Value Distributions of Perfect Nonlinear Functions

Abstract

In this paper, we study the value distributions of perfect nonlinear functions, i.e., we investigate the sizes of image and preimage sets. Using purely combinatorial tools, we develop a framework that deals with perfect nonlinear functions in the most general setting, generalizing several results that were achieved under specific constraints. For the particularly interesting elementary abelian case, we derive several new strong conditions and classification results on the value distributions. Moreover, we show that most of the classical constructions of perfect nonlinear functions have very specific value distributions, in the sense that they are almost balanced. Consequently, we completely determine the possible value distributions of vectorial Boolean bent functions with output dimension at most 4. Finally, using the discrete Fourier transform, we show that in some cases value distributions can be used to determine whether a given function is perfect nonlinear, or to decide whether given perfect nonlinear functions are equivalent.

1 Introduction

Let G and H be two additively written finite groups. A mapping $L:G\rightarrow H$ is called a homomorphism if $L(x+a)-L(x)=L(a)$ for all $x, a \in G$. Homomorphisms $L:G\rightarrow H$ are essentially linear mappings between the finite groups G and H, which can be equivalently characterized by the property

$$\begin{aligned} |\{x \in G:L(x+a)-L(x)=b\}| \in \{0, |G|\}. \end{aligned}$$

In this article, we consider functions $F:G \rightarrow H$ which are as far as possible from all homomorphisms; such functions can be introduced with the notion of perfect nonlinearity as follows [27]. A function $F:G \rightarrow H$ is said to be perfect nonlinear (or simply bent) if

$$\begin{aligned} |\{x \in G:F(x+a)-F(x)=b\}|=\frac{|G|}{|H|} \quad \text{ holds } \text{ for } \text{ all } a \in G \setminus \{0\}\quad \text{ and } \quad b \in H. \end{aligned}$$

In general, the terms “perfect nonlinear” and “bent” are considered to be synonymous. However, in this paper, we will use the term “bent” for mappings between two elementary abelian groups. Bent functions considered in this setting play a very important role in finite geometry (they give rise to commutative semifields [13]), combinatorics (one can use them to construct skew Hadamard difference sets [11]), and applications due to their rich connections to coding theory and cryptography [2, 21].

1.1 Preliminaries

Let G and H be two finite groups and let $F:G\rightarrow H$ be a function. For an element $\beta \in H$, we denote by $F^{-1}(\beta )$ the preimage set of $\beta$. By value distribution of the function $F:G\rightarrow H$ we understand the multiset $\{*\, |F^{-1}(\beta )| :\beta \in H \, *\}$. We use no special notation for this multiset, since determining the value distribution just boils down to determining the sizes of all preimages.

In the following, we will frequently consider functions $F:G\rightarrow H$, where G and H are two elementary abelian groups. In this case, we use the notation $G=\mathbb F_p^n$ and $H=\mathbb F_p^m$, where $\mathbb F_p$ is the finite field with p elements and $\mathbb F_p^n$ is the vector space of dimension n over the prime field $\mathbb F_p$. For $x=(x_1,\ldots ,x_n),y=(y_1,\ldots ,y_n)\in \mathbb F_p^n$, we define the scalar product of $\mathbb F_p^n$ by $\langle x,y\rangle _n=x_1y_1+\cdots +x_ny_n$. If necessary, we endow the vector space $\mathbb F_p^n$ with the structure of the finite field $\mathbb F_{p^{n}}$; in this case, we define the scalar product of $\mathbb F_{p^n}$ by $\langle x,y\rangle _n={{\,\textrm{Tr}\,}}(xy)$, where ${{\,\textrm{Tr}\,}}(z):={{\,\textrm{Tr}\,}}_1^n(z)$ is the absolute trace and ${{\,\textrm{Tr}\,}}^n_m(z)=\sum _{i=0}^{\frac{n}{m}-1} z^{p^{i\cdot m}}$ is the relative trace of $z \in \mathbb {F}_{p^n}$ from $\mathbb {F}_{p^n}$ into the subfield $\mathbb {F}_{p^m}$. If $n=2k$ is even, the vector space $\mathbb F_p^n$ can be identified with $\mathbb {F}_{p^k} \times \mathbb {F}_{p^k}$; in this case, we define the scalar product $\left\langle \left( u_1, u_2\right) ,\left( v_1, v_2\right) \right\rangle _n={\text {Tr}}_1^k\left( u_1 v_1+u_2 v_2\right)$.

For an odd prime p, the mappings $F:\mathbb F_p^n\rightarrow \mathbb F_p$ are called p-ary functions, and for $p=2$, Boolean functions. For $m\ge 2$, the mappings $F:\mathbb F_p^n\rightarrow \mathbb F_p^m$ are called vectorial functions. Any vectorial function $F:\mathbb F_p^n\rightarrow \mathbb F_p^m$ can be uniquely described by m coordinate functions $f_i:\mathbb F_p^n\rightarrow \mathbb F_p$ for $1\le i\le m$ as a vector $F(x):=(f_1(x),\ldots ,f_m(x))$. For $b\in \mathbb F_p^m$, the function $F_b(x):=\langle b,F(x)\rangle _m$ is called a component function of F.

Vectorial and p-ary functions can be also represented with a help of multivariate polynomials in the ring $\mathbb F_p[x_1,\dots ,x_n]/(x_1- x_1^p,\dots ,x_n- x_n^p)$. This representation is unique and called the algebraic normal form (ANF, for short), namely for p-ary functions $f:\mathbb F_p^n\rightarrow \mathbb F_p$ it is formally defined as $f(x)=\sum _{a\in \mathbb F_p^n}c_{a}\left( \prod _{i=1}^{n} x_i^{a_i} \right)$, where $x = (x_1,\dots , x_n)\in \mathbb F_p^n$, $c_{a}\in \mathbb F_p$ and $a = (a_1,\dots , a_n)\in \mathbb F_p^n$, while for vectorial functions $F:\mathbb F_p^n\rightarrow \mathbb F_p^m$ it is defined coordinate-wise. Besides the coordinate representation and algebraic normal form, we will also consider trace representations. Identifying $\mathbb F_p^n$ with $\mathbb F_{p^n}$, we can uniquely represent any function $F:\mathbb F_p^n\rightarrow \mathbb F_p^n$ as a polynomial $F:\mathbb F_{p^n}\rightarrow \mathbb F_{p^n}$ of the form $F(x)=\sum _{i=0}^{p^{n}-1} a_{i} x^{i}$ with coefficients $a_i\in \mathbb F_{p^{n}}$. Clearly, when m|n, any function $F:\mathbb F_p^n\rightarrow \mathbb F_p^m$ can be written as a polynomial $F:\mathbb F_{p^n}\rightarrow \mathbb F_{p^m}$ given by $F(x)={{\,\textrm{Tr}\,}}^{n}_{m}\left( \sum _{i=0}^{p^{n}-1} a_{i} x^{i}\right)$. This representation is called the univariate (trace) representation, however, it is not unique in general.

Now, we define the following equivalence relation, which preserves the nonlinearity of functions on elementary abelian groups. Functions $F,F':\mathbb F_p^n\rightarrow \mathbb F_p^m$, are called equivalent (extended-affine equivalent, to be more precise), if $F' = A_1 \circ F \circ A_2 + A$ for some affine permutations $A_1$, $A_2$ and an affine mapping A. Clearly, for affine permutations $A_1$ and $A_2$, the functions $F' = A_1 \circ F \circ A_2$ and F have the same value distributions, while the functions $F'=F+A$ and F, where A is an affine mapping, generally do not have the same value distributions; the latter will be illustrated with extensive examples in the following sections.

Our main tool for dealing with perfect nonlinear functions defined on elementary abelian groups is the discrete Fourier transform. In this specific setting, it is often called the Walsh transform, which is the term we will use throughout the paper. For a p-ary function $f:\mathbb F_p^n\rightarrow \mathbb F_p$, the Walsh transform is the complex-valued function $W_f:\mathbb F_{p}^n\rightarrow \mathbb {C}$ defined by

$$\begin{aligned} W_f(b)=\sum _{x \in \mathbb F_p^n} \zeta _p^{f(x) -\langle b, x\rangle _n}, \quad \text{ where } \zeta _p=e^{2 \pi i / p} \quad \text{ and } \quad i^2=-1. \end{aligned}$$

For vectorial functions $F:\mathbb F_p^n\rightarrow \mathbb F_p^m$, the Walsh transform is defined using the notion of component functions as $W_F(b,a)=W_{F_b}(a)$ for all $a\in \mathbb F_p^n,b\in \mathbb F_p^m$.

1.2 Value Distributions of Bent Functions: The Known Cases

With the Walsh transform, bent functions can be equivalently defined in the following way, for details we refer to [16, 20, 22].

Definition 1.1

A function $f:\mathbb F_p^n\rightarrow \mathbb F_p$ is called a bent function, if the Walsh transform satisfies $|W_f(b)|=p^{n / 2}$ for all $b \in \mathbb F_p^n$.

First, we consider in detail the Walsh transform of single-output bent functions. In the Boolean case, i.e., $p=2$ we have that $\zeta _2=-1$, from what follows that $W_f(b)$ is an integer. Consequently, for every $b\in \mathbb F_2^n$ a Boolean bent function f on $\mathbb F_2^n$ satisfies $W_f(b)=2^{n / 2}(-1)^{f^*(b)}$, where $f^*:\mathbb F_2^n\rightarrow \mathbb F_2$ is called the dual of f, what implies that n must be even. The dual function $f^*$ is bent [29], moreover the equality $(f^*)^*=f$ holds. In the p odd case, the Walsh transform $W_f(a)$ at $b \in \mathbb F_p^n$ of a p-ary bent function $f:\mathbb F_p^n\rightarrow \mathbb F_p$ satisfies [16]:

$$\begin{aligned} W_f(a)=\left\{ \begin{array}{cc} \pm \zeta _p^{f^*(a)} p^{n / 2} &{} \text{ if } p^n \equiv 1 \bmod 4, \\ \pm i \zeta _p^{f^*(a)} p^{n / 2} &{} \text{ if } p^n \equiv 3 \bmod 4, \end{array}\right. \end{aligned}$$

where $f^*:\mathbb F_p^n\rightarrow \mathbb F_p$, is called the dual of f. Opposite to the Boolean case, p-ary bent functions $f:\mathbb F_p^n\rightarrow \mathbb F_p$ exist for all integers $n\in \mathbb {N}$, however, the dual of a p-ary bent function is not necessarily bent. A bent function $f:\mathbb F_p^n\rightarrow \mathbb F_p$ is called dual-bent if the dual $f^*$ is bent as well, otherwise, it is called non-dual-bent. Consider the following important classes of dual-bent functions, namely weakly regular and regular bent functions. A bent function $f:\mathbb F_p^n\rightarrow \mathbb F_p$ is called weakly regular if for all $a \in \mathbb F_p^n$, we have $W_f(a)=\epsilon \zeta _p^{f^*(a)} p^{n / 2}$ for some fixed $\epsilon \in \{\pm 1, \pm i\}$. If $\epsilon =1$, a bent function f is called regular. If no such a fixed $\epsilon \in \{\pm 1, \pm i\}$ exists, then f is called non-weakly regular bent; such functions can be either dual-bent or non-dual-bent. For further references on p-ary bent functions and their duals, we refer to [19]. For the sake of simplicity, we will include Boolean functions when talking about regular functions from $\mathbb F_{p}^n$ to $\mathbb F_{p}^m$.

With the notion of component functions, vectorial bent functions can be defined in the following way [16, 20, 22].

Definition 1.2

A function $F:\mathbb F_p^n\rightarrow \mathbb F_p^m$ is called a vectorial bent function, if for all $b \in \mathbb F_p^m\setminus \{0\}$ the component function $F_b:\mathbb F_p^n\rightarrow \mathbb F_p$ is bent.

For vectorial Boolean bent functions $F:\mathbb F_2^n\rightarrow \mathbb F_2^m$, we have necessarily $m\le n/2$ (this fact is also known as the Nyberg’s bound, see [22]), while for p-ary vectorial bent functions $F:\mathbb F_p^n\rightarrow \mathbb F_p^m$, it is possible that $n=m$; in this case bent functions $F:\mathbb F_p^n\rightarrow \mathbb F_p^n$ are called planar. For a survey on bent and planar functions, we refer to [28].

Note that bent functions belong to a larger class of plateaued functions. A function $F:\mathbb F_p^n\rightarrow \mathbb F_p^m$ is called plateaued, if for every $b\in \mathbb F_p^m\setminus \{0\}$ the Walsh transform of $F_b$ at $a\in \mathbb F_p^n$ satisfies $\left| W_{F_b}(a)\right| \in \left\{ 0, p^{(n+s_b) / 2}\right\}$ for an integer $s_b$ with $0 \le s_b \le n$. Bent functions $F:\mathbb F_p^n\rightarrow \mathbb F_p^m$ are exactly 0-plateaued functions, i.e., $s_b=0$ for all $b\in \mathbb F_p^m\setminus \{0\}$.

Now, we survey the known results about value distributions of bent functions. The sizes of the preimage sets of Boolean bent functions were determined by Dillon in his thesis [10], whereas the case of p-ary bent functions was addressed by Nyberg [22].

Theorem 1.3

[22, Theorems 3.2–3.5] Let p be a prime and $f:\mathbb F_p^n \rightarrow \mathbb F_p$ be a bent function, and for $l \in \mathbb F_p,$ let $b_{l}=\left| f^{-1}(l)\right| ,$ where $f^{-1}(l)=\left\{ x \in \mathbb F_p^n: f(x)=l \right\}$.

(i):

If n is even, then there exists a unique $c \in \mathbb {F}_p$ such that

$$\begin{aligned} \begin{aligned} b_c=&p^{n-1} \pm (p-1) p^{\frac{n}{2}-1},\\ b_{l}=&p^{n-1} \mp p^{\frac{n}{2}-1} \quad \text{ for } \text{ all } l \in \mathbb {F}_p \backslash \{c\}. \end{aligned} \end{aligned}$$

(1.1)

Moreover, a regular bent function has the upper signs.

(ii):

If p and n are odd, then the value distribution of a regular bent function is given by $\left( b_0, b_1, \ldots , b_{p-1}\right)$ or a cyclic shift of $\left( b_0, b_1, \ldots , b_{p-1}\right) ,$ where $b_0=p^{n-1}$ and

$$\begin{aligned} \begin{aligned} b_{l}=&p^{n-1}+\left( \frac{l}{p}\right) p^{\frac{n-1}{2}}\quad \text{ for } \text{ all } l \in \mathbb F_p \setminus \{0\}, \text{ or }\\ b_{l}=&p^{n-1}-\left( \frac{l}{p}\right) p^{\frac{n-1}{2}}\quad \text{ for } \text{ all } l \in \mathbb F_p \setminus \{0\}, \end{aligned} \end{aligned}$$

(1.2)

and

$$\begin{aligned} \left( \frac{l}{p}\right) ={{\left\{ \begin{array}{ll}1&{}{\text {if }}l{\text { is a quadratic residue modulo }}p{\text { and }}l\not \equiv 0{\pmod {p}},\\ -1&{}{\text {if }}l{\text { is a non-quadratic residue modulo }}p,\\ 0&{}{\text {if }}l\equiv 0{\pmod {p}},\end{array}\right. }} \end{aligned}$$

is the Legendre symbol.

