Open Problems on Binary Bent Functions

Chapter

Abstract

This chapter gives a survey of the recent results on Boolean bent functions and lists some open problems in this domain. It includes also new results. We recall the definitions and basic results, including known and new characterizations of bent functions; we describe the constructions (primary and secondary; known and new) and give the known infinite classes, in multivariate representation and in trace representation (univariate and bivariate). We also focus on the particular class of rotation symmetric (RS) bent functions and on the related notion of bent idempotent: we give the known infinite classes and secondary constructions of such functions, and we describe the properties of a recently introduced transformation of RS functions into idempotents.

1 Introduction

Boolean functions are functions from \(\mathbb{F}_{2}^{n}\) to \(\mathbb{F}_{2}\), where n is some positive integer called the number of variables. They play a role in almost all the domains of computer science. We are more interested here in their relationship with error-correcting codes and private-key cryptography. Multi-output Boolean functions are functions from \(\mathbb{F}_{2}^{n}\) to \(\mathbb{F}_{2}^{m}\) for some m (to specify that m = 1, we can speak of single-output Boolean function, but even without such precision, “Boolean function” without writing “vectorial” will imply single output).

A binary error-correcting code of a given length N is a subset C of \(\mathbb{F}_{2}^{N}\). Each information to be sent over a noisy channel is encoded before transmission by the sender into an element of C (a codeword); if d is the minimum Hamming distance between two distinct codewords (called the minimum distance of the code), such encoding allows theoretically the receiver to correct up to \(e = \left [\frac{d-1} {2} \right ]\) binary errors in the transmission of a codeword (e is called the error correction capability of the code). When the code has length N = 2n, the codewords can be interpreted as Boolean functions (some order on the elements of \(\mathbb{F}_{2}^{n}\) being chosen beforehand). Reed-Muller codes [49] are examples of such codes defined as sets of Boolean functions. Any code of length N can be viewed itself as the support of an N-variable function, and some notions on codes (e.g., the dual distance) correspond to notions on Boolean functions (e.g., correlation immunity), but we shall not address this here.

Private-key cryptosystems (stream ciphers, which encrypt at a bit level, and block ciphers, which encrypt block by block) allow exchanging confidentially large-size data over a public channel. With such conventional symmetric ciphers, it is necessary to possess the secret encryption key (resp. the secret decryption key, which is in general equal to the encryption key, and is supposed to have been safely shared in advance between the sender and the receiver) for being able to encrypt (resp. decrypt) messages.1 For reasons of speed, these cryptosystems involve linear operations, and for reasons of resistance to attacks, they need also to involve some amount of nonlinearity, often brought by single-output or multi-output Boolean functions. There are several ways of quantifying how nonlinear (i.e., different from linear functions) a given Boolean function can be. The main parameter for such quantification is the so-called nonlinearity, equal to the minimum Hamming distance between the function and all affine functions (i.e., sums of a linear function and a binary constant). The nonlinearity of any n-variable Boolean function is bounded above by \(2^{n-1} - 2^{n/2-1}\). The functions achieving this bound with equality exist only for n even since the nonlinearity is an integer (in fact, they exist if and only if n is even). They are called bent. Such bent functions are not directly used in stream ciphers because bentness makes impossible the function to be balanced (i.e., to have output uniformly distributed over \(\mathbb{F}_{2}\)), and this induces a statistical correlation between the plaintext and the ciphertext; bentness also implies other cryptographic weaknesses. But bent functions can be involved in the substitution boxes (S-boxes) of block ciphers, whose role is also to bring some amount of nonlinearity (allowing to resist the differential and linear attacks), and the study of bent functions and those of Boolean functions for stream ciphers and of S-boxes for block ciphers are closely related.

Bent functions are involved in codes such as the Kerdock codes (see Sect. 3.4). They are also related to combinatorics (e.g., difference sets; see Sect. 2.2.1), design theory (any difference set can be used to construct a symmetric design), and sequence theory (see [16]).

Bent functions have been studied in numerous papers. A survey on Boolean bent functions is given in [11, Sect. 8.6] (and complements on non-binary bent functions, that we do not address here, can be found in [56]). The purpose of this chapter is to complete this survey on Boolean bent functions with results which appeared after the publication of [11] (and with a few original results) and to focus on open problems.

2 Boolean Bent Functions: Definitions and Basic Results

2.1 Representations of Affine Boolean Functions

Affine Boolean functions (i.e., sums of linear functions and constants) over \(\mathbb{F}_{2}^{n}\) can be written in multivariate representation, that is, writing the input x as a vector \((x_{1},\ldots,x_{n})\) of \(\mathbb{F}_{2}^{n}\), in the form
$$\displaystyle{a_{1}\,x_{1} + \cdots + a_{n}\,x_{n}+\epsilon = a \cdot x +\epsilon \text{ (sums mod 2)}}$$
for some \(a = (a_{1},\ldots,a_{n}) \in \mathbb{F}_{2}^{n},\,\epsilon \in \mathbb{F}_{2}\).
Other representations exist. The vector space \(\mathbb{F}_{2}^{n}\) can be endowed with the structure of the field \(\mathbb{F}_{2^{n}}\) (since we know that this field is an n-dimensional vector space over \(\mathbb{F}_{2}\)). This allows to use the trace function \(\mathrm{Tr}_{1}^{n}(x) = x + x^{2} + x^{2^{2} } + \cdots + x^{2^{n-1} }\) as a basic linear form over \(\mathbb{F}_{2^{n}}\), and any affine function of \(x \in \mathbb{F}_{2^{n}}\) can then be written in the so-called univariate trace representation:
$$\displaystyle{\mathrm{Tr}_{1}^{n}(\mathit{ax})+\epsilon \;;\,a \in \mathbb{F}_{ 2^{n}},\,\epsilon \in \mathbb{F}_{2}\text{ (sum mod 2)}.}$$
The multivariate and univariate trace representations are at two opposite extremes. A representation which is intermediate and happens to be important in the framework of bent functions is the bivariate trace representation. For n even, we identify \(\mathbb{F}_{2}^{n}\) with \(\mathbb{F}_{2^{n/2}} \times \mathbb{F}_{2^{n/2}}\), and every affine Boolean function of \((x,y) \in \mathbb{F}_{2^{n/2}} \times \mathbb{F}_{2^{n/2}}\) can then be expressed as
$$\displaystyle{\mathrm{Tr}_{1}^{n/2}(\mathit{ax} + \mathit{ay})+\epsilon \;;\,a,b \in \mathbb{F}_{ 2^{n/2}},\,\epsilon \in \mathbb{F}_{2}\text{ (sum mod 2)}.}$$

2.2 Corresponding Expressions for the Walsh Transform of Boolean Functions, Nonlinearity, and Bentness

The Walsh transform of a Boolean function calculates the correlations between the function and linear Boolean functions.

In multivariate representation, that is, over \(\mathbb{F}_{2}^{n}\), it can be expressed as
$$\displaystyle{\widehat{\chi _{f}}(a) =\sum _{x\in \mathbb{F}_{2}^{n}}(-1)^{f(x)+a\cdot x};\;a \in \mathbb{F}_{ 2}^{n}(\text{sum in }\mathbb{Z}),}$$
where “⋅ ” is an inner product in \(\mathbb{F}_{2}^{n}\) (for instance, we can take the usual inner product, introduced in Sect. 2.1).
In univariate trace representation (over \(\mathbb{F}_{2^{n}}\)), we take
$$\displaystyle{\widehat{\chi _{f}}(a) =\sum _{x\in \mathbb{F}_{2^{n}}}(-1)^{f(x)+\mathrm{Tr}_{1}^{n}(\mathit{ax}) };\;a \in \mathbb{F}_{2^{n}}.}$$
In bivariate trace representation (over \(\mathbb{F}_{2^{m}} \times \mathbb{F}_{2^{m}}\); m = n∕2), we take:
$$\displaystyle{\widehat{\chi _{f}}(a,b) =\sum _{x,y\in \mathbb{F}_{2^{m}}}(-1)^{f(x,y)+\mathrm{Tr}_{1}^{m}(\mathit{ax}+\mathit{by}) }.}$$
The Hamming distance between two functions equals by definition the Hamming weight of their difference (i.e., their sum):
$$\displaystyle{d_{H}(f,g) = w_{H}(f + g) = \vert \{x \in \mathbb{F}_{2}^{n}\,/\,f(x)\neq g(x)\}.}$$
The nonlinearity nl(f) of a Boolean function f equals by definition the minimum Hamming distance between f and affine functions. It is a simple matter to show that
$$\displaystyle{\mathit{nl}(f) = 2^{n-1} -\frac{1} {2}\max _{a\in \mathbb{F}_{2}^{n}}\,\vert \widehat{\chi _{f}}(a)\vert }$$
(note that this equality is valid whatever is the choice of the inner product “⋅ ”). Because of the easily proved Parseval relation
$$\displaystyle{\sum _{a\in \mathbb{F}_{2}^{n}}\widehat{\chi _{f}}^{2}(a) = 2^{2n},}$$
the mean of \(\widehat{\chi _{f}}^{2}(a)\), equals 2n and this implies the so-called covering radius bound:
$$\displaystyle{\mathit{nl}(f) \leq 2^{n-1} - 2^{n/2-1}.}$$
The bound is tight for every even n; the functions achieving it with equality are called bent; the Walsh transforms of bent functions take values ± 2n∕2, only. The dual\(\tilde{f}\) of a bent function f is the function defined on \(\mathbb{F}_{2}^{n}\) by
$$\displaystyle{\widehat{\chi _{f}}(u) = 2^{m}(-1)^{\tilde{f}(u)},u \in \mathbb{F}_{ 2}^{n},\,m = n/2.}$$
It is also a bent function, and the mapping \(f\mapsto \tilde{f}\) is an isometry [11]. Bounds involving the algebraic degrees of bent functions (see definition below) and their duals and relations between the degree n∕2 terms in the algebraic normal form (ANF, see also below) of bent functions and their duals are recalled in [11]. Self-dual bent functions are studied in [21].

