Abstract
This work extends the idea introduced by Hou and Langevin (J. Combin. Theory, Ser. A, 80:232–246, 1997) of applying nonlinear permutations to (a portion of) the input variable space of a given Boolean function so that the resulting function is bent. Applying such a permutation to a bent function that can be represented in a suitable form then gives an affine inequivalent bent function which potentially does not belong to the same class as the original one. While Hou and Langevin only provided two sporadic examples of bent functions that can be turned into affine inequivalent ones, in this article we identify two generic families of bent functions suitable for generating such affine inequivalent counterparts. The same method when applied to the MarioanaMcFarland class of bent functions, depending on the subset of inputs to which a nonlinear action is applied, either lead to bent functions that are provably within the same class or to bent functions that are potentially outside this class. The problem of finding suitable permutations that act nonlinearly on more than two input variables of the initial function and ensure the bentness of the resulting function appears to be generally hard. In this direction, we only slightly extend the approach of Hou and Langevin by identifying suitable permutations that act nonlinearly on three input variabl es. Most notably, the existence of nonlinear permutations that act without strict separation of the input space in terms of linear and nonlinear action is also confirmed. Finally, we show a direct correspondence between (some classes of) bent functions and permutations by providing an efficient method to define permutations using the derivatives of a given bent function. This not only gives a relationship between two seemingly different algebraic objects, but also provides us with a new infinite family of permutations over finite fields.
1 Introduction
Bent functions are extremal combinatorial objects with several areas of application, such as coding theory, maximum length sequences, cryptography, the theory of difference sets to name a few. The term bent Boolean function was introduced by Rothaus [17], where also two classes of bent functions were considered. Among other equivalent characterizations of bent functions, the one that is most often used is a characterization of bent functions as a class of Boolean functions having socalled flat Walsh spectra. This means that an nvariable function f, where n is even, is bent is equivalent to the fact that W_{f}(u) ∈{± 2^{n/2}}, for any \(u \in {\mathbb {F}_{2}^{n}}\). Alternatively, the Hamming distance to any nvariable affine functions is 2^{n− 1} ± 2^{n/2 − 1}.
The known primary classes of bent functions are the Partial Spread (\(\mathcal {P}\mathcal {S}\)) class due to Dillon [7], the MaioranaMcFarland (\(\mathcal {M}\mathcal {M}\)) class introduced in [11] and the Dobbertin’s class [8] commonly denoted by \(\mathcal {H}\). Apart from these classes, the socalled secondary constructions of bent functions have received a lot of attention [2, 3, 5, 13, 14, 18,19,20]. In particular, some secondary constructions known as indirect sum (and its extensions) have been proposed by Carlet [3] which use three initial bent functions satisfying certain conditions for the purpose of constructing bent functions on larger variable spaces. A similar approach, though without increasing the variable space was initially considered by Carlet [6] and later addressed by Mesnager [15]. The mentioned references above mainly refer to secondary constructions and for an exhaustive survey on bent functions the reader is referred to [4]. The known primary of bent functions constitute just a tiny portion in the space of all bent functions (the same applies to secondary constructions) and consequently they are not sufficient to fully describe the variety of bent functions.
In difference to these approaches, two decades ago Hou and Langevin [9] proposed quite a different framework for specifying the bent properties of Boolean functions. More precisely, considering an arbitrary Boolean function f one may ask a question what kind of nonlinear permutation σ over \({\mathbb {F}_{2}^{n}}\) composed to the input variables of f yield a bent function f ∘ σ^{− 1}. In a rather simple manner they showed that both the necessary and sufficient condition that f ∘ σ^{− 1} is bent is equivalent to the fact that the linear span of the coordinate Boolean functions of σ, thus σ_{1}(x),…, σ_{n}(x) is a subset of the set of all Boolean functions whose Hamming distance to f is 2^{n− 1} ± 2^{n/2 − 1}. This simple result is of great significance in many aspects. In the first place, it is not necessary that f is bent in order that f ∘ σ^{− 1} is bent. Moreover, the permutation σ being nonlinear gives immediately affine nonequivalence between f and f ∘ σ^{− 1} when f is bent. However, apart from two sporadic examples of cubic bent functions in 8variables for which suitable nonlinear transformation of the input could be applied, no efficient method for identifying suitable classes of bent functions to which such transformation could be applied was given in [9].
In this article, we address the problem of deducing affine inequivalent bent functions by specifying two different (infinite) families of bent functions that can be represented in a suitable form so that f ∘ σ^{− 1} is in general affine inequivalent to f, for a nonlinear permutation σ given in [9]. Even though the nonlinear permutation, as originally considered in [9], only acts on two input variables (whereas the remaining inputs are kept fixed/invariant), a suitable representation (form) of f was hard to identify in a generic manner in [9]. The main question regarding these two infinite families of bent functions that we identify, that generate affine inequivalent bent functions, is whether this method generates bent functions outside the class the initial bent function belongs to. It is also shown that the efficiency of this method when applied to bent functions in the \(\mathcal {M}\mathcal {M}\) class largely depends on the choice of input variables used to represent \(f \in \mathcal {M}\mathcal {M}\) in a suitable form. More precisely, if f(x, y) = x ⋅ ϕ(y) + ψ(y), \(x,y \in \mathbb {F}_{2}^{n/2}\), is represented by means of the variables x_{1} and x_{2}, thus given by (3) as originally considered by Hou and Langevin, then we only obtain affine inequivalent bent functions that provably remain within the \(\mathcal {M}\mathcal {M}\) class. On the other hand, for suitably chosen permutation ϕ and Boolean function ψ, expressing f with respect to two variables from the set y_{1},…, y_{n/2} may potentially give rise to bent functions F which are outside the \(\mathcal {M}\mathcal {M}\) class. Nevertheless, this important question, which is intrinsically hard, remains open. Increasing the action of nonlinear permutations to a larger subset of inputs appears to be very difficult due to the condition that the bentness of the input function is preserved. In this context, using selfinverse matrices, we introduce a nonlinear permutation that acts on three input variables. More importantly, we illustrate by an example that a larger class of permutations acting on the whole input space can be employed for the same purpose, which opens up for a much wider framework than originally considered by Hou and Langevin.
In another direction, we continue the initiative initially taken by Hou and Langevin in terms of establishing a generic connection between bent functions and permutations over finite fields (vector spaces). Namely, it is well known that all the derivatives of a bent function, say an nvariable function f, are balanced Boolean functions and the question raised in [9] concerns the possibility of selecting n derivatives such that all their (notrivial) linear combinations are also balanced. This would imply that such a bent function induces a permutation over \({\mathbb {F}_{2}^{n}}\). This idea was actually confirmed in [9] using a computer search for some cubic 8variable bent functions. In this context a more general (and interesting) connection may be established when considering the \(\mathcal {M}\mathcal {M}\) class. More precisely, a bent function f(x, y) = ϕ(y) ⋅ x + ψ(y), \(x,y \in \mathbb {F}_{2}^{n/2}\) is bent if and only if ϕ is a permutation over \(\mathbb {F}_{2}^{n/2}\). Then, since a permutation ϕ induces a bent function a natural question in this context is whether there is a class of permutations ϕ which has the property that the derivatives of f (taken for instance with respect to canonical basis of \({\mathbb {F}_{2}^{n}}\)) induces a permutation over \({\mathbb {F}_{2}^{n}}\). We answer this question positively by providing a generic connection between a subclass of bent functions in \(\mathcal {M}\mathcal {M}\) (defined by means of a suitable permutation over \(\mathbb {F}_{2}^{n/2}\) that we specify) and deduced permutations over \({\mathbb {F}_{2}^{n}}\), which is an interesting connection between two seemingly different algebraic objects. As an independent contribution, this approach gives a new infinite family of permutations over finite fields.
This article is organized as follows. In Section 2, we give some basic definitions related to Boolean functions. Two generic methods of identifying bent functions that can be represented in a suitable form are discussed in Section 3. Furthermore, the possibility of finding bent functions within some primary (secondary) classes to which we can efficiently apply the specific nonlinear permutation proposed by Hou and Langevin is addressed here. The extended framework of nonlinear permutations that act on three input variables is presented in Section 4. In Section 5, we identify suitable bent functions within \(\mathcal {M}\mathcal {M}\) class, by specifying a new class of permutations over finite fields over \({\mathbb {F}_{2}^{m}}\), whose derivatives give rise to permutations over \(\mathbb {F}_{2}^{2m}\). Some concluding remarks are given in Section 6.
