Formal self duality

Abstract

We study the notion of formal self duality in finite abelian groups. Formal duality in finite abelian groups has been proposed by Cohn, Kumar, Reiher and Schürmann. In this paper we give a precise definition of formally self dual sets and discuss results from the literature in this perspective. Also, we discuss the connection to formally dual codes. We prove that formally self dual sets can be reduced to primitive formally self dual sets similar to a previously known result on general formally dual sets. Furthermore, we describe several properties of formally self dual sets. Also, some new examples of formally self dual sets are presented within this paper. Lastly, we study formally self dual sets of the form $\{(x,F(x)) \ : \ x\in {\mathbb {F}}_{2^{n}}\}$ where F is a vectorial Boolean function mapping ${\mathbb {F}}_{2^{n}}$ to ${\mathbb {F}}_{2^{n}}$.

1 Introduction

In this paper we study formal duality as introduced by Cohn, Kumar, Reiher and Schürmann in [5]. For an outline of the relations of this concept to formal duality of codes, we refer to Section 2. Formal duality has been introduced in relation to energy minimization problems and has subsequently been studied using finite abelian groups in [4].

It can be defined as follows:

Definition 1.1

Let G be some (multiplicative) finite abelian group and $\hat {G}$ be its dual group, i.e., the group of homomorphisms from G to $\mathbb {C}^{\ast }$. Two sets S ⊂ G and $T \subset \hat {G}$ form a formally dual pair, if for all $\chi \in \hat {G}$ we have

$$ \left|\chi(S)\right|^{2} = \frac{|S|^{2}}{|T|}\nu_{T}(\chi), $$

(1)

or equivalently if for all g ∈ G we have

$$ \left|g(T)\right|^{2} = \frac{|T|^{2}}{|S|}\nu_{S}(g), $$

(2)

where

$$\nu_{T}(\chi) = \left|\left\{(\phi,\psi)\in T\times T \ : \ \phi \cdot \psi^{-1} = \chi\right\}\right| $$

is called the weight enumerator of T and we use the notation $\chi (S) = {\sum }_{x\in S} \chi (x)$ and $g(T) = {\sum }_{\chi \in T} \chi (g)$. A set S is called a formally dual set if there is a set T such that S and T form a formally dual pair.

Note that $\hat {\hat {G}}$ is canonically isomorphic to G and S and T form a formally dual pair (in G and $\hat {G}$) if and only if T and S form a formally dual pair (in $\hat {G}$ and $\hat {\hat {G}}$). Furthermore, formal duality can be seen as a generalization of relative difference sets, i.e. sets S ⊂ G such that there is a subgroup N ≤ G and an integer λ with ν_S(g) = |G| if g = 1, ν_S(g) = 0 if g ∈ N and ν_S(g) = λ otherwise.

The characterization of such formally dual sets is an interesting open question which several authors studied before. More information about formal duality in cyclic groups can be found in [18, 20, 25]. A comprehensive analysis of formal duality in general abelian groups is given in [17, 21] and some more examples are discussed in [15, 16].

In order to define formal self duality, we have to regard the set T of Definition 1.1 as a subset of G. A finite abelian group is always isomorphic to its dual group. Thus, by choosing an isomorphism ${\Delta }: G\rightarrow \hat {G}$ we can get rid of the dual group in Definition 1.1. Equivalently we can choose a pairing, that is a nondegenerate bilinear form $\left <\cdot ,\cdot \right >:G\times G \rightarrow {\mathbb {C}}^{\ast }$. Note that any isomorphism Δ defines a pairing $\left <\cdot ,\cdot \right >_{{\Delta }}$ by $\left <a,b\right >_{{\Delta }} = [{\Delta } a](b)$ and any pairing $\left <\cdot ,\cdot \right >$ defines an isomorphism by x↦χ such that $\chi (y) = \left <x,y\right >$ for all y ∈ G.

Using this notion we can define formal duality under isomorphisms and formal self duality:

Definition 1.2

[17, Definition 2.7] Let G be a finite abelian group and ${\Delta }: G\rightarrow \hat {G}$ be an isomorphism. Then S ⊂ G and T ⊂ G form a formally dual pair under Δ if S and Δ(T) form a formally dual pair (in G and $\hat {G}$). Alternatively, we say S and T form a formally dual pair under the pairing $\left <\cdot ,\cdot \right >_{{\Delta }}$. We call a set S formally self dual, when S is formally dual to itself under some isomorphism.

Formal self duality has been briefly studied in [25] and some examples are given in [4, 17].

In this paper we continue the study of formal self duality. An important tool in the study of formal duality is the reduction to so called primitive formally dual sets (see Theorem 3.2). We prove an analog result for formal self duality. Furthermore, we state some equivalent formulations of formal self duality using the even set theory introduced in [17]. Moreover, we state four new examples of primitive formally dual sets in groups of order 64 that happen to be formally self dual. Note that in the set of all groups with order no more than 63 we are able to characterize formally dual sets (see [17, Table A.1]). Thus, these new examples are a step towards increasing the smallest group size with incomplete results.

The paper is organized as follows: We start with a comparison of formal duality in finite abelian groups and formal duality of codes in Section 2. In Section 3 we state previously known facts needed to follow the rest of the paper. We also give an overview of examples of formal self duality known from the literature. In Section 4 we state and prove the results about formal self duality mentioned before and Section 5 contains the new examples. In Section 6, we discuss the relations of formal duality to Boolean vectorial functions and study formally self dual sets of the form $\{(x,F(x)) \ : \ x\in {\mathbb {F}}_{2^{n}}\}$. We conclude this paper by some open questions in Section 7.

2 Connection to formal duality of codes

In this section we point out an interesting connection between formal duality of sets in finite abelian groups as defined in Definition 1.1 and the notion of formal dual codes. The possible connection between these to concepts has been brought to our attention by Claude Carlet. Let $C \subseteq {{\mathbb {F}}_{q}^{n}}$ be a code with q = p^k. We denote the weight of c ∈ C (i.e. the number of non-zero entries) by wt(c) and the Hamming distance of c₁,c₂ by d_H(c₁,c₂) = wt(c₁ − c₂). Further, we define the weight enumerator W_C and distance enumerator D_C by

$$ W_{C}(X,Y) = \sum\limits_{c \in C}X^{n-{wt}(c)}Y^{{wt}(c)} \text{ and } D_{C}(X,Y) = \frac{1}{|C|}\sum\limits_{c_{1},c_{2} \in C}X^{n-d_{H}(c_{1},c_{2})}Y^{d_{H}(c_{1},c_{2})}. $$

If C is a linear code, it is elementary that W_C = D_C. A key result in the theory of linear codes is the MacWilliams identity (see e.g. [19]), which gives a relation between the weight/distance enumerator of a linear code C and its dual $C^{\perp } = \{v \in {{\mathbb {F}}_{q}^{n}} \colon v \cdot c = 0 \text { for all } c \in C\}$, where the multiplication ⋅ denotes the usual dot product on ${{\mathbb {F}}_{q}^{n}}$. The MacWilliams identity then states

$$ \frac{1}{|C|}W_{C}(X+(q-1)Y,X-Y) = W_{C^{\perp}}(X,Y), $$

and, of course, the same relation equivalently for the distance enumerator D_C. Extending the notion of dual codes, we say that two non-linear codes $C,C^{\prime } \subseteq {{\mathbb {F}}_{q}^{n}}$ that nevertheless satisfy the MacWilliams identity in the sense that

$$ \frac{1}{|C|}W_{C}(X+(q-1)Y,X-Y) = W_{C^{\prime}}(X,Y) $$

have dual weight enumerators. Equivalently, if the same relation holds for the distance enumerators, we say that $C,C^{\prime }$ have dual distance enumerators. If $C,C^{\prime }$ have both dual weight and distance enumerators, we call them formal dual codes. In the case of $C=C^{\prime }$, we can also speak of formal self dual codes. Probably the most famous case of formal dual codes are the binary Kerdock and Preparata codes [19, Chapter 15]. The breakthrough result in [11, Theorems 2,3] shows in fact that binary codes constructed via the Gray mapping from ${\mathbb {Z}}_{4}$-linear codes and their ${\mathbb {Z}}_{4}$-duals are always formal dual codes in the binary setting. For a more detailed treatment of this connection between ${\mathbb {Z}}_{4}$-linear codes and formal dual codes, we also refer to [1]. There is also a connection between the notion of formal duality for codes and the notion of formal duality we introduced for finite abelian groups in Definition 1.1: Following the steps of the classical proof of the MacWilliams identity [19, Theorem 13], we have for arbitrary codes $C \subseteq {{\mathbb {F}}_{q}^{n}}$

$$ D_{C}(X+(q-1)Y,X-Y) = \frac{1}{|C|}\sum\limits_{x \in {\mathbb{F}_{q}^{n}}} \left|\sum\limits_{c \in C} \chi_{x}(c)\right|^{2} X^{n-{wt}(x)}Y^{{wt}(x)}, $$

(3)

where $\chi _{x}(c) = \zeta _{p}^{\text {Tr}(x\cdot c )}$, ζ_p = e^2πi/p is a primitive p-th root of unity and $\text {Tr} \colon {\mathbb {F}}_{q} \rightarrow {\mathbb {F}}_{p}$ the absolute trace mapping $x \mapsto x+x^{p}+\dots +x^{p^{k-1}}$. Indeed, the MacWilliams identity for linear codes follows directly from (3) since in that case ${\sum }_{c \in C} \chi _{x}(c)=|C|$ if x ∈ C^⊥ and 0 otherwise. Let us now assume that there is a set $C^{\prime }\subseteq {{\mathbb {F}}_{q}^{n}}$ that is formal dual to C as subsets of $({{\mathbb {F}}_{q}^{n}},+)$ in the sense of Definition 1.2 under the canonical isomorphism x↦χ_x. Then, by (1), for each $x \in {{\mathbb {F}}_{q}^{n}}$ we have $\left |{\sum }_{c \in C}\chi _{x}(c)\right |^{2} = \frac {|C|^{2}}{|C^{\prime }|}\nu _{C^{\prime }}(x)$. Then, using (3), we have

$$ \begin{array}{@{}rcl@{}} D_{C}(X+(q-1)Y,X-Y) &=& \frac{|C|}{|C^{\prime}|}\sum\limits_{x \in {\mathbb{F}_{q}^{n}}} \nu_{C^{\prime}}(x) X^{n-{wt}(x)}Y^{{wt}(x)} \\ &=& \frac{|C|}{|C^{\prime}|}\sum\limits_{c_{1},c_{2} \in C^{\prime}} X^{n-d_{H}(c_{1},c_{2})}Y^{d_{H}(c_{1},c_{2})} = |C| \cdot D_{C^{\prime}}(X,Y). \end{array} $$

In particular, formal dual sets in ${\mathbb {F}_{q}^{n}}$ under the canonical isomorphism always yield codes that have dual distance enumerators.

