Bent functions satisfying the dual bent condition and permutations with the $(\mathcal {A}_m)$ property

Abstract

The concatenation of four Boolean bent functions $f=f_1||f_2||f_3||f_4$ is bent if and only if the dual bent condition $f_1^* + f_2^* + f_3^* + f_4^* =1$ is satisfied. However, to specify four bent functions satisfying this duality condition is in general quite a difficult task. Commonly, to simplify this problem, certain relations between $f_i$ are assumed, as well as functions $f_i$ of a special shape are considered, e.g., $f_i(x,y)=x\cdot \pi _i(y)+h_i(y)$ are Maiorana-McFarland bent functions. In the case when permutations $\pi _i$ of $\mathbb {F}_2^m$ have the $(\mathcal {A}_m)$ property and Maiorana-McFarland bent functions $f_i$ satisfy the additional condition $f_1+f_2+f_3+f_4=0$, the dual bent condition is known to have a relatively simple shape allowing to specify the functions $f_i$ explicitly. In this paper, we generalize this result for the case when Maiorana-McFarland bent functions $f_i$ satisfy the condition $f_1(x,y)+f_2(x,y)+f_3(x,y)+f_4(x,y)=s(y)$ and provide a construction of new permutations with the $(\mathcal {A}_m)$ property from the old ones. Combining these two results, we obtain a recursive construction method of bent functions satisfying the dual bent condition. Moreover, we provide a generic condition on the Maiorana-McFarland bent functions $f_1,f_2,f_3,f_4$ stemming from the permutations of $\mathbb {F}_2^m$ with the $(\mathcal {A}_m)$ property, such that the concatenation $f=f_1||f_2||f_3||f_4$ does not belong, up to equivalence, to the Maiorana-McFarland class. Using monomial permutations $\pi _i$ of $\mathbb {F}_{2^m}$ with the $(\mathcal {A}_m)$ property and monomial functions $h_i$ on $\mathbb {F}_{2^m}$, we provide explicit constructions of such bent functions; a particular case of our result shows how one can construct bent functions from APN permutations, when m is odd. Finally, with our construction method, we explain how one can construct homogeneous cubic bent functions, noticing that only very few design methods of these objects are known.

1 Introduction

Bent functions are fascinating combinatorial objects that has been introduced by Rothaus in [24] and since then have been attracting a lot of attention from the research community for the past four decades [6]. There exist many constructions of bent functions (we refer to [6, 15] and [5, Chapter 6], for comprehensive surveys and extensive references on the subject), which could be divided into primary constructions, e.g., Maiorana-McFarland $\mathcal {M}$ and Partial Spread $\mathcal{P}\mathcal{S}$ [10, 24], $\mathcal {C}$ and $\mathcal {D}$ classes of Carlet [3], to name a few, as well as secondary constructions, which employ the already known bent functions to construct new ones [4, 11, 24, 28].

A well-known secondary construction of bent functions is the so-called bent 4-concatenation: given four bent functions $f_1,f_2,f_3,f_4$ in n variables, one may try to concatenate their truth tables such that the resulting function f is a bent function in $n+2$ variables. We remark that the bent 4-concatenation is a particular case of a general secondary construction dating from 1996, see Theorem 15 in [5]. The first systematic study of the bent 4-concatenation was given in [2], where the authors investigated under which conditions a given bent function f in $n+2$ variables can be written as a concatenation of four bent functions $f_1,f_2,f_3,f_4$ in n variables; in [2], such a representation was called a bent 4-decomposition. Notably, in [2, Theorem 7], the authors provided a criterion for a bent function f to admit a bent 4-decomposition in terms of the second-order derivatives of the dual bent function $f^*$. While the analysis of bent 4-decompositions is useful for distinguishing different functions, the reverse process can be used for the construction of new families of bent functions. In [13], it was shown that for a concatenation of four bent functions $f=f_1||f_2||f_3||f_4$, the necessary and sufficient condition that f is bent is that the dual bent condition is satisfied, i.e., $f_1^*+ f_2^* + f_3^* + f_4^* =1$, see [13, Theorem III.1]; note that this result (but in different formulations) was also obtained in [23, 26]. In [15], Mesnager provided generic secondary constructions of bent functions as well as several explicit infinite families of bent functions and their duals using the permutations of $\mathbb {F}_2^m$ with the $(\mathcal {A}_m)$ property; the latter was formally introduced later in [16] as follows. Permutations $\pi _1,\pi _2,\pi _3$ satisfy the $(\mathcal {A}_m)$ property if $\pi =\pi _1+\pi _2 + \pi _3$ is a permutation and its inverse is given by $\pi ^{-1}=\pi _1^{-1} + \pi _2^{-1} + \pi _3^{-1}$. Despite the fact, that in general it is difficult to determine explicitly permutations satisfying the strong condition $(\mathcal {A}_m)$, new classes of such mappings were constructed in [16]. They were used to provide more constructions of bent functions using involutions [17] as well as gbent functions and $\mathbb {Z}_{2^k}$-bent functions, see [1].

While finding bent functions satisfying the dual bent condition and constructing permutations with the $(\mathcal {A}_m)$ property are two difficult independent open problems (as indicated in [12, 16, 19]), their consideration “as a whole” was shown to be a potential source for the new secondary constructions of bent functions [7].

The main aim of this paper is three-fold. Firstly, to develop further the construction techniques of permutations with the $(\mathcal {A}_m)$ property by extending the results in [7]. Secondly, based on the obtained permutations $\pi _i$ with the $(\mathcal {A}_m)$ property, to specify Maiorana-McFarland bent functions $f_i(x,y)=x\cdot \pi _i(y)+h_i(y)$ which satisfy the dual bent condition, and, hence, whose bent 4-concatenation gives rise to new bent functions. Finally, to show that the obtained constructions of bent functions are indeed “new”, in the sense that the obtained constructions are different from the building blocks used in the concatenation (formally it means that $f=f_1||f_2||f_3||f_4$ is outside the completed Maiorana-McFarland class $\mathcal {M}^\#$).

The rest of the paper is organized in the following way. In Section 1.1, we give basic definitions related to Boolean functions, and in Section 1.2 we summarize important definitions and results regarding the dual bent condition and permutations with the $(\mathcal {A}_m)$ property. In Section 2, we provide secondary constructions of permutations with the $(\mathcal {A}_m)$ property and use them to construct bent functions by concatenating the corresponding Maiorana-McFarland bent functions satisfying the dual bent condition. To be more precise, in Section 2.1, we provide a secondary construction of permutations with the $(\mathcal {A}_m)$ property using the piecewise permutations. In Section 2.2, we first generalize [7, Theorem 7] (see Theorem 2.4), which gives a possibility to concatenate larger classes of Maiorana-McFarland bent functions and to get in such a way new bent functions.

In the remaining sections, we investigate, under which conditions the canonical concatenation of Maiorana-McFarland bent functions is again bent and does not belong, up to equivalence, to the Maiorana-McFarland class. In Section 3, we provide more conditions on permutations $\pi _i$ such that the concatenation $f=f_1||f_2||f_3||f_4$ of Maiorana-McFarland bent functions $f_i(x,y)=x\cdot \pi _i(y)+h_i(y)$ is outside the completed Maiorana-McFarland class $\mathcal {M}^\#$. In Section 4, we provide explicit construction methods so that the concatenation of four Maiorana-McFarland bent functions on $\mathbb {F}_2^n$ (using suitable permutation monomials) generates bent functions on $\mathbb {F}_2^{n+2}$ outside $\mathcal {M}^\#$. In this way, we provide a solution to [19, Open Problem 5.16]. In Section 5, we show that it is possible to construct homogeneous cubic bent functions using our construction methods (note that only a few construction methods of such functions are known in the literature) but due to the underlying difficulty of this problem further research efforts are required. Finally, we conclude the paper in Section 6.

1.1 Preliminaries

Let $\mathbb {F}_2^n$ be the vector space of all binary n-tuples $x=(x_1,\ldots ,x_n)$, where $x_i \in \mathbb {F}_2$. For two elements $x=(x_1,\ldots ,x_n)$ and $y=(y_1,\ldots ,y_n)$ of $\mathbb {F}^n_2$, we define the scalar product over $\mathbb {F}_2$ as $x\cdot y=x_1 y_1 + \cdots + x_n y_n$. For $x=(x_1,\ldots ,x_n)\in \mathbb {F}^n_2$, the Hamming weight of x is defined by $wt(x)=\sum ^n_{i=1} x_i$. Throughout the paper, we denote by $0_n=(0,0,\ldots ,0)\in \mathbb {F}^n_2$ the all-zero vector with n coordinates. If necessary, we endow $\mathbb {F}_2^n$ with the structure of the finite field $\left( \mathbb {F}_{2^{n}},+,\cdot \right)$. An element $\alpha \in \mathbb {F}_{2^n}$ is called a primitive element, if it is a generator of the multiplicative group $\mathbb {F}_{2^n}^*$. The absolute trace $Tr:\mathbb {F}_{2^n} \rightarrow \mathbb {F}_{2}$ is given by $Tr(x) =\sum _{i=0}^{n-1} x^{2^{i}}$.

In this paper, we denote the set of all Boolean functions in n variables by $\mathcal {B}_n$. One can uniquely represent any Boolean function $f\in \mathcal {B}_n$ using the algebraic normal form (ANF, for short), which is given by $f(x_1,\ldots ,x_n)=\sum _{u\in \mathbb {F}^n_2}{\lambda _u}{(\prod _{i=1}^n{x_i}^{u_i})}$, where $x_i, \lambda _u \in \mathbb {F}_2$ and $u=(u_1, \ldots ,u_n)\in \mathbb {F}^n_2$. The algebraic degree of $f\in \mathcal {B}_n$, denoted by $\deg (f)$, is the maximum Hamming weight of $u \in \mathbb {F}_2^n$ for which $\lambda _u \ne 0$ in its ANF. A Boolean function $f\in \mathcal {B}_n$ is called homogeneous if all the monomials in its ANF have the same algebraic degree.

The first order-derivative of a function $f\in \mathcal {B}_n$ in the direction $a \in \mathbb {F}_2^n$ is the mapping $D_{a}f(x)=f(x+a) + f(x)$. Derivatives of higher orders are defined recursively, i.e., the k-th order derivative of a function $f\in \mathcal {B}_n$ is defined by $D_Vf(x)=D_{a_k}D_{a_{k-1}}\ldots D_{a_1}f(x)=D_{a_k}(D_{a_{k-1}}\ldots D_{a_1}f)(x)$, where $V=\langle a_1,\ldots ,a_k \rangle$ is a vector subspace of $\mathbb {F}_2^n$ spanned by elements $a_1,\ldots ,a_k\in \mathbb {F}_2^n$. An element $a\in \mathbb {F}_2^n$ is called a linear structure of $f\in \mathcal {B}_n$, if $f(x+a)+f(x)=const\in \mathbb {F}_2$ for all $x\in \mathbb {F}_2^n$. We say that $f\in \mathcal {B}_n$ has no linear structures, if $0_n$ is the only linear structure of f.

The Walsh-Hadamard transform (WHT) of $f\in \mathcal {B}_n$, and its inverse WHT, at any point $a\in \mathbb {F}^n_2$ are defined, respectively, by

$$\begin{aligned} W_{f}(a)=\sum _{x\in \mathbb {F}_2^n}(-1)^{f(x) + a\cdot x} \quad \text {and}\quad (-1)^{f(x)}=2^{-n}\sum _{a\in \mathbb {F}_2^n}W_f(a)(-1)^{a\cdot x}. \end{aligned}$$

For even n, a function $f\in \mathcal {B}_n$ is called bent if $W_f(u)=\pm 2^{\frac{n}{2}}$ for all $u\in \mathbb {F}_2^n$. For a bent function $f\in \mathcal {B}_n$, a Boolean function $f^*\in \mathcal {B}_n$ defined by $W_f(u)=2^{\frac{n}{2}}(-1)^{f^*(u)}$ for all $u\in \mathbb {F}_2^n$ is a bent function, called the dual of f. Two Boolean functions $f,f'\in \mathcal {B}_n$ are called (extended-affine) equivalent, if there exists an affine permutation A of $\mathbb {F}_2^n$ and an affine function $l\in \mathcal {B}_n$, such that $f\circ A + l= f'$. It is well-known, that extended-affine equivalence preserves the bent property. A class of bent functions $B _n \subset \mathcal {B}_n$ is complete if it is globally invariant under extended-affine equivalence. By $B _n^\#$ we denote the completed $B _n$ class, which is the smallest possible complete class that contains $B _n$.