2 Preliminaries
Let \(\mathbb {F}_{2} = \{0,1\}\) denote the binary field of characteristic two. Furthermore, let \(\mathbb {F}_{2^{n}}\) denote the Galois field of order 2^{n} and \({\mathbb {F}_{2}^{n}}\) be its corresponding vector space (once the basis is fixed). Any function from \(\mathbb {F}_{2}^{n}\) or \(\mathbb {F}_{2^{n}}\) to \(\mathbb {F}_{2}\) is called an nvariable Boolean function, and the set of all Boolean functions in n variables is denoted by \(\mathcal {B}_{n}\).
A Boolean function f(x_{1},…, x_{n}) is commonly represented as a multivariate polynomial over \(\mathbb {F}_{2}\) called the algebraic normal form (ANF) of f. More precisely, f(x_{1},…, x_{n}) can be written as
for \(\lambda _{u}\in \mathbb {F}_{2} , u=(u_{1},\ldots ,u_{n})\).
The algebraic degree of \(f \in \mathcal {B}_{n}\), denoted by deg(f), is equal to the maximum Hamming weight of \(u \in {\mathbb {F}_{2}^{n}}\) for which λ_{u}≠ 0. The set of affine functions in nvariables is denoted by \(\mathcal {A}_{n}=\{\ell (x) \in \mathcal {B}_{n} : \deg (\ell ) \leq 1\}\). A Boolean function f (x_{1},…, x_{n}) may also be represented as the output column of its truth tablef, i.e., a binary string of length 2^{n},
The Hamming weight of f is the number of ones in the truth table of f. This is denoted by wt_{H}(f). The Walsh transform of \(f\in \mathcal { B}_{n}\) at \( \lambda \in \mathbb {F}_{2}^{n}\) is defined as
where “ ⋅ ” denotes the standard inner (dot) product of two vectors, that is, λ ⋅ x = λ_{1}x_{1} + … + λ_{n}x_{n}. If n is an even integer a function \(f \in \mathcal {B}_{n}\) is said to be bent if and only if \(W_{f}(\lambda ) \in \left \{2^{\frac {n}{2}}, 2^{\frac {n}{2}}\right \}\), for all \(\lambda \in \mathbb {F}_{2}^{n}\). Equivalently, f is bent if and only if w_{h}(f + a) = 2^{n− 1} ± 2^{n/2 − 1}, for any affine function \(a \in \mathcal {B}_{n}\). A function \(f\in \mathcal {B}_{n}\) is said to be semibent, if \(W_{f}(\lambda )\in \left \{0,\pm 2^{\frac {n+s}{2}}\right \}\), where s = 1 if n is odd, or s = 2 if n is even. The Walsh support of \(f\in \mathcal {B}_{n}\) is defined as \(S_{f}=\{\lambda \in \mathbb {F}^{n}_{2}:W_{f}(\lambda )\neq 0\}\).
The concatenation, denoted by ”” simply means that the truth tables of the functions are merged. For instance, for \(f_{1},f_{2}\in \mathcal {B}_{n}\) one may construct \(f=f_{1}f_{2}\in \mathcal {B}_{n + 1}, \)meaning that the upper half part of the truth table of f correspond to f_{1} and the lower part to f_{2}. The ANF of f is then given as f(x_{1},…, x_{n}, x_{n+ 1}) = (1 + x_{n+ 1})f_{1}(x_{1},…, x_{n}) + x_{n+ 1}f_{2}(x_{1},…, x_{n}).
A function F is called a Boolean permutation if it is a bijective mapping from \({\Bbb F}_{2}^{m}\) to \({\Bbb F}_{2}^{m}\). The MaioranaMcFarland class of bent functions [11], denoted by \(\mathcal {M}\mathcal {M}\), is the set of all bent functions on \({\Bbb F}^{2m}_{2}=\left \{(x,y):x,y\in {\Bbb F}_{2}^{m}\right \}\) of the form:
where ϕ = (ϕ_{1},…, ϕ_{m}) is any permutation on \({\Bbb F}_{2}^{m}\) and \(\psi \in \mathcal {B}_{m}\) is arbitrary. Moreover, f is a bent function if and only if ϕ is a Boolean permutation.
Two functions \(f, f^{\prime } \in \mathcal {B}_{n}\) are said to be affine equivalent if there exists an invertible binary matrix A of size n × n, binary vectors \(b, c \in {\mathbb {F}_{2}^{n}}\) and \(\epsilon \in \mathbb {F}_{2}\) so that f(x) = f^{′}(Ax + b) + c ⋅ x + 𝜖. The affine equivalence is degree invariant and we necessarily have that deg(f) = deg(f^{′}).
3 Generic methods for affine inequivalent bent functions
A different approach for constructing bent functions was taken in [9], where Hou and Langevin considered the compositional problem of determining nonlinear permutations σ such that f ∘ σ^{− 1} is a bent function regardless whether f is bent or not. Throughout this article a permutation \(\sigma : {\mathbb {F}_{2}^{n}} \rightarrow {\mathbb {F}_{2}^{n}}\) is represented as a collection of its n coordinate functions so that σ(x) = (σ_{1}(x),…, σ_{n}(x)), where \(\sigma _{i}:{\mathbb {F}_{2}^{n}} \rightarrow \mathbb {F}_{2}\). For even n, denoting by \(l(f) =\left \{g \in \mathcal {B}_{n} : d_{H}(f,g)= 2^{n1} \pm 2^{n/21}\right \}\) the set of Boolean functions at the bent distance from f the authors showed that f ∘ σ^{− 1} is bent if and only if the linear span 〈σ_{1},…, σ_{n}〉 = span(σ) is a subset of l(f), cf. Lemma 3.1 in [9]. Furthermore, they also analyzed a special form of bent functions given as
where the functions f_{1}, f_{2}, g and α (where \(\alpha \in \mathcal {A}_{n}\)) only depend on variables x_{3},…, x_{n}. One example of such a bent function f in eight variables was provided and then employed to demonstrate the various possibilities of generating affine nonequivalent functions by showing that the function
is again a bent function. Here F = f ∘ σ^{− 1} where
and consequently
Remark 1
The case α = 1 implies that F is a simple linear translate of f and is of no interest.
Notice that σ^{− 1} acts as the identity permutation with respect to x_{3},…, x_{n} and essentially replaces x_{1} and x_{2} by f_{1} + x_{1} + α(f_{2} + x_{2}) and (α + 1)(f_{1} + x_{1}) + f_{2} + x_{2}, respectively. The balancedness of the coordinate functions \(\sigma _{1}^{1}(x), \ldots ,\sigma _{n}^{1}(x)\) of σ^{− 1}(x) is then ensured through the fact that f_{1}, f_{2} and α all depend only on the variables x_{3},…, x_{n}. More importantly, it was shown that the linear span 〈σ_{1},…, σ_{n}〉 is indeed a subset of l(f) due to a subtle choice of the coordinate functions \(\sigma _{1}^{1}\) and \(\sigma _{2}^{1}\).
This method immediately raises the question whether there are known classes of bent functions which can be represented similarly as in (3). This question is answered positively by providing two efficient and generic methods for designing (generally) affine inequivalent bent functions using some suitable secondary classes of bent functions. Furthermore, it will be shown that when f is in the MaioranaMcFarland class of bent functions then it can be represented in a suitable form similar to (3). Therefore, one can in general derive a bent function F which is affine inequivalent to f and furthermore F is not necessarily in the \(\mathcal {M}\mathcal {M}\) class.
3.1 Employing indirect sum to obtain affine nonequivalent bent functions
We use the indirect sum [3] to represent the initial bent function in the suitable form. In difference to the approach taken by Hou and Langevin [9], where two sporadic examples of bent functions having a suitable decomposition form given by (3) were discussed, we provide some infinite classes of bent functions which are (in general) not affine equivalent to initial ones.