2.2.1 Characterizations of Bent Functions

  • Any Boolean function f is bent if and only if for any nonzero vector a, the so-called derivative Daf(x) = f(x) + f(x + a) (sum mod 2) is balanced (i.e., has Hamming weight 2n−1 or equivalently satisfies \(\sum _{x\in \mathbb{F}_{2}^{n}}(-1)^{D_{a}f(x)} = 0\)) [59], since we have \(\sum _{a\in \mathbb{F}_{2}^{n}}\left ((-1)^{a\cdot b}\sum _{x\in \mathbb{F}_{2}^{n}}(-1)^{D_{a}f(x)}\right ) =\widehat{\chi _{f}}^{2}(b)\) and \(\sum _{b\in \mathbb{F}_{2}^{n}}\widehat{\chi _{f}}^{2}(b)(-1)^{a\cdot b} = 2^{n}\sum _{x\in \mathbb{F}_{2}^{n}}(-1)^{D_{a}f(x)}\). The fact that \(\sum _{b\in \mathbb{F}_{2}^{n}}(-1)^{a\cdot b}\) equals 2n if a = 0 and is null otherwise completes the proof of the equivalence.

    Bent functions are also called perfect nonlinear and are equivalently the indicators of difference sets in elementary Abelian 2-groups [28].

  • An n-variable Boolean function f is bent if and only if \(\sum _{a\in \mathbb{F}_{2}^{n}}\widehat{\chi _{f}}^{4}(a)\) equals 23n (which, by the Cauchy–Schwarz inequality and the Parseval relation, is the minimum possible value).

  • It is shown in [11] that:

Theorem 1

A pair of n-variable Boolean functions f and fsatisfies, for every\(a,b \in \mathbb{F}_{2}^{n}\), the relation\(\sum _{x\in \mathbb{F}_{2}^{n}}(-1)^{D_{a}f^{{\prime}}(x)+b\cdot x } =\sum _{x\in \mathbb{F}_{2}^{n}}(-1)^{D_{b}f(x)+a\cdot x}\)if and only if f and fare bent and are the duals of each other, up to the addition of constant 1. Moreover, for any bent function f, we have\(\sum _{x\in \mathbb{F}_{2}^{n}}(-1)^{D_{a}\tilde{f}(x)+b\cdot x} =\sum _{x\in \mathbb{F}_{ 2}^{n}}(-1)^{D_{b}f(x)+a\cdot x} = 0\)when a ⋅ b = 1.

  • For n-variable Boolean functions f and f, we have \(\sum _{x,y\in \mathbb{F}_{2}^{n}}(-1)^{f(x)+f^{{\prime}}(y)+x\cdot y } = 2^{-n}\sum _{x,y,z\in \mathbb{F}_{2}^{n}}(-1)^{f(x)+(x+z)\cdot y}\widehat{\chi _{f^{{\prime}}}}(z) =\sum _{x\in \mathbb{F}_{2}^{n}}(-1)^{f(x)}\widehat{\chi _{f^{{\prime}}}}(x) \leq \sum _{x\in \mathbb{F}_{2}^{n}}\vert \widehat{\chi _{f^{{\prime}}}}(x)\vert \leq \sqrt{2^{n } \sum _{x\in \mathbb{F}_{2 }^{n } } \widehat{\chi _{f^{{\prime} } } }^{2 } (x)} = 2^{3n/2}\), and this bound \(\sum _{x,y\in \mathbb{F}_{2}^{n}}(-1)^{f(x)+f^{{\prime}}(y)+x\cdot y } \leq 2^{3n/2}\) is achieved with equality if and only if both inequalities above are equalities, that is, if and only if \(\vert \widehat{\chi _{f^{{\prime}}}}(x)\vert\) is constant and (−1)f(x) is the sign of \(\widehat{\chi _{f^{{\prime}}}}(x)\) for every x, that is, if and only if f is bent and \(\widetilde{f^{{\prime}}} = f\). This gives one more characterization of bent functions:

Theorem 2

For every pair of n-variable Boolean functions f and f, we have
$$\displaystyle{\sum _{x,y\in \mathbb{F}_{2}^{n}}(-1)^{f(x)+f^{{\prime}}(y)+x\cdot y } \leq 2^{3n/2},}$$
with equality if and only if f and fare bent and are the duals of each other.

In particular, a Boolean function f is bent and self-dual if and only if the so-called Rayleigh quotient\(\sum _{x,y\in \mathbb{F}_{2}^{n}}(-1)^{f(x)+f(y)+x\cdot y}\) equals 23n∕2; this particular result was given in [21], but as far as we know, the general characterization of Theorem 2 is new. It has the interest of characterizing bent functions with a single character sum.

More characterizations are given in [11].

2.2.2 Number of Bent Functions

The number of bent functions is known only for n ≤ 8 [43]. For larger values of n, only bounds are known. In particular, an upper bound exists [11, 17]. Comparing the bound and the actual value for n = 8 shows that the bound is weak (but it could not be improved during the last 10 years).

Open Problem 1:

Bound more efficiently the number of n-variable bent functions (i.e., improve upon the bound of [17]).

2.2.3 Other Properties

We shall not list here all the properties of bent functions. We refer to the survey [11], in particular for the relationship with the sum-of-square indicator, with nonhomomorphicity, with codes, for the description of super-classes of Boolean functions and of bent sequences and for normal extensions of bent functions.

2.3 Equivalence of Boolean Functions

It seems elusive to determine all bent functions. This has been done for n ≤ 8 only, and doing it for n = 8 was a difficult work [43]. An important subject of research is then to find constructions of bent functions leading to infinite classes of bent functions, or to find directly such infinite classes, after computer investigation. When a class is obtained, it remains to see if at least some of its elements are really new. Indeed, given a bent function, some simple transformations allow to obtain other bent functions; we say then that the known function and the functions we can obtain from it are equivalent (when the correspondence results in an equivalence relation); an infinite class is new if some of its elements are inequivalent to all previously known bent functions. We describe now the relevant notions of equivalence for bent functions.

The automorphism group of the set of bent functions
$$\displaystyle{\{\sigma \text{ permutation of }\mathbb{F}_{2}^{n}\text{ s.t.}f \circ \sigma \text{ bent, }\forall f\text{ bent }\}}$$
is the general affine group: σ(x) = x × A + a (A invertible matrix over \(\mathbb{F}_{2}\)) [11]. Two functions f and fσ are then called affinely equivalent (and f(x) and f(x × A) are called linearly equivalent).

If f is bent and is affine, then f + is bent (sum mod 2). Two functions f and fσ + are called EA-equivalent, and a class of bent functions is called complete if it is globally invariant under EA-equivalence. The completed version of a class is the set of all functions EA-equivalent to the functions in the class.

Another notion of equivalence called CCZ-equivalence [3, 20] exists and is more general than EA-equivalence for vectorial functions, but it is known from [1, 2] that for Boolean functions and for bent (Boolean or vectorial) functions, CCZ-equivalence coincides with EA-equivalence.

Note that X.-D. Hou and P. Langevin have made an observation reported in [11] showing that under some condition on a permutation σ, composing a bent function with σ may give another bent function. But this cannot be viewed as an equivalence since the condition on σ is hard to achieve.

2.4 Representations of Boolean Functions

Each representation of affine functions generalizes to a representation of general Boolean functions, useful for studying bent functions.

2.4.1 Multivariate Representation

Any Boolean function \(f: \mathbb{F}_{2}^{n}\mapsto \mathbb{F}_{2}\) has a unique ANF:
$$\displaystyle{f(x_{1},\ldots,x_{n}) =\sum _{I\subseteq \{1,\ldots,n\}}a_{I}\,\left (\prod _{i\in I}x_{i}\right ),\;a_{I} \in \mathbb{F}_{2}\text{ (sum mod 2)}.}$$

The algebraic degree of a Boolean function f is the global degree of its ANF. The r th-order Reed-Muller code of length 2n equals by definition the set of n-variable Boolean functions (identified with binary vectors of length 2n) of algebraic degrees at most r.