The Maiorana-McFarland class $\mathcal {M}$ is the set of n-variable ($n=2m$) Boolean bent functions of the form

$$ f(x,y)=x \cdot \pi (y)+ h(y), \text{ for } \text{ all } x, y\in \mathbb {F}_2^m, $$

where $\pi$ is a permutation on $\mathbb {F}_2^m$, and h is an arbitrary Boolean function on $\mathbb {F}_2^m$. Using Dillon’s criterion below (the proof of this statement can be found in [5] or [22, p. 19]), one can show that a given Boolean bent function $f\in \mathcal {B}_n$ does (not) belong to the completed Maiorana-McFarland class $\mathcal {M}^\#$.

Lemma 1.1

[10, p. 102] Let $n=2m$. A Boolean bent function $f\in \mathcal {B}_n$ belongs to $\mathcal {M}^{\#}$ if and only if there exists an m-dimensional linear subspace U of $\mathbb {F}_2^n$ such that the second-order derivatives $D_{a}D_{b}f(x)=f(x) + f(x + a) + f(x + b) + f(x + a + b)$ vanish for any $a, b \in U$.

Following the terminology in [19, 22], for a function $f\in \mathcal {B}_n$, we call a vector subspace U such that $D_a D_b f=0$ for all $a,b\in U$ an $\mathcal {M}$-subspace of f. Note that if $f\in \mathcal {M}$, then at least one $\mathcal {M}$-subspace of f has the form $U=\mathbb {F}_2^m \times \{0_m\}$, which we call the canonical $\mathcal {M}$-subspace of f. However, if $f\in \mathcal {M}^\#$ then this is not true in general.

1.2 The dual bent condition and the $(\mathcal {A}_m)$ property

In this subsection, we introduce the main terminology and summarize several important results regarding the bent 4-concatenation, the dual bent condition and permutations of $\mathbb {F}_2^m$ with the $(\mathcal {A}_m)$ property.

Throughout the paper, we denote the (canonical) concatenation of four functions $f_i \in \mathcal {B}_n$ as $f=f_1||f_2||f_3||f_4 \in \mathcal {B}_{n+2}$, whose ANF is given by

$$\begin{aligned} \begin{aligned} f(z,z_{n+1},z_{n+2})=&f_1(z) + z_{n+1}(f_1 + f_3)(z) + z_{n+2}(f_1 + f_2)(z)\\ +&z_{n+1}z_{n+2}(f_1 + f_2 + f_3 + f_4)(z). \end{aligned} \end{aligned}$$

(1.1)

Notice that the subfunctions $f_i$ of f are defined on the four cosets of $\mathbb {F}_2^n$ so that $f_1(z)=f(z,0,0), \ldots , f_4(z)=f(z,1,1)$. Conversely, as shown in [2], any bent function on $\mathbb {F}_2^{n+2}$ can be decomposed into four subfunctions $f_i \in \mathbb {F}_2^n$, where all $f_i$ are bent, disjoint spectra semi-bent functions or suitable 5-valued spectra functions. The latter two cases have been recently analyzed in [18], where efficient methods of designing bent functions outside $\mathcal {M}^\#$ were proposed. For a concatenation of four bent functions $f=f_1||f_2||f_3||f_4$, the necessary and sufficient condition that f is bent is that the dual bent condition is satisfied [13, Theorem III.1], i.e., $f_1^*+ f_2^* + f_3^* + f_4^* =1$. For our purpose, one construction method of bent functions satisfying the dual bent condition is of particular importance. It is based on permutations of $\mathbb {F}_2^m$ with the $(\mathcal {A}_m)$ property and we give it in Theorem 1.3 below.

Definition 1.2

[14] Let $\pi _1,\pi _2,\pi _3$ be three permutations of $\mathbb {F}_2^m$. We say that $\pi _1,\pi _2,\pi _3$ have the $(\mathcal {A}_m)$ property if

• 1. $\pi _4=\pi _1+\pi _2 + \pi _3$ is a permutation and

• 2. $\pi _4^{-1}=\pi _1^{-1} + \pi _2^{-1} + \pi _3^{-1}$.

As the following result shows, the dual bent condition could be satisfied [7] by using Maiorana-McFarland bent functions arising from permutations with the $(\mathcal {A}_m)$ property [16].

Theorem 1.3

[7, Theorem 7] Let $f_j (x, y) = Tr(x \pi _j (y)) + h_j (y)$ for $j \in \{1, 2, 3\}$ and $x, y \in \mathbb {F}_{2^{m}}$, where the permutations $\pi _j$ satisfy the condition ($\mathcal {A}_m$). If the functions $h_j$ satisfy

$$\begin{aligned} h_1(\pi ^{-1}_1 (y))+h_2(\pi ^{-1}_2 (y))+h_3(\pi ^{-1}_3 (y))+(h_1+h_2+h_3)((\pi _1+\pi _2+\pi _3)^{-1}(y)) = 1, \end{aligned}$$

(1.2)

then $f_1, f_2, f_3$ satisfy $f^*_1 + f^*_2 + f^*_3 + f^*_4=1$, where $f_1+f_2 +f_3=f_4$. Consequently, $f=f_1||f_2||f_3||f_4$ is bent.

Notice that $f_4$ is defined as $f_4=f_1+f_2+f_3$ and the functions $h_i(y)$ must be carefully selected (assuming that $\pi _1,\pi _2,\pi _3$ satisfy the ($\mathcal {A}_m$) property) so that (1.2) is satisfied. With the following recent result, it is possible to show that in certain cases the bent 4-concatenation of Maiorana-McFarland bent functions gives a bent function outside $\mathcal {M}^\#$.

Theorem 1.4

[19] Let $f_1, \ldots ,f_4$ be four bent functions on $\mathbb {F}_2^n$, with $n=2m$, satisfying the following conditions:

• 1. $f_1, \ldots ,f_4$ belong to $\mathcal {M}^\#$ and share a unique $\mathcal {M}$-subspace of dimension m;

• 2. $f=f_1||f_2||f_3||f_4 \in \mathcal {B}_{n+2}$ is a bent function;

Let V be an $(\frac{n}{2}-1)$-dimensional subspace of $\mathbb {F}_2^n$ such that $D_aD_bf_i=0$, for all $a,b \in V$; $i=1, \ldots ,4.$ If for any $v\in \mathbb {F}_2^n$ and any such $V \subset \mathbb {F}_2^n$, there exist $u^{(1)},u^{(2)},u^{(3)}\in V$ such that the following three conditions hold simultaneously

• 1) $D_{u^{(1)}}f_1(x)+D_{u^{(1)}}f_2(x+v)\ne 0,~\textit{or}~D_{u^{(1)}}f_3(x)+D_{u^{(1)}}f_4(x+v)\ne 0,$

• 2) $D_{u^{(2)}}f_1(x)+D_{u^{(2)}}f_3(x+v)\ne 0,~\textit{or}~D_{u^{(2)}}f_2(x)+D_{u^{(2)}}f_4(x+v)\ne 0,$

• 3) $D_{u^{(3)}}f_2(x)+D_{u^{(3)}}f_3(x+v)\ne 0,~\textit{or}~D_{u^{(3)}}f_1(x)+D_{u^{(3)}}f_4(x+v)\ne 0,$

then f is outside $\mathcal {M}^\#$.

2 Secondary constructions of bent functions satisfying the dual bent condition and permutations with the $(\mathcal {A}_m)$ property

Constructing new permutations of $\mathbb {F}_2^m$ satisfying the $(\mathcal {A}_m)$ property is a well-known challenging problem. In this section, we explain how one can construct permutations of $\mathbb {F}_2^{m+k}$ that satisfy the $(\mathcal {A}_{m+k})$ property from permutations of $\mathbb {F}_2^{m}$ with the $(\mathcal {A}_{m})$ property, where $k\in \mathbb {N}$ is arbitrary. Consequently, we use this construction method for specifying Maiorana-McFarland bent functions satisfying the dual bent condition. In this way, we obtain a secondary construction of bent functions.

2.1 Permutations with the $(\mathcal {A}_m)$ property: New from old

Since our construction method of new permutations with the $(\mathcal {A}_m)$ property from old is based on the piecewise permutations, we need first to express the inverse of a permutation defined in a piecewise manner, which is required for checking the $(\mathcal {A}_m)$ property. Therefore, we begin this subsection with the following auxiliary result.

Lemma 2.1

Let $\sigma _1,\sigma _2$ be permutations of $\mathbb {F}_2^m$. Define the mapping $\pi :\mathbb {F}_2^{m+1} \rightarrow \mathbb {F}_2^{m+1}$ by

$$\begin{aligned} \pi (y,y_{m+1})= \left( y_{m+1}\sigma _1(y)+(1+y_{m+1}) \sigma _2(y) , y_{m+1} \right) , \end{aligned}$$

for all $y \in \mathbb {F}_2^m, y_{m+1} \in \mathbb {F}_2$. Then, $\pi$ is a permutation, and its inverse on $\mathbb {F}_2^{m+1}$ is given by the permutation $\rho$ on $\mathbb {F}_2^{m+1}$, defined by

$$\begin{aligned} \rho (y,y_{m+1})= \left( y_{m+1}\sigma _1^{-1}(y)+(1+y_{m+1}) \sigma _2^{-1}(y) , y_{m+1} \right) , \end{aligned}$$

for all $y \in \mathbb {F}_2^m, y_{m+1} \in \mathbb {F}_2$.

Proof

First, it is convenient to rewrite $\pi$ and $\rho$ in the piecewise form as follows:

$$\begin{aligned} \begin{aligned} \pi (y,y_{m+1})=&{\left\{ \begin{array}{ll} (\sigma _1(y),1) &{} \text {if } y_{m+1}=1\\ (\sigma _2(y),0) &{} \text {if } y_{m+1}=0 \end{array}\right. }\quad \text{ and }\\ \rho (y,y_{m+1})=&{\left\{ \begin{array}{ll} (\sigma _1^{-1}(y),1) &{} \text {if } y_{m+1}=1\\ (\sigma _2^{-1}(y),0) &{} \text {if } y_{m+1}=0 \end{array}\right. }. \end{aligned} \end{aligned}$$

Since $\sigma _1$ and $\sigma _2$ are permutations of $\mathbb {F}_2^m$, so are $\sigma _1^{-1}$ and $\sigma _2^{-1}$, and hence $\pi$ and $\rho$ are permutations of $\mathbb {F}_2^{m+1}$. Now, we show that $\rho$ is indeed the inverse of the permutation $\pi$. We compute $\pi (\rho (y,y_{m+1}))$, whose expression is given as follows

$$\begin{aligned} \begin{aligned} \pi (\rho (y,y_{m+1}))&={\left\{ \begin{array}{ll} \pi (\rho (y,1)) &{} \text {if } y_{m+1}=1\\ \pi (\rho (y,0)) &{} \text {if } y_{m+1}=0 \end{array}\right. }={\left\{ \begin{array}{ll} \pi (\sigma _1^{-1}(y),1) &{} \text {if } y_{m+1}=1\\ \pi (\sigma _2^{-1}(y),0) &{} \text {if } y_{m+1}=0 \end{array}\right. }\\&={\left\{ \begin{array}{ll} (\sigma _1(\sigma _1^{-1}(y)),1) &{} \text {if } y_{m+1}=1\\ (\sigma _2(\sigma _2^{-1}(y)),0) &{} \text {if } y_{m+1}=0 \end{array}\right. }={\left\{ \begin{array}{ll} (y,1) &{} \text {if } y_{m+1}=1\\ (y,0) &{} \text {if } y_{m+1}=0 \end{array}\right. }. \end{aligned} \end{aligned}$$

(2.1)

Since the latter expression is equal to ${\text {id}}(y,y_{m+1})$, we get that $\rho =\pi ^{-1}$. $\square$

Now, we show that as soon as a single example of permutations $\pi _i$ on $\mathbb {F}_2^{m}$ with the $(\mathcal {A}_m)$ property is found (here m is a fixed integer), then one can always construct many such examples on $\mathbb {F}_2^{m+k}$, where $k>0$ is an arbitrary integer.