Corollary 1
[3] Let\(x\in \Bbb {F}_{2}^{n}, \, y\in \Bbb {F}_{2}^{m}\).Letf_{0}andf_{1}be twonvariable bent functions ( neven) and letg_{0}andg_{1}be twomvariable bent functions(m even). Define
Then the function\(h \in \mathcal {B}_{2}^{n+m}\)is bent.
For convenience, we set \(x=(x_{1},\ldots ,x_{n})\in \mathbb {F}_{2}^{n}\) and X^{(i)} = (x_{1}, x_{2},…, x_{i}), for 1 ≤ i ≤ n − 1. Furthermore, let X^{′} = (x_{1},…, x_{ρ− 1}, x_{ρ+ 1},…,, x_{n− 2}) where 1 ≤ ρ < n − 2. Then, by extracting the variable x_{ρ} a given bent function \(\vartheta \in \mathcal {B}_{n2}\) (in general any Boolean function) can be represented as
for some functions \(T_{1}, T_{2} \in \mathcal {B}_{n3}\). Let us define \(\mathfrak {f}_{0},\mathfrak {f}_{1} \in \mathcal {B}_{n}\) as
Without loss of generality, we set ρ = 1 which means that X^{′} = (x_{2}, x_{3},…, x_{n− 2}) and \(\mathfrak {f}_{0}, \mathfrak {f}_{1}\) are defined accordingly using x_{ρ} = x_{1}.
Theorem 1
Let\(g_{0} \in \mathcal {B}_{m}\)be a bent function and define\(\mathfrak {f}_{0}\),\(\mathfrak {f}_{1}\),T_{1} (X^{′}) andT_{2} (X^{′}) as in (7) and (8) , respectively. Then, hdefined as
is a bent function in n + mvariables, wherel (y) is an affine function. Furthermore, the function\(H \in \mathcal {B}_{n+m}\)defined as
is also a bent function inn + mvariables. If \(\deg (T_{1}(X^{\prime }))=\deg (\mathfrak {f}_{0})1 \geq 2\)and\(\deg (g_{0})\leq \deg (\mathfrak {f}_{0})\), then\(\deg (H)=\deg (\mathfrak {f}_{0})+ 1>\deg (h)=\deg (\mathfrak {f}_{0})\).
Proof
From (8), \(\mathfrak {f}_{0}\) is bent being the direct sum of two bent functions 𝜗(X^{(n− 2)}) and x_{n− 1}x_{n}. Similarly, 𝜗(X^{(n− 2)}) + x_{1} and x_{n− 1}x_{n} + x_{n− 1} are also bent. Representing \(\mathfrak {f}_{1}\) as
by Corollary 1, \(\mathfrak {f}_{1}\) is a bent function in n variables.
Furthermore, defining g_{1}(y) = g_{0}(y) + l(y) where l is affine, it is readily checked that
has the decomposition form given by (3) with respect to variables x_{1} and x_{n− 1}. By Corollary 1, h is a bent function in n + m variables. Then, applying the permutation σ^{− 1} given by (5) one can verify that H = h ∘ σ^{− 1} is given by
By Theorem 4.1 in [9], due to the form of h, the function H is bent. The statement regarding the algebraic degree is trivial. □
Note that \(\deg (T_{1}(X^{\prime }))=\deg (\mathfrak {f}_{0})1\) is easily obtained since we can take ρ = 1,2⋯ , n/2 − 1. Thus, depending on the properties of initial functions g_{0} and \(\mathfrak {f}_{0}\) different bent functions (affine inequivalent to h) can be deduced.
3.2 Using semibent 4decomposition of bent functions
In general, the 4decomposition of a bent function \(f\in \mathcal {B}_{n}\) (where n is even) is a decomposition of f into four subfunctions defined on the four cosets of some (n − 2)dimensional linear subspace [1]. More precisely, for nonzero \(a,b \in {\mathbb F}_{2}^{n}\) with a≠b this (n − 2)dimensional subspace is defined as 〈a, b〉^{⊥}, where the dual of a linear subspace \(V\subset {\mathbb F}_{2}^{n}\), denoted by V^{⊥}, is defined as \(V^{\perp }=\left \{x\in {\mathbb F}_{2}^{n}: \forall y\in V, x\cdot y = 0\right \}\). We call such a decomposition canonical when a = (1,0,0,…,0) and b = (0,1,0,…,0) and denote f = (f_{00}, f_{01}, f_{10}, f_{11}), where f_{ij} are then usual restrictions of f obtained by fixing x_{1} and x_{2}, for i, j ∈{0,1}. Thus, for instance, f_{00}(x_{3},…, x_{n}) = f(0,0, x_{3},…, x_{n}).
It was shown in [1] that there are three possible cases: bent 4decomposition when all f_{ij} are bent; semibent 4decomposition when all f_{ij} are semibent; 5valued 4decomposition when all f_{ij} are 5valued Walsh spectra functions. In particular, for the semibent decomposition we obviously have \(W_{f_{ij}}(\omega ) \in \left \{0, \pm 2^{n/2}\right \}\) since f_{ij} are semibent on \( {\mathbb F}_{2}^{n2}\), n is even. Furthermore, to ensure the bentness of f we necessarily have that for any \(\omega \in \mathbb {F}^{n2}_{2}\) only one coefficient is nonzero, say \(W_{f_{ij}}(\omega )=\pm 2^{\frac {n}{2}}\) and \(W_{f_{kl}}(\omega )= 0\) for ij≠kl, thus one needs a quadruple of disjoint spectra semibent functions.
Our main goal is to provide a generic method of specifying a bent function f using four suitable (disjoint spectra) semibent functions so that f can be represented as f = x_{1}f_{1} + x_{2}f_{2} + x_{1}x_{2}α + g. Using our canonical decomposition the restrictions of such f are given by
The following preparatory result is proved useful for achieving our main goal.
Proposition 1
Letn be even and define\(g:\mathbb {F}^{\frac {n2}{2}+ 1}_{2}\times \mathbb {F}^{\frac {n2}{2}1}_{2}\rightarrow \mathbb {F}_{2}\)by
wherei, j ∈{0,1} are (arbitrary) fixed integers, \(\phi _{ij}:\mathbb {F}^{\frac {n2}{2}1}_{2}\rightarrow \mathbb {F}^{\frac {n2}{2}+ 1}_{2}\), and\(\pi :\mathbb {F}^{\frac {n2}{2}1}_{2}\rightarrow \mathbb {F}^{\frac {n2}{2}1}_{2}\)is an arbitrary permutation. Then\(g \in \mathcal {B}_{n2}\)is a semibent function.
Proof
For any \((\omega _{1},\omega _{2})\in \mathbb {F}^{\frac {n2}{2}+ 1}_{2}\times \mathbb {F}^{\frac {n2}{2}1}_{2}\), we write \(\omega _{1}=(\omega ^{(1)}_{1},\omega ^{(2)}_{1},\omega ^{\prime })\in \mathbb {F}_{2}\times \mathbb {F}_{2}\times \mathbb {F}^{\frac {n2}{2}1}_{2}\) and compute
which means that g is semibent. □
From the previous computation, the Walsh support of g is given by \(S_{g}=(i,j)\times \mathbb {F}^{n4}_{2}\subset \mathbb {F}^{n2}_{2}\). Then, the function d = g + ℓ, where \(\ell (x,y)=c\cdot (x,y) \in \mathcal {A}_{n2}\), is also a semibent function whose Walsh support is S_{d} = c + S_{g}. Based on this fact we provide the following construction of f having the form as in (3).
Theorem 2
Letg be defined by (13), and assume that for a given permutationπover\(\mathbb {F}^{\frac {n2}{2}1}_{2}\)the mappings\(\varphi , \sigma : \mathbb {F}^{\frac {n2}{2}1}_{2} \rightarrow \mathbb {F}^{\frac {n2}{2}1}_{2}\)are such that\(\pi + \langle \varphi ,\sigma \rangle =\{\pi +c_{1}\varphi +c_{2}\sigma :c_{1},c_{2}\in \mathbb {F}_{2}\}\)is an affine space of permutations. Then define\(f_{1},f_{2}, \alpha \in \mathcal {B}_{n2}\)as
where\(a^{\prime }\in \mathbb {F}^{n4}_{2}\)is arbitrary.Then the functionf = x_{1}f_{1} + x_{2}f_{2} + x_{1}x_{2}α + g,with restrictions given by (12), is a bent function which admits the semibent4decomposition.