An important property of bent functions is that their algebraic degrees are bounded above by n∕2 [59].

A function f is called quadratic if it has algebraic degree 2, cubic if it has algebraic degree 3. We are able to characterize the ANF of bent functions only for quadratic functions: a quadratic Boolean function is bent if and only if it is affinely equivalent to \(x_{1}x_{2} + x_{3}x_{4} + \cdots + x_{n-1}x_{n}\) or \(x_{1}x_{2} + x_{3}x_{4} + \cdots + x_{n-1}x_{n} + 1\). Another characterization exists: according to the first result recalled in Sect. 2.2.1 and since all derivatives of a quadratic function are affine and are then balanced if and only if they are nonconstant, any quadratic function f is bent if and only if the so-called linear kernel of f, equal to the set of elements a such that Daf is constant, equals {0}. See more in [11].

Another representation of Boolean functions called the numerical normal form (NNF) and a related notion of degree called numerical degree exist (see the details in [11]), allowing characterizing bent functions. As far as we know, no recent result has been found on this relationship.

Open Problem 2:

The following question is posed by Tokareva in [63]: do the sums of two bent functions cover all Boolean functions of algebraic degrees at most n∕2? Intuitively, the reply to this question would seem negative, for general n. However, the reply is shown by Tokareva to be yes for n = 4, 6 and for several classes of bent functions; it seems difficult to prove that the reply is no, in general: the usual parameters and properties of Boolean functions (ANF, NNF and numerical degree, generalized degree, divisibility of the Fourier transform or of the coefficients of the NNF, other properties of the Fourier or Walsh transform values) do not seem to allow discriminating sums of two bent functions from other Boolean functions of degrees at most n∕2. Note that a positive reply to Tokareva’s question would automatically imply a lower bound on the number of bent functions.

2.4.2 Univariate and Bivariate Representations: Trace Representations

Every function from \(\mathbb{F}_{2^{n}}\) to \(\mathbb{F}_{2^{n}}\) has a unique univariate representation
$$\displaystyle{ f(x) =\sum _{ j=0}^{2^{n}-1 }a_{j}\;x^{j};\quad a_{ j},\,x \in \mathbb{F}_{2^{n}} }$$
(1)
since the mapping \(\sum _{j=0}^{2^{n}-1 }a_{j}\;X^{j}\mapsto \sum _{j=0}^{2^{n}-1 }a_{j}\;x^{j}\) from polynomials to functions is linear injective and therefore bijective.
Function f is Boolean if and only if:
$$\displaystyle{a_{0},a_{2^{n}-1} \in \mathbb{F}_{2}\text{ and }a_{2j} = (a_{j})^{2},\forall j \in \mathbb{Z}/(2^{n} - 1)\mathbb{Z}\setminus \{0\}.}$$
The univariate representation can then be written as a trace representation:
$$\displaystyle{ f(x) =\sum _{j\in \Gamma _{n}}\mathrm{Tr}_{1}^{o(j)}(a_{ j}x^{j}) + a_{ 2^{n}-1}x^{2^{n}-1 }, }$$
(2)
where:
  • \(a_{2^{n}-1} \in \mathbb{F}_{2}\) equals the Hamming weight of f modulo 2,

  • \(\Gamma _{n}\) is the set of integers obtained by choosing one element in each cyclotomic coset of 2 mod 2n − 1,

  • o(j) is the size of the cyclotomic coset containing j,

  • and \(a_{j} \in \mathbb{F}_{2^{o(j)}}\).

In both univariate and trace representations (1), resp. (2), the algebraic degree equals: \(\max \{w_{2}(j);\;j\,\vert \,a_{j}\neq 0\},\) where w2(j) is the Hamming weight of the binary expansion of j [11] (in particular, the univariate trace representation of a bent function does not involve the term \(x^{2^{n}-1 }\)).

We have also \(f(x) = \mathrm{Tr}_{1}^{n}(P(x))\) for some polynomial P(x), but this representation is not unique and does not allow a general (simple) expression for the algebraic degree.

The bivariate representation is based on the identification \(\mathbb{F}_{2}^{n} \approx \mathbb{F}_{2^{m}} \times \mathbb{F}_{2^{m}}\) and has the form:
$$\displaystyle{ f(x,y) =\sum _{0\leq i,j\leq 2^{m}-1}a_{i,j}x^{i}y^{j};\;a_{ i,j} \in \mathbb{F}_{2^{n}}. }$$
(3)
The existence of such representation for every function from \(\mathbb{F}_{2^{m}} \times \mathbb{F}_{2^{m}}\) to \(\mathbb{F}_{2^{n}}\) and the values of the coefficients ai, j in (3) can be derived from the univariate representation: choosing a basis (α, β) of \(\mathbb{F}_{2^{n}}\) over \(\mathbb{F}_{2^{m}}\) allows to express the input of f in the form α x +β y, and expanding (α x +β y)i in (1) gives (3) after reduction modulo \(x^{2^{m} } + x\) and \(y^{2^{m} } + y\). The uniqueness comes from the fact that the number of polynomials (3) equals the number \((2^{n})^{2^{m}\times 2^{m} }\) of functions from \(\mathbb{F}_{2^{m}} \times \mathbb{F}_{2^{m}}\) to \(\mathbb{F}_{2^{n}}\) and that a surjective mapping from a finite set to a set of the same size is a bijection.

The function is Boolean if and only if the expression \((\sum _{0\leq i,j\leq 2^{m}-1}a_{i,j}x^{i}y^{j})^{2}\) equals \(\sum _{0\leq i,j\leq 2^{m}-1}a_{i,j}x^{i}y^{j}\) in the quotient algebra \(\mathbb{F}_{2^{n}}[x,y]/(x^{2^{m} } + x,y^{2^{m} } + y)\), that is, if ai, j2 = a2i, 2j for every (i, j), where 2i (resp. 2j) is replaced by 2i − (2m − 1) if 2i ≥ m (resp. if 2j ≥ m).

This condition implies in particular that \(a_{i,j}^{2^{m} } = a_{i,j}\), that is, \(a_{i,j} \in \mathbb{F}_{2^{m}}\) (which can be directly deduced from \((\sum _{0\leq i,j\leq 2^{m}-1}a_{i,j}x^{i}y^{j})^{2} \equiv \sum _{0\leq i,j\leq 2^{m}-1}a_{i,j}x^{i}y^{j}\) [mod \((x^{2^{m} } + x,y^{2^{m} } + y)\)]).

It also implies that the bivariate representation of any Boolean function over \(\mathbb{F}_{2^{m}} \times \mathbb{F}_{2^{m}}\) can be written in bivariate trace representation:
$$\displaystyle\begin{array}{rcl} f(x,y)& =& \sum _{(i,j)\in \Gamma _{m}^{{\prime}}}\mathrm{Tr}_{1}^{o(i,j)}(a_{ i,j}x^{i}y^{j}) + x^{2^{m}-1 }\sum _{j\in \Gamma _{m}}\mathrm{Tr}_{1}^{o(j)}(a_{ 2^{m}-1,j}y^{j}) \\ & & +y^{2^{m}-1 }\sum _{i\in \Gamma _{m}}\mathrm{Tr}_{1}^{o(i)}(a_{ i,2^{m}-1}x^{i}) + a_{ 2^{m}-1,2^{m}-1}x^{2^{m}-1 }y^{2^{m}-1 },{}\end{array}$$
(4)
where:
  • \(a_{2^{m}-1,2^{m}-1} \in \mathbb{F}_{2}\) equals the Hamming weight of f modulo 2,

  • \(\Gamma _{m}^{{\prime}}\) is a set obtained by choosing one ordered pair in each cyclotomic class of 2 modulo 2m − 1 in \(\{0,\ldots,2^{m} - 2\} \times \{ 0,\ldots,2^{m} - 2\}\),

  • \(\Gamma _{m}\) is a set obtained by choosing one element in each cyclotomic coset of 2 modulo 2m − 1 (in \(\{0,\ldots,2^{m} - 2\}\)),

  • o(i, j) is the size of the equivalence class containing (i, j), and o(i) is the size of the cyclotomic coset containing i,

  • and \(a_{i,j} \in \mathbb{F}_{2^{o(i,j)}}\), \(a_{j} \in \mathbb{F}_{2^{o(j)}}\).

The algebraic degree of f(x, y) equals \(\max _{(i,j)\,\vert \,a_{i,j}\neq 0}(w_{2}(i) + w_{2}(j))\) in (3) and (4). In particular, the bivariate trace representation of a bent function does not involve any of the terms \(x^{2^{m}-1 }y^{2^{m}-1 }\), \(y^{2^{m}-1 }\mathrm{Tr}_{1}^{o(i)}(a_{i,2^{m}-1}x^{i})\), i ≠ 0 and \(x^{2^{m}-1 }\mathrm{Tr}_{1}^{o(j)}(a_{2^{m}-1,j}y^{j})\), j ≠ 0).