Proposition 2.2

Let $\pi _j$, $\sigma _j$ for $j \in \{1,2,3\}$ be permutations on $\mathbb {F}_2^m$ which satisfy the condition $\left( \mathcal {A}_m\right)$. Denote by $\pi _4=\pi _1+\pi _2+\pi _3$, $\sigma _4=\sigma _1+\sigma _2+\sigma _3$. Define four permutations $\phi _i$ for $i\in \{1,2,3,4\}$ on $\mathbb {F}_2^{m+1}$ as

$$\begin{aligned} \phi _i(y,y_{m+1})= {\left\{ \begin{array}{ll} (\pi _i(y),1) &{} \text {if } y_{m+1}=1\\ (\sigma _i(y),0) &{} \text {if } y_{m+1}=0 \end{array}\right. },\quad \text {for all } y \in \mathbb {F}_2^m, y_{m+1} \in \mathbb {F}_2, \end{aligned}$$

(2.2)

Then, permutations $\phi _1,\phi _2,\phi _3$ satisfy the condition $\left( \mathcal {A}_{m+1}\right)$.

Proof

The property $(\mathcal {A}_{m+1})$ means that for the permutations $\phi _i$ on $\mathbb {F}_2^{m+1}$, we have that $\phi _1+\phi _2 + \phi _3=\phi _4$ is also a permutation and $\phi _4^{-1}=\phi _1^{-1} + \phi _2^{-1} + \phi _3^{-1}$. First, we show that $\phi _4$ is a permutation. By definition of $\phi _4$, we get that for all $y\in \mathbb {F}_2^m$, $y_{m+1}\in \mathbb {F}_2$ it holds that

$$ \phi _4(y,y_{m+1})= {\left\{ \begin{array}{ll} ((\pi _1+\pi _2+\pi _3)(y),1) &{} \text {if } y_{m+1}=1\\ ((\sigma _1+\sigma _2+\sigma _3)(y),0) &{} \text {if } y_{m+1}=0 \end{array}\right. }.$$

Since $\pi _4=\pi _1+\pi _2+\pi _3$ and $\sigma _4=\sigma _1+\sigma _2+\sigma _3$ are permutations, we get that $\phi _4$ is a permutation as well. Now, we show that $\phi _4^{-1}=\phi _1^{-1} + \phi _2^{-1} + \phi _3^{-1}$. By Lemma 2.1, we have that for all $y\in \mathbb {F}_2^m$, $y_{m+1}\in \mathbb {F}_2$ it holds that

$$\begin{aligned} \begin{aligned} \phi ^{-1}_4(y,y_{m+1})&= {\left\{ \begin{array}{ll} ((\pi _1+\pi _2+\pi _3)^{-1}(y),1) &{} \text {if } y_{m+1}=1\\ ((\sigma _1+\sigma _2+\sigma _3)^{-1}(y),0) &{} \text {if } y_{m+1}=0 \end{array}\right. } \\&= {\left\{ \begin{array}{ll} (\pi _1^{-1}(y)+\pi _2^{-1}(y)+\pi _3^{-1}(y),1) &{} \text {if } y_{m+1}=1\\ (\sigma _1^{-1}(y)+\sigma _2^{-1}(y)+\sigma _3^{-1}(y),0) &{} \text {if } y_{m+1}=0 \end{array}\right. } \\&=(\phi _1^{-1} + \phi _2^{-1} + \phi _3^{-1} )(y,y_{m+1}), \end{aligned} \end{aligned}$$

from what follows that permutations $\phi _1,\phi _2,\phi _3$ have the $\left( \mathcal {A}_{m+1}\right)$ property.$\square$

2.2 Concatenating Maiorana-McFarland bent functions satisfying the dual bent condition

Theorem 1.3 specifies the dual bent condition for Maiorana-McFarland bent functions $f_i(x,y)=Tr(x\pi _i(y))+h_i(y)$ on $\mathbb {F}_{2^m}\times \mathbb {F}_{2^m}$, where permutations $\pi _i$ have the $(\mathcal {A}_m)$ property and $f_4=f_1+f_2 +f_3$. In this section, we give a generalization of Theorem 1.3, which is motivated by the following example.

Example 2.3

Define the permutations $\pi _i$ on $\mathbb {F}_2^4$ as follows (where the rows correspond to the coordinate functions):

$$\begin{aligned} \begin{aligned} \pi _1(y)&=\begin{pmatrix} y_1 + y_2 + y_1 y_4 + y_2 y_4 + y_3 y_4 \\ y_1 + y_1 y_2 + y_3 + y_2 y_3 + y_2 y_4 \\ y_1 y_2 + y_3 + y_1 y_3 + y_2 y_4 + y_3 y_4 \\ y_1 + y_3 + y_1 y_3 + y_2 y_3 + y_4 + y_1 y_4 + y_2 y_4 \end{pmatrix}, \\ \pi _2(y)&=\pi _1(y)+\begin{pmatrix} y_2 + y_3 + y_4\\ 1 + y_2 + y_3 + y_4\\ y_1 + y_3\\ y_1 + y_3 \end{pmatrix},\\ \pi _3(y)&=\pi _1(y)+ \begin{pmatrix} y_1 + y_4\\ y_1 + y_2\\ 1 + y_1 + y_2\\ 1 + y_1 + y_4 \end{pmatrix}, \pi _4(y)=(\pi _1+\pi _2+\pi _3)(y). \end{aligned} \end{aligned}$$

The algebraic normal forms of the functions $h_i$ are given as follows:

$$\begin{aligned} \begin{aligned} h_1(y)&=y_1 y_3 y_4, \quad h_2(y)= y_2 y_3 + y_1 y_4 + y_2 y_4 + y_3 y_4 + y_1 y_3 y_4, \\ h_3(y)&=y_1 y_3 + y_2 y_3 + y_3 y_4 + y_1 y_3 y_4, \quad h_4(y)= (h_1+h_2+h_3)(y)+s(y), \end{aligned} \end{aligned}$$

where $s(y)=y_1 + y_2 + y_4$. One can check that the above defined permutations $\pi _1,\pi _2,\pi _3$ of $\mathbb {F}_2^4$ have the $(\mathcal {A}_4)$ property and that $f=f_1|| f_2|| f_3||f_4\in \mathcal {B}_{10}$ is bent with $\deg (f)=3$, where $f_{i}(x,y)=x\cdot \pi _i(y)+h_i(y)$, for $x,y\in \mathbb {F}_2^4$. However, the conditions of Theorem 1.3 are not fulfilled, since $f_1+f_2+f_3+f_4=s\ne 0$.

Now, we provide a more general version of Theorem 1.3, which covers the previous example.

Theorem 2.4

Let $f_i(x, y)=Tr\left( x \pi _i(y)\right) +h_i(y)$ for $i \in \{1,2,3\}$ and $x, y \in$ $\mathbb {F}_{2^{m}}$ with $n=2m$, where the permutations $\pi _i$ satisfy the condition $\left( \mathcal {A}_m\right)$, and let $s(y)\in \mathcal {B}_{m}$. Define a function $h_4\in \mathcal {B}_m$ as $h_4(y)=h_1(y)+h_2(y)+h_3(y)+s(y)$ and a bent function $f_4\in \mathcal {B}_n$ as $f_4(x,y)=f_1(x,y)+f_2(x,y)+f_3(x,y)+s(y)$. If the functions $h_1, \ldots , h_4$ satisfy

$$\begin{aligned} h_1(\pi _1^{-1}(x))+h_2(\pi _2^{-1}(x))+h_3(\pi _3^{-1}(x))+h_4((\pi _1+\pi _2+\pi _3)^{-1}(x))=1 \text{, } \end{aligned}$$

(2.3)

then $f_1|| f_2|| f_3||f_4\in \mathcal {B}_{n+2}$ is bent.

Proof

Clearly $f_4(x,y)=(f_1+f_2+f_3+s)(x,y)=Tr\left( x\left( \pi _1+\pi _2+\pi _3\right) (y)\right) +h_4(y)$. Since the permutations $\pi _1,\pi _2,\pi _3$ satisfy the condition $\left( \mathcal {A}_m\right)$, their sum is again a permutation and $f_4$ is a bent Maiorana-McFarland function. Its dual is $f_4^*(x,y)=Tr(y\left( \pi _1+\pi _2+\pi _3\right) ^{-1}(x))+h_4(\left( \pi _1+\pi _2+\pi _3\right) ^{-1}(x))$. Then, the sum of dual bent functions of $f_i$ is given by

$$\begin{aligned} \begin{aligned} (f_1^*+f_2^*+f_3^*+f_4^*)(x,y) =&Tr(y (\pi _1^{-1}+\pi _2^{-1}+\pi _3^{-1}+(\pi _1+\pi _2+\pi _3)^{-1})(x)) \\ +&h_1(\pi _1^{-1}(x))+ h_2(\pi _2^{-1}(x)) +h_3(\pi _3^{-1}(x)) \\ +&h_4((\pi _1+\pi _2+\pi _3)^{-1}(x)) \\ =&h_1(\pi _1^{-1}(x))+h_2(\pi _2^{-1}(x))+h_3(\pi _3^{-1}(x)) \\ +&h_4((\pi _1+\pi _2+\pi _3)^{-1}(x))\\ =&1, \end{aligned} \end{aligned}$$

thus by [13, Theorem III.1] we have that $f_1|| f_2|| f_3||f_4\in \mathcal {B}_{n+2}$ is bent.$\square$

Remark 2.5

Theorem 2.4 explains why the concatenation $f_1|| f_2|| f_3||f_4\in \mathcal {B}_{10}$ of bent functions $f_1,f_2,f_3,f_4$ from Example 2.3 is a bent function again. Now, applying Theorem 1.4, we show that the concatenation of these functions is outside the completed Maiorana-McFarland class. First, we observe that Maiorana-McFarland bent functions $f_i$ share the unique canonical $\mathcal {M}$-subspace $\mathbb {F}_2^4\times \{0_4\}$. Consequently, all subspaces $U\subset \mathbb {F}_2^4\times \{0_4\}$ of dimension 3 are common $\mathcal {M}$-subspaces for all functions $f_i$; note that there are exactly ${4 \brack 3}_2=15$ such subspaces. Apart from these subspaces $U\subset \mathbb {F}_2^4\times \{0_4\}$, the functions $f_i$ have additionally the following 8 common $\mathcal {M}$-subspaces, which are not subspaces of $\mathbb {F}_2^4\times \{0_4\}$:

$$\begin{aligned}\left\langle \begin{array}{cccccccc} 1 &{} 0 &{} 0 &{} 0 &{} 0 &{} 1 &{} 0 &{} 1 \\ 0 &{} 1 &{} 1 &{} 0 &{} 0 &{} 0 &{} 0 &{} 0 \\ 0 &{} 0 &{} 0 &{} 1 &{} 0 &{} 1 &{} 0 &{} 1 \\ \end{array} \right\rangle ,\left\langle \begin{array}{cccccccc} 1 &{} 0 &{} 0 &{} 0 &{} 1 &{} 1 &{} 1 &{} 1 \\ 0 &{} 1 &{} 0 &{} 0 &{} 1 &{} 1 &{} 1 &{} 1 \\ 0 &{} 0 &{} 1 &{} 1 &{} 0 &{} 0 &{} 0 &{} 0 \\ \end{array} \right\rangle ,\left\langle \begin{array}{cccccccc} 1 &{} 0 &{} 0 &{} 1 &{} 0 &{} 0 &{} 0 &{} 0 \\ 0 &{} 1 &{} 0 &{} 0 &{} 0 &{} 1 &{} 0 &{} 1 \\ 0 &{} 0 &{} 1 &{} 0 &{} 0 &{} 1 &{} 0 &{} 1 \\ \end{array} \right\rangle ,\left\langle \begin{array}{cccccccc} 1 &{} 0 &{} 0 &{} 1 &{} 0 &{} 0 &{} 0 &{} 0 \\ 0 &{} 1 &{} 0 &{} 1 &{} 0 &{} 1 &{} 0 &{} 1 \\ 0 &{} 0 &{} 1 &{} 1 &{} 0 &{} 1 &{} 0 &{} 1 \\ \end{array} \right\rangle \end{aligned}$$

$$\begin{aligned} \left\langle \begin{array}{cccccccc} 1 &{} 0 &{} 0 &{} 1 &{} 0 &{} 0 &{} 0 &{} 0 \\ 0 &{} 1 &{} 1 &{} 0 &{} 0 &{} 0 &{} 0 &{} 0 \\ 0 &{} 0 &{} 0 &{} 0 &{} 0 &{} 1 &{} 0 &{} 1 \\ \end{array} \right\rangle ,\left\langle \begin{array}{cccccccc} 1 &{} 0 &{} 0 &{} 1 &{} 1 &{} 1 &{} 1 &{} 1 \\ 0 &{} 1 &{} 0 &{} 1 &{} 1 &{} 1 &{} 1 &{} 1 \\ 0 &{} 0 &{} 1 &{} 1 &{} 0 &{} 0 &{} 0 &{} 0 \\ \end{array} \right\rangle ,\left\langle \begin{array}{cccccccc} 1 &{} 1 &{} 0 &{} 0 &{} 0 &{} 0 &{} 0 &{} 0 \\ 0 &{} 0 &{} 1 &{} 0 &{} 1 &{} 1 &{} 1 &{} 1 \\ 0 &{} 0 &{} 0 &{} 1 &{} 1 &{} 1 &{} 1 &{} 1 \\ \end{array} \right\rangle ,\left\langle \begin{array}{cccccccc} 1 &{} 1 &{} 0 &{} 0 &{} 0 &{} 0 &{} 0 &{} 0 \\ 0 &{} 0 &{} 1 &{} 1 &{} 0 &{} 0 &{} 0 &{} 0 \\ 0 &{} 0 &{} 0 &{} 0 &{} 1 &{} 1 &{} 1 &{} 1 \\ \end{array} \right\rangle . \end{aligned}$$