Proof
Since π + 〈φ, σ〉 is an affine space of permutations, then the semibent property of g + f_{1}, g + f_{2} and g + f_{1} + f_{2} + α can be easily proved as in the case of g in Proposition 1. Additionally, we have that \(S_{g}=(i,j)\times \mathbb {F}^{n4}_{2}\), \(S_{g+ f_{1}}=(i + 1,j)\times \mathbb {F}^{n4}_{2}\), \(S_{g+ f_{2}}=(i,j + 1)\times \mathbb {F}^{n4}_{2}\) and \(S_{g+ f_{1}+ f_{2}+ \alpha }=(i + 1,j + 1)\times \mathbb {F}^{n4}_{2}\), and these affine subspaces clearly partition the space \(\mathbb {F}^{n2}_{2}\). Consequently, f = x_{1}f_{1} + x_{2}f_{2} + x_{1}x_{2}α + g is a bent function which allows the semibent 4decomposition. □
Remark 2
Notice that the only possibility for the first two coordinates of the vector a (which defines the function α) is to have (0,0), in which case the Walsh support of g + f_{1} + f_{2} + α is given as \(S_{g+ f_{1} + f_{2}+\alpha }=(i + 1, j + 1)\times \mathbb {F}^{n4}_{2}\). In other words, any other choice of the first two coordinates of a would imply that S_{g}, \(S_{g+ f_{1}}\), \(S_{g+ f_{2}}\) and \(S_{g+ f_{1} + f_{2}+\alpha }\) do not partition the space \(\mathbb {F}^{n2}_{2}\), which is the necessary condition to have a semibent 4decomposition.
Remark 3
Note also that φ and σ do not necessarily need to be permutations. For instance, they can be constant mappings defined on \(\mathbb {F}^{\frac {n2}{2}1}_{2}\), but in that case f_{1} and f_{2} are linear, and the degree of F (defined by (4)) remains the same as the degree of f (which is then trivial).
Hence, the construction provided by Theorem 2 is nontrivial (in terms of degrees of F and f ) when the mappings φ and σ are nontrivial (i.e., they are not constant). Employing the above approach, we now illustrate the possibility of obtaining affine inequivalent bent functions from the known ones.
Example 1
We first construct the component functions g, f_{1}, f_{2}, α of \(f:\mathbb {F}^{10}_{2}\rightarrow \mathbb {F}_{2}\)(n = 10) in form (3) as follows. Let g(x, y) be defined by (13) as g(x, y) = x ⋅ (1,1, π(y)), \((x,y)\in \mathbb {F}^{8}_{2}=\mathbb {F}^{5}_{2}\times \mathbb {F}^{3}_{2}\), where \(\pi :\mathbb {F}^{3}_{2}\rightarrow \mathbb {F}^{3}_{2}\) is a permutation given by
In addition, let f_{1}, f_{2} and α be defined as in Theorem 2, where the mappings \(\varphi ,\sigma :\mathbb {F}^{3}_{2}\rightarrow \mathbb {F}^{3}_{2}\) and vector \(a^{\prime }\in \mathbb {F}^{6}_{2}\) are given by
It is easily verified that π + 〈φ, σ〉 is an affine space of permutations. For (x, y) = (x_{1},…, x_{5},\(y_{1},y_{2},y_{3})\in \mathbb {F}^{5}_{2}\times \mathbb {F}^{3}_{2}, \)the functions g, f_{1}, f_{2} and α are given as
Then, f given by (3) is a bent function of degree 3 which admits the semibent 4decomposition (12), and F defined by (4) is a bent function of degree 5. Notice that the terms of degree 5 in the ANF of F entirely come from (α + 1)f_{1}f_{2}.
Remark 4
A method of constructing quadruples of disjoint spectra functions is given in [18]. In general, to construct a function f in form (3), one can take (any) three pairwise disjoint spectra functions f_{00}, f_{10} and f_{01}. But then we need to select f_{11} = g + f_{1} + f_{2} + α = g + (g + f_{1}) + (g + f_{2}) = (f_{00} + f_{10} + f_{01}) + α (for some affine function α≠ 0,1) so that f_{00}, f_{10}, f_{01} and f_{11} are pairwise disjoint spectra semibent functions. In other words, (f_{00}, f_{10}, f_{01}, f_{11}) is not an arbitrary quadruple of disjoint spectra semibent functions.
3.3 Suitable forms for some known classes of bent functions
We start this section by a further analysis of f and F in terms of their algebraic structure. A canonical decomposition of \(f \in \mathcal {B}_{n}\) given as f = f_{00}f_{01}f_{10}f_{11}, corresponds to the ANF of f which can be written as
where any f_{ij} only depends on the variables x_{3},…, x_{n}. Denoting by
we essentially have f = x_{1}f_{1} + x_{2}f_{2} + x_{1}x_{2}α + g which is same as (3). This also implies that we can write f = g(f_{2} + g)(f_{1} + g)(f_{1} + f_{2} + g + α).
We observe that \({\sum }_{a \in {\mathbb {F}_{2}^{2}}} f_{a}=\alpha \) is supposed to be an affine function, and further the bent property of f depends on the proper choice of f_{1}, f_{2}, α and g. We only need to ensure that α≠ 1 since for α = 1 the transformation is trivial due to the vanishing term (1 + α)f_{1}f_{2} in the definition of F.
Remark 5
The elementary approach of defining f = g + x_{1}x_{2}, assuming the bentness of g, implies that f is bent but in this case f = ggg(g + 1) and the sum of restrictions is α = 1.
The following result shows that a suitable representation of functions in the \(\mathcal {M}\mathcal {M}\) class may potentially lead to bent functions outside this class. We always assume that f_{1}, f_{2}, α and g do not depend on the two input variables used to represent f suitably, and that α is affine.
Proposition 2
Letf (x, y) = x ⋅ ϕ (y) + ψ(y) , where\(x,y \in \mathbb {F}_{2}^{n/2}\), be an arbitrarybent function in the\(\mathcal {M}\mathcal {M}\)class. Then, representingf as:

i)
f = x_{k}f_{1} + x_{l}f_{2} + x_{k}x_{l}α + g,where1 ≤ k ≠ l ≤ n/2,gives a bent functionF that remains in the\(\mathcal {M}\mathcal {M}\)class,

ii)
f = y_{k}f_{1} + y_{l}f_{2} + y_{k}y_{l}α + g,where1 ≤ k ≠ l ≤ n/2,for a suitable choice ofϕandψ,gives a bent functionF that may potentially lie outside the\(\mathcal {M}\mathcal {M}\)class.
Proof
Let us consider the restrictions of f(x, y) = x ⋅ ϕ(y) + ψ (y) in the \(\mathcal {M}\mathcal {M}\) class, where \(x,y \in \mathbb {F}_{2}^{n/2}\) and \(\psi \in \mathcal {B}_{n/2}\) is arbitrary, see (2). i) Due to symmetry, w.l.o.g. we consider its decomposition by fixing x_{1} and x_{2}, which gives
where x^{′} = (x_{3},…, x_{n/2}). Apparently, \({\sum }_{(i,j)\in {\mathbb {F}_{2}^{2}}} f_{ij} = \alpha = 0\) and furthermore f_{1}, f_{2} and g = f_{00} (cf. (15)) do not depend on variables x_{1}, x_{2}. Therefore, with α = 0, the function F given by (4) can be written as
which is a bent function. In particular, f_{1} = f_{00} + f_{01} = ϕ_{2}(y), f_{2} = f_{00} + f_{10} = ϕ_{1}(y) and f_{1}f_{2} = ϕ_{1}(y)ϕ_{2}(y) so that
But this is just another bent function in the \(\mathcal {M}\mathcal {M}\) class obtained from f by a simple linear transformation and addition of some function that only depends on y variables. Indeed, we can write
where ψ^{′}(y) = ϕ_{1}(y)ϕ_{2}(y) + ϕ_{1}(y) + ϕ_{2}(y) + ψ(y).