As in the case of univariate representation, the simpler representation \(f(x,y) = \mathrm{Tr}_{1}^{m}(P(x,y))\) (where P(x, y) is a polynomial over \(\mathbb{F}_{2^{m}}\)) exists but is not unique.

3 Known Infinite Classes of Boolean Bent Functions

In all the rest of this chapter, n is even and we denote n∕2 by m.

3.1 Basic Constructions in Multivariate Representation

In the Maiorana–McFarland (MM) construction, the input is represented in the form (x, y) where \(x,y \in \mathbb{F}_{2}^{m}\). Given \(\pi: \mathbb{F}_{2}^{m}\mapsto \mathbb{F}_{2}^{m}\) and \(g: \mathbb{F}_{2}^{m}\mapsto \mathbb{F}_{2}\), the function:
$$\displaystyle{f(x,y) = x \cdot \pi (y) + g(y);\;x,y \in \mathbb{F}_{2}^{m}}$$
is bent if and only if π is a permutation on \(\mathbb{F}_{2}^{m}\).

The dual function equals: \(\tilde{f}(x,y) = y \cdot \pi ^{-1}(x) + g(\pi ^{-1}(x))\).

The truth table of an MM function is the concatenation of the truth tables of the affine functions \(x\mapsto x \cdot \pi (y) + g(y)\) (in m variables). Completed MM class is the widest known class of bent functions. It covers all bent functions for n ≤ 6 and all quadratic bent functions; but, for n = 8, it has size negligible with respect to all bent functions.

Generalizations of MM construction (see [11]):
  • MM class has been modified by the addition of indicators of flats

  • it has been generalized in diverse ways:
    • concatenations of quadratic functions,

    • concatenations of indicators of flats,

    • more complex concatenations (these constructions are more efficient for designing resilient functions than bent functions, though),

  • it has also been generalized into a secondary construction (see Sect. 4).

  • A construction including MM and PSap (see below) was given by Dobbertin.

3.2 Known Infinite Classes of Bent Functions in Univariate Trace Form

We list these known classes:
  • \(f(x) = \mathrm{Tr}_{1}^{n}\left (\mathit{ax}^{2^{j}+1 }\right )\), where \(a \in \mathbb{F}_{2^{n}}\setminus \{x^{2^{j}+1 };\,x \in \mathbb{F}_{2^{n}}\}\), \(\frac{n} {\gcd (j,n)}\) even (the bentness of such function is directly deduced from the characterization recalled above of bent quadratic functions). This class has been generalized by Yu and Gong in [65] to functions of the form \(\mathrm{Tr}_{1}^{n}(\sum _{i=1}^{m-1}a_{i}x^{2^{i}+1 }) + c_{m}Tr_{1}^{m}(a_{m}x^{2^{m}+1 })\). Being quadratic, these functions belong to the completed MM class.

  • \(f(x) = \mathrm{Tr}_{1}^{n}\left (\mathit{ax}^{2^{2j}-2^{j}+1 }\right )\), where \(a \in \mathbb{F}_{2^{n}}\setminus \{x^{3};\,x \in \mathbb{F}_{2^{n}}\}\), gcd(j, n) = 1 [29].

  • \(f(x) = \mathrm{Tr}_{1}^{n}\left (\mathit{ax}^{(2^{n/4}+1)^{2} }\right ),\) where n ≡ 4 [mod 8], \(a = a^{{\prime}}b^{(2^{n/4}+1)^{2} }\), \(a^{{\prime}}\in w\mathbb{F}_{2^{n/4}}\), \(w \in \mathbb{F}_{4}\setminus \mathbb{F}_{2}\), \(b \in \mathbb{F}_{2^{n}}\) (Leander [44], see also [24]); the functions in this class belong to the completed MM class.

  • \(f(x) = \mathrm{Tr}_{1}^{n}\left (\mathit{ax}^{2^{n/3}+2^{n/6}+1 }\right )\), where 6 | n, \(a = a^{{\prime}}b^{2^{n/3}+2^{n/6}+1 }\), \(a^{{\prime}}\in \mathbb{F}_{2^{m}}\), \(\mathrm{Tr}_{m/3}^{m}(a^{{\prime}}) = 0\), \(b \in \mathbb{F}_{2^{n}}\) [6]; the functions in this class belong to the completed MM class.

  • \(f(x) = \mathrm{Tr}_{1}^{n}\left (a[x^{2^{i}+1 } + (x^{2^{i} } + x + 1)\mathrm{Tr}_{1}^{n}(x^{2^{i}+1 })]\right )\), where n ≥ 6, m does not divide i, \(\frac{n} {\gcd (i,n)}\) even, \(a \in \mathbb{F}_{2^{n}}\setminus \mathbb{F}_{2^{i}}\), \(\{a,a + 1\} \cap \{ x^{2^{i}+1 };\,x \in \mathbb{F}_{2^{n}}\} = \varnothing\) [2]. These functions belong to the completed MM class when \(a \in \mathbb{F}_{2^{m}}\).

  • \(f(x) = \mathrm{Tr}_{1}^{n}\big(a\big[\big(x + \mathrm{Tr}_{3}^{n}\big(x^{2(2^{i}+1) } + x^{4(2^{i}+1) }\big)\)

    \(+\mathrm{Tr}_{1}^{n}(x)\mathrm{Tr}_{3}^{n}\big(x^{2^{i}+1 } + x^{2^{2i}(2^{i}+1) }\big)\big)^{2^{i}+1 }\big]\big)\), where 6 | n, m does not divide i, \(\frac{n} {\gcd (i,n)}\) even, \(b + d + d^{2}\not\in \{x^{2^{i}+1 };\,x \in \mathbb{F}_{2^{n}}\}\) for every \(d \in \mathbb{F}_{2^{3}}\) [2]. These functions are EA-inequivalent to functions in MM.

  • Niho bent functions [31] whose restrictions to the cosets \(u\mathbb{F}_{2^{m}}\) are linear. These functions can be written:
    $$\displaystyle{f(x) = \mathrm{Tr}_{1}^{m}(\mathit{ax}^{2^{m}+1 }) + \mathrm{Tr}_{1}^{n}(bx^{d});\;b = 0\text{ or }a = b^{2^{m}+1 } \in \mathbb{F}_{2^{m}}^{\star }.}$$
    The values of d are such that:
    1. 1.

      d = (2m − 1) 3 + 1 (the original condition \(\exists u \in \mathbb{F}_{2^{n}}\,s.t.\,b = u^{5}\) if m ≡ 2 [mod 4] has been shown not useful by Helleseth–Kholosha–Mesnager [40]),

       
    2. 2.

      \(d = (2^{m} - 1)\frac{1} {4} + 1\) (m odd),

       
    3. 3.

      \(d = (2^{m} - 1)\frac{1} {6} + 1\) (m even).

       

    Classes 1 and 3 are not EA-equivalent to MM functions [5]. Class 2 is in completed MM class. In classes 1 (for m ≢ 2 [mod 4]), 2, and 3, we can up to EA-equivalence fix b = 1.

    Extension of the second class [45]:
    $$\displaystyle{\mathrm{Tr}_{1}^{m}(x^{2^{m}+1 }) + \mathrm{Tr}_{1}^{n}\big(\sum _{ i=1}^{2^{r-1}-1 }t^{s_{i} }\big),}$$
    where
    • r > 1 and gcd(r, m) = 1,

    • \(s_{i} = (2^{m} - 1)\left ( \frac{i} {2^{r}}[\mod 2^{m} + 1]\right ) + 1\), \(i \in \{ 1,\ldots,2^{r-1} - 1\}\).

  • Dillon’s and generalized Dillon’s functions [23, 28, 46]: let gcd(r, 2m + 1) = 1 and \(a \in \mathbb{F}_{2^{n}}^{{\ast}}\), then
    $$\displaystyle{f(x) = \mathrm{Tr}_{1}^{n}(\mathit{ax}^{r(2^{m}-1) })}$$
    is bent if and only if
    $$\displaystyle{K(a^{2^{m}+1 }) = 0,}$$
    where \(K(u) =\sum _{x\in \mathbb{F}_{2^{m}}}\mathrm{Tr}_{1}^{m}\left (ux + \frac{1} {x}\right )\), \(u \in \mathbb{F}_{2^{m}}\), is a Kloosterman sum.
    This class has been generalized to functions:
    $$\displaystyle\begin{array}{rcl} & \mathrm{Tr}_{1}^{n}\left (\sum _{r\in R}a_{r}x^{r(2^{m}-1) }\right ), & {}\\ &\mathrm{Tr }_{1 }^{n }\left (\mathit{ax}^{r(2^{m}-1) } + \mathit{bx}^{\left (\frac{q+1} {e} -l\right )(2^{m}-1) } + cx^{\left (\frac{q+1} {e} +l\right )(2^{m}-1) }\right ) + \mathrm{Tr}_{1}^{\ell}\left (\epsilon x^{\frac{2^{n}-1} {e} }\right ),& {}\\ & \mathrm{Tr}_{1}^{n}\left (\sum _{i\in D}\mathit{ax}^{(ri+s)(2^{m}-1) }\right ) + \mathrm{Tr}_{1}^{\ell}\left (\epsilon x^{\frac{2^{n}-1} {e} }\right ), & {}\\ \end{array}$$
    where  | n and e | 2 − 1.

