorem statement we use a different approach, counting the cardinality of $X_k(n,d)$ directly. First let us count the number of subspaces V of ${{\mathbb {F}}}_2^n$ of dimension i such that $V\cap W_k = \{ {\mathbf {0}}\}$. This latter condition implies $0\le i \le n-k$. To pick a basis $v_1, \ldots , v_i$ for such a space V we have $2^n-2^k$ possibilities to pick $v_1\in {{\mathbb {F}}}_2^n \setminus W_k$, then $2^n-2^{k+1}$ possibilities to pick $v_2\in {{\mathbb {F}}}_2^n \setminus \langle W_k, v_1\rangle$ etc. However, this way each space V ends up being counted $(2^i-1)(2^{i}-2)\cdots (2^n-2^{i-1})$ times (the number of bases of V, taking into account the ordering of the basis elements). So altogether the number of spaces is

$$\begin{aligned} \frac{(2^n-2^{k})(2^n-2^{k+1})\cdots (2^n-2^{k+i-1})}{(2^i-1)(2^{i}-2^1)\cdots (2^i-2^{i-1})} = 2^{ik}\genfrac[]{0.0pt}{}{n-k}{i} \end{aligned}$$

For each such space V, there are $|{\mathrm F}^{(1)}(n,d;V)| = |{\mathrm F}^{(1)}(n-i,d;0)|$ functions which have V as their set of fast points. Putting everything together we obtain formula (18). $\square$

We can now move to determining the number of functions with prescribed spaces (or prescribed dimensions of spaces) of fast points of each order.

Theorem 4

Let $1\le \ell \le d \le n$ and $n-d \ge k_1 \ge k_2 \ge \cdots \ge k_{\ell } \ge 0$, and let vector spaces $U_1\supseteq U_2 \supseteq \cdots \supseteq U_{\ell }$, with $k_i = \dim (U_i)$. Put $k_0=n$. We have

$$\begin{aligned}&| {\mathrm F}^{(\ell )}(n,d; U_1, \ldots , U_{\ell })| \\&\quad = |{\mathrm F}^{(1)}(n-k_1,d; 0)| \prod _{i=1}^{\ell -1} |X_{k_i - k_{i+1}}(n-k_{i+1}, d-i)| \end{aligned}$$

and

$$\begin{aligned}&|\displaystyle {\mathrm F}^{(\ell )}(n,d; k_1, k_2, \cdots , k_{\ell }) | \\&\quad = |{\mathrm F}^{(1)}(n-k_1,d; 0)| \left( \prod _{i=1}^{\ell }\genfrac[]{0.0pt}{}{k_{i-1}}{k_i}\right) \left( \prod _{i=1}^{\ell -1} |X_{k_i - k_{i+1}}(n-k_{i+1}, d-i)| \right) \end{aligned}$$

where $|{\mathrm F}^{(1)}(\ )|$ is computed using Theorem 1 and $|X(\ )|$ are computed using Proposition 3.

Proof

We continue the proof started at the beginning of this section. By Eq. (15) it suffices to deal with the case when $U_i=W_{k_i}$ for $i=1, \ldots , \ell$. For any class $[f]^{(d-\ell )}$ we can assume that all the monomials of f have degrees between d and $d-\ell +1$ inclusive. Write f as $f = f_d + f_{d-1} + \cdots + f_{d-\ell +1}$ where each $f_i$ is a homogeneous polynomial of degree i; for $i<d$, $f_i$ can also be zero.

We will show that $[f]^{(d-\ell )} \in {\mathrm F}^{(\ell )}(n,d; W_{k_1}, \ldots , W_{k_\ell })$ iff $f_d \in {\mathrm F}^{(1)}(n,d; W_{k_1})$ and $f_{d-i+1} \in \{[g]^{(d-i)}: f \in {\mathrm {BF}}(n,d)\; \text{ and } \; {\mathrm {FP}}^{(1)}(g) \cap W_{k_{i-1}} = W_{k_i}\}\cup \{ [0]^{(d-i)} \}$ for $i=2,\ldots ,\ell$. The counting formula will then follow using Lemma 5.

For the direct implication, let $[f]^{(d-\ell )} \in {\mathrm F}^{(\ell )}(n,d; W_{k_1}, \ldots , W_{k_\ell })$, i.e. ${\mathrm {FP}}^{(i)}f = W_{k_i}$ for $i=1, \ldots \ell$. By Lemma 1(iv), we have that $f_{d-i+1}$ does not contain the variables $x_{n-k_i+1}, \ldots , x_n$. If $f_d$ had any fast points of order 1 outside $W_{k_1}$, then those would also be fast points of order 1 for f, so indeed we must have ${\mathrm {FP}}^{(1)}(f_d) = W_{k_1}$. Now let us examine $f_{d-i+1}$ for $i>1$. If $f_{d-i+1}=0$ we are done. Otherwise, since $f_{d-i+1}$ does not contain the variables $x_{n-k_i+1}, \ldots , x_n$, we have that $W_{k_i}\subseteq {\mathrm {FP}}^{(1)}(f_{d-i+1})$. Assume $a \in {\mathrm {FP}}^{(1)}(f_{d-i+1}) \cap W_{k_{i-1}}$. We have