Value distributions of vectorial bent functions were considered mostly for the classes of bent functions with certain prescribed properties. For instance, Nyberg [23, Theorem 3.2] proved that for a bent function $F:\mathbb F_p^n\rightarrow \mathbb F_p^m$ that has only regular (non-zero) component functions, all preimage set sizes are divisible by $p^{n/2-m}$ and derived both lower and upper bounds on preimage set sizes in this setting. Recently, preimage sets of vectorial bent functions attracted a lot of attention due to the connection with partial difference sets observed in [7]. For instance in [7, 30], the value distributions of bent functions $F:\mathbb F_p^n\rightarrow \mathbb F_p^m$ with the following properties have been considered:

• l-forms, i.e., F satisfies $F(\alpha x) = \alpha ^l F(x)$ for all $\alpha \in \mathbb F_p^m$ and some fixed integer l with $\gcd (p^m-1, l-1) = 1$, and,

• vectorial dual-bent functions, i.e., the set of the dual functions of the component functions of F together with the zero function forms a vector space of bent functions dimension m.

Particularly, in [30, Corollary 1], it was shown that a vectorial dual-bent function $F:\mathbb F_p^n \rightarrow \mathbb {F}_{p}^{m}$, which satisfies $F(0)=0, F(-x)=F(x)$ and all component functions are regular (in this case, $\varepsilon =+1$) or weakly regular but not regular (in this case, $\varepsilon =-1$) satisfies

$$\begin{aligned} \left| F^{-1}(0)\right|= & {} p^{n-m}+\varepsilon \left( p^m-1\right) p^{\frac{n}{2}-m}\quad \text{ and } \quad \left| F^{-1}(\beta )\right| \nonumber \\= & {} p^{n-m}-\varepsilon p^{\frac{n}{2}-m},\quad \text{ for } \beta \in \mathbb F_p^m\setminus \{0\} . \end{aligned}$$

(1.3)

Finally, in the case $n=m$, it was shown in [17, Theorem 2] that planar functions $F:\mathbb F_p^n\rightarrow \mathbb F_p^n$ with the minimal image set, i.e., $|{\text {Im}}(F)|=(p^n+1)/2$, have special value distributions, namely, they are 2-to-1 mappings.

As these results show, the value distributions of bent functions $F:\mathbb F_p^n\rightarrow \mathbb F_p^m$ are well-understood in the extremal cases, namely in the single-output case $m=1$ as well as in the planar case $m=n$, for p odd. However, the knowledge of value distributions in the “in-between” cases $1<m<n$, is limited to the bent functions with specific additional properties (e.g., vectorial dual bent, l-forms). Moreover, the non-elementary abelian case has not been addressed at all.

In this paper, we develop a purely combinatorial general framework for the study of value distributions of perfect nonlinear functions. With our approach, we are able to unify the known results on value distributions of bent functions in different settings, which were previously obtained with different techniques. In the process, we strengthen many known results and prove new structural properties of functions with specific value distributions. Moreover, we show that our framework is also applicable for perfect nonlinear functions defined on non-elementary abelian groups.

The rest of the paper is organized in the following way. In Sect. 2, we derive general, sharp upper and lower bounds on the cardinalities of the preimage sets of perfect nonlinear functions on arbitrary groups (Theorem 2.4). We show that for functions meeting these bounds, all but one values in the image set are equally distributed between preimages. Additionally, we investigate the surjectivity of perfect nonlinear functions. In Sect. 3, we introduce the notion of almost balanced perfect nonlinear functions; these are the perfect nonlinear functions which achieve upper/lower bounds on the cardinalities of the preimage sets with equality and thus are extremal objects of particular interest. Considering the elementary abelian framework, we show in Sect. 3.1 that many primary constructions of bent functions are almost balanced. In Sect. 3.2, we demonstrate how one can construct new almost balanced bent functions from known ones using secondary constructions. In particular, combining primary and secondary constructions, we are able to show that almost balanced bent functions exist for all admissible elementary abelian groups (Theorem 3.12). In Sect. 4, we study the connection between value distributions and the Walsh transform of bent functions. Using these spectral properties, we generalize Nyberg’s result on the possible sizes of preimage sets of bent functions, giving stronger and more general conditions on preimage set sizes in both the Boolean case as well as the general p-ary case (Theorems 4.6, 4.8, 4.9). We are also able to prove that in some cases, knowing the value distribution of two vectorial bent functions is enough to settle the (in general difficult) equivalence question (Corollary 4.4). In Sect. 5, we determine possible value distributions for bent functions with small output groups. In particular, we give a complete characterization of all possible value distributions for Boolean bent functions with output dimension at most 4. In Sect. 6, we consider planar functions. Using the techniques developed in this paper, we unify several known results on the characterization of planar functions with extremal value distributions and give a more precise description of planar functions with the maximum possible image set size. Finally, we provide new characterizations of planar functions of special shapes, again generalizing several well-known results. For instance, we are able to show that plateaued 2-to-1 functions are automatically planar (Theorem 6.4). In Sect. 7, we conclude the paper and give a list of open problems on perfect nonlinear functions and their value distributions.

2 Bounds on the Cardinality of Preimage Sets

In this section, we derive upper and lower bounds on the cardinalities of the preimage sets of perfect nonlinear functions on arbitrary groups and show that in the cases when the bounds are attained, we have that all but one values are equally distributed. We begin with the following simple result. It has already appeared in [4]; we add a short proof for the convenience of the reader.

Proposition 2.1

Let G and H be two finite groups, and let $F :G \rightarrow H$ be a perfect nonlinear function. Then the following holds

$$\begin{aligned}\sum _{\beta \in H}|F^{-1}(\beta )|^2 = |G|+\frac{|G|}{|H|}(|G|-1).\end{aligned}$$

Proof

We have $\sum _{\beta \in H}|F^{-1}(\beta )|^2=|\{(x,y) \in G\times G :F(x)=F(y)\}|$. Observe that

$$\begin{aligned}| \{(x,y) \in G\times G :F(x)= & {} F(y)\}|=|G|+|\{(x,a) \in G\times (G\setminus \{0\}) :F(x)\\= & {} F(x+a)\}|.\end{aligned}$$

Since F is perfect nonlinear, we have that $F(x)=F(x+a)$ holds for a fixed value $a\ne 0$ for exactly |G|/|H| values of x. In this way, $|\{(x,a) \in G\times (G\setminus \{0\}) :F(x)=F(x+a)\}|=|G|/|H|\cdot (|G|-1)$ and the result follows. $\square$

This result can be applied to get minimum and maximum sizes of preimage set sizes of perfect nonlinear functions. For the sake of brevity, denote for a function $F :G \rightarrow H$ the preimage set sizes by $X_1,X_2,\dots ,X_{|H|}$, where we use an arbitrary ordering. By Proposition 2.1, for a perfect nonlinear function, we get

$$\begin{aligned} \sum _{i=1}^{|H|} X_i^2&=|G|+\frac{|G|}{|H|}(|G|-1), \end{aligned}$$

(2.1)

$$\begin{aligned} \sum _{i=1}^{|H|} X_i&=|G|, \end{aligned}$$

(2.2)

where the second equation follows from the fact that all preimages exhaust G. We will now look for bounds and explicit solutions of the $X_i$.

Remark 2.2

Note that not every solution to Eqs. (2.1) and (2.2) yields a preimage distribution of a perfect nonlinear function. For instance, there is no vectorial bent function from $G=\mathbb F_2^4$ to $H=\mathbb F_2^3$ (since Nyberg’s bound is violated) but for $|G|=16$ and $|H|=8$ a solution to Eqs. (2.1) and (2.2) exists, for example $X_1=5, X_2=3, X_3=X_4=2, X_5=\cdots =X_8=1$.

Considering Eqs. (2.1) and (2.2), it is clear that if $X_1,\dots ,X_{p^m}$ are a solution, the average value of $X_i$ is $p^{n-m}$. As the next proposition shows, handling these equations is made a lot easier when one considers the deviations from this mean instead of the $X_i$ directly.

Proposition 2.3

Define $H_i=X_i-\frac{|G|}{|H|}$. Then Eqs. (2.1) and (2.2) are satisfied if and only if

$$\begin{aligned} \sum _{i=1}^{|H|} H_i^2&=|G|-\frac{|G|}{|H|}, \end{aligned}$$

(2.3)

$$\begin{aligned} \sum _{i=1}^{|H|} H_i&=0. \end{aligned}$$

(2.4)

Proof

Equation (2.2) is clearly equivalent to Eq. (2.4). For Eq. (2.1), we have

$$\begin{aligned} |G|+\frac{|G|}{|H|}(|G|-1)&=\sum _{i=1}^{|H|} X_i^2= \sum _{i=1}^{|H|} \left( \frac{|G|}{|H|}+H_i\right) ^2 \\&=\frac{|G|^2}{|H|}+2\frac{|G|}{|H|}\sum _{i=1}^{|H|}H_i+\sum _{i=1}^{|H|} H_i^2 \\&= \frac{|G|^2}{|H|} + \sum _{i=1}^{|H|} H_i^2. \end{aligned}$$

Rearranging yields $\sum _{i=1}^{|H|} H_i^2=|G|-\frac{|G|}{|H|}$ as desired. $\square$

Note that all solutions of Eqs. (2.3) and (2.4) come in pairs since one can change the signs of all the $H_i$.

The following theorem gives general bounds on the minimum and maximum preimage set sizes of perfect nonlinear functions in the most general setting. We will see later that the bounds achieved here are (at least for elementary abelian groups) sharp. Note that here and in other proofs later, we will repeatedly use the second moment method.

Theorem 2.4

Let G and H be two finite groups, and let $F:G \rightarrow H$ be a perfect nonlinear function. Then for every $\beta \in H$ the following inequality holds

$$\begin{aligned} \frac{|G|}{|H|}-\sqrt{|G|}+\frac{\sqrt{|G|}}{|H|}\le |F^{-1}(\beta )| \le \frac{|G|}{|H|}+\sqrt{|G|}-\frac{\sqrt{|G|}}{|H|}. \end{aligned}$$

(2.5)

• (1) If $\displaystyle |F^{-1}(\alpha )|=\frac{|G|}{|H|}-\sqrt{|G|}+\frac{\sqrt{|G|}}{|H|}$ then $\displaystyle |F^{-1}(\beta )|=\frac{|G|}{|H|}+\frac{\sqrt{|G|}}{|H|}$ for each $\beta \ne \alpha$.

• (2) If $\displaystyle |F^{-1}(\alpha )|=\frac{|G|}{|H|}+\sqrt{|G|}-\frac{\sqrt{|G|}}{|H|}$ then $\displaystyle |F^{-1}(\beta )|=\frac{|G|}{|H|}-\frac{\sqrt{|G|}}{|H|}$ for each $\beta \ne \alpha$.

If the equality takes place, then |H| divides $\sqrt{|G|},$ and consequently |G| is a square.

Proof

We consider Eqs. (2.3) and (2.4). By the Cauchy–Schwarz inequality, we have

$$\begin{aligned} \sum _{i=2}^{|H|} H_i^2 \ge \left( \sum _{i=2}^{|H|} H_i\right) ^2 \cdot \frac{1}{|H|-1}, \end{aligned}$$

with equality if and only if all $X_i$, $i>1$ are identical. Then

$$\begin{aligned} |G|-\frac{|G|}{|H|}=\sum _{i=1}^{|H|} H_i^2 =H_1^2+\sum _{i=2}^{|H|} H_i^2 \ge H_1^2+\frac{H_1^2}{|H|-1}. \end{aligned}$$

This inequality is quadratic in $H_1$ and can be solved with elementary techniques, the result is

$$\begin{aligned} -\sqrt{|G|}+\frac{\sqrt{|G|}}{|H|}\le H_1 \le \sqrt{|G|}-\frac{\sqrt{|G|}}{|H|}, \end{aligned}$$

which leads for the preimage set sizes $X_i$ to the distributions

$$\begin{aligned}\frac{|G|}{|H|}-\sqrt{|G|}+\frac{\sqrt{|G|}}{|H|}\le X_1 \le \frac{|G|}{|H|}+\sqrt{|G|}-\frac{\sqrt{|G|}}{|H|}. \end{aligned}$$

In the extremal cases, equality in the Cauchy–Schwarz inequality has to hold, so all $H_i$, $i>1$ are identical (and thus also the $X_i$) and we get

$$\begin{aligned} X_i=\frac{|G|-X_1}{|H|-1}\quad \text{ for } \text{ all } i>1. \end{aligned}$$

The result follows by plugging in the extremal values for $X_1$.

In the case of equality, we then necessarily have that |G| is a square and |H| divides $\sqrt{|G|}$. $\square$

For the sake of convenience, we give the bounds for bent functions $F:\mathbb F_p^n\rightarrow \mathbb F_p^m$ which will be considered in details in the following sections.

Theorem 2.5

Let $F :\mathbb F_p^n \rightarrow \mathbb F_p^m$ be a bent function and $F^{-1}(\beta )$ the preimage set of $\beta \in \mathbb F_p^m$. Then for every $\beta \in \mathbb F_p^m$ the following inequality holds

$$\begin{aligned} p^{n-m}-p^{n/2}+p^{n/2-m}\le |F^{-1}(\beta )| \le p^{n-m}+p^{n/2}-p^{n/2-m}. \end{aligned}$$

(2.6)

• (1) If $|F^{-1}(\alpha )|=p^{n-m}-p^{n/2}+p^{n/2-m}$ then $|F^{-1}(\beta )|=p^{n-m}+p^{n/2-m}$ for each $\beta \ne \alpha$.

• (2) If $|F^{-1}(\alpha )|=p^{n-m}+p^{n/2}-p^{n/2-m}$ then $|F^{-1}(\beta )|=p^{n-m}-p^{n/2-m}$ for each $\beta \ne \alpha$. If equality takes place, then $m\le n/2$ and n is even.

Remark 2.6

1. If we look for a moment at the Boolean case, i.e., $G=\mathbb F_2^n$ and $H=\mathbb F_2$, we see that the two extremal cases in Theorem 2.5 recover the well-known value distributions of Boolean bent functions. Indeed, for a Boolean bent function $f:\mathbb F_2^n\rightarrow \mathbb F_2$, we have

$$\begin{aligned}W_f(0)=\sum _{x \in \mathbb F_2^n}{(-1)^{f(x)}}=|f^{-1}(0)|-|f^{-1}(1)| \in \{\pm 2^{n/2}\}.\end{aligned}$$

Since $|f^{-1}(0)|+|f^{-1}(1)|=2^n$, this implies $|f^{-1}(0)| = 2^{n-1} \pm 2^{n/2-1}$ which are exactly the two extremal cases in Theorem 2.5.

2. For p odd, n even and $m=1$, the two extremal cases in Theorem 2.5 also recover the well-known value distributions of p-ary bent functions given in Theorem 1.3. For p odd, n odd and $m=1$, compared to Theorem 1.3, we obtain bounds on the cardinality of preimage sets of bent functions, which are not regular.

3. For the special case p odd and n even, the two extremal cases in Theorem 2.5 also cover the extremal distributions obtained in Eq. (1.3) found in [7, 30]. Moreover, these extremal cases not only recover the bound from [7, Corollary 2], but also show that the remaining elements in the image set are uniformly distributed between the remaining elements in $\mathbb F_{p}^n\setminus \{0\}$.

Theorem 2.4 can be used to identify a large class of surjective perfect nonlinear functions.

Corollary 2.7

Let G and H be two finite groups, and let $F:G\rightarrow H$ be a perfect nonlinear function. If $|H| \le \sqrt{|G|},$ then F is surjective. A preimage set of size 1 is only possible if $|H|=\sqrt{|G|}$.