It is however not the case, that formal dual sets in groups of the form ${\mathbb {F}_{q}^{n}}$ always yield formal dual codes. Indeed, formal duality in abelian groups is invariant under translations. But formal dual codes $C,C^{\prime }$ always have to contain $(0,\dots ,0)$ (since $\frac {1}{|C|}W_{C}(X+(q-1)Y, X-Y)$ always contains the term Xⁿ and W_C(X,Y ) contains the term Xⁿ only if C contains $(0,\dots ,0)$). Thus, formal duality of codes is not invariant under translations. A simple counterexample can thus be constructed by translating any formal dual subset of a suitable group in such a way that it does not contain the zero vector. But there are also formal dual sets in groups of the form ${{\mathbb {F}}_{q}^{n}}$ which contain $(0,\dots ,0)$ and still are not formal dual codes. For example, consider the set

$$ \begin{array}{@{}rcl@{}} C &=& \{(0, 0, 0, 0), (0, 1, 0, 1), (0, -1, 0, 1), (1, 0, 0, -1), (1, 1, -1, 0), (1, -1, 1, 0),\\ &&(-1, 0, 0, -1), (-1, 1, 1, 0), (-1, -1, -1, 0)\}{\in\mathbb{F}_{3}^{4}}. \end{array} $$

Note that C forms with $C^{\prime } = {\Delta }(C)$ a formally dual pair in ${\mathbb {F}_{3}^{4}}$ under the canonical isomorphism, where Δ(x₁,x₂,x₃,x₄) = (x₃,−x₄,x₁,−x₂). Further, $W_{C}(X,Y) = W_{C^{\prime }}(X,Y)$ since the weight is clearly invariant under Δ. Moreover, $(0,0,0,0)\in C\cap C^{\prime }$. But the MacWilliams identity does not hold since

$$ \begin{array}{@{}rcl@{}} W_{C}(X,Y) &= &X^{4} + 4X^{2}Y^{2} + 4XY^{3}\\ \frac{1}{|C^{\prime}|}W_{C^{\prime}}(X+2Y, X-Y) &=& X^{4} + {\frac{4}{3}} X^{3}Y + 4 XY^{3} + {\frac{8}{3}} Y^{4}. \end{array} $$

Therefore, C and $C^{\prime }$ are not formal dual codes.

On the other hand, it is also not the case that formal dual codes always yield formal dual sets.

As a counterexample, consider the two $\mathbb {Z}_{4}$-linear codes C = 〈(2,1,3,1),(1,2,1,3)〉, $C^{\prime } = \langle (1,3,1,0),(3,1,0,1) \rangle$. It is easy to check that $C,C^{\prime }$ are ${\mathbb {Z}}_{4}$-duals, i.e. $C^{\prime } = \{x \in {{\mathbb {Z}}_{4}^{4}} \colon x \cdot c = 0 \text { for all } c \in C\}$, where ⋅ again denotes the usual dot product in ${{\mathbb {Z}}_{4}^{4}}$. Then, by [11, Theorems 2,3], the associated binary codes $\phi (C),\phi (C^{\prime }) \subseteq {{\mathbb {F}}_{2}^{8}}$, where $\phi \colon {{\mathbb {Z}}_{4}^{4}} \rightarrow {{\mathbb {F}}_{2}^{8}}$ is the Gray mapping (see [11]), are formal dual codes. We explicitly state the resulting codes for convenience:

$$ \begin{array}{@{}rcl@{}} \phi(C)& =& \{(0,0,0,0,0,0,0,0),(1,0,1,0,1,1,0,1),(0,1,1,1,0,1,1,1),(1,1,0,1,1,0,1,0), \\ &&(0,1,0,1,1,1,1,0),(1,0,1,1,1,0,1,1),(1,1,1,0,0,1,0,1),(1,1,0,0,0,0,0,0), \\ &&(1,1,0,0,1,1,0,0),(0,0,0,0,1,1,0,0),(0,0,0,1,0,1,1,0),(0,1,1,0,0,0,0,1), \\ &&(0,1,1,1,1,0,1,1),(0,0,1,0,1,0,0,1),(1,0,0,1,0,0,1,0),(1,0,1,1,0,1,1,1)\}, \\ \phi(C^{\prime})& =& \{(0,0,0,0,0,0,0,0),(0,1,0,0,1,0,1,0),(1,1,1,0,1,1,1,0),(1,0,1,0,0,1,0,0),\\ &&(1,0,0,0,0,1,0,1),(1,1,0,1,1,1,0,1),(0,1,0,1,1,0,0,0),(0,0,0,0,0,0,1,1), \\ &&(1,0,0,1,0,1,1,1),(1,1,0,1,1,1,1,0),(0,1,1,0,1,0,1,1),(0,0,1,1,0,0,1,1),\\ &&(1,0,1,1,0,1,1,0),(1,1,1,0,1,1,0,1),(0,1,1,1,1,0,0,1),(0,0,1,1,0,0,0,0)\}. \end{array} $$

Note that both codes are non-linear over $\mathbb {F}_{2}$. However, the condition for formally dual sets is not fulfilled by $\phi (C),\phi (C^{\prime })$: Indeed, as can be checked easily by computer, we have ${\sum }_{c \in \phi (C)}\chi (c) = 0$ for only 216 choices of χ while $\nu _{\phi (C^{\prime })}(x) = 0$ for 228 choices of x, violating (1) for any choice of isomorphism as in Definition 1.2.

However, there are also sets which are simultaneously formally self dual sets and formal self dual codes. For example, when p is an odd prime, the set $C = \{(x,x^{2}) \ : \ x\in {\mathbb {F}}_{p}\}$ is a formally self dual set under the pairing $\langle (a,b),(x,y)\rangle = \zeta _{p}^{\text {Tr}(ay + bx)}$ in the additive group of ${{\mathbb {F}}_{p}^{2}}$ (see [4, Theorem 3.2]). This set is also a formally self dual code: Indeed ${wt}((x,x^{2})) = \left \{\begin {array}{ll} 0 \text { if } x = 0,\\ 2 \text { otherwise,} \end {array}\right .$ and therefore C has a self dual weight enumerators as

$$ \frac{1}{|C|}W_{C}(X+(p-1)Y, X-Y) = X^{2} + (p-1)Y^{2} = W_{C}(X,Y). $$

Similar to the discussion above, we can see that C also has a self dual distance enumerator and is therefore a formally self dual code.

Of course, the motivation of the study of formal dual sets in finite abelian groups is quite different from the motivations in coding theory. For instance, the coding theoretical properties like minimum distance are one of the main reasons to investigate the formal dual Kerdock and Preparata codes, but are not of particular interest in our study.

3 Preliminaries

In this section we give a brief summary of needed results from the literature. Recall, that the definition of formal self duality, i.e., Definition 1.2, uses an isomorphism from G to $\hat {G}$ or a pairing in G. Often, a very specific paring is used. If a group is given in the form $G = {\mathbb {Z}}_{n_{1}}\times {\mathbb {Z}}_{n_{2}}\times \dots \times {\mathbb {Z}}_{n_{m}}$ we define the standard pairing of G as

$$ \left<(a_{1},\dots,a_{m}),(b_{1},\dots,b_{m})\right> = \zeta_{n_{1}}^{a_{1}b_{1}}\zeta_{n_{2}}^{a_{2}b_{2}}\dots\zeta_{n_{m}}^{a_{m}b_{m}} $$

where ζ_n = e^2πi/n.

An important tool in the study of formal duality is the reduction to so called primitive sets. A primitive set is defined as follows.

Definition 3.1

A set S ⊂ G is called primitive if none of the following holds:

• 1. S ⊂ v ⋅ H for some proper subgroup H of G,

• 2. S is a union of cosets with respect to a non-trivial subgroup of G.

The characterization of formally dual sets reduces to the study of primitive formally dual sets by the following result:

Theorem 3.2

[4, Lemma 4.2], [21, Theorem 3.15] Let S ⊂ G and $T\subset \hat {G}$ form a formally dual pair. Then the following holds:

• 1. The set S is contained in a proper coset a ⋅ H of G if and only if T is a union of cosets with respect to $H^{\perp }:= \{\chi \in \hat {G} \ : \ \chi (h) = 1 \text { for all } h\in H\}$ and vice versa.