One can check that for every 3-dimensional subspace V of $\mathbb {F}_2^8$ such that $D_aD_bf_i=0$, for all $a,b \in V$, where $i=1, \ldots ,4$, the conditions of Theorem 1.4 are satisfied, and hence, the bent function $f_1|| f_2|| f_3||f_4\in \mathcal {B}_{10}$ is outside $\mathcal {M}^\#$.

Now, we provide a recursive construction of Maiorana-McFarland bent functions $f'_1,f'_2,f'_3,f'_4\in \mathcal {B}_{n+2}$ satisfying the condition $(f'_1)^*+(f'_2)^*+(f'_3)^*+(f'_4)^*=1$ from bent functions $f_1,f_2,f_3,f_4\in \mathcal {B}_{n}$ satisfying the condition $f_1^*+f_2^*+f_3^*+f_4^*=1$ using Theorem 2.4.

Proposition 2.6

Let $\pi _j$, $\sigma _j$ for $j \in \{1,2,3\}$ be permutations on $\mathbb {F}_2^m$ which satisfy the condition $\left( \mathcal {A}_m\right)$. Denote by $\pi _4=\pi _1+\pi _2+\pi _3$, $\sigma _4=\sigma _1+\sigma _2+\sigma _3$ and let Boolean functions $h_i$, $g_i$ on $\mathbb {F}_2^m$, $i \in \{1,2,3,4\}$ satisfy

$$\begin{aligned} \begin{aligned} h_1(\pi _1^{-1}(y))+h_2(\pi _2^{-1}(y))+h_3(\pi _3^{-1}(y))+h_4(\pi _4^{-1}(y))=1, \\ g_1(\sigma _1^{-1}(y))+g_2(\sigma _2^{-1}(y))+g_3(\sigma _3^{-1}(y))+g_4(\sigma _4^{-1}(y))=1. \end{aligned} \end{aligned}$$

Define four permutations $\phi _i$ on $\mathbb {F}_2^{m+1}$ as in (2.2) and four Boolean functions $h_i'$ on $\mathbb {F}_2^{m+1}$ as follows

$$\begin{aligned} h_i'(y,y_{m+1})=y_{m+1}h_i(y)+(y_{m+1}+1)g_i(y) \text { for } i\in \{1,2,3,4\}. \end{aligned}$$

Then, the following hold.

• 1. The functions $h'_i$ satisfy

  $$\begin{aligned} \sum \limits _{i=1}^4 h_i'(\phi _i^{-1}(y,y_{m+1}))=1, \end{aligned}$$

  for all $y\in \mathbb {F}_2^m,y_{m+1}\in \mathbb {F}_2$, where $\phi _4=\phi _1+\phi _2+\phi _3$.

• 2. The Boolean functions $f'_i(x',y')=Tr\left( x' \phi _i(y')\right) +h'_i(y')$ for $i \in \{1,2,3,4\}$ and $x'=(x,x_{m+1}), y'=(y,y_{m+1}) \in$ $\mathbb {F}_{2}^{m+1}$ are bent, moreover, $f_1'|| f_2'|| f_3'||f_4'\in \mathcal {B}_{n+2}$ is bent as well.

Proof

1. Observe that for $j\in \{1,2,3\}$, we have that for all $y\in \mathbb {F}_2^m,y_{m+1}\in \mathbb {F}_2$ holds

$$\begin{aligned} \begin{aligned} h'_j(\phi _j^{-1}(y,y_{m+1}))&= {\left\{ \begin{array}{ll} h'_j(\phi ^{-1}_j(y,1)) &{} \text {if } y_{m+1}=1\\ h'_j(\phi ^{-1}_j(y,0)) &{} \text {if } y_{m+1}=0 \end{array}\right. }\\&={\left\{ \begin{array}{ll} h'_j(\pi _j^{-1}(y),1) &{} \text {if } y_{m+1}=1\\ h'_j(\sigma _j^{-1}(y),0) &{} \text {if } y_{m+1}=0 \end{array}\right. } \\&={\left\{ \begin{array}{ll} h_j(\pi _j^{-1}(y)) &{} \text {if } y_{m+1}=1\\ g_j(\sigma _j^{-1}(y)) &{} \text {if } y_{m+1}=0 \end{array}\right. }. \\ \end{aligned} \end{aligned}$$

Then, for all $y\in \mathbb {F}_2^m,y_{m+1}\in \mathbb {F}_2$, we consider the sum

$$\begin{aligned} \begin{aligned} \sum \limits _{i=1}^4 h_i'(\phi _i^{-1}(y,y_{m+1}))=&{\left\{ \begin{array}{ll} \sum \limits _{i=1}^4 h_i(\pi _i^{-1}(y)) &{} \text {if } y_{m+1}=1\\ \sum \limits _{i=1}^4 g_i(\sigma _i^{-1}(y)) &{} \text {if } y_{m+1}=0 \end{array}\right. }\\ =&{\left\{ \begin{array}{ll} \sum \limits _{i=1}^3 h_i(\pi _i^{-1}(y))+h_4((\pi _1+\pi _2+\pi _3)^{-1}(y)) &{} \text {if } y_{m+1}=1\\ \sum \limits _{i=1}^3 g_i(\sigma _i^{-1}(y))+ g_4((\sigma _1+\sigma _2+\sigma _3)^{-1}(y)) &{} \text {if } y_{m+1}=0 \end{array}\right. }\\ =&1, \end{aligned} \end{aligned}$$

since $h_1\left( \pi _1^{-1}(y)\right) +h_2\left( \pi _2^{-1}(y)\right) +h_3\left( \pi _3^{-1}(y)\right) +h_4((\pi _1+\pi _2+\pi _3)^{-1}(y))=1$ and $g_1\left( \sigma _1^{-1}(y)\right) +g_2\left( \sigma _2^{-1}(y)\right) +g_3\left( \sigma _3^{-1}(y)\right) +g_4((\sigma _1+\sigma _2+\sigma _3)^{-1}(y))=1$ hold for all $y\in \mathbb {F}_2^m$.

2. The statement follows immediately from Theorem 2.4. $\square$

Remark 2.7

Applying Proposition 2.6 to Example 2.3, one gets infinite families of permutations having the $(\mathcal {A}_{m+k})$ property for $k\in \mathbb {N}$, since Proposition 2.6 can be used recursively to define permutations on $\mathbb {F}_2^{m+k}$ that satisfy the $(\mathcal {A}_{m+k})$ property, and, in turn, bent functions satisfying the dual bent condition.

Example 2.8

Let $m=4$. Let permutations $\pi _i$ of $\mathbb {F}_2^m$ and Boolean functions $h_i\in \mathcal {B}_m$ be defined as in Example 2.3. Depending on the choice of permutations $\sigma _i$ and Boolean functions $g_i$, one can get bent functions on $\mathbb {F}_2^n$ of different algebraic degrees by applying the suggested iterative construction to the bent function considered in Example 2.3.

1. For $i\in \{1,2,3,4\}$, define $g_i=h_i$ and $\sigma _i=\pi _i$. By Proposition 2.2, we have that $\phi _i(y,y_{m+1})=(\pi _i(y),y_{m+1})$ and by Proposition 2.6, $h_i'(y,y_{m+1})=h_i(y)$. For $i\in \{1,2,3,4\}$, setting $\pi _i=\phi _i$, $h_i=h'_i$, and applying this procedure recursively, one can see that the obtained bent functions $f_i(x,y)=x\cdot \phi _i(y)+h_i(y)$ on $\mathbb {F}_2^{4+k}\times \mathbb {F}_2^{4+k}$ as well as their concatenations $f=f_1||f_2||f_3||f_4$ on $\mathbb {F}_2^{4+k}\times \mathbb {F}_2^{4+k}\times \mathbb {F}_2^2$ have the algebraic degree 3.

2. Define $g_1=g_2=g_3=0,g_4=1$ and $\sigma _i=id$ for $i\in \{1,2,3,4\}$. By Proposition 2.2, we have that for $i\in \{1,2,3\}$ it holds that $\phi _i(y,y_{m+1})=(y_{m+1}\pi _i(y)+(y_{m+1}+1)\sigma _i(y),y_{m+1})$. Moreover, by Proposition 2.6, for $i\in \{1,2,3\}$ we have $h_i'(y,y_{m+1})=y_{m+1}h_i(y)$ and $h_4'(y,y_{m+1})=y_{m+1}h_4(y)+y_{m+1}+1$. Applying this procedure recursively, one can see that the obtained bent functions $f_i(x,y)=x\cdot \phi _i(y)+h_i(y)$ on $\mathbb {F}_2^{4+k}\times \mathbb {F}_2^{4+k}$ as well as their concatenations $f=f_1||f_2||f_3||f_4$ on $\mathbb {F}_2^{4+k}\times \mathbb {F}_2^{4+k}\times \mathbb {F}_2^2$ have the algebraic degree $k+3$.

Open problem 1

Provide sufficient conditions for permutations $\phi _i$ in Proposition 2.6, more precisely on the permutations $\pi _i$ and $\sigma _i$ defined on $\mathbb {F}_2^m$, so that the concatenation of four bent functions $f_i(x,y)=x \cdot \phi _i(y) + h_i(y) \in \mathcal {M}^\#$, where $f_i:\mathbb {F}_2^{m+k} \times \mathbb {F}_2^{m+k} \rightarrow \mathbb {F}_2$, generates a bent function $f=f_1||f_2||f_3||f_4$ on $\mathbb {F}_2^{2m+2k +2}$ outside $\mathcal {M}^\#$.

Open problem 2

Example 2.3 demonstrates that it is possible to define four permutations $\pi _i$ of $\mathbb {F}_2^m$ with $i\in \{1,2,3,4\}$, where $\pi _j(y)=\pi _1(y)+L_j(y)$ for $j=2,3,4$, and $L_j:\mathbb {F}_2^m\rightarrow \mathbb {F}_2^m$ are linear mappings, such that for four suitably chosen Boolean functions $h_i\in \mathcal {B}_m$, the concatenation $f=f_1||f_2||f_3||f_4\in \mathcal {B}_{2m+2}$ of four Maiorana-McFarland bent functions $f_i(x,y)=x\cdot \pi _i(y)+h_i(y)$ on $\mathbb {F}_2^m\times \mathbb {F}_2^m$ is bent. We suggest to find constructions of such permutations $\pi _i$ and Boolean functions $h_i$ explicitly, and, additionally, show that the resulting bent function $f\in \mathcal {B}_{2m+2}$ is outside $\mathcal {M}^\#$.