Proof

We apply Theorem 2.4. The function F is surjective, if for all $\beta \in H$ we have

$$\begin{aligned} |F^{-1}(\beta )|\ge \frac{|G|}{|H|}-\sqrt{|G|}+\frac{\sqrt{|G|}}{|H|}\ge 1. \end{aligned}$$

(2.7)

From the latter inequality we have that

$$\begin{aligned} |G| + \sqrt{|G|} \ge |H|\cdot \left( \sqrt{|G|} +1 \right) , \end{aligned}$$

which is equivalent to $|H| \le \sqrt{|G|}$. A preimage set of size 1 is only possible if $|H|=\sqrt{|G|}$. $\square$

For perfect nonlinear functions beyond the “square root bound”, the question about surjectivity becomes much more difficult to answer. In the following statement, we give a bound on the cardinality of the image set of a bent function, which has essentially been proven by Carlet [3] in a different context (namely, to give a connection between nonlinearity and the cardinality of the image sets of mappings $F:\mathbb F_2^n\rightarrow \mathbb F_2^m$).

Proposition 2.8

Let G and H be two finite groups, and let $F :G \rightarrow H$ be a perfect nonlinear function. Then

$$\begin{aligned} |{{\,\textrm{Im}\,}}(F)| \ge \frac{|G|\cdot |H|}{|G|+|H|-1}. \end{aligned}$$

(2.8)

Proof

We have from Eqs. (2.1) and (2.2)

$$\begin{aligned} \sum _{i=1}^{|{{\,\textrm{Im}\,}}(F)|} X_i^2&=|G|+\frac{|G|}{|H|}\cdot (|G|-1) \\ \sum _{i=1}^{|{{\,\textrm{Im}\,}}(F)|} X_i&=|G|, \end{aligned}$$

and again by the Cauchy–Schwarz inequality, the following holds

$$\begin{aligned} |G|+\frac{|G|}{|H|}\cdot (|G|-1)=\sum _{i=1}^{|{{\,\textrm{Im}\,}}(F)|} X_i^2\ge \frac{|G|^2}{|{{\,\textrm{Im}\,}}(F)|}. \end{aligned}$$

(2.9)

The claim follows by solving Eq. (2.9) for $|{{\,\textrm{Im}\,}}(F)|$. $\square$

Now, we give the expression of the bound in Eq. (2.8) for bent functions $F:\mathbb F_p^n\rightarrow \mathbb F_p^m$ and recover the well-known lower bound [17] for the planar case, i.e., p is odd and $n=m$.

Corollary 2.9

Let $F:\mathbb F_p^n\rightarrow \mathbb F_p^m$ be a bent function. Then the following hold.

• (1) The cardinality of the image set of F satisfies

  $$\begin{aligned} |{{\,\textrm{Im}\,}}(F)| \ge \frac{p^{2n}}{p^n+p^{n-m}(p^n-1)} > \frac{p^n}{1+p^{n-m}}. \end{aligned}$$

• (2) If p is odd and $n=m,$ then $|{{\,\textrm{Im}\,}}(F)| \ge \frac{p^n+1}{2}$.

• (3) If $m\le n/2,$ then F is surjective.

If the “square root bound” is violated, then the expression $\frac{|G|}{|H|}-\sqrt{|G|}+\frac{\sqrt{|G|}}{|H|}$ in Eq. (2.7) becomes negative. That means that our techniques cannot shed more light on the surjectivity of perfect nonlinear functions beyond the “square root bound”. In the following example, we show that for small values of p, n and $m\ge \lfloor n/2+1\rfloor$ surjective vectorial bent functions $F:\mathbb F_p^n\rightarrow \mathbb F_p^m$ exist.

Example 2.10

Consider the planar function $F(x)=x^2$ on $\mathbb F_{p^n}$. Denote by $f_1,\ldots ,f_n :\mathbb F_p^n\rightarrow \mathbb F_p$ the coordinate functions of F, i.e., $F(x)=(f_1(x),\ldots ,f_n(x))$ for $x\in \mathbb F_{p^n}$. Let $F_{k}:\mathbb F_{p^n}\rightarrow \mathbb F_p^k$ be the vectorial bent function formed by the first k coordinate functions of F, i.e., $F_{k}(x):=(f_1(x),\ldots ,f_{k}(x))$. With Magma [1], we checked that for the following values of p and n given in Table 1, the functions $F_{k}:\mathbb F_{p^n}\rightarrow \mathbb F_p^k$, where $k=\lfloor n/2 \rfloor + 1$ are surjective.

Table 1 Surjective vectorial bent functions $F_{\lfloor n/2 \rfloor + 1}:\mathbb F_{p^n}\rightarrow \mathbb F_p^{\lfloor n/2 \rfloor + 1}$

More general, we expect that for a fixed p and a sufficiently large n there exist $m>\lfloor n/2 \rfloor + 1$, such that the functions $F_k:\mathbb F_{p^n}\rightarrow \mathbb F_p^k$ are surjective for all $\lfloor n/2 \rfloor + 1\le k\le m$, but not for $k\ge m+1$. Consider $p=3,n=13$ and $m=10$. The functions $F_{k}:\mathbb F_{p^n}\rightarrow \mathbb F_p^{k}$ are surjective for all $1\le k\le 6$ by Corollary 2.9. With Magma [1], we checked that for all $7\le k\le 10$ the functions $F_{k}:\mathbb F_{p^n}\rightarrow \mathbb F_p^{k}$ are surjective as well. However, the functions $F_{k}:\mathbb F_{p^n}\rightarrow \mathbb F_p^{k}$ are not surjective for all $11\le k\le 13$.

Based on our observations on surjectivity of vectorial bent functions beyond the “square root bound”, we formulate the following open problems for vectorial bent functions $F:\mathbb F_p^n\rightarrow \mathbb F_p^m$, since most of the constructions are studied in this setting. Clearly, the asked questions do not lose their relevance for the case of perfect nonlinear functions beyond the “square root bound” on arbitrary groups.

Open Problem 2.11

Let p be odd.

• (1) Find constructions of surjective vectorial bent functions $F:\mathbb F_p^n\rightarrow \mathbb F_p^m$ for $m\ge \lfloor n/2 \rfloor +1$.

• (2) What is the maximum m such that all vectorial bent functions $F:\mathbb F_p^n\rightarrow \mathbb F_p^m$ are surjective?

• (3) What is the minimum m such that all vectorial bent functions $F:\mathbb F_p^n\rightarrow \mathbb F_p^m$ are not surjective?

3 Almost Balanced Perfect Nonlinear Functions

By Theorem 2.4, we know that if one preimage set $F^{-1}(\alpha )$ of a perfect nonlinear function $F:G\rightarrow H$ has either minimum or maximum cardinality, then the remaining elements in $H \setminus \{ \alpha \}$ are uniformly distributed between the remaining elements of $G \setminus F^{-1}(\alpha )$. This fact motivates the following definition.

Definition 3.1

Let G and H be two finite groups. For a perfect nonlinear function $F :G \rightarrow H$, we call the first extremal value distribution in Theorem 2.4 of type (−), and the second extremal value distribution of type ($+$).

A perfect nonlinear function $F :G \rightarrow H$ is said to be almost balanced, if its value distribution is extremal. Particularly, we say that F is almost balanced of type (−), if its value distribution is extremal of type (−), and almost balanced of type ($+$), if its value distribution is extremal of type ($+$).

For an almost balanced perfect nonlinear function, we say that $F^{-1}(\alpha )$ is the unique preimage of F, if $\displaystyle |F^{-1}(\alpha )|=\frac{|G|}{|H|}\mp \sqrt{|G|}\pm \frac{\sqrt{|G|}}{|H|}$ (where the sign depends on the type).

Note that the two extremal distributions $(+)$ and $(-)$ belong to the solution $H_1=\pm \sqrt{|G|}-\frac{\sqrt{|G|}}{|H|}$, $H_i=\mp \frac{\sqrt{|G|}}{|H|}$ for all $i>1$ in Eqs. (2.3) and (2.4).

From now on, we consider bent functions $F:\mathbb F_p^n\rightarrow \mathbb F_p^m$, since the problem of construction of bent functions is mostly considered in this setting. In the following subsections, we prove that many primary constructions of bent functions are, in fact, almost balanced. Moreover, we show how one can construct new almost balanced bent functions from known ones using secondary constructions.

3.1 Primary Constructions

First, we consider three general classes of vectorial bent functions, namely the Maiorana–McFarland, the Desarguesian partial spread and the o-polynomial construction. We show that all these constructions yield almost balanced bent functions of the $(+)$ type.

Proposition 3.2

Let n be even.

• (1) Let $F :\mathbb F_{p^{n/2}} \times \mathbb F_{p^{n/2}} \rightarrow \mathbb F_{p}^{m}$ be a Maiorana–McFarland bent function defined by

  $$\begin{aligned} F(x,y)=L(x\pi (y))+\rho (y), \end{aligned}$$

  where $\pi :\mathbb F_{p^{n/2}} \rightarrow \mathbb F_{p^{n/2}}$ is a permutation, $\rho :\mathbb F_{p^{n/2}}\rightarrow \mathbb F_{p}^m$ is an arbitrary function, and $L:\mathbb F_{p^{n/2}}\rightarrow \mathbb F_{p}^m$ is a surjective linear mapping. Let $\pi (y^*)=0$ and $\alpha :=\rho (y^*)$ for $y^*\in \mathbb F_{p^m}$. Then $|F^{-1}(\alpha )|=p^{n-m}+p^{n/2}-p^{n/2-m}$ and $|F^{-1}(\beta )|=p^{n-m}-p^{n/2-m}$ for each $\beta \ne \alpha$, and hence F is almost balanced of $(+)$ type.

• (2) Let $F :\mathbb F_{p^{n/2}} \times \mathbb F_{p^{n/2}} \rightarrow \mathbb F_{p}^{m}$ be a Desarguesian partial spread bent function defined by

  $$\begin{aligned} F(x,y)=\Psi (xy^{p^{n/2}-2}), \end{aligned}$$

  where $\Psi :\mathbb F_{p^{n/2}}\rightarrow \mathbb F_{p}^m$ is an arbitrary balanced function. Then $|F^{-1}(0)|=p^{n-m}+p^{n/2}-p^{n/2-m}$ and $|F^{-1}(\beta )|=p^{n-m}-p^{n/2-m}$ for each $\beta \ne 0,$ and hence F is almost balanced of $(+)$ type.

Proof

In the both cases, it is enough to find an element $\alpha \in \mathbb F_{p}^m$, such that for the function $F :\mathbb F_{p^{n/2}} \times \mathbb F_{p^{n/2}} \rightarrow \mathbb F_{p}^{m}$ we have $|F^{-1}(\alpha )|=p^{n-m}+p^{n/2}-p^{n/2-m}$, since the uniformity of the other preimages follows immediately from Theorem 2.5.

1. For $\alpha =\rho (y^*)$, the equation $L(x\pi (y))+\rho (y)=\alpha$ has $p^{n/2}$ solutions $(x,y^*)$, where $x\in \mathbb F_{p^{n/2}}$. Now let $y\ne y^*$ be fixed. The equation $L(z)=\alpha -\rho (y)$ has $p^{n/2-m}$ solutions $z\in \mathbb F_{p^{n/2}}$, since L is linear and surjective, and hence it is balanced, i.e., $|L^{-1}(\gamma )|=p^{n/2-m}$ for all $\gamma \in \mathbb F_{p^{m}}$. In turn, for every fixed $z\in \mathbb F_{p^{n/2}}$, the equation $z=x\pi (y)$ has a unique solution $x\in \mathbb F_{p^{n/2}}$ given by $x=z(\pi (y))^{-1}$. Hence, the equation $L(x\pi (y))+\rho (y)=\alpha$ has $p^{n/2-m}(p^{n/2}-1)$ additional solutions (x, y), where $y\ne y^*$, and thus $p^{n-m}+p^{n/2}-p^{n/2-m}$ solutions in total.

2. Let $\alpha =\Psi (0)$. Consider the equation $\Psi (z)=\alpha$. Since $\Psi$ is balanced, we have $p^{n/2-m}$ solutions $z\in \mathbb F_{p^{n/2}}$. If $z\ne 0$, then for a fixed $y\in \mathbb F_{p^{n/2}}^*$, the equation $z=xy^{p^{n/2}-2}=xy^{-1}$ has a unique solution $x=zy$, and hence the equation $\Psi (xy^{p^{n/2}-2})=\alpha$ has $(p^{n/2-m}-1)(p^{n/2}-1)$ solutions (x, y), where $x=zy$ and $y\ne 0$. If $z=0$, then the set $\{ (x,0) :x\in \mathbb F_{p^n}\}\cup \{ (0,y) :y\in \mathbb F_{p^n}\}$ gives $p^{n/2+1}-1$ more solutions of the equation $\Psi (xy^{p^{n/2}-2})=\alpha$, and $p^{n-m}+p^{n/2}-p^{n/2-m}$ solutions in total. $\square$

Recall the following definition of an o-polynomial [5]. For an extensive summary of the known o-polynomials and in particular their relations to (hyper)ovals in finite geometry, we refer to [21].

Definition 3.3

Let k be any positive integer. A permutation polynomial $\Psi$ over $\mathbb F_{2^k}$ is called an o-polynomial (an oval polynomial) if, for every $a\in \mathbb F_{2^k}^*$, the function

$$\begin{aligned} z\in \mathbb F_{2^k}\mapsto {\left\{ \begin{array}{ll} \dfrac{\Psi (z+a)+\Psi (a)}{z}, &{} \text{ if } z\ne 0,\\ 0, &{} \text{ if } z= 0, \end{array}\right. } \end{aligned}$$

is a permutation of $\mathbb F_{2^k}$.

In the following statement, we show that bent functions obtained with the o-polynomial construction are also almost balanced of the $(+)$ type.

Proposition 3.4

Let n be even and $F :\mathbb F_{2^{n/2}} \times \mathbb F_{2^{n/2}} \rightarrow \mathbb F_{2^{n/2}}$ be an o-polynomial bent function defined by

$$\begin{aligned} F(x,y)=x\Psi (yx^{2^{n/2-1}}), \end{aligned}$$

(3.1)

where $\Psi :\mathbb F_{2^{n/2}} \rightarrow \mathbb F_{2^{n/2}}$ is an o-polynomial. Then $|F^{-1}(0)|=2^{n/2+1}-1$ and $|F^{-1}(\beta )|=2^{n/2}-1$ for each $\beta \ne 0,$ and hence F is almost balanced of $(+)$ type.

Proof

We have $F(x,y)=x\Psi (yx^{2^{n/2-1}})$, where $\Psi$ is an o-polynomial. Recall that as an o-polynomial $\Psi$ satisfies $\Psi (x)=0$ if and only if $x=0$. The equation $F(x,y)=0$ is thus only solvable if $xy=0$, so it has $2^{n/2+1}-1$ solutions. The uniformity of the other preimages follows then immediately from Theorem 2.5. $\square$

Now, we consider some monomial bent functions in even and odd characteristics. Again we find that these infinite families give almost balanced bent functions, but this time both $(+)$ and $(-)$ types occur.

Proposition 3.5

Let n be even.

• (1) Let $n=2^{r+1}s$ with $r \ge 0$ and s odd. Define $F :\mathbb F_{2^n} \rightarrow \mathbb F_{2^{n/2}}$ by $F(x)={{\,\textrm{Tr}\,}}^n_{n/2}(\lambda x^{2^{2^r}+1})$ where $\lambda$ is not a $(2^{2^r}+1)$-st power in $\mathbb F_{2^n}^*$. Then $|F^{-1}(0)|=1$ and $|F^{-1}(\beta )|=2^{n/2}+1$ for each $\beta \in \mathbb F_{2^{n/2}}^*,$ and hence F is almost balanced of type $(-)$.

• (2) Let n/2 be odd and define $F :\mathbb F_{2^n} \rightarrow \mathbb F_{2^{n/2}}$ by $F(x)={{\,\textrm{Tr}\,}}^n_{n/2}(\lambda x^{4^i-2^i+1})$ where $\gcd (i,n)=1$ and $\lambda$ is a non-cube in $\mathbb F_{2^n}^*$. Then $|F^{-1}(0)|=1$ and $|F^{-1}(\beta )|=2^{n/2}+1$ for each $\beta \in \mathbb F_{2^{n/2}}^*,$ and hence F is almost balanced of type $(-)$.