$$\begin{aligned} D_{a}f= & {} D_{a}f_{d} + \cdots +D_{a}f_{d-i+2} +D_{a}f_{d-i+1} +D_{a}f_{d-i} +\cdots + D_{a}f_{d-\ell +1} \nonumber \\= & {} D_{a}f_{d-i+1} +D_{a}f_{d-i} +\cdots + D_{a}f_{d-\ell +1} \end{aligned}$$

(19)

since $a\in W_{k_{i-1}}$ and the first i functions do not contain the variables $x_{n-k_{i-1}+1}, \ldots , x_n$. Therefore, $\deg (D_{a}f_{d-i+1} )< \deg (f_{d-i+1})-1 =d-i$ iff $\deg (D_{a}f)<d-i$ iff $a\in {\mathrm {FP}}^{(i)}(f) = W_{k_{i}}$.

For the reverse implication, assume f is such that ${\mathrm {FP}}^{(1)}(f_d) = W_{k_1}$ and $f_{d-i+1}$ are such that either $f_{d-i+1}=0$ or ${\mathrm {FP}}^{(1)}(f_{d-i+1}) \cap W_{k_{i-1}} = W_{k_i}$. We have to show ${\mathrm {FP}}^{(i)}(f) = W_{k_i}$ for $i=1, \ldots \ell$. Since $W_{k_i} \subseteq {\mathrm {FP}}^{(1)}(f_{d-i+1})$ for $i=1, \ldots , \ell$, we know that $f_{d-i+1}$ does not contain the variables $x_{n-k_i+1}, \ldots , x_n$, so we have $W_{k_i}\subseteq {\mathrm {FP}}^{(i)}(f)$. Now let $a\in {\mathrm {FP}}^{(i)}(f)$. By induction on i we show that $a\in W_{k_i}$. For $i=1$ we have that a is a fast point of order 1 for f, which means it is also a fast point of order 1 for $f_d$, so $a\in {\mathrm {FP}}^{(1)}(f_d) = W_{k_1}$. For the inductive step, note that if a is a fast point of order i for f, then it is also a fast point of order $i-1$, so by the induction hypothesis $a\in W_{k_{i-1}}$. Therefore, as in (19), a is a fast point of order i for f iff $f_{d-i+1}=0$ or a is a fast point of order 1 for $f_{d-i+1}$, hence $a\in W_{k_{i-1}}\cap {\mathrm {FP}}^{(1)}(f_{d-i+1}) = W_{k_{i}}$. $\square$

We therefore have now an alternative to Theorem 2 for computing ${\mathrm F}^{(2)}(n,d;0)$:

Corollary 3

$$\begin{aligned} |{\mathrm F}^{(2)}(n,d;0)| = \sum _{k=0}^{n -d} \genfrac[]{0.0pt}{}{n }{k} X_k(n, d-1) |{\mathrm F}^{(1)}(n-k, d, 0)| \end{aligned}$$

Proof

Use Theorem 4 combined with

$$\begin{aligned} {\mathrm F}^{(2)}(n,d;0)= \bigcup _{U} {\mathrm F}^{(2)}(n-k, d; U, 0) \end{aligned}$$

where U ranges over all subspaces of ${{\mathbb {F}}}_2^n$; the sets in the union are disjoint. $\square$

Example 3

Let $n=7, d=3$. We compute the number of functions (up to equivalence) of degree 3 in 7 variables which have no fast points of order 2 using Corollary 3:

$$\begin{aligned} |{\mathrm F}^{(2)}(7,3;0)|= \sum _{k=0}^{4} \genfrac[]{0.0pt}{}{7 }{k} X_k(7, 2) |{\mathrm F}^{(1)}(7-k, 3, 0)| \end{aligned}$$

Using the values of $|{\mathrm F}^{(1)}(7-k, 3, 0)|$ computed in [13], we obtain 72, 053, 235, 856, 200, 704, same as in Example 1.

6 Conclusion

Motivated by the properties of cryptographic functions exploited by differential attacks, Duan and Lai [6] introduced the notion of Boolean functions that admit “fast points”. We generalised this notion, defining functions f which have “fast points of order $\ell$” i.e. the degree of at least one of the discrete derivatives of f is lower by $\ell$ than the expected value (i.e. it is $d-1-\ell$ or less, instead of the expected $d-1$, where d is the algebraic degree of f). We obtained explicit formulae for the number of such functions of degree d in n variables. As an important particular case, this allowed us to compute the number of functions which admit a linear structure. Moreover, we computed the number of functions which have a given profile in terms of the number of fast points of each order.