ii) For simplicity, by fixing y_{1} and y_{2}, we consider f = y_{1}f_{1} + y_{2}f_{2} + y_{1}y_{2}α + g. In this case, the restrictions of ϕ_{i}(y) and ψ(y) w.r.t. y_{1} and y_{2} are not necessarily the same for different choices of (y_{1}, y_{2}). Let f_{ij}(x, y^{′}), for i, j ∈{0,1} and y^{′} = (y_{3},…, y_{n/2}), denote the restriction of f when (y_{1}, y_{2}) = (i, j) so that
where \(\phi _{k}^{ij}(y^{\prime })\) and ψ^{ij}(y^{′}) are obtained by fixing (y_{1}, y_{2}) = (i, j). Then, the necessary condition that \({\sum }_{(i,j)\in {\mathbb {F}F_{2}^{2}}}f_{ij}(x,y^{\prime })=\alpha \) is affine implies that
Since ψ is arbitrary the second condition can always be satisfied and it can be easily verified that for instance ϕ(y) = y satisfies the first condition. In general, depending on the choice of ϕ and ψ the function F given by (4), where x_{1} and x_{2} are substituted by y_{1} and y_{2} respectively, may potentially lie outside the \(\mathcal {M}\mathcal {M}\) class. □
Though the conditions related to the restrictions of ϕ_{k} given by (18) may appear difficult, it turns out that these conditions can be easily satisfied in a nontrivial manner (for nonlinear permutations ϕ).
Example 2
For instance, one can define a permutation ϕ over \(\mathbb {F}_{2}^{n/2}\) as
where \(\widetilde {y}=(y_{5},\ldots ,y_{n/2})\), π is a permutation with respect to \(\widetilde {y}\) and r, r^{′} are any functions that only depend on the subset of variables \(\widetilde {y}\). In addition, let ψ(y) = y_{1}y_{2}y_{t} for some t ∈ [5, n/2]. Then, the sum of restrictions of the coordinate functions of ϕ are given as
where y^{′} = (y_{3},…, y_{n/2}) and 0_{n/2 − 4} denotes the all zero vector of length n/2 − 4. Then, \(\alpha ={\sum }_{(i,j)\in {\mathbb {F}_{2}^{2}}}f_{ij}(x,y^{\prime })=x\cdot (1,1,0,0, \textbf {0}_{n/24} )+y_{t}, \) where \(x=(x_{1}, \ldots ,x_{n/2})\in \mathbb {F}^{n/2}_{2}\). Moreover, since f_{00}(x, y^{′}) = g(x, y^{′}), f_{01}(x, y^{′}) = g(x, y^{′}) + f_{2}(x, y^{′}) and f_{10}(x, y^{′}) = g(x, y^{′}) + f_{1}(x, y^{′}), we have that
Consequently, the functions f(x, y) and F(x, y) are given as
and thus both functions have degree max{3, g(x, y^{′})}. However, since the function F contains the terms which are products of certain coordinates of x = (x_{1},…, x_{n/2}) (for instance it contains x_{3}x_{4} instead of y_{1}y_{2} as in f), then it is not obvious whether F remains in the \(\mathcal {M}\mathcal {M}\) class.
Remark 6
It can be shown that if ψ(y) = 0 then F belongs to the \(\mathcal {M}\mathcal {M}\) class. However, if ψ(y) = y_{1}y_{2}y_{t} and ϕ is chosen suitably the question whether F remains in \(\mathcal {M}\mathcal {M}\) becomes difficult.
Open Problem 1
In general, due to a nonlinear action of σ on two fixed coordinates the resulting functions are affine inequivalent to initial ones. However, the exact classification of bent functions obtained by the above methods remains open and it is of crucial importance for our better understanding of these objects.
Remark 7
A similar analysis can be performed on the Rothaus generic method of defining a bent function f [17] as
where A, B, C are bent and additionally A + B + C is bent. Due to its particular form f cannot be represented as f = x_{1}f_{1} + x_{2}f_{2} + x_{1}x_{2}α + g since it would imply that α = 1 which is the trivial case due to the annihilation of the term (1 + α)f_{1}f_{2} in F.
We remark that the \(\mathcal {D}_{0}\) class of bent functions introduced in [2], which for n = 2m corresponds to a bent function \(f(x,y)=x \cdot \phi (y) + {\prod }_{i = 1}^{m}(x_{i}+ 1)\), can in certain cases be represented suitably.
Example 3
When n = 2m = 6 and \(f(x,y)=x \cdot \phi (y) + {\prod }_{i = 1}^{3}(x_{i}+ 1)\), \(x,y \in {\mathbb {F}_{2}^{3}}\), only the restriction f_{00} in (16) is different compared to the standard \(\mathcal {M}\mathcal {M}\) class and equals to f_{00}(x_{3}, y) = x_{3}ϕ_{3}(y) + (1 + x_{3}) since fixing (x_{1}, x_{2}) to any other value different from (0,0) makes that the term \({\prod }_{i = 1}^{3}(x_{i}+ 1)\) vanishes. Thus, \({\sum }_{(i,j) \in {\mathbb {F}_{2}^{2}}}f_{ij}=\alpha = 1+x_{3}\). Representing f as in (14), where f_{1} = 1 + x_{3} + ϕ_{2}(y), f_{2} = 1 + x_{3} + ϕ_{1}(y) and g = 1 + x_{3} + x_{3}ϕ_{3}(y) (which do not depend on x_{1}, x_{2}), we obtain using (4) that
In the above example the terms x_{i}ϕ_{j}(y) could have been obtained by some (invertible) affine transformation of the input space but this is not the case for the term x_{3}ϕ_{1}(y)ϕ_{2}(y). Nevertheless, as remarked in Corollary 4.2 [9], the algebraic degree of x_{3}ϕ_{1}(y)ϕ_{2}(y) in Example 3 cannot be larger than 3 and therefore in general the product ϕ_{i}(y)ϕ_{j}(y), for a permutation (ϕ_{1},…, ϕ_{m}) over \({\mathbb {F}_{2}^{m}}\), is of degree ≤ m − 1. The next result confirms that this is always the case for any permutation ϕ.
Proposition 3
Letϕ (y) = (ϕ_{1} (y),…, ϕ_{m}(y)) be a permutation over\({\mathbb {F}_{2}^{m}}\),wherem ≥ 3.Then, deg (ϕ_{i}ϕ_{j}) ≤ m − 1 for any 1 ≤ i, j ≤ m.
Proof
Since ϕ is a permutation over \({\mathbb {F}_{2}^{m}}\) all nonzero linear combinations of ϕ_{i} are balanced. In particular, wt(ϕ_{i}) = wt(ϕ_{j}) = wt(ϕ_{i} + ϕ_{j}) = 2^{m− 1}, for 1 ≤ i≠j ≤ m. Using a wellknown result [12] that
we deduce that wt(ϕ_{i}(y)ϕ_{j}(y)) = 2^{m− 2}, which is an even number for m ≥ 3. Thus, the ANF of ϕ_{i}(y)ϕ_{j}(y) contains an even number of terms of degree m (that cancel out each other) and consequently deg(ϕ_{i}(y)ϕ_{j}(y)) ≤ m − 1. If i = j then ϕ_{i}(y)ϕ_{j}(y) = ϕ_{i}(y), which is balanced by assumption implying deg(ϕ_{i}) ≤ m − 1. □
The main problem related to a generalization of the above example for n > 6 is that for k > 3 the term \({\prod }_{i = 1}^{k}(x_{i}+ 1)\) is not cubic any longer and thus by fixing x_{1} and x_{2} the function \(\alpha ={\sum }_{(i,j) \in {\mathbb {F}_{2}^{2}}} f_{ij}\) is not affine, which implies that (4) does not apply in this case. The problem of extending the approach of Hou and Langevin to nonlinear transformations that include more than two variables is treated in the next section.