In the sequel, we will demonstrate that these sufficient conditions that the concatenation $f=f_1||f_2||f_3||f_4$ is outside $\mathcal {M}^\#$ can be specified when permutations $\pi _i$ on $\mathbb {F}_2^m$ have the $(\mathcal {A}_{m})$ property, thus without using Proposition 2.6 recursively.

3 A sufficient condition for satisfying the outside $\mathcal {M}^\#$ property

Since in the concatenation $f=f_1||f_2||f_3||f_4\in \mathcal {B}_{n+2}$ we consider bent functions $f_i\in \mathcal {B}_n$ in $\mathcal {M}^\#$, it is essential to specify the conditions on these functions such that the resulting bent function f is outside $\mathcal {M}^\#$. Otherwise, one just gets a complicated construction method of bent functions in $\mathcal {M}^\#$. For this purpose, we will use the following description of $\mathcal {M}$-subspaces of $f=f_1||f_2||f_3||f_4\in \mathcal {B}_{n+2}$, which together with several other results for the concatenation of bent functions in $\mathcal {M}^\#$ class are given in [19].

Proposition 3.1

[19] Let $f_1,f_2,f_3,f_4\in \mathcal {B}_n$ be four Boolean functions (not necessarily bent), such that $f=f_1||f_2||f_3||f_4 \in \mathcal {B}_{n+2}$ is a bent function in $\mathcal {M}^{\#}$. Let $W\subset \mathbb {F}_2^{n+2}$ be an $\mathcal {M}$-subspace of f of dimension $(\frac{n}{2}+1)$. Then, there exists an $(\frac{n}{2}-1)$-dimensional subspace V of $\mathbb {F}_2^n$ such that $V \times \{(0,0)\}$ is a subspace of W, and such that for all $i=1, \ldots ,4$ the equality $D_aD_bf_i=0$ holds for all $a,b \in V$.

For the main result of this section, we will also need to define the $(P_1)$ property, which was recently introduced in [19] for specifying Maiorana-McFarland bent functions with the unique canonical $\mathcal {M}$-subspace.

Definition 3.2

A mapping $\pi :\mathbb {F}_2^m\rightarrow \mathbb {F}_2^m$ has the property $(P_1)$ if for all linearly independent $v,w\in \mathbb {F}_2^m$ we have that $D_vD_w\pi (y)\ne 0_m$ for all $y\in \mathbb {F}_2^m$.

More precisely, by Theorem 3.1 in [19], if a permutation $\pi$ on $\mathbb {F}_2^m$ satisfies the property $(P_1)$ then the bent function $f(x,y)=x \cdot \pi (y) + h(y)$ (where h is arbitrary) has the unique canonical $\mathcal {M}$-subspace of dimension m, namely $U=\mathbb {F}_2^m \times \{0_m\}$.

Theorem 3.3

Let $n=2m$ for $m >3$ and define three bent functions $f_i(x,y)=x \cdot \pi _i(y) + h_i(y)$, with $x, y \in \mathbb {F}_2^m$, for $i=1, \ldots ,3$, where

• 1. Three pairwise distinct permutations $\pi _1,\pi _2,\pi _3$ have the property $\left( \mathcal {A}_m\right)$,

• 2. Permutations $\pi _1,\pi _2,\pi _3$ and the mapping $\pi _1+\pi _2$ have the property $(P_1)$,

• 3. The components of $\pi _1+\pi _2$, do not admit linear structures.

Define $f=f_1||f_2||f_3||f_4$ where $f_4(x,y)=f_1(x,y)+f_2(x,y)+f_3(x,y) + s(y)$ (consequently $h_4(y)=h_1(y)+h_2(y)+h_3(y) + s(y)$) using suitable $h_i\in \mathcal {B}_m$ and where $s\in \mathcal {B}_m$ is an affine function so that the dual bent condition in (2.3) is satisfied. Then, the function $f\in \mathcal {B}_{n+2}$ is bent and outside $\mathcal {M}^\#$. In particular, the same conclusion is valid when $s(y)=0$.

Proof

The bentness of f follows from Theorem 2.4, since we assume that the dual bent condition in (2.3) is satisfied. To simplify the notation, we use the variable $z \in \mathbb {F}_2^n$ to replace $(x,y) \in \mathbb {F}_2^m \times \mathbb {F}_2^m$. Denoting $a=(a',a^{(1)},a^{(2)})$ and $b=(b',b^{(1)},b^{(2)})$, where $a',b' \in \mathbb {F}_2^{2m}$ and $a^{(i)},b^{(i)} \in \mathbb {F}_2$, the second-order derivative of f is given by $D_aD_bf(z,y_1,y_2)=$

$$\begin{aligned} \begin{aligned}&=D_{a'}D_{b'}f_1(z)+ y_1D_{a'}D_{b'}f_{13}(z)+ y_2 D_{a'}D_{b'}f_{12}(z)+ y_1y_2D_{a'}D_{b'}f_{1234}(z) \\&+ a^{(1)}D_{b'}f_{13}(z + a')+ b^{(1)} D_{a'}f_{13}(z + b') + a^{(2)}D_{b'}f_{12}(z + a') \\&+ b^{(2)}D_{a'}f_{12}(z + b') + (a^{(1)}y_2 + a^{(2)}y_1 + a^{(1)}a^{(2)})D_{b'}f_{1234}(z + a') \\ {}&+(b^{(1)}y_2 + b^{(2)}y_1 + b^{(1)}b^{(2)}) D_{a'}f_{1234}(z + b') \\ {}&+ (a^{(1)}b^{(2)} + b^{(1)}a^{(2)})f_{1234} (z + a' + b'), \end{aligned} \end{aligned}$$

(3.1)

where $f_{i_1\ldots i_k}:=f_{i_1} + \cdots + f_{i_k}$. We need to show that for any $(m+1)$-dimensional subspace W of $\mathbb {F}_2^{2m+2}$ there will always exist some nonzero $a, b \in W$ such that $D_aD_bf(z,y_1,y_2)\ne 0$. For convenience, we denote

$$W^{(x)}=\{ u_1: (u_1,u_2,u^{(1)},u^{(2)})\in W, (u_1,u_2,u^{(1)},u^{(2)})\in \mathbb {F}_2^m \times \mathbb {F}_2^m \times \mathbb {F}_2 \times \mathbb {F}_2\},$$

$$ W^{(y)}=\{ u_2: (u_1,u_2,u^{(1)},u^{(2)})\in W, (u_1,u_2,u^{(1)},u^{(2)})\in \mathbb {F}_2^m \times \mathbb {F}_2^m \times \mathbb {F}_2 \times \mathbb {F}_2\},$$

and also $a'=(a_1,a_2)$ and $b'=(b_1,b_2)$, where $a_i,b_i \in \mathbb {F}_2^m$.

There are three cases to be considered.

CASE A.   If $\dim (W^{(y)})>1$, then we can find two vectors $a=(a',a^{(1)},a^{(2)}), b=(b',b^{(1)},b^{(2)})\in W$ such that $a_2\ne 0_m, b_2\ne 0_m$ and $a_2\ne b_2$.

Since $D_uD_v \pi _i(y) \ne 0_m$ for any nonzero $u \ne v \in \mathbb {F}_2^m$ (as $\pi _i$ satisfies the property $(P_1)$), the functions $f_i$ share the unique canonical $\mathcal {M}$-subspace $U=\mathbb {F}_2^m \times \{0_m\}$, see Theorem 3.1 in [19]. Since, by the assumption, $D_{a_2}D_{b_2} ( \pi _1(y) + \pi _2(y)) \ne 0_m$ for any $a_2,b_2 \in \mathbb {F}_2^m$ ($a_2,b_2\ne 0$ and distinct), the term $y_2D_{a'}D_{b'}f_{12}(x,y)$ in (3.1) cannot be canceled unless $a_2=0_m$ or $b_2=0_m$ or $a_2=b_2$, which is due to the fact that (same can be deduced for $D_{(a_1, a_2)}D_{(b_1, b_2)}f_{13}(x,y)$)

$$\begin{aligned} \begin{aligned} D_{(a_1, a_2)}D_{(b_1, b_2)}f_{12}(x,y) =&x\cdot \left( D_{a_2}D_{b_2}(\pi _1(y)+\pi _2(y)) \right) \\ +&a_1\cdot D_{b_2}(\pi _1+\pi _2)(y+ a_2)\\ +&b_1 \cdot D_{a_2}(\pi _1+\pi _2)(y+ b_2) + D_{a_2} D_{b_2} h_{12}(y), \end{aligned} \end{aligned}$$

(3.2)

and the first term cannot be canceled. Here, similarly to $f_{ij}$, we denote $h_{i_1\ldots i_k}:=h_{i_1} + \cdots + h_{i_k}$, thus $h_{12}=h_1+h_2$. Notice that the other terms in (3.1) that possibly contain the variable $y_2$, such as $a^{(1)}y_2 D_{b'}f_{1234}(z + a')$ and $b^{(1)}y_2 D_{a'}f_{1234}(z + b')$, cannot cancel the term $y_2D_{a'}D_{b'}f_{12}(x,y)$ since $f_{1234}(x,y)=s(y)$ and its derivatives never depend on x (more precisely derivatives are constants since s(y) is affine).

CASE B.   If $\dim (W^{(y)})=1$, then we can find two vectors $a=(a_1,a_2,a^{(1)},a^{(2)})$, $b=(b_1,b_2,b^{(1)},b^{(2)})\in W$, where $a_2 \ne 0_m, b_2=0_m$ or $a_2=0_m, b_2\ne 0_m$ or $a_2= b_2\ne 0_m$ or $a_2=b_2=0_m$. We first select $a\in W$ such that $a_2 \ne 0_m$. Since $\dim (W^{(y)})=1$ and $\dim (W)=m+1$, we can find $b\in W$ such that $b_1 \ne 0_m$, $b_2=0_m$ and using the fact that $f_{1234}=s(y)$, we have $b_1 \cdot D_{a_2}(\pi _1+\pi _2)(y+ b_2)\ne D_{a'}f_{1234}(z + b')=const$, noticing that s(y) is affine and that the components of $\pi _1+\pi _2$ do not have linear structures. From (3.2), we have

$$\begin{aligned} \begin{aligned} D_{(a_1, a_2)}D_{(b_1, b_2)}f_{12}(x,y) =b_1 \cdot D_{a_2}(\pi _1+\pi _2)(y+ b_2)\ne const. \end{aligned} \end{aligned}$$

(3.3)

Then, from (3.1), we deduce that $D_aD_bf(z,y_1,y_2)\ne 0$ since $b_1 \cdot D_{a_2}(\pi _1+\pi _2)(y+ b_2)\ne D_{a'}f_{1234}(z + b')$. That is, $y_2 D_{a'}D_{b'}f_{12}(z)$ in (3.1) cannot be canceled.

CASE C.   If $\dim (W^{(y)})=0$, then (3.1) reduces to (since $a_2=b_2=0_m$)

$$\begin{aligned}{} & {} D_aD_bf(z,y_1,y_2)= a^{(1)}D_{b'}f_{13}(z + a')+ b^{(1)} D_{a'}f_{13}(z + b') + a^{(2)}D_{b'}f_{12}(z + a') \nonumber \\{} & {} + b^{(2)}D_{a'}f_{12}(z + b') + (a^{(1)}b^{(2)} + b^{(1)}a^{(2)})f_{1234} (z + a' + b'). \end{aligned}$$

(3.4)

There are two cases to be considered.

CASE C1.   First assume that $\dim \{ (u^{(1)},u^{(2)}): (u_1,u_2,u^{(1)},u^{(2)})\in W\}=2$. Due to this fact and since $\dim (W)= m+1$ (implying that $\dim (W^{(x)}) \in \{m-1, m\}$), there exist $a=(a_1,0_m,0,0)$ and $b=(b_1,0_m,0,1)$ in W, where $a_1 \ne 0_m$. Then, using that only $b^{(2)}\ne 0$, (3.4) reduces to $b^{(2)}D_{a'}f_{12}(z+b')=D_{a'}f_{12}(z+b')=a_1 \cdot (\pi _1 + \pi _2)(y)$, which cannot be zero by our assumption.