• 2. If S ⊂ a ⋅ H then S under the canonical map $a\cdot H \rightarrow H$ and T under the natural reduction map $\hat {G}\rightarrow \hat {G}/H^{\perp }\simeq \hat {H}$ also form a formally dual pair.

An equivalent definition of formal duality using the so called even sets has been introduced in [17, Section 4]. For this purpose, we consider the group algebra ${\mathbb {Q}} G$. More information about group algebras can be found in [12, page 104]. Here, for a finite abelian group (G,⋅), the group algebra ${\mathbb {Q}} G$ is the set of formal sums $A = {\sum }_{g\in G} a_{g} g$ with coefficients $a_{g}\in {\mathbb {Q}}$. We define addition and multiplication in ${\mathbb {Q}} G$ by

$$ \left( \sum\limits_{g\in G} a_{g} g\right) + \left( \sum\limits_{g\in G} b_{g} g\right) = {\sum}_{g\in G} \left( a_{g} + b_{g}\right) g, $$

$$ \left( \sum\limits_{g\in G} a_{g} g\right) \cdot \left( \sum\limits_{g\in G} b_{g} g\right) = \sum\limits_{g\in G}\sum\limits_{h\in G} (a_{g} a_{h}) g\cdot h = \sum\limits_{g\in G} \left( \sum\limits_{h\in G} a_{h} a_{h^{-1}g}\right)g. $$

With this addition and multiplication ${\mathbb {Q}} G$ is indeed an algebra. Also, for $A = {\sum }_{g\in G} a_{g} g\in {\mathbb {Q}} G$ we use $A^{(-1)} := {\sum }_{g\in G} a_{g} g^{-1}$.

Furthermore, we abuse notation as $S = {\sum }_{g\in S} g\in \mathbb {Q} G$ as well as $S^{(-1)} := {\sum }_{g\in S} g^{-1}\in {\mathbb {Q}} G$ for S ⊂ G. Note that this abuse of notation can also be applied to subgroups of G. Also, note that

$$SS^{(-1)} = \sum\limits_{g\in S}\sum\limits_{h\in S}gh^{-1} = \sum\limits_{g\in G} \nu_{S}(g)g.$$

Then, an even set S is a set such that SS^(− 1) can be expressed as a linear combination of subgroups in the group algebra using the mentioned abuse of notation. For more details about even sets kindly refer to [17, Section 4] or [21, Chapter 4]. We recall the main theorem of this perspective:

Theorem 3.3

[17, Theorem 4.9] Two sets S ⊂ G and $T\subset \hat {G}$ form a formally dual pair if and only if there are coefficients $\lambda _{H}\in {\mathbb {Q}}$ such that

• 1. $SS^{(-1)} = {\sum }_{H\leq G} \lambda _{H} H$ and

• 2. $TT^{(-1)} = {\sum }_{H\leq G} \left (\frac {\lambda _{H} |G| \cdot |H|}{|S|^{3}}\right ) H^{\perp }$.

Especially S and T are even sets.

The following example states previously known formally self dual sets:

Example 3.4

The following sets are formally self dual sets.

• 1. The trivial example S = {1}⊂ G = {1},

• 2. $\text {TITO} := \{0,1\}\subset \mathbb {Z}_{4}$ under the standard pairing ([4, Section 3.1]),

• 3. any (n,n,n,1)-relative difference set with forbidden subgroup N such that Δ(N) = N^⊥ under Δ ([17, Theorem 3.7]),

• 4. generalized relative difference sets in $\mathbb {Z}_{p^{k}}^{2s}$ under a specific isomorphism ([17, Section 3.3]),

• 5. The set $\{n\cdot k \ : \ k\in \mathbb {Z}_{n^{2}}\}$ under the standard pairing [25, Theorem 6.1],

• 6. For any prime p and any α with α² ≡− 1 mod p the set

  $$\{ (k,k\cdot \alpha) \ : \ k\in \mathbb{Z}_{p}\}$$

  is formally self dual in $(\mathbb {Z}_{p})^{2}$ under the standard pairing (by the choice of α, we might only consider p with p ≡ 1 mod 4) [25, Theorem 6.3].

There is another way known to construct primitive formally dual sets of the same size using skew Hadamard difference sets:

Definition 3.5

Let G be a finite abelian group. A set D is called a skew Hadamard difference set if

• 1. DD^(− 1) = λG + k for some $\lambda ,k\in \mathbb {Z}$,

• 2. G = D + D^(− 1) + {1} (D, D^(− 1) and {1} are a partition of G).

Theorem 3.6

[17, Theorem 3.20] Let p^m ≡ 3 (mod 4) be a prime power and D be a skew Hadamard difference set in ${\mathbb {Z}_{p}^{m}}$ and ${\Delta }:{{\mathbb {Z}}_{p}^{m}}\rightarrow \hat {{{\mathbb {Z}}_{p}^{m}}}$ be a group isomorphism. Let

$$ D^{*} = \left\{a \in {\mathbb{Z}_{p}^{m}} \ : \ \left<a,D\right>_{{\Delta}} = \frac{-1 + i\sqrt{p^{m}}}{2}\right\} $$

be the dual set of D (see [17] and [22] for details). Furthermore, let α and β be nonzero elements of ${\mathbb {Z}}_{p}$ with α≠β and $G = {{\mathbb {Z}}_{p}^{m}}{\times {\mathbb {Z}}_{p}^{m}}$. Then

$$ S = \{(0,0)\} \cup \{(x,\alpha x) \ : \ x\in D\} \cup \left\{(x,{\beta} x) \ : \ x\in D^{(-1)}\right\} $$

and

$$ T = \{(0,0)\} \cup \left\{\left( \frac{\alpha}{\alpha-{\beta}}x,\frac{1}{{\beta} - \alpha}x\right) \ : \ x\in D^{*}\right\} \cup \left\{\left( \frac{{\beta}}{\alpha-{\beta}}x, \frac{1}{{\beta} - \alpha}x\right) \ : \ x\in D^{*(-1)}\right\} $$

form a formally dual pair under the isomorphism (x,y)↦(Δ(x),Δ(y)).

Remark 3.7

Theorem 3.6 can be easily obtained by [17, Theorem 3.20], even though it is a slight generalization of this result.

In Theorem 3.9 we will prove that, at least in a special case, Theorem 3.6 produces a formally self dual set. Therefore, consider the following example of a skew Hadamard difference set:

Example 3.8

[24, Example 2.5] Let p^m ≡ 3 (mod 4) be a prime power. Then the set

$$D = \left\{x^{2} \ : \ x\in \mathbb{F}_{p^{m}}\setminus \{0\}\right\}$$

is a skew Hadamard difference set in the additive group of ${\mathbb {F}}_{p^{m}}$ called the Paley difference set.

Theorem 3.9

Let D be the Paley difference set in ${\mathbb {Z}_{p}^{m}}$ and $\alpha ,{\beta }\in \mathbb {Z}_{p}$ with α≠β. Then

$$S = \{(0,0)\} \cup \{(x,\alpha x) \ : \ x\in D\} \cup \left\{(x,{\beta} x) \ : \ x\in D^{(-1)}\right\}$$

is a formally self dual set.

Proof

Let Tr be the field trace of $\mathbb {F}_{p^{m}}$. We consider the isomorphism Δ_Tr with the respective pairing $\left <a,b\right >_{{\Delta }_{\text {Tr}}} = \zeta _{p}^{\text {Tr}(a\cdot b)}$.

For a≠ 0 we have

$$ \left<a,D\right>_{{\Delta}_{\text{Tr}}} = {\frac{1}{2}} \left( \sum\limits_{x\in \mathbb{F}_{p^{m}}} \left<a,x^{2}\right>-1\right). $$

(4)

It is known (see for example [14, Theorems 5.15, 5.33]) that

$$\sum\limits_{x\in \mathbb{F}_{p^{m}}} \left<a,x^{2}\right>_{{\Delta}_{\text{Tr}}} = \left\{\begin{array}{cc} \eta(a)(-1)^{m-1}\sqrt{p^{m}} \text{ if } p\equiv 1\pmod 4\\ \eta(a)(-1)^{m-1}i^{m}\sqrt{p^{m}} \text{ if } p\equiv 3\pmod 4 \end{array}\right.$$

where η is the quadratic character (η(a) = 1 if a is square and η(a) = − 1 if a is nonsquare).

In the considered case, we have p^m ≡ 3 (mod 4) and therefore p ≡ 3 (mod 4) and m ≡ 1 (mod 2). Therefore

$$ \sum\limits_{x\in \mathbb{F}_{p^{m}}} \left<a,x^{2}\right>_{{\Delta}_{\text{Tr}}} = \pm \eta(a)i\sqrt{p^{m}}. $$

By substituting this term in (4) we get

$$ \left<a,D\right>_{{\Delta}_{\text{Tr}}} = {\frac{1}{2}} \left( -1 \pm \eta(a)i\sqrt{p^{m}}\right). $$

This yields

$$ D^{*} = \left\{a\in\mathbb{F}_{p^{m}} \ : \ \left<a,D\right>_{{\Delta}_{\text{Tr}}} = \frac{-1 + i\sqrt{p^{m}}}{2}\right\} \in \left\{D, D^{(-1)}\right\}. $$

(5)

By Theorem 3.6 we know that

$$ S = \{(0,0)\} \cup \{(x,\alpha x) \ : \ x\in D\} \cup \left\{(x,{\beta} x) \ : \ x\in D^{(-1)}\right\} $$

and

$$ T = \{(0,0)\} \cup \left\{\left( \frac{\alpha}{\alpha-{\beta}}x,\frac{1}{{\beta} - \alpha}x\right) \ : \ x\in D^{*}\right\} \cup \left\{\left( \frac{{\beta}}{\alpha-{\beta}}x, \frac{1}{{\beta} - \alpha}x\right) \ : \ x\in D^{*(-1)}\right\} $$

form a formally dual pair under Δ_Tr ×Δ_Tr : (x,y)↦(Δ_Tr(x),Δ_Tr(y)).