    Two explicit classes are given in [37]: \(\sum _{i=1}^{2^{m-1}-1 }\mathrm{Tr}_{1}^{n}\left (\beta x^{i(2^{m}-1) }\right )\), where \(\beta \in \mathbb{F}_{2^{m}}\setminus \mathbb{F}_{2}\) and \(\sum _{i=1}^{2^{m-2}-1 }\mathrm{Tr}_{1}^{n}\left (\beta x^{i(2^{m}-1) }\right )\), where m is odd, \(\beta \in \mathbb{F}_{2^{m}}^{{\ast}}\), \(\mathrm{Tr}_{1}^{m}\left (\beta ^{(2^{m}-4)^{-1} }\right ) = 0\).

  • Mesnager’s functions [52, 53]: let \(\gcd (r,2^{m} + 1) = 1;\;m\text{ odd }> 3;\;a \in \mathbb{F}_{2^{n}}^{{\ast}},b \in \mathbb{F}_{2^{2}}^{{\ast}}\), then
    $$\displaystyle{f(x) = \mathrm{Tr}_{1}^{n}(\mathit{ax}^{r(2^{m}-1) }) + \mathrm{Tr}_{1}^{2}(\mathit{bx}^{\frac{2^{n}-1} {3} })}$$
    is bent if and only if
    $$\displaystyle{K(a^{2^{m}+1 }) = 4.}$$

    This class can be extended to the case m even, but no necessary and sufficient condition is known in this case.

    Generalizations exist by Mesnager [51] and Mesnager–Flori [55] to functions using trace functions in other subfields, including the class of functions \(f(x) = \mathrm{Tr}_{1}^{n}(\mathit{ax}^{r(2^{m}-1) }) + \mathrm{Tr}_{1}^{4}(\mathit{bx}^{\frac{2^{n}-1} {5} })\).

Open Problem 3:

Characterize the cases of bentness for Mesnager’s functions when m is even.

  • Mesnager’s functions, second class [50]: let m odd, \(a \in \mathbb{F}_{2^{n}}^{{\ast}},b \in \mathbb{F}_{2^{2}}^{{\ast}}\), then
    $$\displaystyle{f(x) = \mathrm{Tr}_{1}^{n}(\mathit{ax}^{3(2^{m}-1) }) + \mathrm{Tr}_{1}^{2}(\mathit{bx}^{\frac{2^{n}-1} {3} })}$$
    is bent if and only if \(m\not\equiv 3\text{ [mod 6] and }\Big(\mathrm{Tr}_{1}^{m}(a^{\frac{2^{m}+1} {3} }) = 0\text{ and }K\Big(a^{2^{m}+1 }\Big) = 4\Big)\text{ or }\Big(\mathrm{Tr}_{1}^{m}(a^{\frac{2^{m}+1} {3} }) = 1\text{ and }a\not\in \mathbb{F}_{2^{m}}\text{ and }K\Big(a^{2^{m}+1 }\Big)+C\Big(a^{2^{m}+1 }\Big) = 4\Big),\) where \(C(u) =\sum _{x\in \mathbb{F}_{2^{m}}}\mathrm{Tr}_{1}^{m}\left (u(x^{3} + x)\right )\).
  • Finally, bent functions have been also obtained by Dillon and McGuire [30] as the restrictions of functions on \(\mathbb{F}_{2^{n+1}}\), with n + 1 odd, to a hyperplane of this field: these functions are the Kasami functions \(\mathit{tr}_{n}\left (x^{2^{2k}-2^{k}+1 }\right )\), and the hyperplane has equation trn(x) = 0. The restriction is bent under the condition that n + 1 = 3k ± 1.

Remark 1

These classes are small for each n. Moreover, many of them belong to completed MM class, when viewed in multivariate representation, and their bentness may then seem easily explained. However, finding bent functions in univariate trace form is in general difficult and presents theoretical interest, since it gives more insight on bent functions. Note also that the output to such functions is often faster to compute thanks to their particular form.

Open Problem 4:

find more univariate classes. It has been checked that all monomial bent functions \(\mathrm{Tr}_{1}^{n}(\mathit{ax}^{i})\) are covered by the four first classes of bent functions described above and by Dillon’s class for n ≤ 20.

3.3 Known Infinite Classes of Bent Functions in Bivariate Trace Form

  • MM class can be viewed in bivariate form. Its elements are the functions \(f(x,y) = \mathrm{Tr}_{1}^{m}(x\,\pi (y)) + g(y);\;x,y \in \mathbb{F}_{2^{m}}\), where π is a permutation on \(\mathbb{F}_{2^{m}}\).

  • Dillon’s PSapclass: \(f(x,y) = g(\mathit{xy}^{2^{m}-2 }) = g\left (\frac{x} {y}\right )\), where g is any balanced Boolean function on \(\mathbb{F}_{2^{m}}\). The dual equals \(g\left (\frac{y} {x}\right )\).

    This class is much larger than the classes above but much smaller than the MM class. It contains, up to EA-equivalence, the generalized Dillon’s functions and the Mesnager functions. The functions in this class are, when viewed in univariate form, those bent functions whose restrictions to the cosets \(u\mathbb{F}_{2^{m}}^{{\ast}}\) are constant. They are hyperbent: f(xs) is bent for every s co-prime with 2n − 1 (see more in [14, 64] on hyperbent functions).

Open Problem 5:

Find hyperbent functions EA-inequivalent to PSap functions in more than 4 variables (a sporadic example exists in 4 variables [14]).

PSap class is included in the more general Dillon’s PS class (see [28]), which has itself been generalized to the GPS class (see [11]), which covers all bent functions up to EA-equivalence [38].

  • An isolated class [11]: \(f(x,y) = \mathrm{Tr}_{1}^{m}(x^{2^{i}+1 } + y^{2^{i}+1 } + \mathit{xy})\), \(x,y \in \mathbb{F}_{2^{m}}\), where n is co-prime with 3 and i is co-prime with m.

  • Functions related to Dillon’s H class and o-polynomials: In his thesis [28], J. Dillon had introduced several classes of functions. Some of these classes were merely constructions since the functions in them needed to satisfy some conditions difficult to achieve. One of such classes was class H, whose elements had linear restrictions to the lines through the origin of the \(\mathbb{F}_{2^{m}}\)-vector space \(\mathbb{F}_{2^{m}} \times \mathbb{F}_{2^{m}}\). J. Dillon had not found inside it functions which were not already in previously defined classes. More than 35 years later, the condition for a function to be in class H was connected with a classical notion in finite geometry.

Definition 1

Let m be any positive integer. A permutation polynomial G over \(\mathbb{F}_{2^{m}}\) is called an o-polynomial if, for every \(\gamma \in \mathbb{F}_{2^{m}}\), the function \(z \in \mathbb{F}_{2^{m}}\mapsto \left \{\begin{array}{l} \frac{G(z+\gamma )+G(\gamma )} {z} \text{ if }z\neq 0\\ 0\text{ if } z = 0 \end{array} \right.\) is a permutation.

Theorem 3 ([18])

Any Boolean function of the form
$$\displaystyle{g(x,y) = \left \{\begin{array}{l} \mathrm{Tr}_{1}^{m}\left (xH\left (\frac{y} {x}\right )\right )\text{ if }x\neq 0 \\ \mathrm{Tr}_{1}^{m}(\mu y)\text{ if }x = 0 \end{array} \right.,}$$
that is, having linear restrictions to the lines through the origin of the two-dimensional vector space\(\mathbb{F}_{2^{m}} \times \mathbb{F}_{2^{m}}\), is bent if and only if G(z):= H(z) + μz is an o-polynomial.

The class of such functions is denoted by \(\mathcal{H}\); its elements are EA-equivalent to functions in class H.