CASE C2.   If $\dim \{ (u^{(1)},u^{(2)}): (u_1,u_2,u^{(1)},u^{(2)})\in W\}=1$, then consequently $a=(a_1,0_m,0,0) \in W$. Notice that $W=\langle \mathbb {F}_2^{m} \times 0_m \times (0,0), (u_1,0_m, u^{(1)},u^{(2)}) \rangle$. Additionally, if $(u^{(1)},u^{(2)})=(0,1)$, then we have that for $b=(0_m,0_m,0,1)$ and any $a=(a_1,0_m,0,0) \in W$ with $a_1 \ne 0_m$, we have $D_aD_bf \ne 0$ in the same way as in CASE C1.

On the other hand, if $(u^{(1)},u^{(2)})=(1,0)$, then we select $a=(a_1,0_m,0,0)$ and $b=(0_m,0_m,1,0)$. Then, $D_{a'}f_{13}(z + b')=D_{a'}f_{13}(z)= a_1 \cdot (\pi _1 + \pi _3)(y)\ne 0$ by our assumption that $\pi _1+\pi _3 \ne 0_m$, since we can select $a_1 \in \mathbb {F}_2^m$ arbitrarily. Therefore, $D_aD_bf(z,y_1,y_2) \ne 0$.

If $(u^{(1)},u^{(2)})=(1,1)$, then we select $a=(a_1,0_m,0,0)$ and $b=(0_m,0_m,1,1)$, which gives $D_{a'}f_{13}(z + b')+D_{a'}f_{12}(z + b')=D_{a'}f_{23}(z )\ne 0$ using our assumption on $\pi _2 + \pi _3$. Equation (3.4) reduces to $D_{a'}f_{23}(z+b')=D_{a'}f_{23}(z)$, which cannot be zero.$\square$

Remark 3.4

Notice that our condition that $f_{1234}=s(y)$ is affine is important when considering the terms in (3.1) that contain the variable $y_2$, i.e., $a^{(1)}y_2 D_{b'}f_{1234}(z + a')$ and $b^{(1)}y_2 D_{a'}f_{1234}(z + b')$. Currently, the only examples when $f_1+f_2+f_3+f_4 \ne 0$ are exactly those when s(y) is affine. It is an interesting research task to analyze whether the $(\mathcal {A}_m)$ property can be extended for non-affine functions s(y).

Notice that we consider permutations $\pi$ on $\mathbb {F}_2^m$ for $m>3$ since otherwise $\pi$ are at most quadratic and, hence, their components admit linear structures [9].

Example 3.5

Let $m = 4$ and the multiplicative group of $\mathbb {F}_{2^{4}}$ be given by $\mathbb {F}_{2^{4}}^*=\langle a \rangle$, where the primitive element a satisfies $a^4 + a + 1=0$. Define $\alpha _1=a, \alpha _2=a^2,\alpha _3=a^4$ and $\alpha _4=\alpha _1+\alpha _2+\alpha _3=a^8$. It is easy to verify that for $i=1, \ldots ,3$, the permutations $\pi _i(y)=\alpha _i y^{14}$ (viewed as permutations over $\mathbb {F}_{2^4}$) satisfy the conditions in Theorem 3.3. Define the following four Boolean functions

$$h_1(y)=0, \; h_2(y)=Tr(y),\; h_3(y)=Tr(a y), \; h_4(y)=Tr(a^{13}y) + 1,$$

as well as four bent Maiorana-McFarland bent functions

$$f_i(x,y)=Tr(x\pi _i(y))+h_i(y)\quad \text {for } i=1,2,3,4\quad \text{ where } x,y\in \mathbb {F}_{2^4}.$$

Note that $h_1(y)+h_2(y)+h_3(y)+h_4(y)= s(y)= Tr(a^{11}y) + 1$, and hence, $f_4=f_1+f_2+f_3+ s$. Since the functions $h_i$ satisfy the condition (2.3) of Theorem 2.4, we have that $f=f_1|| f_2|| f_3||f_4\in \mathcal {B}_{10}$. By Theorem 3.3, the function f is bent and outside $\mathcal {M}^\#$.

4 Explicit construction methods of bent functions outside $\mathcal {M}^\#$ using permutation monomials

Monomial permutations $\pi _i$ of $\mathbb {F}_{2^m}$ satisfying the $(\mathcal {A}_m)$ property were specified in [17]. In this section, we show that for these permutations, it is always possible to find suitable functions $h_i$, such that the concatenation of bent functions $f_i(x,y)=Tr(x\pi _i(y))+h_i(y)$ is bent and outside $\mathcal {M}^\#$.

Theorem 4.1

[17] Let $m \ge 3$ be an integer and $d^2 \equiv 1 \mod 2^m-1$. Let $\pi _i$ be three permutations of $\mathbb {F}_{2^m}$ defined by $\pi _i(y)=\alpha _i y^d$, for $i=1,2,3$, where $\alpha _i \in \mathbb {F}_{2^m}^*$ are pairwise distinct elements such that $\alpha _i^{d+1}=1$ and $\alpha _4^{d+1}=1$ where $\alpha _4=\alpha _1+\alpha _2 + \alpha _3$. Then, the permutations $\pi _i$ of $\mathbb {F}_{2^m}$ satisfy the property ($\mathcal {A}_m$) and furthermore $\pi _i$ are involutions (i.e., $\pi _i^{-1}=\pi _i$) as well as $\pi _4=\pi _1+\pi _2+\pi _3$.

4.1 Concatenating Maiorana-McFarland bent functions stemming from the permutation monomials

In the following statement, we show how one can specify the functions $h_i$ for permutations $\pi _i$ in Theorem 4.1, so that the dual bent condition for the corresponding Maiorana-McFarland bent functions $f_i(x,y)=T(x\pi _i(y))+h_i(y)$ is fulfilled.

Proposition 4.2

Let $m \ge 3$ and $\pi _i(y)=\alpha _iy^d$ for $i=1,2,3,4$ be involutions of   $\mathbb {F}_{2^m}$ defined as in Theorem 4.1. Let also $\sigma :\{\alpha _1,\alpha _2,\alpha _3,\alpha _4\}\rightarrow \{\alpha _1,\alpha _2,\alpha _3,\alpha _4\}$ be a permutation. Define Boolean functions $h_i\in \mathcal {B}_{m}$ for $i=1,2,3,4$ as follows

$$\begin{aligned} h_i(y)=Tr(\beta _i y^k)\quad \text{ for } i=1,2,3\quad \text{ and } h_4(y)=Tr(\beta _4 y^k) + 1, \end{aligned}$$

(4.1)

where $k\in \mathbb {N}$ and the elements $\beta _i\in \mathbb {F}_{2^m}^*$ are given by

$$\begin{aligned} \beta _1=\frac{\sigma (\alpha _2)}{\alpha _1^k}, \beta _2=\frac{\sigma (\alpha _3)}{\alpha _2^k}, \beta _3=\frac{\sigma (\alpha _4)}{\alpha _3^k}, \beta _4=\frac{\sigma (\alpha _1)}{\alpha _4^k}. \end{aligned}$$

(4.2)

Then, the Maiorana-McFarland bent functions $f_i(x, y)=Tr\left( x \pi _i(y)\right) +h_i(y)$ for $i \in \{1,2,3,4\}$ and $x, y \in$ $\mathbb {F}_{2^{m}}$ satisfy

$$\begin{aligned} h_1(\pi _1^{-1}(y))+h_2(\pi _2^{-1}(y))+h_3(\pi _3^{-1}(y))+h_4(\pi _4^{-1}(y))=1, \end{aligned}$$

and, hence, $f=f_1|| f_2|| f_3||f_4\in \mathcal {B}_{2m+2}$ is bent.

Proof

Since all permutations $\pi _i(y)=\alpha _i y^d$ of $\mathbb {F}_{2^m}$ are involutions, we have

$$\begin{aligned} \begin{aligned} \sum \limits _{i=1}^4 h_i(\pi _i^{-1}(y))&=Tr(\beta _1\alpha _1^ky^{kd}+\beta _2\alpha _2^ky^{kd}+\beta _3\alpha _3^ky^{kd}+\beta _4\alpha _4^ky^{kd})+1\\&=Tr((\sigma (\alpha _1)+\sigma (\alpha _2)+\sigma (\alpha _3)+\sigma (\alpha _4))y^{kd})+1=1, \end{aligned} \end{aligned}$$

since $\sigma (\alpha _1)+\sigma (\alpha _2)+\sigma (\alpha _3)+\sigma (\alpha _4)=\alpha _1+\alpha _2+\alpha _3+\alpha _4=0$. Consequently, $f=f_1|| f_2|| f_3||f_4\in \mathcal {B}_{2m+2}$ is bent.$\square$

Remark 4.3

From (1.1), one can see that the algebraic degree of the concatenation $f=f_1||f_2||f_3||f_4 \in \mathcal {B}_{n+2}$ of four functions $f_i \in \mathcal {B}_n$ is equal to

$$\deg (f)=\max \{ \deg (f_1), \deg (f_1+f_3)+1, \deg (f_1+f_2)+1, \deg (f_1+f_2+f_3+f_4)+2 \}. $$

In Proposition 4.2, we show that one can specify four Maiorana-McFarland bent functions $f_i(x,y)=Tr(x\pi _i(y))+h_i(y)$ satisfying the dual bent condition, where $\deg (\pi _i)\ge 2$ and $\deg (h_i)\le n/2$. In this way, one can construct bent concatenations $f\in \mathcal {B}_{n+2}$ with a flexible degree in the range $3\le \deg (f)\le n/2+1$.

4.2 Bent functions outside $\mathcal {M}^\#$ using monomial permutations

In this subsection, we describe how one can concatenate Maiorana-McFarland bent functions stemming from non-linear permutation monomials in order to get infinite families of bent functions outside $\mathcal {M}^\#$. While the case of non-quadratic monomials is an immediate consequence of Theorem 3.3, the quadratic case cannot be covered by this result anymore. The reason for that is the condition “the components of $\pi$ do not admit linear structures” excludes the use of quadratic monomial permutations [9]. Therefore, the quadratic case needs a special treatment. In this context, we recall that a quadratic permutation $\pi$ on $\mathbb {F}_2^m$ satisfies the $(P_1)$ property if and only if $\pi$ is an APN permutation, see [19, Corollary 4.2]. Fist, we recall the following characterization of linear structures of the components of permutation monomials given in [9] (stated only for binary quadratic case), which is useful for our purpose.

Theorem 4.4

[9, Theorem 5] Let $\delta \in \mathbb {F}_{2^m}$ and $1 \le s \le 2^m-2$ be such that $f(x)=Tr(\delta x^s)$ is not the zero function on $\mathbb {F}_2^m$. Then, f has no linear structures if $wt(s)>2$, and when $wt_H(s)=2$ the function f has a linear structure if and only if $s=2^j(2^i+1)$, where $0 \le i, j \le m-1$, $i \not \in \{0,m/2\}$. In this case, $\alpha \in \mathbb {F}_{2^m}$ is a linear structure of f if and only if it satisfies $(\delta ^{2^{m-j}} \alpha ^{2^i+1})^{2^i-1}+1=0$. More precisely, the linear space $\Lambda$ of f is as follows. Denote $\sigma =\gcd (m,2i)$. Then, $\Lambda =\{0\}$ if $\delta$ is not a $(2^i+1)$-th power in $\mathbb {F}_{2^m}$. Otherwise, if $\delta =\beta ^{2^j(2^i+1)}$ for some $\beta \in \mathbb {F}_{2^m}$, it holds that $\Lambda =\beta ^{-1}\mathbb {F}_{2^\sigma }$.

With this result, which states that quadratic monomial permutations always have some components that admit non-zero linear structures, we are ready to prove the main theorem of this subsection.

Theorem 4.5

Let $m \ge 3$ and the Maiorana-McFarland bent functions

$$f_i(x, y)=Tr\left( x \pi _i(y)\right) +h_i(y)$$

for $i \in \{1,2,3,4\}$ and $x, y \in$ $\mathbb {F}_{2^{m}}$ be defined as in Proposition 4.2, where $\pi _i(y)=\alpha _iy^d$ are four permutations of $\mathbb {F}_{2^m}$ defined as in Theorem 4.1 satisfying additionally the $(P_1)$ property. If $wt(d)>1$, then $f=f_1|| f_2|| f_3||f_4\in \mathcal {B}_{2m+2}$ is bent and outside $\mathcal {M}^\#$.