4 Extended bent transforms
The approach of Hou and Langevin only addressed the transformation of input space with respect to two variables. It can be readily checked that their construction relies on the fact that σ and σ^{− 1} are related through the property that \(A=\left [ \begin {array}{cc} 1 & \alpha + 1 \\ \alpha & 1 \end {array} \right ]\) is a selfinverse matrix, that is, A = A^{− 1}. A natural question is whether this approach can be extended by defining other permutations that keep fixed k number of variables, where k > 2, thus defining
where A is a k × k invertible matrix, k > 2, with entries in \(\mathcal {A}_{n}^{k}=\{\ell (x_{k + 1},\ldots , x_{n}) \in \mathcal {A}_{n}\}\) (the subset of \(\mathcal {A}_{n}\) with variables x_{k+ 1},…, x_{n}) with the property that A = A^{− 1} so that A^{2} = I.
In terms of the existence of selfinverse matrices the following example and remark are useful.
Example 4
For instance when k = 3, the binary matrix \(A_{3\times 3}=\left [ \begin {array}{ccc} 1 & 0 & 0 \\ 0 & 1 & 0 \\ 1 & 0 & 1 \end {array} \right ]\) is selfinverse. Nevertheless, there are selfinverse matrices with entries in \(\mathcal {A}_{n}\), e.g. \(A^{*}=\left [ \begin {array}{ccc} 1 & \alpha + 1 &0 \\ \alpha & 1 & 0 \\ \alpha & 0 & 1 \end {array} \right ]\) is selfinverse for any nonconstant affine function \(\alpha \in \mathcal {A}_{n}\).
Remark 8
Selfinverse matrices are easily defined recursively when their size is a power of two. For instance, taking A^{(0)} = [1] one can define selfinverse matrices \(A^{(n)}=\left [ \begin {array}{cc} A^{(n1)} & A^{(n1)} \\ \textbf {0} & A^{(n1)} \end {array}\right ]\) of size 2^{n} × 2^{n} for n ≥ 1. Here 0 denotes an allzero matrix of size 2^{n− 1} × 2^{n− 1}. For instance,
is a selfinverse matrix where α is an affine function. In addition, we remark that given any selfinverse matrix A the matrix PAP^{− 1} is also selfinverse whenever P is invertible.
Notice that selfinverse matrices simply relate σ and σ^{− 1} efficiently but the sufficient condition that f ∘ σ^{− 1} is bent (where f is not necessarily bent) is that
is such that span(σ) ⊂ l(f), where \(l(f) =\{g \in \mathcal {B}_{n} : d_{H}(f,g)= 2^{n1} \pm 2^{n/21}\}\), where n is even. More precisely, the main difficulty is to guarantee that the above condition is satisfied rather than to specify different selfinverse matrices.
4.1 The special case of nonlinear action on three input variables
Since the sufficient conditions in terms of finding suitable (nontrivial) transformations whose linear span is at bent distance for a given f appears to be hard, we restrict our attention to the case k = 3. For this purpose, we use a selfinverse matrix A^{∗} given in Example 4. The coordinate functions σ_{1},…, σ_{3} of a permutation σ = (σ_{1},…, σ_{n}) over \({\mathbb {F}_{2}^{n}}\) (cf. (19) and substitute A by A^{∗}) are given as:
and σ acts as identity permutation for the remaining coordinate functions, that is, σ_{i}(x) = x_{i} for 4 ≤ i ≤ n. Once again, the functions f_{i} and α only depend on variables x_{4},…, x_{n}, and furthermore α is affine. Using the same variable dependency for \(g \in \mathcal {B}_{n}\) as for f_{i} and α, let us assume that \(f \in \mathcal {B}_{n}\) can be represented as
In contrast to (3), we later demonstrate by an example that the function α may also depend on the variables x_{1},…, x_{3} in this case. Apparently, \(span(\sigma )\subset span(\mathcal {A}_{n}, f_{1} + \alpha (x_{2}+x_{3}), f_{2} + \alpha x_{1}, f_{3})=\mathcal {U}\) and we need to show that span(σ) ⊂ l(f). For any \(\beta \in \mathcal {U}\) we can write
where \(\epsilon _{i} \in \mathbb {F}_{2}\) and \(\gamma \in \mathcal {A}_{n}\). Combining (21) and (22) we obtain
where γ^{′} is an affine function. Thus, if β ∈ l(f) we must have w_{H}(f + β) = 2^{n− 1} − 2^{n/2}. This is in general true only if α ∈{0,1} (assuming that α depends on x_{4},…, x_{n}), in which case we have that f ∘ σ^{− 1} is a bent function (due to invertibility of the selfinverse matrix A^{∗}) and is given as:
where we have used the following substitution in f related to σ^{− 1} :
With the following example we show that in (21) it is possible to take α = x_{3} (which also implies that f + β is bent, cf. (23)) in which case α does not strictly depend on variables x_{4},…, x_{n}. This implies that σ^{− 1} is not given as above, i.e., \(\sigma ^{1}(x)=(\sigma _1^{1}(x), \sigma _2^{1}(x),\sigma _3^{1}(x), x_4,\ldots ,x_{n})\) is not equal to ([(f_{1}(x^{′}), f_{2}(x^{′}), f_{3}(x^{′}))⊕ (x_{1}, x_{2}, x_{3})]A^{∗}, x_{4},…, x_{n}), since the matrix A^{∗} contains α that depends on x_{3}.
Example 5
In [9] an example of a cubic bent function \(f \in \mathcal {B}_{8}\) having the form as in (3) was given. Namely,
which is now represented using the form (21). Thus, f_{1} = x_{8}, f_{2} = x_{4}x_{5} + x_{7}, f_{3} = x_{6}, α = x_{3} and g = x_{4}x_{5} + x_{4}x_{8} + x_{5}x_{6}. By relation (20), setting α = x_{3}, we have that the first three coordinate functions of σ = (σ_{1}, σ_{2}, σ_{3},…, σ_{8}) = (σ_{1}, σ_{2}, σ_{3}, x_{4},…, x_{8}) are given as
Since α = x_{3}, then we find that \(\sigma ^{1}=(\sigma ^{1}_{1},\sigma ^{1}_{2},\sigma ^{1}_{3},x_{4},\ldots ,x_{8})\) is given by
Using the substitution \(x_{1}\rightarrow \sigma ^{1}_{1}\), \(x_{2}\rightarrow \sigma ^{1}_{2}\) and \(x_{3}\rightarrow \sigma ^{1}_{3}\) in relation (21) we have that the bent function F = f ∘ σ^{− 1} is given as
which is a bent function of degree 4 and therefore affine inequivalent to f.
Remark 9
The importance of the above example lies in the fact that one can combine the extended form (21) and the possibility that α can essentially depend on x_{1},…, x_{n} and not only on x_{k+ 1},…, x_{n}. In the same way, we may consider that some of the functions f_{1}, f_{2}, f_{3} depends on arbitrary input variables, but clearly the bent conditions (along with the difficulty of specifying suitable σ and σ^{− 1}) become much harder.
5 Bent functions from nonlinear permutations and vice versa
It is wellknown that any permutation ϕ over \({\mathbb {F}_{2}^{m}}\) induces a bent function in the \(\mathcal {M}\mathcal {M}\) class f(x, y) = ϕ(y) ⋅ x + ψ(y), where \(x,y \in {\mathbb {F}_{2}^{m}}\). On the other hand, ϕ(y) = (ϕ_{1}(y),…, ϕ_{m}(y)) is a permutation over \({\mathbb {F}_{2}^{m}}\) if and only if all linear (nonzero) combinations of the coordinate functions ϕ_{i} are balanced [10, Theorem 7.7]. The fact that for any bent function \(f \in \mathcal {B}_{n}\) the derivatives D_{a}f(x) = f(x + a) + f(x) are balanced functions, for any nonzero \(a \in {\mathbb {F}_{2}^{n}}\), leads to a natural question whether certain classes of bent functions have balanced linear combinations of their derivatives thus giving rise to permutations over \(\mathbb {F}_{2}^{2m}\). In [9], Hou and Langevin provided two sporadic examples of cubic bent functions \(f \in \mathcal {B}_{8}\) to define a permutation \(\sigma =(D_{e_{1}}f, \ldots ,D_{e_{8}}f)\), where \(D_{e_{i}}f\) is a derivative of with respect to the set {e_{1},…, e_{8}} that forms a basis of \({\mathbb {F}_{2}^{8}}\). The authors noted that for the considered cubic bent function approximately half of the choices of different basis essentially give rise to permutations. Henceforth, we always use the canonical basis of the vector space \({\mathbb {F}_{2}^{n}}\), that is, the set \(\{e_{1},\ldots ,e_{n}\} \in {\mathbb {F}_{2}^{n}}\) where e_{i} equals one at position i otherwise its entries are zeros.