The known o-polynomials provide then the following bent functions:
  1. 1.
    m odd:
    • \(f(x,y) = \mathrm{Tr}_{1}^{m}(x^{-5}y^{6})\);

    • \(f(x,y) = \mathrm{Tr}_{1}^{m}(x^{\frac{5} {6} }\,y^{\frac{1} {6} })\);

     
  2. 2.
    m = 2k − 1:
    • \(f(x,y) = \mathrm{Tr}_{1}^{m}(x^{-3\cdot (2^{k}+1) }y^{3\cdot 2^{k}+4 })\);

    • \(f(x,y) = \mathrm{Tr}_{1}^{m}(x^{2^{m}-3\cdot 2^{k-1}+2 }y^{3\cdot 2^{k-1}-2 })\);

     
  3. 3.
    m = 4k − 1:
    • \(f(x,y) = \mathrm{Tr}_{1}^{m}(x^{2^{m}-2^{k}-2^{2k} }y^{2^{k}+2^{2k} })\);

    • \(f(x,y) = \mathrm{Tr}_{1}^{m}(x^{2^{3k-1}-2^{2k}+2^{k} }y^{2^{m}-2^{3k-1}+2^{2k}-2^{k} })\);

     
  4. 4.
    m = 4k + 1:
    • \(f(x,y) = \mathrm{Tr}_{1}^{m}(x^{2^{m}-2^{2k+1}-2^{3k+1} }y^{2^{2k+1}+2^{3k+1} })\);

    • \(f(x,y) = \mathrm{Tr}_{1}^{m}(x^{2^{3k+1}-2^{2k+1}+2^{k} }y^{2^{m}-2^{3k+1}+2^{2k+1}-2^{k} })\);

     
  5. 5.
    m = 2k − 1:
    • \(f(x,y) = \mathrm{Tr}_{1}^{m}(x^{1-2^{k} }y^{2^{k} } + x^{-(2^{k}+1) }y^{2^{k}+2 } + x^{-3\cdot (2^{k}+1) }y^{3\cdot 2^{k}+4 })\);

    • \(f(x,y) = \mathrm{Tr}_{1}^{m}\left (\frac{x\left (\frac{y} {x}+1+\frac{y^{2^{k} }} {x^{2^{k}}}\right )\frac{y^{2^{k-1} }} {x^{2^{k-1}}} } { \frac{y^{2^{k}}} {x^{2^{k}}}+\frac{y^{2}} {x^{2}} +1} \right )\);

     
  6. 6.
    m odd:
    • \(f(x,y) = \mathrm{Tr}_{1}^{m}(x^{\frac{5} {6} }y^{\frac{1} {6} } + x^{\frac{3} {6} }y^{\frac{3} {6} } + x^{\frac{1} {6} }y^{\frac{5} {6} }) = D_{5}((y/x)^{6})\);

    • \(f(x,y) = \mathrm{Tr}_{1}^{m}\left (x\left [D_{\frac{1} {5} }\left (\frac{y} {x}\right )\right ]^{6}\right )\); \(D_{\frac{1} {5} }\) Dickson polynomial.

     
  7. 7.
    Four functions related to the two more o-polynomials:
    • \(\frac{\delta ^{2}(z^{4}+z)+\delta ^{2}(1+\delta +\delta ^{2})(z^{3}+z^{2})} {z^{4}+\delta ^{2}z^{2}+1} + z^{1/2}\), where \(\mathrm{Tr}_{1}^{m}(1/\delta ) = 1\) and, if m ≡ 2 [mod 4], then \(\delta \not\in \mathbb{F}_{4^{}}\);

    • \(\frac{\mathrm{Tr}_{m}^{n}(v^{r})(z+1)+\mathrm{Tr}_{ m}^{n}\left [(vz+v^{2^{m}})^{r}\right ]\left (z+\mathrm{Tr}_{ m}^{n}(v)z^{1/2}+1\right )^{1-r}} {\mathrm{Tr}_{m}^{n}(v)} + z^{1/2}\), where m is even, \(r = \pm \frac{2^{m}-1} {3}\), \(v \in \mathbb{F}_{2^{2m}}\), \(v^{2^{m}+1 } = 1\), and v ≠ 1.

     
Class 1

of Niho bent functions corresponds to the so-called Subiaco hyperovals, related to the first of the two classes of o-polynomials recalled above in 7 [40]

Classes 2 and 3

correspond to Adelaide hyperovals [39] related to the second of the two classes of o-polynomials recalled above in 7.

Open Problem 6:

Clarify the relation between EA-equivalence of Niho bent functions and equivalence of the corresponding o-polynomials/hyperovals.

Open Problem 7:

Find more univariate Niho bent functions having simple expression, related to the two last classes of o-polynomials.

  • Bent functions associated to AB functions:

Definition 2

The nonlinearity of a vectorial function\(F: \mathbb{F}_{2}^{n} \rightarrow \mathbb{F}_{2}^{n}\) (resp. \(\mathbb{F}_{2^{n}} \rightarrow \mathbb{F}_{2^{n}}\text{)}\) equals:
$$\displaystyle{\mathit{nl}(F) =\min \{ \mathit{nl}(b \cdot F);\,b \in \mathbb{F}_{2}^{n}\setminus \{0\}\}\text{ (resp. }\min \{\mathit{nl}(\mathrm{Tr}_{ 1}^{n}(bF));\,b \in \mathbb{F}_{ 2^{n}}^{{\ast}}\}\text{)}.}$$
F is almost bent (AB) if \(\mathit{nl}(F) = 2^{n-1} - 2^{\frac{n-1} {2} }\), which is the best possible value (see more in [12]).

Theorem 4 ([20])

Let F be a function from\(\mathbb{F}_{2}^{m}\)to itself. Then F is AB if and only if\(\gamma _{F}: \left (\mathbb{F}_{2^{m}}\right )^{2} \rightarrow \mathbb{F}_{2}\)defined by
$$\displaystyle{\gamma _{F}(a,b) = 1 \Leftrightarrow \left \{\begin{array}{l} a\neq 0\\ \exists x\,\vert \,F(x) + F(x + a) = b \end{array} \right.}$$
is bent. The dual function satisfies
$$\displaystyle{\widetilde{\gamma _{F}}(a,b) = 1 \Leftrightarrow \left \{\begin{array}{l} b\neq 0\\ \widehat{\chi _{b\cdot F}}(a)\neq 0 \end{array} \right..}$$

The known AB power functions F(x) = xd, \(x \in \mathbb{F}_{2^{m}}\) are given in Table 1.

Table 1

Known AB power functions xd on \(\mathbb{F}_{2^{m}}\)

Functions

Exponents d

Conditions

 

Gold

2i + 1

gcd(i, m) = 1, 1 ≤ i < m∕2

 

Kasami

22i − 2i + 1

gcd(i, m) = 1, 2 ≤ i < m∕2

 

Welch

2k + 3

m = 2k + 1

 

Niho

\(2^{k} + 2^{\frac{k} {2} } - 1\), k even

m = 2k + 1

 
 

\(2^{k} + 2^{\frac{3k+1} {2} } - 1\), k odd

  
The associated bent functions γF are studied in [4]. We give them below:
Gold:

\(\gamma _{F}(a,b) = \mathrm{Tr}_{1}^{m}\big( \frac{b} {a^{2^{i}+1}} \big)\) with \(\frac{1} {0} = 0\);

Kasami, Welch, Niho:

\(F(x + 1) + F(x) = q(x^{2^{s} } + x)\) (q permutation determined by Dobbertin, gcd(s, m) = 1);

F(x + 1) + F(x) = b has solutions if and only if \(\mathrm{Tr}_{1}^{m}(q^{-1}(b)) = 0\).
$$\displaystyle{\text{Then: }\gamma _{F}(a,b) = \left \{\begin{array}{ll} \mathrm{Tr}_{1}^{m}(q^{-1}(b/a^{d})) + 1&\mbox{ if $a\neq 0$,} \\ 0 &\text{ otherwise.} \end{array} \right.}$$
  • Kasami: s = i, \(q(x) = \frac{x^{2^{i}+1}} {\sum _{j=1}^{i^{{\prime}}}x^{2^{ji}}+\alpha \mathrm{Tr}_{ 1}^{m}(x)} + 1,\) where
    $$\displaystyle{i^{{\prime}}\equiv 1/i\mod m,\,\alpha = \left \{\begin{array}{l} 0\text{ if }i^{{\prime}}\text{ is odd} \\ 1\text{ otherwise} \end{array} \right..}$$
  • Welch: s = k, \(q(x) = x^{2^{k+1}+1 } + x^{3} + x + 1\).

  • Niho: s = k∕2 if k is even and s = (3k + 1)∕2 if k is odd, \(q(x) = \left \{\begin{array}{ll} \frac{1} {g(x^{2^{s}-1})+1} + 1&\text{ if }x\notin \mathbb{F}_{2} \\ 1 &\text{ otherwise } \end{array} \right.\) where
    $$\displaystyle{g(x) = x^{2^{2s+1}+2^{s+1}+1 } + x^{2^{2s+1}+2^{s+1}-1 } + x^{2^{2s+1}+1 } + x^{2^{2s+1}-1 } + x}$$

    The functions γF associated to Kasami, Welch, and Niho functions with m = 7, 9 are neither in the completed MM class nor in the completed PSap class.

The other known infinite classes of AB functions are quadratic; their associated γF belong to the completed MM class.
Open Problem 8:

Find infinite classes of bent functions whose bivariate trace representation (4) involves several values of o(i, j).