• (3) Let p be odd and $F :\mathbb F_{p^n} \rightarrow \mathbb F_{p^{n/2}}$ be a vectorial bent function defined via $F(x)={{\,\textrm{Tr}\,}}^n_{n/2}(\lambda x^d)$ with $\gcd (d,p^{n/2}-1)=2$. If $p^{n/2} \equiv 3 \pmod 4$ and $\lambda$ is a square, or $p^{n/2} \equiv 1 \pmod 4$ and $\lambda$ is a non-square, then F is almost balanced of type $(+)$. In the other cases, F is almost balanced of type $(-)$.

Proof

1. These are well-known Gold vectorial bent functions (see, e.g., [12, Theorem 6]). We have $F(x)=0$ if and only if ${{\,\textrm{Tr}\,}}^n_{n/2}(\lambda x^{2^{2^r}+1})=0$. Observe that ${{\,\textrm{Tr}\,}}^n_{n/2}(x)=0$ if and only if $x \in \mathbb F_{2^{n/2}}$. We have $\gcd (2^{2^r}+1,2^{n/2}-1)=1$ since $(n/2)/\gcd (2^r,n/2)=1$ so $x \mapsto x^{2^{2^r}+1}$ is bijective on $\mathbb F_{2^{n/2}}$. In particular, each element in $\mathbb F_{2^{n/2}}$ is a $(2^{2^r}+1)$-st power. Now note that $\lambda x^{2^{2^r}+1}$ is never a $(2^{2^r}+1)$-st power, since $\lambda$ is a not a $(2^{2^r}+1)$-st power. So $\lambda x^{2^{2^r}+1} \in \mathbb F_{2^{n/2}}$ if and only if $x=0$. Thus $F(x)=0$ if and only if $x=0$.

Now consider $F(x)=y$ with $y \ne 0$. We can write each $x \in \mathbb F_{2^{n/2}}^*$ uniquely as $x=ab$ where $a \in \mathbb F_{2^{n/2}}^*$, $b \in U_{2^m+1}=\{x \in \mathbb F_{2^n} :x^{2^{n/2}+1}=1\}$ since $(2^{n/2}-1)(2^{n/2}+1)=2^n-1$ and $\gcd (2^{n/2}-1,2^{n/2}+1)=1$. Then

$$\begin{aligned} F(ab)=a^{2^{2^r}+1}{{\,\textrm{Tr}\,}}^n_{n/2}(\lambda b^{2^{2^r}+1})=y \end{aligned}$$

has for each $b\in U_{2^{n/2}+1}$ one unique solution a (again since $x \mapsto x^{2^{2^r}+1}$ is bijective on $\mathbb F_{2^{n/2}}$). We conclude that each $y \ne 0$ has $2^{n/2}+1$ preimages. (The uniformity also follows immediately from Theorem 2.5.)

2. These are the well-known Kasami vectorial bent functions (see, e.g., [12, Theorem 7]). We have $F(x)=0$ if and only if ${{\,\textrm{Tr}\,}}^n_{n/2}(\lambda x^{4^i-2^i+1})=0$. Observe that ${{\,\textrm{Tr}\,}}^n_{n/2}(x)=0$ if and only if $x \in \mathbb F_{2^{n/2}}$. Since n/2 is odd, $\gcd (4^i-2^i+1,2^{n/2}-1)=1$ (see, e.g., [18, Lemma 3.8]) and $x \mapsto x^{4^i-2^i+1}$ is bijective on $\mathbb F_{2^{n/2}}$. In particular, each element in $\mathbb F_{2^{n/2}}$ is a $(4^i-2^i+1)$-th power. Now note that $\lambda x^{4^i-2^i+1}$ is never a $(4^i-2^i+1)$-th power, since $\gcd (4^i-2^i+1,2^n-1)=3$ (which can be readily checked) and $\lambda$ is a non-cube, so not a $(4^i-2^i+1)$-th power. So $\lambda x^{4^i-2^i+1} \in \mathbb F_{2^{n/2}}$ if and only if $x=0$. Thus $F(x)=0$ if and only if $x=0$. The uniformity follows immediately from Theorem 2.5

3. Without loss of generality, we can assume $d=2$. We then have $F(x)=0$ if and only if ${{\,\textrm{Tr}\,}}^n_{n/2}(\lambda x^{2})=\lambda x^{2}+\lambda ^{p^{n/2}} x^{2p^{n/2}}=0$. The non-zero roots r must satisfy the equation $r^{2(p^{n/2}-1)}=-1/(\lambda ^{p^{n/2}-1})$. If $-\lambda ^{p^{n/2}-1}$ is a $2(p^{n/2}-1)$-st power, this has $2(p^{n/2}-1)$ non-zero solutions, meaning we have in total $2p^{n/2}-1$ solutions, so F is of type ($+$). If $-\lambda ^{p^{n/2}-1}$ is not a $2(p^{n/2}-1)$-st power, we conclude $F(x)=0$ if and only if $x=0$, i.e., we only have one solution and thus a type (−) function. The uniformity for the other preimage sizes follows from Theorem 2.5. Note that $-\lambda ^{p^{n/2}-1}$ is a $2(p^{n/2}-1)$-st power if and only if either $-1$ is a $2(p^{n/2}-1)$-st power and $\lambda$ is a square or $-1$ is not a $2(p^{n/2}-1)$-st power and $\lambda$ is a non-square. The result follows since $-1$ is a $2(p^{n/2}-1)$-st power if and only if $4(p^{n/2}-1)|p^n-1$ which is equivalent to $4|p^{n/2}+1$. $\square$

Remark 3.6

Note that all planar monomials $x \mapsto x^d$ on $\mathbb F_{p^n}$ satisfy $\gcd (d,p^n-1)=2$ (for a proof, see Corollary 6.6 later) so Proposition 3.5 in particular holds for the vectorial bent functions derived from all planar monomials. This means that Case 3 of Proposition 3.5 yields almost balanced functions for all odd p and all even n, since $x \mapsto x^2$ always yields a planar function (among other examples).

3.2 Secondary Constructions

In this subsection, we show how one can construct almost balanced bent functions from the known ones. First, we consider the direct sum construction.

Definition 3.7

For two functions $F_1:\mathbb F_p^n\rightarrow \mathbb F_p^m$ and $F_2:\mathbb F_p^k\rightarrow \mathbb F_p^m$, the function $F:\mathbb F_p^n\times \mathbb F_p^k\rightarrow \mathbb F_p^m$ defined by $F(x,y):=F_1(x)+ F_2(y)$ is called the direct sum of the functions $F_1$ and $F_2$.

In the following statement, we give an expression of the cardinality of a preimage set of a direct sum $F(x,y)=F_1(x)+F_2(y)$ in terms of cardinalities of preimage sets of $F_1$ and $F_2$.

Proposition 3.8

Let $F_1:\mathbb F_{p}^{n}\rightarrow \mathbb F_p^{m},F_2:\mathbb F_{p}^{k}\rightarrow \mathbb F_p^{m}$ and $F:\mathbb F_{p}^{n}\times \mathbb F_{p}^{k}\rightarrow \mathbb F_p^{m}$ be defined as the direct sum of $F_1$ and $F_2,$ i.e., $F(x,y)=F_1(x)+F_2(y)$ for $x\in \mathbb F_{p}^n$ and $y\in \mathbb F_{p}^k$. Then, for $c\in \mathbb F_{p}^m$ we have

$$\begin{aligned} |F^{-1}(c)|=\sum _{a\in \mathbb F_{p}^m} |F_1^{-1}(a)|\cdot |F_2^{-1}(c-a)|. \end{aligned}$$

Proof

Let $c\in \mathbb F_{p}^m$. Clearly, $F(x,y)=c$ can be written as $F(x,y)=a+b$, where $a=F_1(x)$, $b=F_2(y)$ and $c=a+b$. In this way, the cardinality of the preimage set $F^{-1}(c)$ is given by

$$\begin{aligned} |F^{-1}(c)|=\sum _{\begin{array}{c} a,b\in \mathbb F_{p^n},\\ a+b=c\in \mathbb F_p^m \end{array}} |F_1^{-1}(a)|\cdot |F_2^{-1}(b)|=\sum _{a\in \mathbb F_{p}^m} |F_1^{-1}(a)|\cdot |F_2^{-1}(c-a)|,\nonumber \\ \end{aligned}$$

(3.2)

completing the proof. $\square$

Recall the following well-known result on the direct sum of two bent functions.

Proposition 3.9

[29] Let $F_1:\mathbb F_{p}^{n}\rightarrow \mathbb F_p^{m},F_2:\mathbb F_{p}^{k}\rightarrow \mathbb F_p^{m}$ be two bent functions and let $F:\mathbb F_{p}^{n}\times \mathbb F_{p}^{k}\rightarrow \mathbb F_p^{m}$ be defined as $F(x,y)=F_1(x)+F_2(y)$ for $x\in \mathbb F_{p}^n$ and $y\in \mathbb F_{p}^k$. Then F is bent if and only if both $F_1$ and $F_2$ are bent.

In the following statement, we show that the direct sum of two almost balanced bent functions is almost balanced again.

Proposition 3.10

Let $F_1:\mathbb F_{p}^{n}\rightarrow \mathbb F_p^{m},F_2:\mathbb F_{p}^{k}\rightarrow \mathbb F_p^{m}$ be two almost balanced bent functions and let $F:\mathbb F_{p}^{n}\times \mathbb F_{p}^{k}\rightarrow \mathbb F_p^{m}$ be defined as $F(x,y)=F_1(x)+F_2(y)$ for $x\in \mathbb F_{p}^n$ and $y\in \mathbb F_{p}^k$. Then the following hold.

• (1) If $F_1$ and $F_2$ are both of the $(+)$ type, then the direct sum F is of the $(+)$ type as well.

• (2) If $F_1$ and $F_2$ are both of the $(-)$ type, then the direct sum F is of the $(+)$ type.

• (3) If $F_1$ is of the $(+)$ type, and $F_2$ is of the $(-)$ type, then the direct sum F is of the $(-)$ type.

Proof

Let $F_1^{-1}(a_1)$ and $F_2^{-1}(a_2)$ be the unique preimages of $F_1$ and $F_2$, respectively. Define $c^*\in \mathbb F_p^m$ as $c^*=a_1+a_2$. Since F is bent by Proposition 3.9, it is enough to show that $|F^{-1}(c^*)|=p^{n+k-m}- p^{(n+k)/2}+ p^{(n+k)/2-m}$, i.e., F is almost balanced of (−) type, or $|F^{-1}(c^*)|=p^{n+k-m}+ p^{(n+k)/2}- p^{(n+k)/2-m}$, i.e., F is almost balanced of ($+$) type, since by Theorem 2.5 the uniformity of the other preimages is forced automatically. From Eq. 3.2, we have

$$\begin{aligned} \begin{aligned} |F^{-1}(c^*)|=&\sum _{a\in \mathbb F_{p}^m} |F_1^{-1}(a)|\cdot |F_2^{-1}(c^*-a)|\\ =&|F_1^{-1}(a_1)|\cdot |F_2^{-1}(a_2)|+\sum _{a\in \mathbb F_{p}^m\setminus \{a_1\}} |F_1^{-1}(a)|\cdot |F_2^{-1}(c^*-a)|\\ =&|F_1^{-1}(a_1)|\cdot |F_2^{-1}(a_2)|+(p^m-1)\cdot |F_1^{-1}(a)|\cdot |F_2^{-1}(c^*-a)|, \end{aligned} \end{aligned}$$

(3.3)

where $a\in \mathbb F_{p}^m\setminus \{a_1\}$.

1. Since $F_1$ and $F_2$ are both of the ($+$) type, we get from Eq. (3.3) that the cardinality of $F^{-1}(c^*)$ is given by

$$\begin{aligned} \begin{aligned} |F^{-1}(c^*)|&=\left( -p^{\frac{k}{2}-m}+p^{k-m}+p^\frac{k}{2}\right) \cdot \left( -p^{\frac{n}{2}-m}+p^{n-m}+p^\frac{n}{2}\right) \\&\quad +\left( p^m-1\right) \cdot \left( p^{k-m}-p^{\frac{k}{2}-m}\right) \cdot \left( p^{n-m}-p^{\frac{n}{2}-m}\right) \\&=p^{n+k-m}+ p^\frac{n+k}{2}- p^{\frac{n+k}{2}-m}, \end{aligned} \end{aligned}$$

from what follows that F is almost balanced of the ($+$) type.

2. Since $F_1$ and $F_2$ are both of the (−) type, we get from Eq. (3.3) that the cardinality of $F^{-1}(c^*)$ is given by

$$\begin{aligned} \begin{aligned} |F^{-1}(c^*)|&=\left( p^{\frac{k}{2}-m}+p^{k-m}-p^\frac{k}{2}\right) \cdot \left( p^{\frac{n}{2}-m}+p^{n-m}-p^\frac{n}{2}\right) \\&\quad +\left( p^m-1\right) \cdot \left( p^{\frac{k}{2}-m}+p^{k-m}\right) \cdot \left( p^{\frac{n}{2}-m}+p^{n-m}\right) \\&=p^{n+k-m}+ p^\frac{n+k}{2}- p^{\frac{n+k}{2}-m}, \end{aligned} \end{aligned}$$

from what follows that F is almost balanced of the ($+$) type.

3. Since $F_1$ is of the ($+$) type, and $F_2$ is of the (−) type, we get from Eq. (3.3) that the cardinality of $F^{-1}(c^*)$ is given by

$$\begin{aligned} \begin{aligned} |F^{-1}(c^*)|&=\left( -p^{\frac{k}{2}-m}+p^{k-m}+p^\frac{k}{2}\right) \cdot \left( p^{\frac{n}{2}-m}+p^{n-m}-p^\frac{n}{2}\right) \\&\quad +\left( p^m-1\right) \cdot \left( p^{k-m}-p^{\frac{k}{2}-m}\right) \cdot \left( p^{\frac{n}{2}-m}+p^{n-m}\right) \\&=p^{n+k-m}- p^\frac{n+k}{2}+ p^{\frac{n+k}{2}-m}, \end{aligned} \end{aligned}$$

from what follows that F is almost balanced of the (−) type. $\square$

Finally, we show that all possible bent functions which are “contained” in a given almost bent function are almost balanced of the same type.

Proposition 3.11

Let $F:\mathbb F_p^n\rightarrow \mathbb F_p^m$ be an almost balanced surjective bent function and let $L:\mathbb F_p^m\rightarrow \mathbb F_p^{k}$ be a surjective linear mapping. Then the following hold.

• (1) If F is of the $(+)$ type, then $L\circ F:\mathbb F_p^n\rightarrow \mathbb F_p^{k}$ is of the $(+)$ type as well.

• (2) If F is of the $(-)$ type, then $L\circ F:\mathbb F_p^n\rightarrow \mathbb F_p^{k}$ is of the $(-)$ type as well.

Consequently, if F is of the $(+)$ type [resp. $(-)$ type], then every component bent function is of the $(+)$ type [resp. $(-)$ type].