Due to (3) this yields T = π(S) where

$$\pi(x,y) = \left\{\begin{array}{ll}\left( \frac{1}{\alpha-{\beta}}y, \frac{1}{{\beta}-\alpha}x\right) \text{ if } D^{*} = D\\ \left( \frac{\alpha+{\beta}}{\alpha-{\beta}}x + \frac{1}{{\beta}-\alpha}y, \frac{1}{{\beta}-\alpha}x\right) \text{ if } D^{*} = D^{(-1)} \end{array}\right.$$

Therefore, S is a formally self dual set under Δ_Tr ×Δ_Tr ∘ π. □

Remark 3.10

There are several other constructions of skew-Hadamard difference sets (see for example [6,7,8,9, 23]). It is unknown if these examples and Theorem 3.6 can be used to produce more formally self dual sets. Another family of examples has been constructed in [15] (see also [16]). These examples are not formally self dual since the respective sets have unequal sizes. Also, it is unknown if there are any relative difference sets with forbidden subgroup N such that N and N^⊥ are not isomorphic. If such relative difference sets exist, it is unclear if they are formally self dual sets or even if they are formally dual sets.

4 Structural results about formally self dual sets

It is easy to see that Example 3.4. (5) and (6) are not primitive. Thus, by Theorem 3.2 they can be reduced to a primitive formally dual set. However, it is not guaranteed that the resulting set is still a formally self dual set. The following proposition implies, that a result similar to Theorem 3.2 also holds for formally self dual sets, i.e., every non-primitive formally self dual set can be reduced to a primitive formally self dual set. A weaker version of this Proposition has been stated in the second authors thesis [21, Proposition 3.22].

Proposition 4.1

Suppose S ⊂ G is a non-primitive formally self dual set under an isomorphism Δ. Then S is contained in some proper coset of H < G. Furthermore, if H is chosen as small as possible, then $\tilde {H} := {\Delta }^{-1} H^{\perp } \leq H$ and

$$ S^{\prime} = \left\{v\tilde{H} \ : \ v\in S\right\} \subset H/\tilde{H} $$

is formally self dual under the isomorphism ${{\Delta }^{\prime }}$ given by $\left <a \tilde {H},b \tilde {H}\right >_{{\Delta }^{\prime }} = \left <a,b\right >_{{\Delta }}.$

Proof

First suppose S is not primitive but also not contained in a proper coset. Due to Definition 3.1 we know that $S = \bigcup v\cdot L$ for some non-trivial L ≤ G. Using Theorem 3.2 we then know that ΔS is contained in a coset with respect to $L^{\perp } < \hat {G}$ and thus S is contained in a coset with respect to Δ^− 1L^⊥ < G which is a contradiction.

Now assume that S is contained in a coset with respect to H < G. By Theorem 3.2 we know that ΔS is invariant under translations by H^⊥ and thus S is invariant under translations by $\tilde {H}$.

Therefore, using Theorem 3.2 again, we have ${\Delta } S \subset \tilde {H}^{\perp }$ and thus $S\subset H\cap {\Delta }^{-1}\tilde {H}^{\perp }$. Since H is chosen as small as possible and $|H| = |{\Delta }^{-1}\tilde {H}^{\perp }|$ we have $H = {\Delta }^{-1}\tilde {H}^{\perp }$. In other words ${\Delta } H = \tilde {H}^{\perp }$.

This yields, that ${{\Delta }^{\prime }}$ is well defined, since for all $h\in \tilde {H}$ and b ∈ H we have

• 1. $\left <h,b\right >_{{\Delta }} = 1$ (indeed ${\Delta } h\in {\Delta } \tilde {H} = {\Delta } {\Delta }^{-1} H^{\perp } = H^{\perp }$),

• 2. $\left <b,h\right >_{{\Delta }} = 1$ (indeed ${\Delta } b \in {\Delta } H = \tilde {H}^{\perp }$).

Then we have for all $a\tilde {H}\in H/\tilde {H}$ that $\nu _{S^{\prime }}(a\tilde {H}) = \nu _{S}(a) / |\tilde {H}|$ as well as $|S^{\prime }| = |S|/|\tilde {H}|$ and

$$\left<a,S\right>_{{\Delta}} = \sum\limits_{v\in S} \left<a,v\right>_{{\Delta}} = |\tilde{H}|\cdot \sum\limits_{v\tilde{H}\in S^{\prime}} \left<a \tilde{H},v\tilde{H}\right>_{{\Delta}^{\prime}} = |\tilde{H}|\cdot \left <a\tilde{H}, S^{\prime}\right>_{{\Delta}^{\prime}}.$$

Altogether, we have

$$\frac{|S^{\prime}|^{2}}{|S^{\prime}|} \nu_{S^{\prime}}(a\tilde{H}) = \frac 1{|\tilde{H}|^{2}} \frac{|S|^{2}}{|S|} \nu_{S}(a) = \frac 1 {|\tilde{H}|^{2}} \left| \left<a,S\right>_{{\Delta}}\right|^{2} = \left|\left <a\tilde{H}, S^{\prime}\right>_{{\Delta}^{\prime}}\right|^{2}. $$

Thus, $S^{\prime }$ is formally self dual under ${\Delta }^{\prime }$. □

Due to this result, we only need to characterize the primitive formally self dual sets in order to characterize all formally self dual sets. In particular we have:

Corollary 4.2

By using Proposition 4.1 on Example 3.4. (5) and (6) with H = S, the examples reduce to the trivial formally self dual set.

We continue by discussing formal self duality in perspective of even sets. Our main aim is to provide a canonical even set decomposition for formally self dual sets. This is achieved in Proposition 4.5. First we discuss some insights which are helpful in order to proof Proposition 4.5. Recall that an even set is a set S ⊂ G such that $SS^{(-1)} = {\sum }_{H \leq G} \lambda _{H} H \in {\mathbb {Q}} G$ for some rational coefficients λ_H. For every isomorphism ${\Delta }: G\rightarrow \hat {G}$ we define the adjoint isomorphism by ${\Delta }_{*}: G\rightarrow \hat {G}$ such that $\left <x,y\right >_{{\Delta }} = \left <y,x\right >_{{\Delta }_{*}}$. In other words

$$ \chi(y) = \left[{\Delta}_{*} y\right]\left( {\Delta}^{-1}\chi\right) = [{\Delta} y]\left( {\Delta}_{*}^{-1}\chi\right) $$

for all $\chi \in \hat {G}$ and y ∈ G. This induces an automorphism $\sigma = {\Delta }^{-1}{\Delta }_{*}$ of G. Note, that if Δ corresponds to a symmetric bilinear form, for example the standard pairing, then Δ = Δ_∗ and σ = id. In the general case we can use the following to describe the relations among H, H^⊥, Δ and Δ_∗.

Lemma 4.3

For some isomorphism ${\Delta }:G\rightarrow \hat {G}$ and subgroup H ≤ G we have:

• 1. $({\Delta }_{*} H)^{\perp } = {\Delta }^{-1} H^{\perp }$ (see also [21, Lemma 2.1]),

• 2. ${\Delta }_{*}^{-1}\left ({\Delta }^{-1} H^{\perp }\right )^{\perp } = H$,

• 3. ${\Delta }^{-1}\left ({\Delta }^{-1} H^{\perp }\right )^{\perp } = \sigma H$,

• 4. Δ^− 1(σH)^⊥ = σΔ^− 1H^⊥.

Proof

Let h ∈Δ^− 1H^⊥. Then for all χ ∈Δ_∗H we have

$$ h(\chi) = \chi(h) = [\underbrace{{\Delta} h}_{\in H^{\perp}}](\underbrace{{\Delta}_{*}^{-1}\chi}_{\in H}) = 1. $$

Thus h ∈ (Δ_∗H)^⊥.

On the other hand let g ∈ (Δ_∗H)^⊥. Then for all h ∈ H we have

$$[{\Delta} g](h) = [{\Delta}_{*} h](g) = g(\underbrace{{\Delta}_{*} h}_{\in {\Delta}_{*} H}) = 1.$$

Thus Δg ∈ H^⊥ or in other words g ∈Δ^− 1H^⊥. Altogether, we get assertion (1).

Furthermore, ${\Delta }_{*}^{-1}\left ({\Delta }^{-1} H^{\perp }\right )^{\perp } = {\Delta }_{*}^{-1} {\Delta }_{*} H = H$ and

$$ {\Delta}^{-1}\left( {\Delta}^{-1} H^{\perp}\right)^{\perp} = {\Delta}^{-1}{\Delta}_{*} H = \sigma H $$

as well as

$$ {\Delta}^{-1}\underbrace{\left( {\Delta}^{-1}{\Delta}_{*} H\right)^{\perp}}_{={\Delta}_{*}({\Delta}_{*} H)^{\perp}} = \sigma({\Delta}_{*} H)^{\perp} = \sigma {\Delta}^{-1} H^{\perp} $$

yielding the other assertions. □

Furthermore, we have the following result about formal duality (see also [21, Lemma 3.21]):

Lemma 4.4

Two sets S ⊂ G and T ⊂ G form a formally dual pair under isomorphism Δ if and only if T and S form a formally dual pair under Δ_∗. In particular, S is formally self dual under Δ if and only if S is formally self dual under Δ_∗.