The main motivation of this section is to investigate whether there is a generic method of deriving permutations σ over \(\mathbb {F}_{2}^{2m}\) given a bent function in the \(\mathcal {M}\mathcal {M}\) class defined using a suitable permutation ϕ over \({\mathbb {F}_{2}^{m}}\). The next result gives sufficient conditions for a permutation ϕ over \({\mathbb {F}_{2}^{m}}\) that can be used to design a permutation σ over \(\mathbb {F}_{2}^{2m}\).
Proposition 4
Letϕ = (ϕ_{1},…, ϕ_{m}) be a permutation over\({\mathbb {F}_{2}^{m}}\).Letf (y, x) = ϕ(y) ⋅ xbe a bent function in\(\mathcal {B}_{2m}\),\(x,y \in {\mathbb {F}_{2}^{m}}\).Let\(e_{i}=(e_{i}^{\prime },e_{i}^{\prime \prime })\)where\(e_{i}^{\prime },e_{i}^{\prime \prime } \in {\mathbb {F}_{2}^{m}}\).If\(\{ \phi (y+ e_{1}^{\prime })+\phi (y), \ldots ,\phi (y+ e_{m}^{\prime })+\phi (y) \}\)is a basis of\({\mathbb {F}_{2}^{m}}\)for any fixed\(y\in {\mathbb {F}_{2}^{m}}\),then the function\(\sigma =(D_{e_{1}}f, \ldots , D_{e_{2m}}f )\)is a permutation over\(\mathbb {F}_{2}^{2m}\).
Proof
It is convenient to write f(y, x) = ϕ_{1}(y)x_{1} + ⋯ + ϕ_{m}(y)x_{m}. Since f is bent it implies that \(D_{e_{i}}f\) are balanced functions, thus it remains to show that the linear combinations of \(D_{e_{1}}f, \ldots , D_{e_{2m}}f \) are also balanced.
Then, for i = m + 1,…,2m we have \(D_{e_{i}}f=f(y,x+e_{i}^{\prime \prime })+f(y,x)=\phi _{im}(y)\). Now, considering \(\sigma =(\sigma _{1},\ldots ,\sigma _{2m})=(D_{e_{1}}f, \ldots ,D_{e_{2m}}f)\), we notice that \({\sum }_{j=m + 1}^{2m}b_{j}\sigma _{j}={\sum }_{j=m + 1}^{2m}b_{j}\phi _{j m}(y)\) is a balanced function for any \( (b_{m + 1},\ldots ,b_{2m}) \in {{\mathbb {F}_{2}^{m}}}^{*}\), since ϕ is a permutation.
On the other hand, for any e_{j}, j = 1,…, m, (thus of the form \((e_{j}^{\prime },\textbf {0}_{m}))\) we have
which are balanced by assumption. In order that σ is a permutation we need to have that all (nontrivial) linear combinations of the form
(involving both halves ) are balanced. Then, defining
it is sufficient to show that the equation
has 2^{2m− 1} solutions, for any \((a_{1}, a_{2}, \ldots ,a_{m},b_{m + 1},\ldots ,b_{2m})\in {{\Bbb F}_{2}^{2m}}^{*} \).
If a = (a_{1},…, a_{m}) = 0_{m}, then we know \({\sum }_{j=m + 1}^{2m}b_{j}\phi _{j  m}(y)\) is a balanced function for any \( (b_{m + 1},\ldots ,b_{2m}) \in {{\mathbb {F}_{2}^{m}}}^{*}\), that is, the (26) has 2^{2m− 1} solutions.
Now assume a = (a_{1},…, a_{m})≠0_{m}. Since \(\{ \phi (y+ e_{1}^{\prime })+\phi (y), \ldots ,\phi (y+ e_{m}^{\prime })+\phi (y) \}\) is a basis of \({\mathbb {F}_{2}^{m}}\) for any fixed \(y\in {\mathbb {F}_{2}^{m}}\) (the matrix M_{m×m} is nonsingular for any fixed \(y\in {\mathbb {F}_{2}^{m}}\)), then (a_{1}, a_{2},…, a_{m})M_{m×m} is a nonzero vector. Hence, the equation (26) has 2^{2m− 1} solutions since ((a_{1}, a_{2},…, a_{m})M) ⋅ x is a linear function. □
If ϕ(y) = (ϕ_{1}(y),…, ϕ_{m}(y)) = (y_{1},…, y_{m}), then the matrix M_{m×m} is an identity matrix. In the following, we provide a nonlinear permutation ϕ such that \(\{ \phi (y+ e_{1}^{\prime })+\phi (y), \ldots ,\phi (y+ e_{m}^{\prime })+\phi (y) \}\) is a basis of \({\mathbb {F}_{2}^{m}}\), for any fixed \(y\in {\mathbb {F}_{2}^{m}}\). For this purpose, using the canonical basis \(\{e_{1}^{\prime },\ldots , e_{m}^{\prime }\}\) of \({\mathbb {F}_{2}^{m}}\), we simply define the permutation \(\phi :{\mathbb {F}_{2}^{m}} \rightarrow {\mathbb {F}_{2}^{m}}\) as follows:
where γ(i) = i + 1 for i ∈ [1, m − 1] and γ(m) = 1. Thus, ϕ can be viewed as an identity permutation on \({\mathbb {F}_{2}^{m}} \setminus \{e_{1}^{\prime },\ldots ,e_{m}^{\prime }\}\), whereas the images of ϕ are cyclically shifted when \(y \in \{e_{1}^{\prime },\ldots ,e_{m}^{\prime }\}\).
Theorem 3
Let\(e_{i}=(e_{i}^{\prime },e_{i}^{\prime \prime })\)where\(e_{i}^{\prime },e_{i}^{\prime \prime } \in {\mathbb {F}_{2}^{m}}\)and define a permutation\(\phi :{\mathbb {F}_{2}^{m}} \rightarrow {\mathbb {F}_{2}^{m}}\)by (27) . Letf (y, x) = ϕ (y) ⋅ xbe a bent function in\(\mathcal {B}_{2m}\),\(x,y \in {\mathbb {F}_{2}^{m}}\).Then\(\{ \phi (y+ e_{1}^{\prime })+\phi (y), \ldots ,\phi (y+ e_{m}^{\prime })+\phi (y) \}\)is a basis of\({\mathbb {F}_{2}^{m}}\),for any fixed\(y\in {\mathbb {F}_{2}^{m}}\).Consequently,\(\sigma =(D_{e_{1}}f, \ldots , D_{e_{2m}}f )\)is a permutation over\(\mathbb {F}_{2}^{2m}\).
Proof
It is enough to show that \(\{ \phi (y+ e_{1}^{\prime })+\phi (y), \ldots ,\phi (y+ e_{m}^{\prime })+\phi (y) \}\) is a basis of \({\mathbb {F}_{2}^{m}}\), for any fixed \(y\in {\mathbb {F}_{2}^{m}}\). There are three cases to be considered.

1.
If wt(y) = 1, w.l.o.g. we set \(y=e_{1}^{\prime }\). From the definition of ϕ we have that
$$\begin{array}{c} \phi(y+ e_{1}^{\prime})+\phi(y)= e_{2}^{\prime},\\ \phi(y+ e_{2}^{\prime})+\phi(y)= e_{1}^{\prime}+e_{2}^{\prime}+e_{2}^{\prime}=e_{1}^{\prime},\\ \phi(y+ e_{3}^{\prime})+\phi(y)= e_{1}^{\prime}+e_{3}^{\prime}+e_{2}^{\prime},\\ \vdots\\ \phi(y+ e_{m}^{\prime})+\phi(y)= e_{1}^{\prime}+e_{m}^{\prime}+e_{2}^{\prime} \end{array} $$is a basis of \({\mathbb {F}_{2}^{m}}\).