3.4 Bent Functions in Hybrid Form and Kerdock Codes

A known infinite class of quadratic bent functions is defined over \(\mathbb{F}_{2^{n-1}} \times \mathbb{F}_{2}\) as
$$\displaystyle{f_{u}(x^{{\prime}},x_{ n}) =\sum _{ i=1}^{\frac{n} {2} -1}\mathrm{Tr}_{1}^{n-1}((ux^{{\prime}})^{2^{i}+1 })+x_{n}Tr_{1}^{n-1}(ux^{{\prime}}),\text{ where }u \in \mathbb{F}_{ 2^{n-1}}^{{\ast}},x^{{\prime}}\in \mathbb{F}_{ 2^{n-1}}.}$$
The difference (i.e., the sum) of two functions of such form corresponding to two distinct values of u is bent as well.

It is easily shown that any code of length 2n (i.e., any set of Boolean functions) equal to the union of at least two cosets of the first-order Reed-Muller code RM(1,n) has minimum distance bounded above by \(2^{n-1} - 2^{m-1}\), with equality if and only if all the differences between the elements of two distinct cosets are bent functions.

The Kerdock code of length 2n (n ≥ 4 even) equals the union of all the cosets fu + RM(1, n) where u ranges over \(\mathbb{F}_{2^{n-1}}\). It is an optimal code (it was shown by Delsarte that no code exists with better parameters, e.g., with smaller length, same size, and same minimum distance, or larger size, same length, and same minimum distance, or larger minimum distance, same length, and same size).

Open Problem 9:

Find a code with the same parameters as the Kerdock code (for instance, find a set of 2n−1 − 1 bent functions in n variables whose pairwise sums are also bent) and which is not equivalent to a subcode of the second-order Reed-Muller code.

3.5 Determining the Duals of Bent Functions in Univariate Form

Lemma 1

Let (u,v) be an autodual basis of\(\mathbb{F}_{2^{n}}\)over\(\mathbb{F}_{2^{m}}\). Let f be bent over\(\mathbb{F}_{2^{n}}\)and g(x,y) = f(ux + vy),\(x,y \in \mathbb{F}_{2^{m}}\).

Then:
$$\displaystyle{\widehat{\chi _{f}}(\mathit{au} + \mathit{bv}) = \widehat{\chi _{g}}(a,b).}$$
The dual of Niho class 2 of bent functions [31] has been determined in [18]. Let v be such that \(\mathrm{Tr}_{m}^{n}(v) = 1\) and \(b^{4} = a^{2}v^{2^{m}-1 }\). Then
$$\displaystyle\begin{array}{rcl} & & \tilde{f}(a^{\frac{1} {2} }x) = {}\\ & & \quad \mathrm{Tr}_{1}^{m}\left (\left (v^{\frac{2^{m}+1} {2} } + 1 + \mathrm{Tr}_{m}^{n}(v^{2^{m} }x)\right )\left (\frac{\mathrm{Tr}_{m}^{n}(\mathit{vx}) + v^{\frac{2^{m}+1} {2} }} {\mathrm{Tr}_{m}^{n}(v^{-1})} \right )^{\frac{1} {3} }\right ) {}\\ \end{array}$$
has algebraic degree \(\frac{m+3} {2}\) (hence, \(\tilde{f}\) is EA-inequivalent to f).

The dual of the Kholosha-Leander extension of class 2 has also been determined [5].

Open Problem 10:

Determine the duals of Niho bent functions 1 and 3.

The duals of Mesnager’s functions have been determined [50, 52, 53].

4 Secondary Constructions of Bent Functions

We call secondary a construction of bent functions from already known bent functions, in the same numbers of variables or not (while primary constructions, like Maiorana-McFarland construction, build bent functions from scratch).

4.1 A Maiorana-McFarland-Like Construction

Let r, s be two positive integers such that n = r + s is even and r < s. Let \(\phi: \mathbb{F}_{2}^{s}\mapsto \mathbb{F}_{2}^{r}\) be such that ϕ−1(a) is an (sr)-dimensional affine subspace of \(\mathbb{F}_{2}^{s}\), for every \(a \in \mathbb{F}_{2}^{r}\), and let g be a Boolean function on \(\mathbb{F}_{2}^{s}\) whose restriction to ϕ−1(a) is bent, for every \(a \in \mathbb{F}_{2}^{r}\).

Then \(f(x,y) = x \cdot \phi (y) + g(y);\;x \in \mathbb{F}_{2}^{r},y \in \mathbb{F}_{2}^{s},\) is bent on \(\mathbb{F}_{2}^{n}\).

4.2 Adding the Indicator of a Flat

The condition for preserving bentness when adding the indicator of an affine subspace of \(\mathbb{F}_{2}^{n}\) is given in [7] and recalled in [11].

4.3 A Secondary Construction Which Does Not Increase the Number of Variables

Let f1, f2, and f3 be three Boolean functions on \(\mathbb{F}_{2}^{n}\). Let \(s_{1} = f_{1} + f_{2} + f_{3}\) and \(s_{2} = f_{1}f_{2} + f_{1}f_{3} + f_{2}f_{3}\). Then
$$\displaystyle{ \widehat{\chi _{f_{1}}} +\widehat{\chi _{f_{2}}} +\widehat{\chi _{f_{3}}} =\widehat{\chi _{s_{1}}} + 2\,\widehat{\chi _{s_{2}}}. }$$
(5)
If f1, f2, and f3 are bent, then:
  • if s1 is bent and if \(\tilde{s_{1}} =\tilde{ f_{1}} +\tilde{ f_{2}} +\tilde{ f_{3}}\), then s2 is bent, and \(\tilde{s_{2}} =\tilde{ f_{1}}\tilde{f_{2}} +\tilde{ f_{1}}\tilde{f_{3}} +\tilde{ f_{2}}\tilde{f_{3}}\);

  • if \(\widehat{\mathrm{s}_{2}{{}_{_{\chi }}}}(a)\) is divisible by 2m for every a (e.g., if s2 is bent), then s1 is bent [10].

Open Problem 11:

Deduce significantly new and large classes of bent functions from this construction (classes are found in [10], but they are a little peculiar).

4.4 Rothaus’ Construction

Let f1, f2, f3 be bent functions on \(\mathbb{F}_{2}^{n}\) such that \(f_{1} + f_{2} + f_{3}\) is bent as well, then the function on \(\mathbb{F}_{2}^{n+2}\):
$$\displaystyle\begin{array}{rcl} & & f(x,x_{n+1},x_{n+2}) = {}\\ & & \quad f_{1}(x)f_{2}(x) + f_{1}(x)f_{3}(x) + f_{2}(x)f_{3}(x) + x_{n+1}x_{n+2} {}\\ & & \qquad + [f_{1}(x) + f_{2}(x)]x_{n+1} + [f_{1}(x) + f_{3}(x)]x_{n+2} {}\\ \end{array}$$
is bent [59].

4.4.1 Designing the Initial Functions in the Rothaus Construction

Definition 3

A permutation π on \(\mathbb{F}_{2}^{m}\) is called an orthomorphic permutation if the function π + Id, where Id(x) = x, is also a permutation.

Theorem 5 ([22])

Let π be a permutation on\(\mathbb{F}_{2}^{m}\). Let ϕ and ψ be orthomorphic permutations on\(\mathbb{F}_{2}^{m}\). Let\(g_{1},g_{2},g_{3}\)be three m-variable Boolean functions. Let
$$\displaystyle{\pi _{1} =\pi;\quad \pi _{2} =\phi \circ \pi _{1};\quad \pi _{3} =\psi \circ \left (\pi _{1} +\pi _{2}\right )}$$

then the four following MM functions are bent:

\(\begin{array}{l} h_{1}(x,y) = x \cdot \pi _{1}(y) + g_{1}(y), \\ h_{2}(x,y) = x \cdot \pi _{2}(y) + g_{2}(y), \\ h_{3}(x,y) = x \cdot \pi _{3}(y) + g_{3}(y), \\ h_{1} + h_{2} + h_{3}.\end{array}.\)

Open Problem 12:

Find more general constructions of initial functions for the Rothaus construction.

4.5 The Indirect Sum and Its Generalizations

A very general secondary construction of bent functions with initial conditions was given in [8]:

Theorem 6

Let f be a Boolean function on\(\mathbb{F}_{2}^{r+s} = \mathbb{F}_{2}^{r} \times \mathbb{F}_{2}^{s}\), where r, s are even, such that, for any\(y \in \mathbb{F}_{2}^{s}\), the function on\(\mathbb{F}_{2}^{r}\):
$$\displaystyle{f_{y}: x\mapsto f(x,y)}$$
is bent. Then f is bent if and only if for any element u of\(\mathbb{F}_{2}^{r}\), the function
$$\displaystyle{\vartheta _{u}: y\mapsto \widetilde{f_{y}}(u)}$$
is bent on\(\mathbb{F}_{2}^{s}\), and the dual of f is the function\(\tilde{f}(u,v) =\widetilde{\vartheta _{u}}(v)\).