Proof

Suppose S and T form a formally dual pair under Δ. Observe that ν_ΔT(Δg) = ν_T(g) and

$$ [{\Delta} g](S) = \sum\limits_{x\in S} [{\Delta} g](x) = \sum\limits_{x\in S} [{\Delta}_{*} x](g) = \sum\limits_{x\in S} g({\Delta}_{*} x) = g({\Delta}_{*} S). $$

Then

$$ \frac{|{\Delta}_{*} S|^{2}}{|T|} \nu_{T}(g) = \frac{|S|^{2}}{|{\Delta} T|}\nu_{{\Delta} T}({\Delta} g) = |[{\Delta} g](S)|^{2} = |g({\Delta}_{*} S)|^{2}. $$

With [Δ_∗]_∗ = Δ the assertion follows by Definition 1.2. □

With these results we can provide a canonical even set decomposition of formally self dual sets:

Proposition 4.5

Let S ⊂ G and ${\Delta }: G\rightarrow \hat {G}$ be an isomorphism.

The following are equivalent:

• 1. S is a formally self dual set under Δ,

• 2. $SS^{(-1)} = {\sum }_{H\leq G} \lambda _{H} H$ with λ_σH = λ_H and $\lambda _{{\Delta }^{-1} H^{\perp }} = \frac {|H|}{|S|}\lambda _{H}$.

Proof

Suppose S is a formally self dual set under Δ. By Theorem 3.3

$$SS^{(-1)} = \sum\limits_{H\leq G} \mu_{H} H$$

for suitable $\mu _{H}\in \mathbb {Q}$.

First we show by induction in i that

$$ SS^{(-1)} = \sum\limits_{H\leq G} \mu_{\sigma^{i} H} H = \sum\limits_{H\leq G} \frac{|S|}{|H|} \mu_{\sigma^{i}{\Delta}^{-1} H^{\perp}} H \text{ for all }i\in{\mathbb{N}}. $$

(6)

If i = 0 the first equation follows from the above assumption $SS^{(-1)} = {\sum }_{H\leq G} \mu _{H} H$. For the second equation we use Theorem 3.3, Lemma 4.4 and |S|² = |G| to get

$$ SS^{(-1)} = \sum\limits_{H\leq G} \underbrace{\frac{|G|}{|S|^{3}}|H|}_{=\frac{|H|}{|S|}} \mu_{H} {\Delta}_{*}^{-1} H^{\perp}. $$

By changing the order of summation by substituting H by Δ^− 1H^⊥ and using Lemma 4.3 we get

$$ SS^{(-1)} = \sum\limits_{H\leq G} \underbrace{\frac{|{\Delta}^{-1} H^{\perp}|}{|S|}}_{\frac{|S|}{|H|}}\mu_{{\Delta}^{-1} H^{\perp}}\underbrace{{\Delta}_{*}^{-1} \left( {\Delta}^{-1} H^{\perp}\right)^{\perp}}_{= H}. $$

The proof of induction can be obtained in a similar fashion using Lemma 4.3 as

$$ \begin{array}{@{}rcl@{}} SS^{(-1)} &=& \sum\limits_{H\leq G} \frac{|S|}{|H|} \mu_{\sigma^{i}{\Delta}^{-1}H^{\perp}} H\qquad \qquad= \sum\limits_{H\leq G}\mu_{\sigma^{i}{\Delta}^{-1}H^{\perp}}{\Delta}_{*}^{-1}H^{\perp} \end{array} $$

(7)

$$ \begin{array}{@{}rcl@{}} &=& \sum\limits_{H\leq G} \underbrace{\mu_{\sigma^{i}{\Delta}^{-1}\left( {\Delta}^{-1} H^{\perp}\right)^{\perp}}}_{= \mu_{\sigma^{i+1} H}} H \end{array} $$

(8)

$$ \begin{array}{@{}rcl@{}} &=& \sum\limits_{H\leq G} \frac{|H|}{|S|} \mu_{\sigma^{i+1}H}{\Delta}_{*}^{-1}H^{\perp} \qquad\quad= \sum\limits_{H\leq G} \frac{|S|}{|H|} \mu_{\sigma^{i+1}{\Delta}^{-1} H^{\perp}} H. \end{array} $$

(9)

Equation (6) then follows by the lines (8) and (9).

Now set s = ordσ and by taking the average over all equations of the form (6) we get $SS^{(-1)} = {\sum }_{H\leq G} \lambda _{H} H$ with

$$\lambda_{H} := \frac{1}{2s}\sum\limits_{i=0}^{s-1}\left( \mu_{\sigma^{i} H} + \frac{|S|}{|H|} \mu_{\sigma^{i}{\Delta}^{-1}H^{\perp}}\right).$$

Observe that by Lemma 4.3 and σ^s = σ⁰:

$$\lambda_{\sigma H} = \frac{1}{2s} \sum\limits_{i=0}^{s-1} \left( \mu_{\sigma^{i+1} H} + \frac{|S|}{|H|} \underbrace{\mu_{\sigma^{i}{\Delta}^{-1}(\sigma H)^{\perp}}}_{=\mu_{\sigma^{i+1}{\Delta}^{-1}H^{\perp}}}\right) = \lambda_{H}$$

and

$$ \lambda_{{\Delta}^{-1} H^{\perp}} = \frac{1}{2s} \sum\limits_{i=0}^{s-1} \left( \mu_{\sigma^{i} {\Delta}^{-1} H^{\perp}} + \frac{|H|}{|S|}\underbrace{\mu_{\sigma^{i}{\Delta}^{-1}\left( {\Delta}^{-1} H^{\perp}\right)^{\perp}}}_{=\mu_{\sigma^{i+1}H}}\right) = \frac{|H|}{|S|}\lambda_{H}. $$

On the other hand, if $SS^{(-1)} = {\sum }_{H\leq G} \lambda _{H} H$ with λ_H as asserted, then

$$ SS^{-1} = \sum\limits_{H\leq G} \frac{|H|}{|S|} \lambda_{{\Delta}^{-1} H^{\perp}} H = \sum\limits_{H\leq G} \frac{|S|}{|H|} \lambda_{H} {\Delta}_{*}^{-1} H^{\perp}. $$

By Theorem 3.3 S is formally self dual under Δ_∗ and thus by Lemma 4.4 S is formally self dual under Δ. □

The following result discusses the relations between the canonical decomposition given in Proposition 4.5 and an arbitrary even set decomposition.

Corollary 4.6

Let S be an even set and $SS^{(-1)} = {\sum }_{H\leq G} \mu _{H} H$. Furthermore, define λ_H similar as in the proof of Proposition 4.5. Then S is formally self dual under Δ if and only if

$$\sum\limits_{H\leq G} \left( \mu_{H} - \lambda_{H}\right) H = 0.$$

Proof

If S is formally self dual, then $SS^{-1} = {\sum }_{H\leq G} \mu _{H} H = {\sum }_{H\leq G} \lambda _{H} H$ following the proof of Proposition 4.5. The assertion easily follows. On the other hand, if ${\sum }_{H\leq G} \left (\mu _{H} - \lambda _{H}\right ) H = 0$ then

$$SS^{-1} = \sum\limits_{H\leq G} \mu_{H} H + \sum\limits_{H\leq G} \left( \lambda_{H} - \mu_{H}\right) H = \sum\limits_{H\leq G} \lambda_{H} H$$

and S is formally self dual under Δ by Proposition 4.5. □

5 New examples

In this section we discuss two examples of formally self dual sets in groups of order 64 found via computer search.

Example 5.1

The following sets are primitive formally self dual sets under the standard pairing:

$$ \begin{array}{@{}rcl@{}} &&{}\{(0,0,0),(0,0,1),(0,0,2),(0,0,5),(0,1,0),(0,3,0),(1,0,0),(1,2,6)\}\subset\mathbb{Z}_{2}\times\mathbb{Z}_{4}\times\mathbb{Z}_{8},\\ &&{}\{(0,0,0,0),(0,0,0,1),(0,0,0,2), (0,0,0,5),(0,0,1,0),(0,1,0,0),(1,0,0,0),(1,1,1,6)\}\\ &&{\subset\mathbb{Z}_{2}^{3}}\times\mathbb{Z}_{8} \end{array} $$

The correctness of these examples can easily be verified by a computer algebra system. However, the two examples have a common structure, which possibly contains important information.

Remark 5.2

Let S be one of the examples in Example 5.1. Then G = H₀ × H₁ × H₂ ($H_{0} = {\mathbb {Z}}_{2}$, $H_{2} = {\mathbb {Z}}_{8}$, $H_{1} = {\mathbb {Z}}_{4}$ and $H_{1} = {{\mathbb {Z}}_{2}^{2}}$ respectively). Futhermore, there is a set S₀ ⊂ H₀, an element e ((1,2,6) and (1,1,1,6) respectively) as well as $H_{1}^{\prime } < H_{1}$ such that

• 1. $S = S_{0} + H_{1} - H_{1}^{\prime } + H_{2} + e$,

• 2. $[H_{1}^{\prime }:H_{1}] = 2$,

• 3. 2e ∈ H₀ (written additively),

• 4. 4e = 0,

• 5. $S_{0} + S_{0}^{-1} = H_{0} - \left <2e\right >$,

• 6. S₀ + e is an even set.