Proof

For $wt(d)>2$, the statement follows from Theorems 3.3 and 4.4.

For $wt(d)=2$, without loss of generality, we assume $d=2^j(2^k+1)$, where $0 \le j, k \le m-1$ and $k \not \in \{0,m/2\}$. Since all $\pi _i$ have the property $(P_1)$ (and are necessarily APN permutations by Corollary 4.2 in [19]), by Theorem 3.1 in [19], we have that the functions $f_i$ share the unique canonical $\mathcal {M}$-subspace $U=\mathbb {F}_2^m \times \{0_m\}$ of dimension m. Thus, we can apply Theorem 1.4 and verify that the conditions 1) to 3) are satisfied.

Let V be an $(\frac{n}{2}-1)$-dimensional subspace of $\mathbb {F}_2^{2m}$ such that $D_aD_bf_i=0$, for all $a,b \in V$; $i=1, \ldots ,4.$ If for any $v\in \mathbb {F}_2^{2m}$ and any such $V \subset \mathbb {F}_2^{2m}$, there exist $u^{(1)},u^{(2)},u^{(3)}\in V$ such that the following three conditions hold simultaneously (replacing $x \in \mathbb {F}_2^{2m}$ in Theorem 1.4 by $(x,y) \in \mathbb {F}_2^m \times \mathbb {F}_2^m$):

• 1) $D_{u^{(1)}}f_1(x,y)+D_{u^{(1)}}f_2((x,y)+v)\ne 0,~\textit{or}~D_{u^{(1)}}f_3(x,y)+D_{u^{(1)}}f_4((x,y)+v)\ne 0,$

• 2) $D_{u^{(2)}}f_1(x,y)+D_{u^{(2)}}f_3((x,y)+v)\ne 0,~\textit{or}~D_{u^{(2)}}f_2(x,y)+D_{u^{(2)}}f_4((x,y)+v)\ne 0,$

• 3) $D_{u^{(3)}}f_2(x,y)+D_{u^{(3)}}f_3((x,y)+v)\ne 0,~\textit{or}~D_{u^{(3)}}f_1(x,y)+D_{u^{(3)}}f_4((x,y)+v)\ne 0,$

then by Theorem 1.4 we conclude that f is outside $\mathcal {M}^\#$.

In what follows, we show that the above conditions are actually satisfied. Denoting $u^{(i)}=(u_1^{(i)},u_2^{(i)})$, where $u_1^{(i)}, u_2^{(i)} \in \mathbb {F}_2^m$. There are two cases to be considered.

• 1. If $\dim (\{u_2:u=(u_1,u_2)\in V,u_1,u_2\in \mathbb {F}_2^m\})>0$, then we can select $u^{(i)}\in V$ such that $u_2^{(i)}\ne 0_m$, where $i=1,2,3$, the translates of $f_i$ correspond to

  $$\begin{aligned} \begin{array}{rl} &{} f_i(x+u^{(1)}_1,y+u^{(1)}_2)\\ =&{}Tr\left( (x+u^{(1)}_1) \pi _i(y+u^{(1)}_2)\right) +h_i(y+u^{(1)}_2)\\ =&{}Tr\left( (x+u^{(1)}_1) \alpha _i(y+u^{(1)}_2)^d\right) +h_i(y+u^{(1)}_2)\\ =&{}Tr\left( (x+u^{(1)}_1) \alpha _i\left( y^d+(u^{(1)}_2)^d+y^{2^{k+j}}(u^{(1)}_2)^{2^j}+y^{2^{j}}(u^{(1)}_2)^{2^{k+j}}\right) \right) \\ +&{}h_i(y+u^{(1)}_2)\\ =&{}Tr\left( x \alpha _i\left( y^d+(u^{(1)}_2)^d+y^{2^{k+j}}(u^{(1)}_2)^{2^j}+y^{2^{j}}(u^{(1)}_2)^{2^{k+j}}\right) \right) +G_i(y), \end{array} \end{aligned}$$

  (4.3)

  where

  $$\begin{aligned} \begin{aligned} G_i(y)&= Tr\left( u^{(1)}_1 \alpha _i\left( y^d+(u^{(1)}_2)^d+y^{2^{k+j}}(u^{(1)}_2)^{2^j}+y^{2^{j}}(u^{(1)}_2)^{2^{k+j}}\right) \right) \\ {}&+h_i(y+u^{(1)}_2). \end{aligned} \end{aligned}$$

  Then,

  $$\begin{aligned} \begin{array}{rl} D_{u^{(1)}}f_i(x,y)=&{}Tr\left( x \pi _i(y)\right) +h_i(y)+Tr\left( (x+u^{(1)}_1) \pi _i(y+u^{(1)}_2)\right) \\ +&{}h_i(y+u^{(1)}_2)\\ =&{}Tr\left( x \alpha _i\left( (u^{(1)}_2)^d+y^{2^{k+j}}(u^{(1)}_2)^{2^j}+y^{2^{j}}(u^{(1)}_2)^{2^{k+j}}\right) \right) \\ +&{}G_i(y)+h_i(y), \end{array} \end{aligned}$$

  (4.4)

  and similarly

  $$\begin{aligned} \begin{array}{rl} &{} D_{u^{(1)}}f_i(x+v_1,y+v_2) \\ =&{}Tr\left( (x+v_1) \alpha _i\left( (u^{(1)}_2)^d+(y+v_2)^{2^{k+j}}(u^{(1)}_2)^{2^j}+(y+v_2)^{2^{j}}(u^{(1)}_2)^{2^{k+j}}\right) \right) \\ +&{}G_i(y+v_2)+h_i(y+v_2). \end{array} \end{aligned}$$

  (4.5)

  From (4.4) and (4.5), we have

  $$\begin{aligned} \begin{array}{rl} &{} D_{u^{(1)}}f_1(x,y) +D_{u^{(1)}}f_2(x+v_1,y+v_2) \\ =&{}Tr\left( x \alpha _1\left( (u^{(1)}_2)^d+y^{2^{k+j}}(u^{(1)}_2)^{2^j}+y^{2^{j}}(u^{(1)}_2)^{2^{k+j}}\right) \right) +G_1(y)+h_1(y)\\ +&{}Tr\left( (x+v_1) \alpha _2\left( (u^{(1)}_2)^d+(y+v_2)^{2^{k+j}}(u^{(1)}_2)^{2^j}+(y+v_2)^{2^{j}}(u^{(1)}_2)^{2^{k+j}}\right) \right) \\ +&{}G_2(y+v_2)+h_2(y+v_2),\\ \end{array} \end{aligned}$$

  (4.6)

  and furthermore  (4.6) can be written as

  $$Tr\left( x (\alpha _1+\alpha _2)\left( y^{2^{k+j}}(u^{(1)}_2)^{2^j}+y^{2^{j}}(u^{(1)}_2)^{2^{k+j}}\right) \right) +G'(y)+S(x),$$

  where $G'(y)$ and S(x) cover the terms in the ANF of $D_{u^{(1)}}f_1(x,y) +D_{u^{(1)}}f_2(x+v_1,y+v_2)$ that exclusively use the variables y and x, respectively. Thus, combining $u_1^{(i)} \ne 0_m$ and $u_2^{(i)} \ne 0_m$, we have

  $$ D_{u^{(1)}}f_1(x,y) +D_{u^{(1)}}f_2(x+v_1,y+v_2) \ne 0,$$

  since if $\alpha _1\ne \alpha _2$, then

  $$Tr\left( x (\alpha _1+\alpha _2)\left( y^{2^{k+j}}(u^{(1)}_2)^{2^j}+y^{2^{j}}(u^{(1)}_2)^{2^{k+j}}\right) \right) \ne const.,$$

  and the functions $G'(y)$ and S(x) clearly cannot cancel this term since it contains quadratic terms of the form $Tr(xy^{2^{k+j}})$ or $Tr(xy^{2^{j}})$. Similarly, we have

  $$ D_{u^{(2)}}f_1(x,y) +D_{u^{(2)}}f_3(x+v_1,y+v_2) \ne 0$$

  if $\alpha _1\ne \alpha _3$, and

  $$ D_{u^{(3)}}f_2(x,y) +D_{u^{(3)}}f_3(x+v_1,y+v_2) \ne 0$$

  if $\alpha _2\ne \alpha _3$.

• 2. If $\dim (\{u_2:u=(u_1,u_2)\in V,u_1,u_2\in \mathbb {F}_2^m\})=0$, then we can select $u^{(i)}\in V$ such that $u_1^{(i)}\ne 0_m$ and $u_2^{(i)}= 0_m$, where $i=1,2,3$. From (4.3), we have

  $$\begin{aligned} \begin{array}{c} f_i(x+u^{(1)}_1,y) =Tr\left( x \alpha _iy^d\right) + Tr\left( u^{(1)}_1 \alpha _iy^d\right) +h_i(y). \end{array} \end{aligned}$$

  (4.7)

  Then,

  $$\begin{aligned} \begin{array}{c} D_{u^{(1)}}f_i(x,y)=Tr\left( u^{(1)}_1 \alpha _iy^d\right) \end{array} \end{aligned}$$

  (4.8)

  and similarly

  $$\begin{aligned} \begin{array}{c} D_{u^{(1)}}f_i(x+v_1,y+v_2) =Tr\left( u^{(1)}_1 \alpha _i(y+v_2)^d\right) . \end{array} \end{aligned}$$

  (4.9)

  From (4.8) and (4.9), we have

  $$\begin{aligned} \begin{array}{rl} &{} D_{u^{(1)}}f_1(x,y) +D_{u^{(1)}}f_2(x+v_1,y+v_2) \\ =&{}Tr\left( u^{(1)}_1(\alpha _1+\alpha _2)y^d\right) + Tr\left( u^{(1)}_1\alpha _2(v_2^d+y^{2^{j}}v_2^{2^{j+k}}+v_2^{2^{j}}y^{2^{j+k}})\right) . \end{array} \end{aligned}$$

  (4.10)

  From (4.10) and $u_1^{(i)} \ne 0_m$, we have

  $$ D_{u^{(1)}}f_1(x,y) +D_{u^{(1)}}f_2(x+v_1,y+v_2) \ne 0,$$

  since

  $$Tr\left( u^{(1)}_1(\alpha _1+\alpha _2)y^d\right) $$

  is a quadratic function if $\alpha _1\ne \alpha _2$. Similarly, we have

  $$ D_{u^{(2)}}f_1(x,y) +D_{u^{(2)}}f_3(x+v_1,y+v_2) \ne 0$$

  if $\alpha _1\ne \alpha _3$, and

  $$ D_{u^{(3)}}f_2(x,y) +D_{u^{(3)}}f_3(x+v_1,y+v_2) \ne 0$$

  if $\alpha _2\ne \alpha _3$.

Thus, by Theorem 1.4, f is outside $\mathcal {M}^\#$.$\square$

Remark 4.6

1. Notice that there are no quadratic APN permutations on $\mathbb {F}_2^m$ for even m [25], but we do not refine the parity of m in Theorem 4.5 since the statement is given in a wider context.

2. Using Theorem 4.1, we were able to find only a few sporadic examples of quadratic permutations, giving rise to bent functions outside $\mathcal {M}^\#$. However, we believe that the proof techniques used for the case $wt(d)=2$ in the proof of Theorem 4.5, can be useful for deriving similar results for other classes of quadratic permutations.

In the following example, we indicate that (due to Theorem 4.5) the conditions of Theorem 3.3 can indeed be relaxed, since the permutations $\pi _i(y)\mapsto \alpha _i y^{-1}$ that we use in this example are quadratic and therefore do not satisfy the conditions of Theorem 3.3. As already mentioned in Theorem 4.4, monomial quadratic permutations have at least one component that admits non-trivial linear structures and essentially Theorem 4.5 is the first result in the literature that ensures the outside $\mathcal {M}^\#$ property using this class of permutations.