Proof

For $b\in \mathbb F_p^m$, let $F^{-1}(b)$ be the unique preimage of F. Denote by $c=L(b)\in \mathbb F_p^k$. Since every non-zero component function of F is bent, we have that $L\circ F$ is bent as well, and hence it is enough to show that $|(L\circ F)^{-1}(c)|=p^{n-k}\pm p^{n/2}\mp p^{n/2-k}$, since by Theorem 2.5 the uniformity of the other preimages is forced automatically. Since $L:\mathbb F_p^m\rightarrow \mathbb F_p^{k}$ is a surjective linear mapping, it is balanced, and hence $|L^{-1}(a)|=p^{m-k}$ for all $a\in \mathbb F_{p}^{k}$. In this way, the cardinality of $(L\circ F)^{-1}(c)$ is given by

$$\begin{aligned} |(L\circ F)^{-1}(c)|=|F^{-1}(b)|+(p^{m-k}-1)|F^{-1}(a)|, \end{aligned}$$

(3.4)

where $a\in \mathbb F_{p}^m\setminus \{b\}$.

1. If F is of the ($+$) type, then $|F^{-1}(b)|=p^{n-m}+p^{n/2}-p^{\frac{n}{2}-m}$ and $|F^{-1}(a)|=p^{n-m}-p^{\frac{n}{2}-m}$ for $a\in \mathbb F_{p}^m\setminus \{b\}$. Then, from Eq. (3.4), we have $|(L\circ F)^{-1}(c)|=p^{\frac{1}{2} (n-2 k)} \left( p^k+p^{n/2}-1\right)$.

2. If F is of the (−) type, then $|F^{-1}(b)|=p^{n-m}-p^{n/2}+p^{\frac{n}{2}-m}$ and $|F^{-1}(a)|=p^{n-m}+p^{\frac{n}{2}-m}$ for $a\in \mathbb F_{p}^m\setminus \{b\}$. Then, from Eq. (3.4), we have $|(L\circ F)^{-1}(c)|=p^{\frac{1}{2} (n-2 k)} \left( -p^k+p^{n/2}+1\right)$.

The last claim follows by considering the composition $L\circ F$, where $L:\mathbb F_p^m\rightarrow \mathbb F_p$ is linear and surjective. $\square$

In particular, these results show that almost balanced bent functions of both types exist for all possible choices of p, n, m (of course, the trivial restrictions n even and $m\le n/2$ follow immediately from the definition of the two types).

Theorem 3.12

Almost balanced bent functions $F:\mathbb F_p^n\rightarrow \mathbb F_p^m$ of types $(+)$ and $(-)$ exist for all $m\le n/2,$ where $n\in \mathbb {N}$ is an arbitrary even number and p is an arbitrary prime number.

Proof

Follows from the application of Proposition 3.11 to almost balanced vectorial bent functions $F:\mathbb F_p^n\rightarrow \mathbb F_p^{n/2}$ from primary constructions given in Propositions 3.2, 3.4 and 3.5, all of which are surjective. $\square$

4 Value Distributions and the Walsh Transform

In this section, we develop the connection between the Walsh transform of a bent function and its value distribution. Particularly, we show that with the knowledge of the Walsh transform, one can get precise information about the value distribution, and vice versa.

Recall the following well-known result, which will play an important role in the connection between value distributions and the Walsh transform.

Lemma 4.1

[22] Let p be an odd prime. Then

$$\begin{aligned}\sum _{r=1}^{p-1} a_r \zeta _p^r={\left\{ \begin{array}{ll} \sqrt{p}, &{} \hbox { if}\ p \equiv 1 \pmod 4, \\ i\sqrt{p}, &{} \hbox { if}\ p \equiv 3 \pmod 4, \end{array}\right. }\end{aligned}$$

has a (unique) integer solution $a_r=\left( \frac{r}{p}\right)$ for all r,  where $\left( \frac{r}{p}\right) \in \{-1,1\}$ is the Legendre symbol.

As we have seen previously, many of the known constructions yield almost balanced bent functions. Interestingly, these preimage set distributions actually force a plateaued function to be bent. Since plateaued functions are much more prevalent than bent functions, this again underscores the special nature of the almost balanced bent functions we introduced.

Theorem 4.2

Let $F :\mathbb F_{p^n} \rightarrow \mathbb F_{p^m}$ be a plateaued function with the preimage distribution of type $(+)$ or $(-)$ where the unique preimage is $F^{-1}(0)$. Then F is bent. More precisely, we have $W_F(b,0)=-p^{n/2}$ for all $b \in \mathbb F_{p^m}^*$ for the type $(-)$ function and $W_F(b,0)=p^{n/2}$ for all $b \in \mathbb F_{p^m}^*$ for the type $(+)$ function.

Proof

Let us first consider the type $(-)$ distribution, so $|F^{-1}(0)|=p^{n-m}-p^{n/2}+p^{n/2-m}$ and $|F^{-1}(y)|=p^{n-m}+p^{n/2-m}$ for non-zero y. Then $|\{x \notin F^{-1}(0) :{{\,\textrm{Tr}\,}}(bF(x))=c\}|$ is divisible by $p^{n-m}+p^{n/2-m}$ for any $c \in \mathbb F_p$ and any $b \in \mathbb F_{p^m}^*$. In particular,

$$\begin{aligned} W_F(b,0) \equiv p^{n-m}-p^{n/2}+p^{n/2-m} \equiv -p^{n/2} \pmod {p^{n-m}+p^{n/2-m}}. \end{aligned}$$

Since F is plateaued, $W_F(b,0)$ can only attain the values with absolute value $p^{(n+k)/2}$ with $k\ge 0$ or 0 for $b \ne 0$. Clearly, $W_F(b,0)=0$ is not possible.

By the congruence above, $p^{n/2}+W_F(b,0) = C (p^{n-m}+p^{n/2-m})$ for some $C \in \mathbb {Z}[\zeta _p]$. This simplifies to

$$\begin{aligned} C(p^{n/2}+1)=p^m(1 + W_F(b,0)/p^{n/2}). \end{aligned}$$

(4.1)

Let us first focus on the case $p=2$, so $C \in \mathbb {Z}$. Then $W_F(b,0)=\pm 2^{n/2+k}$ with $k\le n/2$. Observe that $2^{n/2}+1$ can divide $2^k \pm 1$ only if $k \in \{0,n/2\}$. If $k=n/2$ then ${{\,\textrm{Tr}\,}}(bF(x))$ is constant 0, in particular, the image sets of bF(x) would be contained in a hyperplane of size $2^{n-1}$. This contradicts Proposition 2.8. We conclude that $k=0$ and $W_F(b,0)=-2^{n/2}$ for all $b \ne 0$. Since F is plateaued, it is thus bent.

Now consider $p>2$. Then $C=\sum _{r=1}^{p-1}a_r \zeta _p^r$ with integer coefficients $a_r$. Further, recall that $\sum _{r=1}^{p-1}\zeta _p^r=-1$, so Eq. (4.1) becomes

$$\begin{aligned} \sum _{r=1}^{p-1}(p^m+(p^{n/2}+1)a_r)\zeta _p^r=p^{m-n/2}W_F(b,0) \end{aligned}$$

(4.2)

By [14, Theorem 2], we have $W_F(b,0)= \epsilon p^{\frac{n+k}{2}} \zeta _p^t$ for some $0\le k \le n$ and t where $\epsilon \in \{1,-1\}$ if $n+k$ is even or $n+k$ is odd and $p \equiv 1 \pmod 4$ and $\epsilon \in \{i,-i\}$ if $n+k$ is odd and $p \equiv 3 \pmod 4$. Let us first deal with the case that $W_F(b,0)= \pm p^{\frac{n+k}{2}} \in \mathbb {Z}$. Equation (4.2) then states

$$\begin{aligned}\sum _{r=1}^{p-1}(p^m+(p^{n/2}+1)a_r\mp p^{m+k/2})\zeta _p^r=0.\end{aligned}$$

We conclude that $p^m+(p^{n/2}+1)a_r\mp p^{m+k/2}=0$ for all r, that is,

$$\begin{aligned}p^m\frac{\pm p^{k/2}-1}{p^{n/2}+1}=a_r \in \mathbb {Z}.\end{aligned}$$

We can now argue as in the $p=2$ case that, for divisibility reasons, we must have the minus sign in the equation and $k=0$, leading to a bent function and $W_F(b,0)=-p^{n/2}$.

It remains to exclude the case $W_F(b,0) \notin \mathbb {Z}$. Let us first deal with the case $\epsilon =\pm 1$. Then, again from Eq. (4.2), we have that

$$\begin{aligned}\sum _{r=1}^{p-1}(p^m+(p^{n/2}+1)a_r)\zeta _p^r-p^{\frac{n+k}{2}}\epsilon \zeta _p^t=0\end{aligned}$$

for some $1 \le t \le p-1$, leading to $p^m+(p^{n/2}+1)a_r=0$ for any $r \ne t$. This is clearly never satisfied for $a_r \in \mathbb {Z}$, so this case cannot occur. Let us now assume $\epsilon = \pm i$. Then

$$\begin{aligned} \sum _{r=1}^{p-1}(p^m+(p^{n/2}+1)a_r)\zeta _p^r=\pm p^{\frac{n+k-1}{2}} \left( \sum _{r=1}^{p-1}c_r \zeta _p^{r+t}\right) , \end{aligned}$$

(4.3)

using Lemma 4.1, where $c_r=\left( \frac{r}{p}\right)$. If $t=0$ this means $p^m+(p^{n/2}+1)a_r\mp p^{\frac{n+k-1}{2}}c_r=0$ for all r. This is equivalent to $a_r=p^mc_r \frac{\pm p^{\frac{n+k-m-1}{2}}-c_r}{p^{n/2}+1}$. Since both $c_r=-1,1$ occur, this cannot always be an integer for a fixed k, yielding a contradiction. If $t \ne 0$, then $\zeta _p^n$ occurs on the right hand side of Eq. (4.3), yielding $p^m+(p^{n/2}+1)a_r\mp p^{\frac{n+k-1}{2}}c_r=\pm 1$ for all but one r. Since both $c_r=-1,1$ occur, $2p^{\frac{n+k-1}{2}}$ must be divisible by $p^{n/2}+1$, which is clearly not the case. We get again a contradiction. This concludes the $(-)$ case.

The second extremal case $|F^{-1}(0)|=p^{n-m}+p^{n/2}-p^{n/2-m}$ and $|F^{-1}(y)|=p^{n-m}-p^{n/2-m}$ for each $y \ne 0$ can be dealt with in a similar fashion. This time, we have

$$\begin{aligned}W_F(b,0) \equiv p^{n/2} \pmod {p^{n-m}-p^{n/2-m}}\end{aligned}$$

and with the same argumentation as above with only a change of signs throughout, F is bent where $W_F(b,0)=p^{n/2}$ for all $b \ne 0$. $\square$

Remark 4.3

Note that the condition in Theorem 4.2 that the unique preimage is the preimage of 0 is not restrictive. Indeed, one can shift a plateaued function always to achieve this without changing the preimage set sizes or losing the plateaued property. Of course, such a shift will however change the signs of the Walsh transform.

The following result is a direct consequence of Theorem 4.2, which gives a purely combinatorial way (via preimage set sizes) to check for the regularity of bent functions.

Corollary 4.4

Let p be odd and n be even. Let $F:\mathbb F_p^n\rightarrow \mathbb F_p^m$ be a bent function.

• (1) If F is of type $(+)$ it is inequivalent to a function of the $(-)$ type.

• (2) If F is of the $(+)$ type [or equivalent to a $(+)$ type function] then each weakly regular component function of F is regular.

• (3) If F is of the $(-)$ type [or equivalent to a $(-)$ type function] then each weakly regular component function of F is not regular.

Proof

This follows from Theorem 4.2 and the fact that for p odd and n even regularity is preserved under equivalence, see [6, p. 233] $\square$

Theorem 4.2 also shows that almost balanced bent functions of type $(+)$ or $(-)$ have a very special Walsh transform in the sense that (potentially after a shift) $W_F(b,0)$ is always plus or minus $p^{n/2}$. Interestingly, this is a precise characterization of these distributions, i.e., the converse also holds:

Proposition 4.5

Let $F :\mathbb F_{p^n} \rightarrow \mathbb F_{p^m}$ be a bent function such that $W_F(b,0)=p^{n/2}$ (resp. $-p^{n/2})$ for all $b \in \mathbb F_{p^m}^*$. Then F is almost balanced of type $(+)$ (resp. $(-))$ and the unique preimage is $F^{-1}(0)$.

Proof

We only deal with the $(+)$ case, the $(-)$ case works identically up to changing the sign throughout. We have

$$\begin{aligned} \sum _{b \in \mathbb F_{p^m}}W_F(b,0)=\sum _{x \in \mathbb F_{p^n}}\sum _{b \in \mathbb F_{p^m}} \zeta _p^{{{\,\textrm{Tr}\,}}(bF(x))}=p^m\cdot |\{x \in \mathbb F_{p^n} :F(x)=0\}|. \end{aligned}$$

Counting another way, we also have

$$\begin{aligned} \sum _{b \in \mathbb F_{p^m}}W_F(b,0)=p^n+\sum _{b \in \mathbb F_{p^m}^*}W_F(b,0)=p^n+p^{n/2}(p^m-1). \end{aligned}$$

Comparing these two equations yields

$$\begin{aligned}|\{x \in \mathbb F_{p^n} :F(x)=0\}|=\frac{p^n+p^{n/2}(p^m-1)}{p^m}=p^{n-m}+p^{n/2}-p^{n/2-m}.\end{aligned}$$

By Theorem 2.5, it follows that F is necessarily of type $(+)$. $\square$

For bent functions, where every component function is weakly regular with the same sign (for instance, if all component functions are regular), the possible preimage set sizes are actually very limited. Note that this in particular holds for all Boolean bent functions, where we consider all component functions to be regular by default.

Theorem 4.6

Let $F :\mathbb F_{p^n} \rightarrow \mathbb F_{p^m}$ be a bent function where $W_F(b,0)=\epsilon p^{n/2}\zeta _p^{r_b}$ with $\epsilon \in \{\pm 1,\pm i\}$ for all $b \in \mathbb F_{p^m}^*$. Then n is even, $m\le n/2$ and for any $a \in \mathbb F_{p^m}$ we have

• If $\epsilon \in \{1,i\}$:

  $$\begin{aligned}|F^{-1}(a)|=p^{n-m}+p^{n/2}-p^{n/2-m}(pk_a+1),\end{aligned}$$

  where $0 \le k_a \le \frac{p^m-1}{p-1}$. In particular, $|F^{-1}(a)| \ge p^{n-m}-\frac{p^m-1}{p-1}p^{n/2-m}$.

• If $\epsilon \in \{-1,-i\}$:

  $$\begin{aligned}|F^{-1}(a)|=p^{n-m}-p^{n/2}+p^{n/2-m}(pk_a+1),\end{aligned}$$

  where $0 \le k_a \le \frac{p^m-1}{p-1}$. In particular, $|F^{-1}(a)| \le p^{n-m}+\frac{p^m-1}{p-1}p^{n/2-m}$.

Additionally, $k_0=|\{b \in \mathbb F_{p^m}^* :W_F(b,0)=p^{n/2}\epsilon \zeta _p\}|$ .