This representation of S can be used to find an even set representation

$$SS^{-1} = \sum\limits_{H\leq G} \lambda_{H} H$$

(with many nonzero coefficients). Then Corollary 4.6 can be used to find an equation $0 = {\sum }_{H\leq G} \mu _{H} H$ which, together with the stated properties (possibly with the addition of a few more) could yield more examples of formal self duality. However, this is not understood in detail yet.

6 Formally self dual sets from vectorial Boolean functions

In this section, we investigate formally self dual sets of the form $\{(x,F(x))\colon x \in \mathbb {F}_{2^{n}}\}~\subset ~\mathbb {F}_{2^{n}}^{2}$, where $\mathbb {F}_{2^{n}}$ denotes as usual the field with 2ⁿ elements and $F:{\mathbb {F}}_{2^{n}}\rightarrow {\mathbb {F}}_{2^{n}}$ is a function (such functions are also called vectorial Boolean functions). Recall that the additive group of ${\mathbb {F}}_{2^{n}}$ is isomorphic to ${{\mathbb {Z}}_{2}^{n}}$. We define the absolute trace mapping of ${\mathbb {F}}_{2^{n}}$ as $\text {Tr} \colon {\mathbb {F}}_{2^{n}} \rightarrow {\mathbb {F}}_{2}$ via $x \mapsto x+x^{2}+{\dots } x^{2^{n-1}}$.

Our investigation is motivated by the following new sporadic example that has been found by Shuxing Li [13] who gave his permission to publish it here.

Example 6.1

The set $S := \left \{\left (x,x^{3}\right ) \ : \ x\in \mathbb {F}_{8}\right \}$ is formally self dual under the trace pairing $\left <(x,y),(a,b)\right > =(-1)^{\text {Tr} (ax + by)}$.

The correctness of this example can easily be verified by a computer algebra system. Of course, the natural question is whether this specific example generalizes to larger fields and if similar formally self dual sets of the form $\{(x,F(x))\colon x \in {\mathbb {F}}_{2^{n}}\} \subset {\mathbb {F}}_{2^{n}}^{2}$ under the trace pairing $\left <(x,y),(a,b)\right > =(-1)^{\text {Tr} (ax + by)}$ exist. Let us start with some more general results.

Definition 6.2

Let $F \colon \mathbb {F}_{2^{n}} \rightarrow \mathbb {F}_{2^{n}}$ be a vectorial Boolean function. We define

$$ \delta_{F}(a,b)=|\{x \in \mathbb{F}_{2^{n}} \colon F(x+a)+F(x)=b\}| $$

for all $a,b \in \mathbb {F}_{2^{n}}$. Functions where δ_F(a,b) ≤ 2 for all $a \in \mathbb {F}_{2^{n}}^{*}$ and all $b \in {\mathbb {F}}_{2^{n}}$ are called almost perfect nonlinear (APN).

Moreover, we define the Walsh transform of F by

$$ W_{F}(a,b)=\sum\limits_{x \in \mathbb{F}_{2^{n}}}(-1)^{\text{Tr}(bF(x)+ax)} $$

for all $a,b \in \mathbb {F}_{2^{n}}$.

Both the Walsh transform and the differential uniformity of vectorial Boolean functions have been the subject of much research because of their immense importance to symmetric cryptography: If F is used as an S-box of a block cipher, the Walsh transform immediately determines the resistance of F to linear attacks and $\max \limits _{a \in {\mathbb {F}}_{2^{n}}^{*},b\in {\mathbb {F}}_{2^{n}}}\delta _{F}(a,b)$ the resistance to differential attacks. For an overview on vectorial Boolean functions and their cryptographic properties, we refer the reader to [2]. Note that δ_F(a,b) is always even. Indeed, if x is a solution of F(x + a) + F(x) = b then so is x + a. We can now characterize formally self dual sets of the structure in Example 6.1 via the values of δ_F and the Walsh transform.

Theorem 6.3

The set $S=\{(x,F(x))\colon x \in \mathbb {F}_{2^{n}}\}\subset \mathbb {F}_{2^{n}}^{2}$ with $F \colon \mathbb {F}_{2^{n}} \rightarrow \mathbb {F}_{2^{n}}$ is formally self dual under the pairing 〈(x,y),(a,b)〉 = (− 1)^Tr(ax+by) if and only if

$$ 2^{n}\delta_{F}(a,b)=(W_{F}(a,b))^{2} $$

(10)

holds for all $a,b \in {\mathbb {F}_{2}^{n}}$.

Proof

We have $v_{S}(a,b)=|\{(x,y) \in \mathbb {F}_{2^{n}}^{2} \colon x+y=a, F(x)+F(y)=b\}|$. By substituting y = x + a in the second equation, we get

$$v_{S}(a,b)=|\{x \in \mathbb{F}_{2^{n}} \colon F(x)+F(x+a)=b\}|=\delta_{F}(a,b).$$

Further, we have $\langle (a,b),S \rangle = {\sum }_{x \in \mathbb {F}_{2^{n}}}(-1)^{\text {Tr}(bF(x)+ax)}=W_{F}(a,b)$. The necessary condition for formally self dual sets now becomes 2ⁿδ_F(a,b) = (W_F(a,b))² as stated in the theorem. □

Remark 6.4

Of course, it is easy to recognize a trivial formally self dual set: Choosing F(x) = x the set $S=\{(x,x)\colon x \in {\mathbb {F}}_{2^{n}}\}\subset {\mathbb {F}}_{2^{n}}^{2}$ is clearly formally self dual.

Corollary 6.5

If $S=\{(x,F(x))\colon x \in \mathbb {F}_{2^{n}}\}\subset \mathbb {F}_{2^{n}}^{2}$ with $F \colon \mathbb {F}_{2^{n}} \rightarrow \mathbb {F}_{2^{n}}$ is a formally self dual set, then F(x) is bijective.

Proof

Assume S is formally self-dual. We have δ_F(0,b) = 0 for all b≠ 0. By (10), then W_F(0,b) = 0 for all b≠ 0, i.e.

$$ W_{F}(0,b)=\sum\limits_{x \in \mathbb{F}_{2^{n}}}(-1)^{\text{Tr}(bF(x))}=0. $$

It is well known that this holds if and only if F(x) is a bijection (see e.g. [14, Theorem 7.7.]). □

Remark 6.6

For bijective funtions, the case a = 0 or b = 0 in (10) holds trivially. The case a = 0, b≠ 0 was used in the corollary above, and if b = 0 and a≠ 0 then δ_F(a,0) = W_F(a,0) = 0. If a = b = 0 then δ_F(0,0) = W_F(0,0) = 2ⁿ.

Note that this immediately shows us that the set $\{(x,x^{3}) \colon x \in \mathbb {F}_{2^{n}}\}$ cannot be formally self dual if n is even as the mapping x↦x³ is bijective on ${\mathbb {F}}_{2^{n}}$ if and only if n is odd.

Corollary 6.7

If $S=\{(x,F(x))\colon x \in \mathbb {F}_{2^{n}}\}\subset \mathbb {F}_{2^{n}}^{2}$ with $\mathbb {F} \colon \mathbb {F}_{2^{n}} \rightarrow \mathbb {F}_{2^{n}}$ is a formally self dual set, then W_F(a,b) is divisible by $2^{\lceil \frac {n+1}{2}\rceil }$ for all $a,b \in {\mathbb {F}}_{2^{n}}$.

Proof

By (10) we have that 2ⁿδ_F(a,b) = (W_F(a,b))² for all $a,b \in \mathbb {F}_{2^{n}}$. The result follows since δ_F(a,b) is always even. □

Generally, determining the precise values for δ_F(a,b) as well as for the Walsh transform using theoretic means is quite difficult. By Theorem 6.3 the number of different values of |W_F(a,b)| has to be the same as the number of different values of δ_F(a,b). For an arbitrary function F this is not expected. There is however one special class of functions for which this is always satisfied.

Definition 6.8

Let $F \colon \mathbb {F}_{2^{n}} \rightarrow \mathbb {F}_{2^{n}}$ be a function. We call F almost bent (AB) if $W_{F}(a,b) \in \{0,\pm 2^{\frac {n+1}{2}}\}$ for all $a \in {\mathbb {F}}_{2^{n}}$ and $b \in {\mathbb {F}}_{2^{n}}^{*}$

Of course, AB functions exist only if n is odd since W_F(a,b) is always an integer. It is well known that all AB functions are also APN, i.e. δ_F(a,b) ∈{0,2} for all $a \in {\mathbb {F}}_{2^{n}}^{*}$ and $b \in {\mathbb {F}}_{2^{n}}$ [3].

Theorem 6.9

Let n be odd and $F \colon \mathbb {F}_{2^{n}} \rightarrow \mathbb {F}_{2^{n}}$ be a bijective AB function. The set $S=\{(x,F(x))\colon x \in {\mathbb {F}}_{2^{n}}\}$ is formally self dual under the pairing 〈(x,y),(a,b)〉 = (− 1)^Tr(ax+by)if and only if

$$ \delta_{F}(a,b)=0 \iff W_{F}(a,b)=0. $$

(11)

for all $a,b \in \mathbb {F}_{2^{n}}$.