Example 4.7

Let $m = 3$ and the multiplicative group of $\mathbb {F}_{2^{3}}$ be given by $\mathbb {F}_{2^{3}}^*=\langle a \rangle$, where the primitive element a satisfies $a^3 + a + 1=0$. Let $d=2^m-2=6$, which satisfies $d^2 \equiv 1 \mod 7$. Define $\alpha _1=a, \alpha _2=a^4,\alpha _3=a^6$ and $\alpha _4=\alpha _1+\alpha _2+\alpha _3=1$. By Theorem 4.1, the mappings $\pi _i(y)=\alpha _i y^d$, for $i=1,2,3$, are involutions, as well as $\pi _4=\pi _1+\pi _2+\pi _3$. Set $k=3$ and $\sigma =id$. Then, quadratic Boolean functions $h_i\in \mathcal {B}_3$ are given in the following way:

$$\begin{aligned} \begin{aligned} h_1(y)&=Tr(\beta _1y^k)=Tr\left( \frac{\alpha _2}{\alpha _1^3} y^3\right) =Tr(a^3 y^3),\\ h_2(y)&=Tr(\beta _2y^k)=Tr\left( \frac{\alpha _3}{\alpha _2^3} y^3\right) =Tr(a^2 y^3),\\ h_3(y)&=Tr(\beta _3y^k)=Tr\left( \frac{\alpha _4}{\alpha _3^3} y^3\right) =Tr(a y^3),\\ h_4(y)&=Tr(\beta _4y^k) + 1=Tr\left( \frac{\alpha _1}{\alpha _4^3} y^3\right) +1=Tr(y^3) + 1. \end{aligned} \end{aligned}$$

(4.11)

Since the Boolean functions $h_i$ satisfy the condition (2.3) of Theorem 2.4, that is, $\sum _{i=1}^{4} h_i(\pi _i^{-1}(x))=1$, we have that $f=f_1|| f_2|| f_3||f_4\in \mathcal {B}_{8}$ is bent, where $f_i(x,y)=Tr(x\pi _i(y))+h_i(y)$ for $i=1,2,3,4$, with $x,y\in \mathbb {F}_{2^3}$. The algebraic normal form of $f\in \mathcal {B}_8$ is given by

$$\begin{aligned} \begin{aligned} f(z)=&z_2 z_4 + z_1 z_5 + z_4 z_5 + z_3 z_4 z_5 + z_6 + z_1 z_6 + z_3 z_6 + z_1 z_4 z_6 + z_2 z_4 z_6 \\ +&z_2 z_5 z_6 + z_4 z_7 + z_1 z_4 z_7 + z_2 z_4 z_7 + z_3 z_4 z_7 + z_5 z_7 + z_2 z_5 z_7 + z_3 z_5 z_7 \\ +&z_1 z_4 z_5 z_7 + z_3 z_4 z_5 z_7 + z_6 z_7 + z_1 z_6 z_7 + z_2 z_6 z_7 + z_1 z_4 z_6 z_7 + z_5 z_6 z_7 \\ +&z_1 z_5 z_6 z_7 + z_2 z_5 z_6 z_7 + z_3 z_5 z_6 z_7 + z_3 z_4 z_8 + z_2 z_5 z_8 + z_1 z_4 z_5 z_8 \\ +&z_2 z_4 z_5 z_8 + z_1 z_6 z_8 + z_2 z_4 z_6 z_8 + z_3 z_4 z_6 z_8 + z_3 z_5 z_6 z_8 + z_7 z_8 + z_4 z_7 z_8 \\ +&z_5 z_7 z_8 + z_6 z_7 z_8 + z_5 z_6 z_7 z_8. \end{aligned} \end{aligned}$$

Using a computer algebra system, one can check (for example, as described in [19]) that the obtained bent function $f\in \mathcal {B}_8$ is outside $\mathcal {M}^\#\cup \mathcal{P}\mathcal{S}^\#$.

Open problem 3

As we showed in Section 2, it is possible to derive new permutations $\phi _i$ of $\mathbb {F}_2^{m+k}$ with the $(\mathcal {A}_{m+k})$ property from permutations $\pi _i$ of $\mathbb {F}_2^{m}$ with the $(\mathcal {A}_{m})$ property, and additionally to derive Boolean functions $h_i'\in \mathcal {B}_{m+k}$ from $h_i\in \mathcal {B}_{m}$, such that $f'=f'_1||f'_2||f'_3||f'_4\in \mathcal {B}_{2m+2k+2}$ is bent, where $f'_i(x,y)=x\cdot \phi _i(y)+h'_i(y)$ is bent on $\mathbb {F}_2^{m+k}\times \mathbb {F}_2^{m+k}$. Assuming that $f=f_1||f_2||f_3||f_4\in \mathcal {B}_{2m+2}$ is outside $\mathcal {M}^\#$, where $f_i(x,y)=x\cdot \pi _i(y)+h_i(y)$ is bent on $\mathbb {F}_2^m\times \mathbb {F}_2^m$, does the function $f'=f'_1||f'_2||f'_3||f'_4$ belong to $\mathcal {M}^\#$?

5 An application to the design of homogeneous cubic bent functions

Despite the intensive study of bent functions in the past decades, only a few works are dedicated to the study of the subclass of homogeneous bent functions (we refer the reader to the seminal paper [8] as well as recent contributions [20, 22, 27]). In this section, we show how bent functions satisfying the dual bent condition and permutations with the $(\mathcal {A}_m)$ property can be used for the construction of homogeneous cubic bent functions, which (together with quadratic) are the only homogeneous bent functions known to exist.

Proposition 5.1

Let $f_1\in \mathcal {B}_n$ be a homogeneous cubic bent function. Let $q_1,q_2 \in \mathcal {B}_n$ be two homogeneous quadratic functions, such that $f_2=f_1+q_2$ and $f_3=f_1+q_3$ are bent, and additionally $f_1+f_2+f_3$ is also bent. Defining $f_4=f_1+f_2+f_3+s$ for $s\in \mathcal {B}_n$, the function $f=f_1||f_2||f_3||f_4\in \mathcal {B}_{n+2}$ is homogeneous cubic bent if and only if $f_1^*+f_2^*+f_3^*=(f_1+f_2+f_3+s)^*+1$, where $s\in \mathcal {B}_n$ is a linear function.

Proof

Substituting the defined functions $f_i$ in the bent concatenation (1.1), we get

$$\begin{aligned} \begin{aligned} f(z,z_{n+1},z_{n+2})&=f_1(z) + z_{n+1}(f_1 + f_3)(z)\\ {}&+ z_{n+2}(f_1 + f_2)(z) + z_{n+1}z_{n+2}(f_1 + f_2 + f_3 + f_4)(z) \\&=f_1(z) + z_{n+1}q_3(z) + z_{n+2}q_2(z) + z_{n+1}z_{n+2}s(z). \end{aligned} \end{aligned}$$

(5.1)

Since the first three terms in (5.1) are homogeneous and cubic, the last term $z_{n+1}z_{n+2}s(z)$ must be either homogeneous and cubic, or zero; this is possible if and only if the function $s\in \mathcal {B}_n$ is linear. Since $f_1^*+f_2^*+f_3^*=(f_1+f_2+f_3+s)^*+1$, we have that the dual bent condition $f_1^*+ f_2^* + f_3^* + f_4^* =1$ is satisfied, and hence $f\in \mathcal {B}_{n+2}$ is bent. $\square$

Example 5.2

Consider the following homogeneous functions $f_1,q_2,q_3,s\in \mathcal {B}_8$, which are given by their algebraic normal forms as follows:

$$\begin{aligned} \begin{aligned} f_1(z)=&z_1 z_2 z_5 + z_1 z_2 z_8 + z_1 z_3 z_4 + z_1 z_3 z_5 + z_1 z_3 z_6 + z_1 z_3 z_7 + z_1 z_4 z_5 + z_1 z_4 z_7 \\ +&z_1 z_4 z_8 + z_1 z_5 z_8 + z_1 z_6 z_8 + z_2 z_3 z_4 + z_2 z_3 z_5 + z_2 z_4 z_5 + z_2 z_4 z_6 + z_2 z_4 z_8 \\ +&z_2 z_5 z_6 + z_2 z_6 z_7 + z_2 z_6 z_8 + z_2 z_7 z_8 + z_3 z_4 z_6 + z_3 z_4 z_8 + z_3 z_5 z_6 + z_3 z_5 z_7 \\ +&z_3 z_6 z_8 + z_4 z_7 z_8 + z_5 z_6 z_7 + z_5 z_6 z_8,\\ q_2(z)=&z_1 z_4 + z_1 z_5 + z_1 z_7 + z_5 z_7 + z_1 z_8 + z_4 z_8 + z_6 z_7 + z_6 z_8 + z_7 z_8, \\ q_3(z)=&z_1 z_3 + z_1 z_4 + z_1 z_7 + z_1 z_8 + z_2 z_3 + z_2 z_8 + z_3 z_5 + z_3 z_8 + z_4 z_7 \\ +&z_5 z_6 + z_6 z_7 + z_7 z_8,\\ s(z)=&z_1 + z_4 + z_6 + z_8.\\ \end{aligned} \end{aligned}$$

One can check that the functions $f_1,q_2,q_3,s\in \mathcal {B}_8$ satisfy the conditions of Proposition 5.1, and hence $f=f_1||f_2||f_3||f_4\in \mathcal {B}_{10}$ constructed as in Proposition 5.1 is homogeneous cubic bent. Notably, there exists a linear non-degenerate transformation $z\mapsto zA$, where the matrix A is given by

$$\begin{aligned}A=\left( \begin{array}{cccccccc} 1 &{} 0 &{} 0 &{} 1 &{} 0 &{} 1 &{} 0 &{} 1 \\ 0 &{} 1 &{} 0 &{} 1 &{} 0 &{} 1 &{} 1 &{} 0 \\ 0 &{} 0 &{} 1 &{} 1 &{} 0 &{} 0 &{} 1 &{} 1 \\ 0 &{} 0 &{} 0 &{} 0 &{} 1 &{} 1 &{} 1 &{} 1 \\ 0 &{} 0 &{} 0 &{} 1 &{} 0 &{} 0 &{} 0 &{} 0 \\ 0 &{} 0 &{} 0 &{} 0 &{} 0 &{} 1 &{} 0 &{} 0 \\ 0 &{} 0 &{} 0 &{} 0 &{} 0 &{} 0 &{} 1 &{} 0 \\ 0 &{} 0 &{} 0 &{} 0 &{} 0 &{} 0 &{} 0 &{} 1 \\ \end{array} \right) , \end{aligned}$$

such that $f_i(zA)=x\cdot \pi _i(y)+h_i(y)$, where permutations $\pi _i$ and Boolean functions $h_i$ are defined in Example 2.3, and hence, permutations $\pi _i$ have the $(\mathcal {A}_4)$ property. Finally, we note that the function $f\notin \mathcal {M}^\#$ since the functions $f_i$ satisfy the conditions of [19, Theorem 5.8].

Open problem 4

Find explicit infinite families of homogeneous bent functions using the dual bent condition and permutations with the $(\mathcal {A}_m)$ property.

6 Conclusions

In this article, we provided construction methods of permutations of $\mathbb {F}_{2^m}$ with the $(\mathcal {A}_m)$ property as well as their application to the design of bent functions satisfying the dual bent condition. Most notably, concatenating Maiorana-McFarland bent functions satisfying the dual bent condition, we were able to provide a generic construction method of bent functions outside $\mathcal {M}^\#$, including an explicit method based on permutation monomials.

To conclude the paper, we give the following list of problems, solutions to which could provide a better understanding of construction methods of bent functions using the bent 4-concatenation.

• 1. In Proposition 4.2, we specified the functions $h_i$ for permutations $\pi _i$ from Theorem 4.1, such that the dual bent condition for the corresponding Maiorana-McFarland bent functions $f_i(x,y)=Tr(x\pi _i(y))+h_i(y)$ is fulfilled. However, as computational results indicate, there are much more choices of such functions $h_i$. We think it would be interesting to provide other construction methods of functions $h_i$, such that the dual bent condition for Maiorana-McFarland bent functions $f_i$ is satisfied.

• 2. Similarly to Theorem 4.5, provide other explicit classes of permutation polynomials, which can be used for the construction of Maiorana-McFarland bent functions satisfying the dual bent condition. As soon as such classes are identified, show that the concatenation of corresponding Maiorana-McFarland bent functions is outside $\mathcal {M}^\#$.

• 3. As results in Section 4 indicate, the strict conditions of Theorem 3.3 can be relaxed. In this way, we propose to relax the conditions imposed on the permutations used in Theorem 3.3 and provide other generic construction methods of bent functions outside $\mathcal {M}^\#$ using concatenation of Maiorana-McFarland functions.