Proof

We start with the $\epsilon \in \{1,i\}$ case. We have

$$\begin{aligned} \sum _{b \in \mathbb F_{p^m}}W_F(b,0)=\sum _{x \in \mathbb F_{p^n}}\sum _{b \in \mathbb F_{p^m}} \zeta _p^{{{\,\textrm{Tr}\,}}(bF(x))}=p^m\cdot |\{x \in \mathbb F_{p^n} :F(x)=0\}|. \end{aligned}$$

Counting another way, we also have

$$\begin{aligned} \sum _{b \in \mathbb F_{p^m}}W_F(b,0)=p^n+\sum _{b \in \mathbb F_{p^m}^*}W_F(b,0)=p^n+p^{n/2}\left( \sum _{r=0}^{p-1}\epsilon l_r\zeta _p^r\right) , \end{aligned}$$

(4.4)

where $l_r=|\{b \in \mathbb F_{p^m}^* :F_b^*(0)=r\}|$. Comparing these two equations yields

$$\begin{aligned} |\{x \in \mathbb F_{p^n} :F(x)=0\}|=p^{n-m}+p^{n/2-m}\left( \sum _{r=0}^{p-1}\epsilon l_r\zeta _p^r\right) . \end{aligned}$$

(4.5)

Observe that the left-hand side of Eq. (4.5) is an integer, so the right-hand side also has to be an integer. We divide the proof now into two cases:

n even: Now $\epsilon =1$ and $p^{n/2-m}$ is rational, implying that $\sum _{r=1}^{p-1}l_r\zeta _p^r$ has to be an integer, which in turn implies that all $l_r=l_1=:l$, for all $r>0$ and $\sum _{r=1}^{p-1}l_r\zeta _p^r=-l$. Clearly, $\sum _{r=0}^{p-1}l_r=(p-1)l+l_0=p^m-1$, leading to $l_0=p^m-1-(p-1)l$. Substituting this into Eq. (4.5) yields

$$\begin{aligned}|\{x \in \mathbb F_{p^n} :F(x)=0\}|= & {} p^{n-m}+p^{n/2-m}(p^m-1-pl)\\= & {} p^{n-m}+p^{n/2}-p^{n/2-m}(pl+1)\end{aligned}$$

as claimed where $0\le l \le \frac{p^m-1}{p-1}$. Note that $pl+1$ is not divisible by p, so $p^{n/2-m}$ has to be an integer, leading to $m\le n/2$.

n odd: Now $p^{n/2-m}$ is not rational, so Eq. (4.5) implies that $\sum _{r=0}^{p-1}l_r\zeta _p^r$ has to be 0 or $\sqrt{p}$ times an integer. In the first case, all $l_r$ have to be the same, contradicting $p^m-1=\sum _{r=0}^{p-1}l_r$. In the other case, we have necessarily by Lemma 4.1 that $l_r=l \cdot \left( \frac{r}{p}\right) +l_0$ for all $r>0$ and some l. Then

$$\begin{aligned}p^m-1=\sum _{r=0}^{p-1}l_r=l_0+\sum _{r=1}^{p-1}l\left( \frac{r}{p}\right) +(p-1)l_0=pl_0.\end{aligned}$$

This is a contradiction since p does not divide the left-hand side.

Clearly, shifting the function preserves the bentness as well as the sizes of the preimage sets, so we get the result not only for the preimage of 0 but for all preimages.

For $\epsilon \in \{-1,-i\}$, we get on the right-hand side of Eq. (4.4) $p^n-p^{n/2}\left( \sum _{r=0}^{p-1}\epsilon l_r\zeta _p^r\right)$, i.e., just a change of signs. Then, the same argument as for the regular case leads to the result.

The minimal image set size in the regular case is clearly reached by setting $l=\frac{p^m-1}{p-1}$ and substituting this into the equation yields

$$\begin{aligned} |F^{-1}(a)|&=p^{n-m}+p^{n/2}-p^{n/2-m}\left( \frac{p}{p-1}(p^m-1)+1\right) \\&=p^{n-m}-\frac{1}{p-1}\left( p^{n/2}-p^{n/2-m}\right) =p^{n-m}-\frac{p^m-1}{p-1}p^{n/2-m}. \end{aligned}$$

Similarly, the maximal image set size for $\epsilon \in \{-1,-i\}$ case is reached by setting $l=\frac{p^m-1}{p-1}$ and the result follows again immediately. $\square$

Remark 4.7

The condition that $W_F(b,0)=\epsilon p^{n/2}\zeta _p^{r_b}$ with $\epsilon \in \{\pm 1,\pm i\}$ for all $b \in \mathbb F_{p^m}^*$ is less restrictive than it might appear. It holds in particular for vectorial bent function where all component functions are regular, and for all Boolean bent functions.

Note that Theorem 4.6 in particular gives a simple proof of Nyberg’s bound, i.e., it shows that $m\le n/2$ for Boolean bent functions. In fact, the result is a stronger version of Nyberg’s original result [23, Theorem 3.2.] which showed that all preimage set sizes of vectorial bent functions that have only regular component functions are of the form $p^{n-m/2} \cdot k$ where k is not divisible by p. Theorem 4.6 gives both more precise information on the preimage set sizes as well as generalizes the result to a wider set of bent functions.

For $p=2$, the constraints on the Walsh transform in Theorem 4.6 are trivial and can be dropped. In this case, the possible values coincide and the bounds coincide with the ones from Theorem 2.5 (while in the p-ary case the bounds from Theorem 4.6 are better). In the Boolean case we can in fact derive an extra condition.

Theorem 4.8

Let $F :\mathbb F_{2^n} \rightarrow \mathbb F_{2^m}$ be a Boolean bent function. Then for any $a \in \mathbb F_{2^m}$ we have

$$\begin{aligned}|F^{-1}(a)|=2^{n-m}+2^{n/2}-2^{n/2-m}(2k_a+1),\end{aligned}$$

where $k_a=|\{b \in \mathbb F_{2^m}^* :W_{F}(b,0)=-2^{n/2}\cdot (-1)^{{{\,\textrm{Tr}\,}}(ab)}\}|$ and all $k_a$ have the same parity.

Proof

The result on the preimage set sizes follows immediately from Theorem 4.6. It remains to show that all $k_a$ have the same parity. We have $k_0=|\{b \in \mathbb F_{2^m}^* :W_F(b,0)=-2^{n/2}\}|$. Further

$$\begin{aligned} W_{F+a}(b,0)=(-1)^{{{\,\textrm{Tr}\,}}(ab)}W_F(b,0).\end{aligned}$$

In particular, we see that $W_{F+a}(b,0)$ coincides with $W_{F}(b,0)$ if ${{\,\textrm{Tr}\,}}(ab)=0$ and does not coincide if ${{\,\textrm{Tr}\,}}(ab)=1$. So we have $2^{m-1}$ sign changes. In particular, the number of $+$ signs that get turned into − signs has the same parity as the − signs that get turned into $+$ signs. Consequently, $k_0=|\{b \in \mathbb F_{2^m}^* :W_F(b,0)=-2^{n/2}\}|$ and $s_a=|\{b \in \mathbb F_{2^m}^* :W_{F+a}(b,0)=-2^{n/2}\}|$ have the same parity for any a. But for $a \in \mathbb F_{2^m}$ we have again

$$\begin{aligned} \sum _{b \in \mathbb F_{2^m}}W_{F+a}(b,0)=\sum _{x \in \mathbb F_{2^n}}\sum _{b \in \mathbb F_{2^m}} (-1)^{{{\,\textrm{Tr}\,}}(b(F(x)+a))}=2^m\cdot |F^{-1}(a)|. \end{aligned}$$

and

$$\begin{aligned} \sum _{b \in \mathbb F_{2^m}}W_{F+a}(b,0)=2^n+\sum _{b \in \mathbb F_{2^m}^*}W_{F+a}(b,0)=2^n+2^{n/2}\left( 2^m-1-2s_a\right) . \end{aligned}$$

By comparison, we see that $s_a=k_a$, so all $k_a$ have the same parity as claimed. $\square$

In the case that n is odd (which necessarily implies that p is odd) we also get more precise information on the possible size of the preimages. Note that here we do not need any additional conditions on the Walsh transform.

Theorem 4.9

Let $F:\mathbb F_{p^n} \rightarrow \mathbb F_{p^m}$ be a bent function with p, n odd. Then for any $a\in \mathbb F_{p^m}$ we have $|F^{-1}(a)|=p^{n-m}$ or

$$\begin{aligned}|F^{-1}(a)|=p^{n-m}\pm p^{(n+1)/2-m} \sum _{r=1}^{p-1} \left( k\left( \frac{r}{p}\right) +k_0\right) ,\end{aligned}$$

where $1 \le k \le \frac{p^m-1}{p-1}-(p-1)k_0$ and $k_0$ is a non-negative integer.

Proof

We get again [like Eq. (4.5) just without assuming additional conditions on the Walsh transform]

$$\begin{aligned} |F^{-1}(0)|=p^{n-m}+p^{n/2-m}\left( \sum _{r=0}^{p-1}\epsilon _r \delta k_r\zeta _p^r\right) , \end{aligned}$$

where $k_r$ are non-negative integers satisfying $\sum _r k_r\le p^m-1$, $\epsilon _r \in \{1,-1\}$ and $\delta \in \{1,i\}$ depending on p. Since n is odd, we know that $p^{n/2-m}=\sqrt{p}\cdot p^{(n-1)/2-m}$ is not rational. Then, either all $k_r=0$ (leading to $|F^{-1}(0)|=p^{n-m}$) or, using Lemma 4.1, we have $\epsilon _rk_r=\epsilon _1k\left( \frac{r}{p}\right) +k_0$ for all $r>0$ with $1\le k \le \frac{p^m-1}{p-1}-(p-1)k_0$, leading to

$$\begin{aligned} |\{x \in \mathbb F_{p^n} :F(x)=0\}|=p^{n-m}\pm p^{(n+1)/2-m} \sum _{r=1}^{p-1} \left( k\left( \frac{r}{p}\right) +k_0\right) . \end{aligned}$$

Again, shifting does not affect the preimage set sizes, so we get the same conditions also on the preimages of non-zero elements. $\square$

5 Value Distributions of Bent Functions $F:\mathbb {F}_p^n \rightarrow \mathbb {F}_p^m$ with Small Values of m

While listing all possible preimage size distributions for vectorial bent functions in complete generality seems to be a very difficult and out-of-reach task, for small values of m such results are possible to obtain from our work in the previous sections. We want to remind the reader that the case $m=1$ is well-known (see Theorem 1.3), while the situation for $m>1$ has up until now not been determined.

For bent functions from $\mathbb F_{p}^n$ to $\mathbb F_{p}^m$ one can use the results from the previous section to derive very strong conditions on the preimage distributions if certain spectral conditions are satisfied. Note that this again covers the important cases of Boolean vectorial bent functions, p-ary bent functions with regular component functions.

Theorem 5.1

Let $F :\mathbb F_{p}^n \rightarrow \mathbb F_{p}^m$ be a bent function such that $W_F(b,0)=\epsilon p^{n/2}\zeta _p^{r_b}$ with $\epsilon \in \{1, i\}$ for all $b \in \mathbb F_{p^m}^*$. Then, the preimage set sizes are $X_i=p^{n-m}+p^{n/2-m}(pT_i-1)$ for all $i \in \{1,\dots ,p^m\}$ where the $T_i$ are integers satisfying the two equations

$$\begin{aligned} \sum _{i=1}^{p^m} T_i^2&=p^{2m-2}, \end{aligned}$$

(5.1)

$$\begin{aligned} \sum _{i=1}^{p^m} T_i&=p^{m-1}. \end{aligned}$$

(5.2)

Proof

Assume Eqs. (2.3) and (2.4) hold for $H_1,\dots ,H_{p^m}$. By Theorem 4.6, we have $H_i=p^{n/2}-p^{n/2-m}(pk_i+1)=p^{n/2-m}(p^m-pk_i-1)$ for $0 \le k_i \le \frac{p^m-1}{p-1}$ and thus $p^{n/2-m}|H_i$. Write $H_i'=\frac{H_i}{p^{n/2-m}}$. Plugging this into Eqs. (2.3) and (2.4) yields

$$\begin{aligned} \sum _{i=1}^{p^m} (H'_i)^2&=p^{2m}-p^m, \\ \sum _{i=1}^{p^m} H'_i&=0. \end{aligned}$$

Observe that $H_i'\equiv -1 \pmod p$ and set $H_i'=pT_i-1$. Plugging this into the equations above yields the desired equations on the $T_i$. Retracing the substitutions yields $X_i=p^{n-m}+H_i=p^{n-m}+p^{n/2-m}H_i'=p^{n-m}+p^{n/2-m}(pT_i-1)$. $\square$

The extremal distribution $(+)$ solves Eqs. (5.1) and (5.2) with $T_1=p^{m-1}$ and $T_i=0$ for all $i>0$ [recall that the $(-)$ case cannot occur here if p is odd by Theorem 4.2]. For $p=2$, the solution $T_1=-2^{m-1}+1$, $T_i=1$ for $i>0$ yields the $(-)$ case.

Theorem 5.2

Let $F :\mathbb F_{p}^n \rightarrow \mathbb F_{p}^m$ be a bent function such that $W_F(b,0)=\epsilon p^{n/2}\zeta _p^{r_b}$ with $\epsilon \in \{-1, -i\}$ for all $b \in \mathbb F_{p^m}^*$. Then, the preimage set sizes are $X_i=p^{n-m}+p^{n/2-m}(1-pT_i)$ for all $i \in \{1,\dots ,p^m\}$ where the $T_i$ are integers satisfying the two equations

$$\begin{aligned} \sum _{i=1}^{p^m} T_i^2&=p^{2m-2}, \end{aligned}$$

(5.3)

$$\begin{aligned} \sum _{i=1}^{p^m} T_i&=p^{m-1}. \end{aligned}$$

(5.4)

Proof

Assume Eqs. (2.3) and (2.4) hold for $H_1,\dots ,H_{p^m}$. By Theorem 4.6 we have $H_i=p^{n/2-m}(pk_i+1)-p^{n/2}=p^{n/2-m}(pk_i-p^m+1)$ for $0 \le k_i \le \frac{p^m-1}{p-1}$ and thus $p^{n/2-m}|H_i$. Write $H_i'=\frac{H_i}{p^{n/2-m}}$. Plugging this into Eqs. (2.3) and (2.4) yields

$$\begin{aligned} \sum _{i=1}^{p^m} (H'_i)^2&=p^{2m}-p^m, \\ \sum _{i=1}^{p^m} H'_i&=0. \end{aligned}$$

Observe that $H_i'\equiv 1 \pmod p$ and set $H_i'=-pT_i+1$. Plugging this into the equations above yields the desired equations on the $T_i$. Retracing the substitutions yields $X_i=p^{n-m}+H_i=p^{n-m}+p^{n/2-m}H_i'=p^{n-m}+p^{n/2-m}(-pT_i+1)$. $\square$

Here, the extremal distribution $(-)$ solves Eqs. (5.3) and (5.4) with $T_1=p^{m-1}$ and $T_i=0$ for all $i>0$ (here the $(+)$ case cannot occur if p is odd). For $p=2$, the solution $T_1=-2^{m-1}+1$, $T_i=1$ for $i>0$ yields the $(+)$ case.

For $p=2$ and low values of m (and arbitrary n) we can use these results to determine all possible preimage distributions of vectorial Boolean bent functions. Since the conditions on the Walsh transform hold trivially in this case, we can use both Theorems 5.1 and  5.2 and get the same results. Note also that the symmetry (with respect to the signs) from Eqs. (2.3) and (2.4) is still visible in the binary case: Indeed, if $\{T_1,\dots ,T_{2^m}\}$ is a valid solution then so is $\{-T_1+1,-T_2+1,\dots ,-T_{2^m}+1\}$. Note that all $T_i$ have the same parity by Theorem 4.8. By the symmetry above, we can concentrate on even $T_i$ since the solutions with odd $T_i$ are covered by the symmetry above.

While this direct connection does not exist anymore in the p-ary case, the solutions here still come in pairs since a solution of the Eqs, (5.1) and (5.2) yield different distributions for the two Theorems 5.1 and  5.2 (while the distributions in the Boolean case overlap).

Theorem 5.3

Let $F :\mathbb F_2^n \rightarrow \mathbb F_2^2$ be a bent function. Then there are only two possible preimage distributions which are exactly the two extremal distributions $(+)$ and $(-)$. Both distributions occur for any even $n\ge 4$.