Proof

By (10) we need to show that

$$ 2^{n}\delta_{F}(a,b)=(W_{F}(a,b))^{2} $$

(12)

for all $a,b \in \mathbb {F}_{2^{n}}$. Since F is bijective, the equation holds if a = 0 or b = 0 by the considerations above. Now assume that δ_F(a,b)≠ 0. Since F is APN this necessarily means δ_F(a,b) = 2. Then by (12) necessarily $W_{F}(a,b)=\pm 2^{\frac {n+1}{2}}$. Since F is almost bent, this is equivalent to W_F(b,a)≠ 0. □

AB functions are rare and finding infinite families of AB functions remains a difficult research problem. A particularly well-studied group of AB functions are AB monomials. It is known that all AB monomials are bijections, so they are natural choices for our search for formally self dual pairs. A table of all known AB monomials is given in Table 1, for references we again refer to [2, Section 3.1.6.]. In the following, we refer to functions given by the exponents in Table 1 as Gold-functions, Kasami functions etc. As we can see, the function x↦x³ that leads to Example 6.1 can be identified as a Gold function.

Table 1 List of known AB exponents over $\mathbb {F}_{2^{n}}$ with n = 2t + 1 (up to equivalences)

The precise values of δ_F(a,b) and of the Walsh transform of AB functions can only be determined easily in the case of Gold functions.

Proposition 6.10

Let $F \colon \mathbb {F}_{2^{n}} \rightarrow \mathbb {F}_{2^{n}}$ be defined by $F(x) = x^{2^{i}+1}$ with n odd and $\gcd (i,n)=1$. Then

$$ |W_{F}(a,1)| = \left\{\begin{array}{ll} 0, & \text{Tr}(a)=0,\\ 2^{\frac{n+1}{2}}, & else. \end{array}\right. $$

and

$$ \delta_{F}(1,b) = \left\{\begin{array}{ll} 0, & \text{Tr}(b)=0,\\ 2, & else. \end{array}\right. $$

Proof

The first statement is a classical result by Gold [10].

For the second statement, expanding yields

$$ (x+1)^{2^{i}+1}+x^{2^{i}+1}= x^{2^{i}}+x+1=b. $$

Note that $\text {Tr}(x^{2^{i}}+x+1)=1$, so the equation has no solution if Tr(b) = 0. Since ${\sum }_{b \in \mathbb {F}_{2^{n}}}\delta _{F}(1,b)=2^{n}$ and δ_F(1,b) ∈{0,2}, we know that δ_F(1,b) = 0 for precisely 2^n− 1 choices of b, and the result follows. □

Corollary 6.11

Let $F \colon \mathbb {F}_{2^{n}} \rightarrow \mathbb {F}_{2^{n}}$ be defined by $F(x) = x^{2^{i}+1}$ with n odd and $\gcd (i,n)=1$. Then

$$ W_{F}(a,b)=0 \text{ if and only if } \text{Tr}\left( ab^{-1/(2^{i}+1)}\right)=0 $$

and

$$ \delta_{F}(a,b)=0 \text{ if and only if } \text{Tr}\left( a^{-(2^{i}+1)}b\right)=0. $$

Here, 1/(2ⁱ + 1) denotes the inverse of 2ⁱ + 1 modulo 2ⁿ − 1.

Proof

Observe that

$$ W_{F}(a,b)=W_{F}\left( ab^{-1/(2^{i}+1)},1\right) $$

by substituting $x \mapsto a^{-1/(2^{i}+1)}x$ (note that 2ⁱ + 1 is invertible in $\mathbb {Z}_{2^{n}-1}$ since $\gcd (i,n)=1$), and the first equation follows from Proposition 6.10.

Further, we have

$$ x^{2^{i}+1}+(x+a)^{2^{i}+1}=x^{2^{i}+1}+a^{2^{i}+1}\left( \frac{x}{a}+1\right)^{2^{i}+1} $$

and by substituting x↦ax we get that δ_F(a,b) is the number of solutions of

$$a^{2^{i}+1}\left( x^{2^{i}+1}+(x+1)^{2^{i}+1}\right)=b,$$

or, equivalently,

$$x^{2^{i}+1}+(x+1)^{2^{i}+1}=ba^{-(2^{i}+1)},$$

so $\delta _{F}(a,b) = \delta \left (1,ba^{-(2^{i}+1)}\right )$ and the result follows again from Proposition 6.10. □

Theorem 6.12

Let n odd and $F \colon \mathbb {F}_{2^{n}} \rightarrow \mathbb {F}_{2^{n}}$ be a Gold function defined by $x~\mapsto ~x^{2^{i}+1}$ with i < n, $\gcd (i,n)=1$. The set $S=\{(x,F(x))\colon x \in {\mathbb {F}}_{2^{n}}\}$ is formally self dual under the pairing 〈(x,y),(a,b)〉 = (− 1)^Tr(ax+by) if and only if n = 3. In this case, both i = 1,2 yield formally self dual sets.

Proof

Using Theorem 6.9 and Corollary 6.11, we just need to check if

$$\text{Tr}\left( ab^{-1/(2^{i}+1)}\right)~=~\text{Tr}\left( a^{-(2^{i}+1)}b\right)$$

holds for all $a,b \in \mathbb {F}_{2^{n}}$. Define the polynomial

$$G_{b}(a)=\text{Tr}\left( ab^{-1/(2^{i}+1)}\right)+\text{Tr}\left( a^{-(2^{i}+1)}b\right).$$

G_b(a) has to be identical to the zero function (as a function in a) to satisfy the condition. $\text {Tr}\left (ab^{-1/(2^{i}+1)}\right )$ is linear in a. On the other hand $\text {Tr}\left (a^{-(2^{i}+1)}b\right )$ is only linear if n − (2ⁱ + 1) is a power of two. Clearly, the binary weight of n − (2ⁱ + 1) is n − 2, so this is only possible for n = 3. For n = 3 it can easily be checked that both i ∈{1,2} satisfy the condition. □

Theorem 6.12 shows that the Example 6.1 is a sporadic example in the sense that the set $\{(x,x^{3})\colon x \in {\mathbb {F}}_{2^{n}}\}\subset {\mathbb {F}}_{2^{n}}^{2}$ only yields a formally self dual set if n = 3. Of course, it would be interesting to find other formally self dual sets of the form $\{(x,F(x))\colon x \in {\mathbb {F}}_{2^{n}}\}$. Natural candidates would be the other AB monomials listed in Table 1. However, computer searches in low dimensions do not yield any new examples, and a theoretic treatment of the condition in Theorem 6.9 is very difficult for the non-Gold AB monomials.

We like to note that when we find a formally self dual set of the form $\{(x,F(x))\colon x \in \mathbb {F}_{2^{n}}\}$ as in Example 6.1, then it is possible to construct some other formally self dual sets of this form.

For a group G and ϕ in its automorphism group Aut(G) we can define the adjoint ϕ^∗ of ϕ such that 〈ϕ(x),y〉 = 〈x,ϕ^∗(y)〉 for all x,y ∈ G. Clearly, ϕ^∗∈Aut(G).

Proposition 6.13

[17, Proposition 2.16] Let G be a group. Let ϕ ∈Aut(G) and ϕ^∗ be the adjoint of ϕ. Suppose S and T form a formally dual pair in G. Then ϕ(S) and (ϕ^∗)^− 1(T) also form a formally dual pair in G.

We can state the following straightforward corollary of Proposition 6.13.

Corollary 6.14

Let G be a group. Let ϕ ∈Aut(G) and ϕ^∗ be the adjoint of ϕ. Suppose S is a formally self dual set in G and ϕ = (ϕ^∗)^− 1. Then ϕ(S) is also a formally self dual set in G.

Remark 6.15

If we consider the group $G = \mathbb {F}_{2^{n}} \times \mathbb {F}_{2^{n}}$ with the component-wise operation (a,b) + (c,d) = (a + c,b + d) and consider sets of the form $\{(x,F(x)) \colon x \in {\mathbb {F}}_{2^{n}}\}$, the construction in Corollary 6.14 is closely related to the concept of CCZ-equivalence (sometimes also called graph-equivalence) of vectorial Boolean functions. We again refer the reader to [2].

We will now give a construction how to use Corollary 6.14 to construct new formally self dual sets of the form $\{(x,F(x)) \colon x \in {\mathbb {F}}_{2^{n}}\}$ under the trace pairing $\left <(x,y),(a,b)\right > =(-1)^{\text {Tr} (ax + by)}$ from known ones.

Let $G = \mathbb {F}_{2^{n}} \times \mathbb {F}_{2^{n}}$ be a group with the component-wise operation (a,b) + (c,d) = (a + c,b + d) and ϕ ∈Aut(G). We can write $\phi =\left (\begin {array}{ll} L_{1} & L_{2} \\ L_{3} & L_{4} \end {array}\right )$, where L₁,L₂,L₃,L₄ are $\mathbb {F}_{2}$-linear mappings from $\mathbb {F}_{2^{n}}$ to $\mathbb {F}_{2^{n}}$. Applying ϕ to a vector $(a,b) \in {\mathbb {F}}_{2^{n}}^{2}$ yields (similar to the usual matrix multiplication)

$$\phi(a,b) = \left( \begin{array}{ll} L_{1} & L_{2} \\ L_{3} & L_{4} \end{array}\right) (a,b) = (L_{1}(a)+L_{2}(b),L_{3}(a)+L_{4}(b)).$$

Lemma 6.16

Let ϕ ∈Aut(G), written as $\phi =\left (\begin {array}{ll} L_{1} & L_{2} \\ L_{3} & L_{4} \end {array}\right )$ where L₁,L₂,L₃,L₄ are $\mathbb {F}_{2}$-linear mappings from $\mathbb {F}_{2^{n}}$ to itself. Then $\phi ^{*}=\left (\begin {array}{ll} L_{1}^{*} & L_{3}^{*} \\ L_{2}^{*} & L_{4}^{*} \end {array}\right )$. Here we denote by $L_{i}^{*}$ the adjoint of L_i with respect to the trace bilinear form $(\cdot ,\cdot ) \colon {\mathbb {F}}_{2^{n}} \times {\mathbb {F}}_{2^{n}} \rightarrow {\mathbb {F}}_{2}$ defined by (a,b)↦Tr(ab).