2.
If wt(y) = 2, w.l.o.g. we set \(y=e_{1}^{\prime }+e_{2}^{\prime }\). Similarly, as above
$$\begin{array}{c} \phi(y+ e_{1}^{\prime})+\phi(y)= e_{3}^{\prime}+e_{1}^{\prime}+e_{2}^{\prime},\\ \phi(y+ e_{2}^{\prime})+\phi(y)= e_{2}^{\prime}+e_{1}^{\prime}+e_{2}^{\prime}=e_{1}^{\prime},\\ \phi(y+ e_{3}^{\prime})+\phi(y)= e_{1}^{\prime}+e_{2}^{\prime}+ e_{3}^{\prime}+e_{1}^{\prime}+e_{2}^{\prime}=e_{3}^{\prime},\\ \vdots\\ \phi(y+ e_{m}^{\prime})+\phi(y)= e_{1}^{\prime}+e_{2}^{\prime}+e_{m}^{\prime}+e_{1}^{\prime}+e_{2}^{\prime}=e_{m}^{\prime} \end{array} $$is a basis of \({\mathbb {F}_{2}^{m}}\).

3.
Now for wt(y) ≥ 3, we have \(wt(y+e_{i}^{\prime })\geq 2\), that is, \(\phi (y+e_{i}^{\prime })=y+e_{i}^{\prime }\). From the definition of ϕ we obtain
$$\begin{array}{c} \phi(y+ e_{1}^{\prime})+\phi(y)= y+e_{1}^{\prime}+y,\\ \phi(y+ e_{2}^{\prime})+\phi(y)= y+e_{2}^{\prime}+y,,\\ \vdots\\ \phi(y+ e_{m}^{\prime})+\phi(y)= y+e_{m}^{\prime}+y, \end{array} $$which is a basis of \({\mathbb {F}_{2}^{m}}\).
By Proposition 4, \(\sigma =(D_{e_{1}}f, \ldots , D_{e_{2m}}f )\) is a permutation over \(\mathbb {F}_{2}^{2m}\). □
Notice that σ is in general a nonlinear permutation and can have large algebraic degree which entirely depends on ϕ. This result has its independent significance as a generic design method to construct permutations over finite fields. The question whether the permutation σ may be used to construct f^{′}(x, y) = σ(y) ⋅ x whose linear combinations of its derivatives are again balanced (thus giving rise to an infinite sequence of permutations) is left open.
Remark 10
The same approach can be applied to a class of permutations proposed recently in [16]. Namely it was checked by computer that the permutations over \({\mathbb {F}_{2}^{m}}\) given in Construction 2 also give rise to permutations over \(\mathbb {F}_{2}^{2m}\) similarly to the class described in Theorem 3.
6 Conclusions
In this article we have identified two generic methods for constructing (in general) affine inequivalent bent functions using suitable classes of existing bent functions. A natural question which remains to be answered is to which primary class of bent functions these functions do belong. More precisely, assuming that a bent function f is provably within a certain class the question is whether the function F constructed by means of a nonlinear transform σ remains in the same class or not. We find this question to be fundamental with respect to the classification of bent functions.
References
Canteaut, A., Charpin, P.: Decomposing bent functions. IEEE Trans. on Inform. Theory 49(8), 2004–2018 (2003)
Carlet, C.: Two new classes of bent functions. In: Proceedings of Eurocrypt ’93 Lecture Notes in Computer Science, vol. 765, pp. 77–101 (1994)
Carlet, C.: On the secondary constructions of resilient and bent functions. In: Proceedings of Coding, Cryptography and Combinatorics, Progress in Computer Science and Applied Logic, vol. 23, Birkhauser Verlag, Basel, pp 3–28 (2004)
Carlet, C., Mesnager, S.: Four decades of research on bent functions. Des. Codes Crypt. 78(1), 5–50 (2016)
Carlet, C., Zhang, F., Hu, Y.: Secondary constructions of bent functions and their enforcements. Adv. Math. Commun. 6(3), 305–314 (2012)
Carlet, C.: On bent and highly nonlinear balanced/resilient functions and their algebraic immunities. In: Proceedings of AAECC Lecture Notes in Computer Science, vol. 3857, pp. 1–28 (2006)
Dillon, J.F.: Elementary Hadamard difference sets. Ph. D. thesis, University of Maryland (1974)
Dobbertin, H.: Construction of bent functions and balanced Boolean functions with high nonlinearity. In: Proceedings of Fast Software Encryption, Leuven 1994 (1995), LNCS vol. 1008. SpringerVerlag, pp 61–74 (1994)
Hou, X.D., Langevin, P.: Results on bent functions. J. Combin. Theory, Ser. A 80, 232–246 (1997)
Lidl, R., Niederreiter, H.: Finite fields, Encyclopedia Math. Appl., vol. 20. AddisonWesley, Boston (1983). Reading
McFarland, R.L.: A family of noncyclic difference sets. J. Combinatorial Theory, Ser. A 15, 1–10 (1973)
MacWilliams, F.J., Sloane, N.J.A.: The theory of errorcorrecting codes. NorthHolland, Amsterdam (1977)
Mesnager, S., Zhang, F.: On constructions of bent, semibent and five valued spectrum functions from old bent functions. Adv. in Math. of Comm. 11(2), 339–345 (2017)
Mesnager, S., Zhang, F., Zhou, Y.: On construction of bent functions involving symmetric functions and their duals. Adv. in Math. of Comm. 11(2), 347–352 (2017)
Mesnager, S.: Several new infinite families of bent functions and their duals. IEEE Trans. Inform. Theory 60(7), 4397–4407 (2014)
Pasalic, E., Cepak, N., Wei, Y.: Infinite classes of vectorial plateaued functions, permutations and complete permutations. Discret. Appl. Math. 215, 177–184 (2016)
Rothaus, O.S.: On bent functions. J. Combinatorial Theory, Ser. A 20, 300–305 (1976)
Zhang, F., Carlet, C., Hu, Y., Cao, T.J.: Secondary constructions of highly nonlinear Boolean functions and disjoint spectra plateaued functions. Inf. Sci. 283, 94–106 (2014)
Zhang, F., Carlet, C., Hu, Y., Zhang, W.: New secondary constructions of bent functions. Appl. Algebra Eng. Commun. Comput. 27(5), 413–434 (2016)
Zhang, F., Pasalic, E., Wei, Y., Cepak, N.: Constructing bent functions outside the MaioranaMcFarland class using a general form of Rothaus. IEEE Trans. Inf. Theory 63(8), 5336–5349 (2017)
Acknowledgments
The authors are thankful to PhD student Nastja Cepak for computer simulations related to permutations in [16]. Enes Pasalic is partly supported by the Slovenian Research Agency (research program P3 0384 and research project J16720). Samir Hodžić is supported in part by the Slovenian Research Agency (research program P30384 and Young Researchers Grant). Fengrong Zhang is supported in part by National Science Foundation of China(61303263), and and in part by the Fundamental Research Funds for the Central Universities (Grant No. 2015XKMS086), and in part by the China Postdoctoral Science Foundation funded project (Grant No. 2015T80600). Yongzhuang Wei is supported in part by the Natural Science Foundation of China (61572148), in part by the Guangxi Natural Science Found (2015GXNSFGA139007), in part by the project of Outstanding Young Teachers Training in Higher Education Institutions of Guangxi.
Author information
Authors and Affiliations
Corresponding author
Rights and permissions
About this article
Cite this article
Pasalic, E., Hodžić, S., Zhang, F. et al. Bent functions from nonlinear permutations and conversely. Cryptogr. Commun. 11, 207–225 (2019). https://doi.org/10.1007/s1209501802829
Received:
Accepted:
Published:
Issue Date:
DOI: https://doi.org/10.1007/s1209501802829
Keywords
 Nonlinear permutations
 Bent functions
 MaioranaMcFarland class
 Affine equivalence
Mathematics Subject Classification (2010)
 94A60
 06E30