Proof

From Theorem 5.1 we get the equations in the $T_i$:

$$\begin{aligned} \sum _{i=1}^{4} T_i^2=4 ,\quad \sum _{i=1}^{4} T_i=2. \end{aligned}$$

It is easy to see that the only possible integer solutions are (up to permutation of the $T_i$): $T_1=2$, $T_2=T_3=T_4= 0$ and $T_1=-1$, $T_2=T_3=T_4=1$. These distributions belong to the two extremal distributions $(+)$ and $(-)$. Conversely, Theorem 3.12 shows that vectorial bent functions $F:\mathbb F_2^n\rightarrow \mathbb F_2^2$ of types $(+)$ and $(-)$ exist for all $n \ge 4$. $\square$

This allows us to deduce a simple corollary.

Corollary 5.4

Let $F :\mathbb F_2^n \rightarrow \mathbb F_2^m$ with $m\in \{1,2\}$ be a plateaued function. Then F is bent if and only if F is of type $(-)$ or $(+)$.

Proof

Follows from Theorem 4.2 together with Remark 2.6 and Theorem 5.3, respectively. $\square$

Theorem 5.5

Let $F :\mathbb F_{2}^n \rightarrow \mathbb F_{2}^3$ be a bent function. Then there are only four possible preimage distributions which are the distributions $(+)$ and $(-),$ and the distributions with preimage set sizes $X_i=2^{n-3}+2^{n/2-3}(2T_i-1)$ where

$$\begin{aligned}&T_1=-2,\quad T_2=T_3=T_4=2,\quad T_5=\cdots =T_8=0 \text {, or}\\&T_1=3,\quad T_2=T_3=T_4=-1,\quad T_5=\cdots =T_8=1. \end{aligned}$$

Proof

From Theorem 5.1 we get the equations in the $T_i$:

$$\begin{aligned} \sum _{i=1}^{8} T_i^2=16 ,\quad \sum _{i=1}^{8} T_i=4. \end{aligned}$$

From Theorem 4.8 and the discussion above we can concentrate on even $T_i$, getting the odd solutions via symmetry. This effectively makes the set of equations even easier. With little effort, one gets the solutions. Up to a permutation, we only get the two solutions belonging to $(+)$ and $(-)$: $T_1=4$, $T_2=T_3=\cdots =T_8= 0$ and $T_1=-3$, $T_2=T_3=\cdots =T_8=1$, as well as the even solution $T_1=-2$, $T_2=T_3=T_4=2$, $T_5=\cdots =T_8=0$ and its “symmetric” solution $T_1=3$, $T_2=T_3=T_4=-1$, $T_5=\cdots =T_8=1$. $\square$

Remark 5.6

We have checked with a computer program using Wolfram Mathematica [32] that by adding linear functions to representatives of the equivalence classes of vectorial bent functions $F:\mathbb F_2^6\rightarrow \mathbb F_2^3$ from [26], it is possible to obtain all four distributions in Theorem 5.5. We conjecture that all four preimage distributions from Theorem 5.5 occur for all vectorial bent functions $F:\mathbb F_2^n\rightarrow \mathbb F_2^3$ with even $n\ge 6$. Of course, it was only left to prove the existence of the two non-extremal distributions since the two extremal distributions are covered by Theorem 3.12.

In the following statement, we also analyse value distributions of vectorial Boolean bent functions $F :\mathbb F_{2^n} \rightarrow \mathbb F_{2^4}$.

Theorem 5.7

Let $F :\mathbb F_{2^n} \rightarrow \mathbb F_{2^4}$ be a bent function. Then there are only 14 possible preimage distributions which are the distributions with preimage set sizes $X_i=2^{n-4}+2^{n/2-4}(2T_i-1)$ where the $T_i$ are one of the following:

• (1) $T_1=-6, T_2=\cdots =T_{9}=0,T_{10}=\cdots =T_{16}=2,$

• (2) $T_1=-4, T_2=T_{3}=-2,T_{4}=\cdots =T_{9}=0,T_{10}=\cdots =T_{15}=2, T_{16}=4,$

• (3) $T_1=-4, T_2=\cdots =T_{13}=0,T_{14}=\cdots =T_{16}=4,$

• (4) $T_1=\cdots =T_{6}=-2,T_{7}=\cdots =T_{16}=2,$

• (5) $T_1=\cdots =T_{4}=-2,T_{5}=\cdots =T_{10}=0,T_{11}=\cdots =T_{14}=2, T_{15}=T_{16}=4,$

• (6) $T_1=\cdots =T_{3}=-2,T_{4}=\cdots =T_{11}=0,T_{12}=\cdots =T_{15}=2, T_{16}=6$,

• (7) $T_1=\cdots =T_{15}=0,T_{16}=8,$

• (8) The symmetric solutions

  $$\begin{aligned} \{-T_1+1,-T_2+1,\ldots ,-T_{16}+1\} \end{aligned}$$

  for all 7 solutions above.

Proof

We again solve the equations on the $T_i$, focusing only on even $T_i$. The solutions for odd $T_i$ follow again using the symmetry $\{T_1,\dots ,T_{16}\} \mapsto \{-T_1+1,-T_2+1,\dots ,-T_{16}+1\}$. Setting $T_i=2T_i'$, we get

$$\begin{aligned} \sum _{i=1}^{16} T_i'^2=16 ,\;\; \sum _{i=1}^{16} T_i'=4. \end{aligned}$$

Clearly, $|T_i'| \le 4$ for any i. Define $c_j$ for $-4 \le j \le 4$ such that $c_j$ is the number of times that $T_i=j$ in the previous set of equations. We can then rephrase these two equations as three easier equations, namely

$$\begin{aligned}\sum _{j=-4}^{4} c_j=16 ,\;\; \sum _{j=-4}^{4} j^2c_j=16 ,\quad \sum _{j=-4}^{4} jc_j=4. \end{aligned}$$

Here, the first equation corresponds to the fact that there are $1 \le i \le 16$ in the original set of equations and the second and third equation capture the previous equations. The solutions of these three equations can be found quite easily by computer (or with a bit of effort by hand), keeping in mind that the $c_j$ are non-negative integers. Retranslating these in terms of $T_i$, we get in total 14 solutions. 7 Of them correspond to the ones given in the statement of the theorem, as well as the following 7 additional ones:

• (i) $T_1=T_2=-4, T_3=\cdots =T_{8}=0,T_{9}=\cdots =T_{16}=2,$

• (ii) $T_1=-4, T_2=\cdots =T_{4}=-2,T_5=\cdots =T_7=0,T_{8}=\cdots =T_{16}=2,$

• (iii) $T_1=-4, T_2=-2,T_3=\cdots =T_{11}=0,T_{12}=\cdots =T_{14}=2,T_{15}=T_{16}=4$,

• (iv) $T_1=-4, T_2=\cdots =T_{12}=0,T_{13}=\cdots =T_{15}=2,T_{16}=6$,

• (v) $T_1=\cdots =T_{5}=-2,T_{6}=\cdots =T_{8}=0,T_9=\cdots =T_{15}=2,T_{16}=4$,

• (vi) $T_1=\cdots =T_{3}=-2,T_{4}=\cdots =T_{12}=0,T_{13}=2,T_{14}=\cdots =T_{16}=4$,

• (vii) $T_1=T_{2}=-2,T_{3}=\cdots =T_{13}=0,T_{14}=2,T_{15}=4,T_{16}=6$.

Now, we show that all 7 distributions from the list cannot occur for bent functions.

By Theorem 4.6, we have $k_a=|\{b \in (\mathbb F_{2^4})^* :W_F(b,0)=-2^{n/2}\cdot (-1)^{{{\,\textrm{Tr}\,}}(ab)}\}|=8-T_i$ for some $a \in \mathbb F_2^4$ and some $1 \le i \le 16$. We can pick without loss of generality (by shifting the function by a constant) the i that corresponds to $k_0$. Set $K=\{b \in \mathbb F_{2^4}^* :W_F(b,0)=-2^{n/2}\}$.

Let us first assume that $k_0=12$, corresponding to a value of $T_i=-4$, so $W_F(b,0)=-2^{n/2}$ for 12 choices of b and $W_F(b,0)=2^{n/2}$ for 3 choices of b. Then $k_a \in \{4,6,8,10\}$ for $a \ne 0$, depending on ${{\,\textrm{Tr}\,}}(ab)$ for $b \in K$. For instance, $k_a=4$ iff all b with ${{\,\textrm{Tr}\,}}(ab)=1$ are contained in K and $k_a=6$ iff precisely 7 b with ${{\,\textrm{Tr}\,}}(ab)=1$ are contained in K. In particular, it is impossible that $k_a=12$ for $a \ne 0$. This means that there can only be at most one i such that $T_i=-4$, excluding the case i).

We can write $\{x,y,z\}=\mathbb F_{2^4}^*\setminus K$ and let H be a hyperplane of $\mathbb F_{2^4}$ containing x, y, z. Then $|H \cap K|=4$ and (denoting $\overline{H}=\mathbb F_{2^4} \setminus H$) clearly $|\overline{H} \cap K|=8$. By the considerations above this means that there exists an a such that $k_a=4$, corresponding to a $T_j=4$. We conclude that if one $T_i=-4$ there also has to exist a j with $T_j=4$. This excludes the cases ii) and iv.

Assume now that we have another value of j such that $T_j=4$ (still $T_i=-4$), corresponding to a $k_a=4$. Then (as outlined above) there is a hyperplane H with $|H \cap K |=4$ and H must contain x, y, z. If x, y, z are linearly independent, this $H= \langle x,y,z \rangle$ is uniquely determined. If $x+y=z$ then there are precisely 3 choices for H. We conclude that if $T_i=-4$ there are either one or three j such that $T_j=4$. This excludes the case iii.

Let us now deal with the last three cases v, vi and vii. All have in common that there is no i with $T_i=-4$ but there is an i with $T_i=4$. Let us thus assume that $k_0=4$, which corresponds to a $T_i=4$. We can thus set $K=\{x,y,z,w\}$. We have $k_a=12$ (corresponding to $T_j=-4$) if and only if ${{\,\textrm{Tr}\,}}(ax)={{\,\textrm{Tr}\,}}(ay)={{\,\textrm{Tr}\,}}(az)={{\,\textrm{Tr}\,}}(aw)=0$ for some $a \ne 0$, i.e., K is contained in a hyperplane. Since $T_j=-4$ does not occur, this means K is not contained in a hyperplane which means that x, y, z, w are linearly independent. Similarly, we have $k_a=4$ (corresponding to a second $T_j=4$) for $a \ne 0$ if and only if ${{\,\textrm{Tr}\,}}(ax)={{\,\textrm{Tr}\,}}(ay)={{\,\textrm{Tr}\,}}(az)={{\,\textrm{Tr}\,}}(aw)=1$ for some a, i.e., K is contained in an affine hyperplane. This occurs if and only if $x+y,x+z,x+w$ are contained in the hyperplane $H_a=\{b :{{\,\textrm{Tr}\,}}(ab)=0\}$ and $x \notin H_a$. But $x+y,x+z,x+w$ are linearly independent, so $H_a= \langle x+y,x+z,x+w \rangle$ is uniquely determined. This means that there is at most one second j (next to i) such that $T_j=4$, excluding case vi. If there is no $j\ne i$ such that $T_j=4$ then (by the argument above) K is not contained in an affine hyperplane, in other words, $|H \cap K| \ge 1$ for all hyperplanes H. But set again $H=\langle x+y,x+z,x+w \rangle$ and since x, y, z, w are linearly independent, we have $H \cap K = \emptyset$, yielding a contradiction. We conclude that there must be exactly one second $j\ne i$ such that $T_j=4$ . This excludes the last remaining two cases v and vii.

It is easy to observe that the symmetric cases $\{-T_1+1,-T_2+1,\dots ,-T_{16}+1\}$ to the 7 cases we just excluded also cannot occur. Indeed, we can repeat the arguments above, just replacing

$$\begin{aligned} \begin{aligned} k_a=&|\{b \in \mathbb F_{2^4}^* :W_F(b,0)=-2^{n/2}\cdot (-1)^{{{\,\textrm{Tr}\,}}(ab)}\}| \text{ with } \\ k'_a=&|\{b \in \mathbb F_{2^4}^* :W_F(b,0)=2^{n/2}\cdot (-1)^{{{\,\textrm{Tr}\,}}(ab)}\}|, \end{aligned} \end{aligned}$$

i.e., a change of a sign. $\square$

We have checked by computer that all the 14 cases in Theorem 5.7 do in fact occur for vectorial Boolean bent functions in 8 variables.

Proposition 5.8

The preimage distributions of vectorial bent functions $F:\mathbb F_2^8\rightarrow \mathbb F_2^4$ are precisely the 14 distributions given in Theorem 5.7.

Verification Consider the following vectorial bent function $F:\mathbb F_2^8\rightarrow \mathbb F_2^4$ (this is the first function in the list [24] obtained in [25]), which is given by its algebraic normal form as follows:

$$\begin{aligned}{} & {} F(x_1,\ldots ,x_8)\nonumber \\{} & {} \quad =\begin{pmatrix}x_1 x_5 + x_2 x_6 + x_3 x_7 + x_4 x_8\\ x_1 x_3 + x_1 x_4 + x_3 x_4 + x_2 x_5 + x_4 x_5 + x_3 x_6 + x_4 x_6 + x_1 x_7 + x_3 x_7 + x_4 x_7 + x_2 x_8\\ x_1 x_5 + x_3 x_5 + x_4 x_5 + x_2 x_6 + x_3 x_6 + x_2 x_7 + x_1 x_8 + x_2 x_8\\ x_1 x_3 + x_1 x_4 + x_3 x_5 + x_2 x_7 + x_5 x_7 + x_1 x_8 + x_6 x_8 \end{pmatrix}.\nonumber \\ \end{aligned}$$

(5.5)

With a help of a computer program, it is possible to check that by adding random linear functions to the bent function F defined in (5.5), one soon gets all possible distributions given in the statement of Theorem 5.7. $\square$

Remark 5.9

In view of Proposition 5.8 and Theorem 5.7, we conjecture that all 14 preimage distributions from Theorem 5.7 occur for all vectorial bent functions $F:\mathbb F_2^n\rightarrow \mathbb F_2^4$ with even $n\ge 8$.

Finally, we demonstrate that in some cases it is possible to determine possible value distributions of bent functions without the exact knowledge of spectral properties of the considered functions. This allows us to extend the proof of Theorem 5.3 to arbitrary groups of sizes $|G|=2^n$ and $|H|=4$.

Theorem 5.10

Let G and H be two finite groups with $|G|=2^n$ and $|H|=4$. Let $F :G \rightarrow H$ be a perfect nonlinear function. Then there are only two possible preimage distributions which are exactly the two extremal distributions from Theorem 2.4.