Proof

Let $a_{1},a_{2},b_{1},b_{2} \in \mathbb {F}_{2^{n}}$. Then

$$ \begin{array}{@{}rcl@{}} \langle \phi(a_{1},b_{1}),(a_{2},b_{2})\rangle &=& \text{Tr}\left( (L_{1}(a_{1})+L_{2}(b_{1}))a_{2}\right)+\text{Tr}((L_{3}(a_{1})+L_{4}(b_{1}))b_{2}) \\ &=&\text{Tr}(a_{1}(L_{1}^{*}(a_{2})+L_{3}^{*}(b_{2})))+\text{Tr}(b_{1}(L_{2}^{*}(a_{2})+L_{4}^{*}(b_{2}))), \end{array} $$

which directly implies the desired structure for ϕ^∗. □

Recall that every $\mathbb {F}_{2}$-linear mapping on $\mathbb {F}_{2^{n}}$ can be written as a polynomial of the form $L = {\sum }_{i=0}^{n-1}c_{i}x^{2^{i}} \in {\mathbb {F}}_{2^{n}}[x]$, and the adjoint of such a linear polynomial can be determined easily from the coefficients. Indeed, we have $L^{*}(x)={\sum }_{i=0}^{n-1}c_{i}^{2^{n-i}}x^{2^{n-i}}$.

Corollary 6.17

Let $F \colon \mathbb {F}_{2^{n}} \rightarrow \mathbb {F}_{2^{n}}$. If $S=\{(x,F(x))\colon x \in \mathbb {F}_{2^{n}}\}$ is a formally self dual set then so is $\{(x,F^{-1}(x))\colon x \in {\mathbb {F}}_{2^{n}}\}$, where F^− 1 denotes the compositional inverse of F.

Proof

We apply Corollary 6.14 with $\phi =\left (\begin {array}{ll} L_{1} & L_{2} \\ L_{3} & L_{4} \end {array}\right )$ and L₁ = L₄ = 0 and L₂ = L₃ = x. This choice implies ϕ = (ϕ^∗)^− 1. Indeed, by Lemma 6.16, we have

$$\phi^{*} =\left( \begin{array}{ll} L_{1}^{*} & L_{3}^{*} \\ L_{2}^{*} & L_{4}^{*} \end{array}\right) = \left( \begin{array}{ll} L_{1} & L_{2} \\ L_{3} & L_{4} \end{array}\right)=\phi,$$

since L₂(x) = L₃(x) = x and the zero-polynomial are self-adjoint. Observe that $\left (\begin {array}{ll} 0 & L \\ L & 0 \end {array}\right )$ for L(x) = x is an involution, so ϕ = ϕ^∗ = (ϕ^∗)^− 1 as claimed. □

Proposition 6.18

Let L₁,L₂ be two bijective $\mathbb {F}_{2}$-linear mappings from $\mathbb {F}_{2^{n}}$ to itself. We set $F^{\prime }=L_{2}\circ F \circ L_{1}$. Further assume $L_{1}=(L_{1}^{-1})^{*}$ and $L_{2}=(L_{2}^{-1})^{*}$.

If $\{(x,F(x))\colon x \in \mathbb {F}_{2^{n}}\}$ is a formally self dual set, then so is $\{(x,F^{\prime }(x))\colon x \in \mathbb {F}_{2^{n}}\}$.

Proof

Define $\phi =\left (\begin {array}{ll} L_{1}^{-1} & 0 \\ 0 & L_{2} \end {array}\right )$.

Then $\phi (x,F(x))=(L_{1}^{-1}(x),L_{2}(F(x)))$. In particular,

$$ \left\{\phi(x,F(x)) \colon x\in \mathbb{F}_{2^{n}}\right\} = \left\{(x,F^{\prime}(x)) \colon x\in \mathbb{F}_{2^{n}}\right\}. $$

The condition ϕ = (ϕ^∗)^− 1 can be easily verified, so the claimed result follows from Corollary 6.14. □

In [17, Definition 2.17], the formal dual pairs that can be constructed with Proposition 6.13 (and, by extension, with Proposition 6.18) are called equivalent to the original one. Still, it is interesting to note that these equivalent formal self dual sets have the special structure of a graph, i.e. $\{(x,F(x))\colon x \in {\mathbb {F}}_{2^{n}}\}$.

Remark 6.19

With Remark 6.4 and Proposition 6.18 we can create some more formally self dual sets. Indeed, if L is a bijective linear function on ${\mathbb {F}}_{2^{n}}$ satisfying L = (L^− 1)^∗, then $\{(x,L(x))\colon x \in {\mathbb {F}}_{2^{n}}\}$ is a formally self dual set.

We now give a criterion when the condition L = (L^− 1)^∗ holds for some linear function $L \colon \mathbb {F}_{2^{n}} \rightarrow {\mathbb {F}}_{2^{n}}$.

Proposition 6.20

Let $L \colon \mathbb {F}_{2^{n}} \rightarrow \mathbb {F}_{2^{n}}$ be a linear function defined by $L(x)={\sum }_{i=0}^{n-1}c_{i}x^{2^{i}}\in {\mathbb {F}}_{2^{n}}[x]$. The condition L = (L^− 1)^∗ holds if and only if

$$ \begin{array}{@{}rcl@{}} \sum\limits_{i=0}^{n-1} c_{i}^{2^{n-i}}&=&1 \\ \sum\limits_{i=0}^{n-1} (c_{i}c_{i+j})^{2^{n-i}} &=&0 \end{array} $$

for all $j \in \{1,\dots ,n-1\}$.

Proof

L = (L^− 1)^∗ holds if and only if L^∗(L(x)) = x for all $x \in \mathbb {F}_{2^{n}}$. A simple calculation yields:

$$ \begin{array}{@{}rcl@{}} L^{*}(L(x))&=&\sum\limits_{i=0}^{n-1}c_{i}^{2^{n-i}}\left( \sum\limits_{j=0}^{n-1}c_{j}x^{2^{j}}\right)^{2^{n-i}}\\ &=&\sum\limits_{j=0}^{n-1}\sum\limits_{i=0}^{n-1}\left( c_{i}c_{j}\right)^{2^{n-i}}x^{2^{j-i}}\\ &=&\sum\limits_{j=0}^{n-1}\sum\limits_{i=0}^{n-1} \left( c_{i}c_{i+j}\right)^{2^{n-i}}x^{2^{j}}. \end{array} $$

The polynomial L^∗(L(x)) has to be equal to the polynomial x, so all coefficients have to be 0 except the coefficient for j = 0, which has to be 1. □

This condition can be checked very easily with a computer. Note that the conditions always hold if $L(x)=x^{2^{i}}$. Moreover, if L = (L^− 1)^∗, then also L^∗ = ((L^∗)^− 1)^∗, so the condition always holds for L and L^∗ simultaneously. We now give an example of such a secondary construction from the formally self dual set $\{(x,x^{3})\colon x \in {\mathbb {F}}_{8}\}\subset {{\mathbb {F}}_{8}^{2}}$.

Example 6.21

Let a be a root of the irreducible polynomial $x^{3}+x+1 \in \mathbb {F}_{2}[x]$. We define $L(x)=(a+1)x+(a^{2}+a+1)x^{2}+(a^{2}+1)x^{4} \in {\mathbb {F}}_{8}[x]$. It is easy to verify that the conditions in Proposition 6.20 hold, so we have L = (L^− 1)^∗. Further, let F(x) = x³ be the cube function. By Proposition 6.18 we can use this polynomial to construct new formally self-dual sets in ${{\mathbb {F}}_{8}^{2}}$, e.g.

• $\left \{(x,L(F(x)))\colon x \in \mathbb {F}_{2^{n}}\right \}=\left \{\left (x,\left (a^{2}+a+1\right )x^{6}+\left (a^{2}+1\right )x^{5}+(a+1)x^{3}\right )\colon x \right .$ $\left .\in \mathbb {F}_{2^{3}}\right \}$

• $\left \{(x,F(L(x)))\colon x \in \mathbb {F}_{2^{n}}\right \}=\left \{(x,\left (a^{2}+1\right )x^{6}+(a+1)x^{5}+\left (a^{2}+a\right )x^{4}+ \left (a^{2}+a \right .\right .$ $\left .\left .+1\right )x^{3}+ax^{2}+a^{2}x)\colon x \in \mathbb {F}_{2^{3}}\right \}$

• $\left \{(x,L(F(L(x))))\colon x \in \mathbb {F}_{2^{n}}\right \}=\left \{\left (x,x^{5}+x^{4}+x\right )\colon x \in \mathbb {F}_{2^{3}}\right \}$.

7 Open questions

We end this paper with some open questions which are valuable to study.

• 1. Are the formally dual sets obtained via Theorem 3.6 formally self dual sets if we use other skew Hadamard difference sets than the Paley difference sets?

• 2. If S is a formally self dual set under isomorphism Δ, can we describe all isomorphisms under which S is formally self dual?

• 3. Are there other formally self dual sets of the form $\{(x,F(x))\colon x \in \mathbb {F}_{2^{n}}\}$?

• 4. Are there other groups of order 64 that contain primitive formally dual sets? The next smallest group where we neither can prove existence or non-existence of primitive formally dual sets would be of order 72. See Table 2 in the A for the currently known results in groups of order 64.

  Table 2 Known existence results about primitive formally dual subsets S of groups G of order 64

Appendix