Proof

Assume Eqs. (2.3) and (2.4) hold for $H_1,\dots ,H_{4}$ and $n>4$. Then

$$\begin{aligned}\sum _{i=1}^{4} H_i^2\equiv 0 \pmod 8.\end{aligned}$$

Observe that $H_i^2$ is $0,1,4 \pmod 8$ and $H_i^2\equiv 1 \pmod 8$ if and only if $H_i$ is odd. This implies that the $H_i$ are all even, say $H_i=2H_i'$. Then Eqs. (2.3) and (2.4) become

$$\begin{aligned} \sum _{i=1}^{4} (H_i')^2&=2^{n-2}-2^{(n-2)-2}, \\ \sum _{i=1}^{4} H_i'&=0. \end{aligned}$$

$H_1,\dots ,H_4$ is thus a solution of Eqs. (2.3) and (2.4) for n if and only if $H_1',\dots ,H_4'$ is a solution of Eqs. (2.3), (2.4) for $n-2$. We can continue this procedure until $n=4$, since in this case $2^{n-2}$ is no longer divisible by 8. We arrive at

$$\begin{aligned} \sum _{i=1}^{4} (H_i')^2&=2^{4}-2^{4-2}=12 ,\\ \sum _{i=1}^{4} H_i'&=0. \end{aligned}$$

One can see that the only possible solutions (up to permutation of the $H_i$) are $H_1=H_2=H_3= \pm 1$, $H_4=\mp 3$. This means that the only possible solutions for the general case are $H_1=H_2=H_3= \pm 2^{n/2-2}$, $H_4=\mp 3 \cdot 2^{n/2-2}$. These correspond to preimage set sizes $X_1=X_2=X_3=2^{n-2} \pm 2^{n/2-2}$, $X_4=2^{n-2} \mp 3\cdot 2^{n/2-2}$. $\square$

6 Value Distributions of Planar Functions

In this section, we discuss the particularly interesting case of planar functions, i.e., vectorial bent functions with p odd and $n=m$. Planar functions have important applications both for difference sets (as they give rise to examples of skew Hadamard difference sets that are inequivalent to Paley difference sets [11]) and commutative semifields (see, e.g., [13]) which play an important role in finite geometry.

The image sets of planar functions were considered in [17] and [9] where lower and upper bounds (respectively) of the image set sizes of planar functions were derived. Using the tools we developed in the previous sections we are able to unify these results and give an alternative proof of one of the main results in [17, Theorem 2] as well as [9], while giving (for the upper bound) more precise information on the preimage set distribution that occurs in the extremal cases. Recall that we call a function $F :\mathbb F_{p^n} \rightarrow \mathbb F_{p^n}$ with p odd 2-to-1 on $\mathbb F_{p^n}$ if one unique element has one preimage and $(p^n-1)/2$ elements have 2 preimages.

Proposition 6.1

Let $F :\mathbb F_{p^n} \rightarrow \mathbb F_{p^n}$ be a planar function. Then

$$\begin{aligned}\frac{p^n+1}{2} \le |{{\,\textrm{Im}\,}}(F)| \le p^n-\frac{1}{2}(\sqrt{4p^n-3}-1).\end{aligned}$$

The lower bound is satisfied with equality if and only if F is 2-to-1 on $\mathbb F_{p^n}$ and the upper bound is satisfied with equality if and only if all but one element in the image set have a unique preimage.

Proof

We consider Eqs. (2.3) and (2.4). Since $H_i=1+X_i$ we have $H_i \ge -1$. Set $k=|\{i :H_i=-1\}|$ and let $H_1=\cdots =H_k=-1$, $H_{k+1}=\cdots =H_{k+s}=0$ and $H_i>0$ for $i>k+s$. Clearly, $|{{\,\textrm{Im}\,}}(F)|=p^n-k$. We get from Eqs. (2.3) and (2.4)

$$\begin{aligned} \sum _{i=k+s+1}^{p^n} H_i^2&=p^n-1-k, \end{aligned}$$

(6.1)

$$\begin{aligned} \sum _{i=k+s+1}^{p^n} H_i&=k. \end{aligned}$$

(6.2)

By the Cauchy–Schwarz inequality, we get $k^2\le (p^n-1-k)(p^n-k-s)$

with equality if and only if all $H_i$ with $i>k+s$ are equal. From Proposition 2.8 we know the possible minimum value is $k=\frac{p^n-1}{2}$. Plugging this in yields $\frac{p^n-1}{2} \le \frac{p^n+1}{2}-s$, only leaving $s \in \{0,1\}$ as possibilities. If $s=0$, then Eq. (6.2) cannot be satisfied as all $H_i \ge 1$ and the sum contains $\frac{p^m+1}{2}=k+1$ terms. Thus $s=1$ and it is easy to see that $H_i=1$ for all $i>k+s$, meaning that $X_i=2$ for these i and F is 2-to-1.

Let us consider the upper bound now. Define $M_i$ as the number of elements $y \in {{\,\textrm{Im}\,}}(F)$ with precisely i preimages. Then (by Proposition 2.1) $p^n+p^{n-m}(p^n-1)=\sum _{i=1}^k i^2M_i$ where r is the maximum preimage set size of F. Note that $\sum _{i=1}^r iM_i=p^n$, so

$$\begin{aligned}p^{n-m}(p^n-1)=\sum _{i=1}^r i(i-1)M_i \le r \sum _{i=1}^r (i-1)M_i,\end{aligned}$$

with equality if and only if $M_i=0$ for all $2 \le i <r$. Then

$$\begin{aligned} |{{\,\textrm{Im}\,}}(F)|&= \sum _{i=1}^r M_i = \sum _{i=1}^r iM_i - \sum _{i=1}^r (i-1)M_i \\&=p^n-\sum _{i=1}^r (i-1)M_i \le p^n-\frac{p^{n-m}(p^n-1)}{r}, \end{aligned}$$

still with equality if and only if $M_i=0$ for all $2 \le i <r$. Clearly, the bound is best if r is maximal, i.e., if the maximum preimage set size is as high as possible, which means maximizing one $H_i$ in Eq. (6.1). This occurs if Eqs. (6.1) and (6.2) only have one term on the left-hand side, which yields $H_i=k$,$H_i^2=p^n-1-k$, i.e., $k^2+k=p^n-1$ which has the positive solution $k=\frac{1}{2}(\sqrt{4p^n-3}-1)$, leading to $|{{\,\textrm{Im}\,}}(F)|=p^n-\frac{1}{2}(\sqrt{4p^n-3}-1)$. Equality is achieved if and only if there is one element with $\frac{1}{2}(\sqrt{4p^n-3}-1)+1$ preimages (since $X_i=1+H_i=1+k$) and all other elements in the image set have a unique preimage. $\square$

Remark 6.2

We are not aware of any planar functions attaining the upper bound. A necessary condition is that $4p^n-3=4(p^n-1)+1=8\left( \frac{p^n-1}{2}\right) +1$ is a square. As already observed by Coulter and Senger in a slightly different context [9], this is the case if and only if $\frac{p^n-1}{2}$ is a triangular number, i.e., a number of the form $u(u-1)/2$. This would mean $p^n-1=u(u-1)$, i.e., this occurs if and only if $p^n-1$ is the product of two consecutive numbers. This can clearly never occur if n is even since then $p^n-1=(p^{n/2}-1)(p^{n/2}+1)$ and it is clear that $p^n-1$ is not the product of two consecutive numbers. For n odd, this can however happen, simple examples include $7-1=2 \cdot 3$ and $7^3-1=18\cdot 19$.

Note that many examples of planar functions satisfying the lower bound are known, in fact, all planar Dembowski–Ostrom polynomials (i.e., polynomials of the form $\displaystyle F(x)=\sum \nolimits _{i,j=0}^{n-1}a_{i,j}x^{p^i+p^j}$, where $a_{i,j}\in \mathbb F_{p^n}$ and $x\in \mathbb F_{p^n}$) are necessarily 2-to-1 which is well known [17, Corollary 1] , as well as the (non-Dembowski–Ostrom) Coulter–Matthews planar function. We add a short proof of the Dembowski–Ostrom case using our techniques here as well.

Proposition 6.3

Let $F :\mathbb F_{p^n} \rightarrow \mathbb F_{p^n}$ be a planar function such that $F(x)=F(-x)$ for all $x \in \mathbb F_{p^n}$. Then F is 2-to-1.

Proof

We again consider Eqs. (2.3) and (2.4). We have $F(x)=F(-x)$ for all $x \in \mathbb F_{p^n}$, so the number of preimages is odd only precisely once. Then the $H_i=1+X_i$ are all odd with exactly one exception. By Eq. (2.3), one $H_i$ has to be 0 and all other satisfy $H_i^2=1$ and then by Eq. (2.4), necessarily $\frac{p^n-1}{2}$ choices of $H_i$ are 1 and the same holds for $-1$. Keeping in mind that $X_i=1+H_i$, we conclude that F is 2-to-1. $\square$

Again, the 2-to-1 property (i.e., information on the preimage size distribution) is enough to force planarity as long as we only consider plateaued functions. This is in many ways surprising since both the 2-to-1 functions as well as plateaued functions seem to be much more prevalent than planar functions. The result and proof idea is an analogue of a similar result for 3-to-1 almost perfect nonlinear functions achieved in [15].

Theorem 6.4

Let $F :\mathbb F_{p^n} \rightarrow \mathbb F_{p^n}$ be a plateaued, 2-to-1 function. Then F is planar.

Proof

Denote for simplicity by $\chi (x)=\zeta _p^{{{\,\textrm{Tr}\,}}(x)}$ for $x\in \mathbb F_p^n$ the canonical additive character. Let us first show that F does not have any balanced component functions, i.e., $W_F(b,0)\ne 0$ for $b \in \mathbb F_{p^n}^*$. Since F is 2-to-1 we have

$$\begin{aligned}W_F(b,0) = \sum _{x \in \mathbb F_{p^n}} \chi (bF(x)) = \chi (bx_0) + 2\sum _{x \in M} \chi (bx),\end{aligned}$$

where $x_0$ is the element that has 1 preimage and M is the set of elements with 2 preimages. We have thus clearly $W_F(b,0) \equiv \chi (bx_0) \not \equiv 0 \pmod 2$, in particular $W_F(b,0) \ne 0$.

Now set $N_k=|\{b \in \mathbb F_{p^n}^* :|W_F(b,0)|=p^{(n+k)/2}\}|$. Since $W_F(b,0)\ne 0$, we infer that $N_k$ is the number of plateaued component functions with amplitude k, so

$$\begin{aligned} \sum _{k \ge 0 } N_k = p^n-1. \end{aligned}$$

(6.3)

Since F is 2-to-1, we have

$$\begin{aligned}\frac{1}{p^n}\sum _{b \in \mathbb F_{p^n}}\sum _{x_1,x_2 \in \mathbb F_{p^n}} \chi (b(F(x_1)-F(x_2))=1+2(p^n-1)=2p^n-1.\end{aligned}$$

On the other hand,

$$\begin{aligned} \frac{1}{p^n}\sum _{b \in \mathbb F_{p^n}}\sum _{x_1,x_2 \in \mathbb F_{p^n}} \chi (b(F(x_1)-F(x_2))&= p^n+\frac{1}{p^n}\sum _{b \in \mathbb F_{p^n}^*}\sum _{x_1,x_2 \in \mathbb F_{p^n}} \chi (b(F(x_1)-F(x_2)) \\&=p^n+\frac{1}{p^n}\sum _{b \in \mathbb F_{p^n}^*}\sum _{x_1,x_2 \in \mathbb F_{p^n}} \chi (bF(x_1))\overline{\chi (bF(x_2))}\\&=p^n+\frac{1}{p^n}\sum _{b \in \mathbb F_{p^n}^*}|W_F(b,0)|^2 \\&= p^n + N_0+pN_1+p^2N_2+ \cdots \end{aligned}$$

We thus infer

$$\begin{aligned}p^n-1 = N_0+pN_1+p^2N_2+ \cdots \end{aligned}$$

and with Eq. (6.3) $N_0=p^n-1$ and $N_k=0$ for all $k>0$, so all component functions of F are bent and F is planar. $\square$

This allows us to state the following corollary. Note that this is a strict generalization of one of the main results in [31, Theorem 2.3] which showed the statement only for DO polynomials, which are a subclass of plateaued functions satisfying $F(x)=F(-x)$.

Corollary 6.5

Let $F :\mathbb F_{p^n} \rightarrow \mathbb F_{p^n}$ be a plateaued function such that $F(x)=F(-x)$ for all $x \in \mathbb F_{p^n}$. Then F is planar if and only if F is 2-to-1.

Proof

Follows from Theorem 6.4 and Proposition 6.3. $\square$

Corollary 6.5 is indeed a generalization from the DO case since plateaued planar functions that are not DO polynomials do in fact exist, an example is the Coulter–Matthews planar monomial [8].

In particular, for monomials, proving planarity can then essentially be reduced to proving the plateaued condition (recall that planar functions cannot be bijective by Proposition 6.1).

Corollary 6.6

Let $F :\mathbb F_{p^n} \rightarrow \mathbb F_{p^n}$ be a plateaued monomial $F=x^d$. Then F is planar if and only if $\gcd (d,p^n-1)=2$.

Proof

Follows from Theorem 6.4 and Proposition 6.1. $\square$

7 Conclusion and Open Problems

In this paper, we systematically developed the theory of value distributions for perfect nonlinear functions. Particularly, we provided a purely combinatorial framework for checking the equivalence of perfect nonlinear functions $F:\mathbb F_p^n\rightarrow \mathbb F_p^m$ in terms of the value distributions. Moreover, we were able to describe all possible value distributions for several large classes of perfect nonlinear functions. In general, however, it seems to be a very difficult problem to determine all possible and impossible value distributions completely since the techniques we used rely on precise spectral information and solving systems of quadratic Diophantine equations, whose possible number of solutions grows with the increasing output group’s order. To conclude, we believe that answering the following questions (in addition to already mentioned open problems and conjectures in the previous sections) will help to provide a better understanding of perfect nonlinear functions, and, more generally, cryptographically significant classes of functions.

• 1. The theory of value distributions of perfect nonlinear functions $F:\mathbb F_p^n\rightarrow \mathbb F_p^m$ (and in general, on arbitrary groups) developed in this article actually only hinges on the fact that $F(x)=F(y)$ has precisely $p^n+p^{n-m}(p^n-1)$ solutions. This is, however, not unique for bent functions. Are there other functions of interest with this property? It would be also interesting to investigate in a similar manner other classes of cryptographically significant functions $F:\mathbb F_p^n\rightarrow \mathbb F_p^m$, for instance, plateaued and differentially uniform functions.

• 2. So far, the known constructions of almost balanced perfect nonlinear functions $F:\mathbb F_p^n\rightarrow \mathbb F_p^m$ are mostly dominated by the ($+$) type constructions. It would be interesting to provide more primary constructions of almost balanced bent functions of the type (−), especially in the p odd case.

• 3. Besides the “direct sum” construction, there exist many other secondary constructions of bent functions, which can be described without loss of generality in the following form $F(F_1(x_1),\ldots ,F_k(x_k))$ where $F_i:\mathbb F_p^{n_i}\rightarrow \mathbb F_p^m$ are perfect nonlinear functions, and F is some function. It would be interesting to provide initial conditions on bent functions $F_1,\ldots ,F_k$, which guarantee that the obtained perfect nonlinear functions of the form $(x_1,\ldots ,x_k)\in \mathbb F_p^{n_1}\times \cdots \times \mathbb F_p^{n_k}\mapsto F(F_1(x_1),\ldots ,F_k(x_k))$ are almost balanced of $(+)$ and $(-)$ types, and hence are inequivalent (in the p odd case).

• 4. Many of the known constructions of vectorial bent functions, whose preimage sets can be used to construct partial difference sets, are, in fact, almost balanced, see [7, 30]. In this regard, it is natural to find other constructions of almost balanced bent functions, which give rise to partial difference sets.

• 5. Our computer experiments show that in the Boolean case, it is possible to obtain both extremal value distributions by adding suitable linear functions from a single given vectorial Boolean bent function, opposite to the p-ary case. It would be interesting to investigate whether for every vectorial Boolean bent function one can add linear functions to obtain both $(+)$ and $(-)$ extremal value distributions, or whether there exist vectorial Boolean functions which cannot reach both extremal value distributions with a help of the addition of suitable linear functions.

• 6. We showed that many primary and secondary constructions of perfect nonlinear functions appear to have extremal value distributions, which implies that the “almost balanced” property unifies many algebraically different constructions. With this observation, it is essential to construct more perfect nonlinear functions in a purely combinatorial manner, using the “almost balanced” property.