The Rothaus construction, which uses four bent functions whose sum is null, is a particular case of this construction, corresponding to r = 2 (indeed, any function \((x_{n+1},x_{n+2})\mapsto a_{0} + x_{n+1}x_{n+2} + a_{1}x_{n+1} + a_{2}x_{n+2}\) is bent and has dual \(a_{0} + x_{n+1}x_{n+2} + a_{2}x_{n+1} + a_{1}x_{n+2} + a_{1}a_{2}\)). Another particular case, called the indirect sum, uses four bent functions as well but is built differently and does not need any initial condition:

Corollary 1 ([9])

Let \(f_{1},f_{2}\)be bent on\(\mathbb{F}_{2}^{r}\)(r even) and\(g_{1},g_{2}\)be bent on\(\mathbb{F}_{2}^{s}\)(s even). Define
$$\displaystyle{h(x,y) = f_{1}(x) + g_{1}(y) + (f_{1} + f_{2})(x)\,(g_{1} + g_{2})(y);\;x \in \mathbb{F}_{2}^{r},\,y \in \mathbb{F}_{ 2}^{s}.}$$
Then h is bent and
$$\displaystyle{\tilde{h}(x,y) =\tilde{ f}_{1}(x) +\tilde{ g}_{1}(y) + (\tilde{f}_{1} +\tilde{ f}_{2})(x)\,(\tilde{g}_{1} +\tilde{ g}_{2})(y);\;x \in \mathbb{F}_{2}^{r},\,y \in \mathbb{F}_{ 2}^{s}.}$$

Indeed, any function \(x\mapsto f_{1}(x) + a_{0} + a_{1}(f_{1} + f_{2})(x)\) is bent and has dual \(\tilde{f}_{1}(x) + a_{0} + a_{1}(\tilde{f}_{1} +\tilde{ f}_{2})(x)\). The name of “indirect sum” comes from the name of the well-known direct sum, which corresponds simply to \(h(x,y) = f_{1}(x) + g_{1}(y)\), and that the indirect sum generalizes.

A generalization of the indirect sum needing initial conditions is given in [22]:

Theorem 7

Let f1,f2, and f3be bent on\(\mathbb{F}_{2}^{r}\). Let\(g_{1},g_{2}\), and g3be bent on\(\mathbb{F}_{2}^{s}\). Let\(\nu _{1} = f_{1} + f_{2} + f_{3}\)and\(\nu _{2} = g_{1} + g_{2} + g_{3}\). If ν1and ν2are bent and if\(\widetilde{\nu _{1}} =\widetilde{ f_{1}} +\widetilde{ f_{2}} +\widetilde{ f_{3}}\), then f(x,y) =
$$\displaystyle{f_{1}(x) + g_{1}(y) + (f_{1} + f_{2})(x)(g_{1} + g_{2})(y) + (f_{2} + f_{3})(x)(g_{2} + g_{3})(y)}$$
is a bent function in r + s variables.

The indirect sum is a particular case of this construction: it corresponds to the case \(f_{2} = f_{3}\) and/or \(g_{2} = g_{3}\). The Rothaus construction is also a particular case.

Case of application: Let p(x) and θ(x) be r-variable bent functions such that there exists \(a \in \mathbb{F}_{2}^{r}\) nonzero such that \(D_{a}p = D_{a}\theta\). We can take \(f_{1}(x) = p(x),f_{2}(x) = p(x + a),f_{3}(x) =\theta (x)\).

Another generalization of the indirect sum is also given in [22]:

Theorem 8

Let f0,f1, f2, and f3be bent functions on\(\mathbb{F}_{2}^{r}\)and g0,g1, g2, and g3be bent functions on\(\mathbb{F}_{2}^{s}\).

Let\(\nu _{j} = f_{j} + f_{(j+1)\mathit{mod}\ 4} + f_{(j+2)\mathit{mod}\ 4}\)and\(\varepsilon _{j} = g_{j} + g_{(j+1)\mathit{mod}\ 4} + g_{(j+2)\mathit{mod}\ 4}\), where j = 0,1,2,3. If νjand\(\varepsilon _{j}\)are bent functions and if for every j = 0,1,2,3, we have\(\widetilde{\nu _{j}} =\widetilde{ f_{j}} + \tilde{f}_{(j+1)\mathit{mod}\ 4} + \tilde{f}_{(j+2)\mathit{mod}\ 4}\), then f(x,y) =
$$\displaystyle\begin{array}{rcl} & f_{0}(x) + g_{0}(y) + (f_{0} + f_{1})(x)(g_{0} + g_{1})(y) + (f_{1} + f_{2})(x)(g_{1} + g_{2})(y)+& {}\\ & (f_{2} + f_{3})(x)(g_{2} + g_{3})(y)\text{ is bent.} & {}\\ \end{array}$$

Case of application: under the same conditions as in the case of application of Theorem 7 (let p(x) and θ(x) be r-variable bent functions such that there exists a nonzero vector \(a \in \mathbb{F}_{2}^{r}\) such that \(D_{a}p = D_{a}\theta\)), we can take \(f_{0}(x) = p(x),f_{1}(x) = p(x + a),f_{2}(x) =\theta (x)\) and f3(x) = θ(x + a).

Open Problem 13:

Generalize the indirect sum without initial condition.

Open Problem 14:

Find more general cases of application of Theorems 7 and 8; deduce new classes.

4.5.1 A Modification of the Indirect Sum

A modified indirect sum is introduced in [66]:

Theorem 9

Let n and m be two positive even numbers and\(\mu \in \{ 1,2,\ldots,n\}\),\(\rho \in \{ 1,2,\ldots,\ m\}\). For\(x = (x_{1},\ldots,x_{n}) \in \mathbb{F}_{2}^{n}\)and\(y = (y_{1},\ldots,y_{m}) \in \mathbb{F}_{2}^{m}\), let\(x^{{\prime}} = (x_{1},\ldots,x_{\mu -1},x_{\mu +1},\ldots,x_{n}) \in \mathbb{F}_{2}^{n-1}\)and\(y^{{\prime}} = (y_{1},\ldots,y_{\rho -1},\ y_{\rho +1},\ldots,y_{m}) \in \mathbb{F}_{2}^{m-1}\). Let f be an n-variable bent function and g an m-variable bent function. We consider the restrictions of f and g:\(f_{0}(x^{{\prime}}) = f(x_{1},\ldots,x_{\mu -1},0,x_{\mu +1},\ldots,x_{n})\),\(f_{1}(x^{{\prime}}) = f(x_{1},\ldots,x_{\mu -1},1,x_{\mu +1},\ \ldots,x_{n})\),\(g_{0}(y^{{\prime}})\,=\,g(y_{1},\ldots,y_{\rho -1},0,y_{\rho +1},\ \ldots,y_{m})\),\(g_{1}(y^{{\prime}}) = g(y_{1},\ldots,\ y_{\rho -1},1,y_{\rho +1},\ldots,y_{m})\), and we define
$$\displaystyle{h(x^{{\prime}},y^{{\prime}}) = f_{ 0}(x) \oplus g_{0}(y) \oplus (f_{0} \oplus f_{1})(x)\,(g_{0} \oplus g_{1})(y).}$$
Then h is a bent function in n + m − 2 variables. Further, the dual of h is obtained from the functions\(\overline{f_{0}}(x^{{\prime}}) = \tilde{f}(x_{1},\ldots,x_{\mu -1},0,x_{\mu +1},\ldots,x_{n})\),\(\overline{f_{1}}(x^{{\prime}}) = \tilde{f}(x_{1},\ldots,x_{\mu -1},1,\ x_{\mu +1},\ldots,x_{n})\),\(\overline{g_{0}}(y^{{\prime}}) = \tilde{g}(y_{1},\ldots,y_{\rho -1},0,y_{\rho +1},\ldots,\ y_{m})\)and\(\overline{g_{1}}(y^{{\prime}}) = \tilde{g}(y_{1},\ldots,y_{\rho -1},\ 1,y_{\rho +1},\ldots,y_{m})\), by the same formula as h is obtained from\(f_{0},f_{1},g_{0}\), and g1.

4.5.2 A New Secondary Construction

We have seen just before Theorem 2 that, given two Boolean functions f and f, we have \(\sum _{x,y\in \mathbb{F}_{2}^{n}}(-1)^{f(x)+f^{{\prime}}(y)+x\cdot y } =\sum _{x\in \mathbb{F}_{2}^{n}}(-1)^{f(x)}\widehat{\chi _{f^{{\prime}}}}(x)\). If f is bent, then we deduce \(\sum _{x,y\in \mathbb{F}_{2}^{n}}(-1)^{f(x)+f^{{\prime}}(y)+x\cdot y } = 2^{m}\sum _{x\in \mathbb{F}_{2}^{n}}(-1)^{f(x)+\widetilde{f^{{\prime}}}(x) }\). This implies that, for every \(a,b \in \mathbb{F}_{2}^{n}\), we have \(\sum _{x,y\in \mathbb{F}_{2}^{n}}(-1)^{f(x)+f^{{\prime}}(y)+x\cdot y+a\cdot x+b\cdot y } =\sum _{x,y\in \mathbb{F}_{2}^{n}}(-1)^{f(x)+a\cdot x+f^{{\prime}}(y)+(x+b)\cdot y } =\sum _{x,y\in \mathbb{F}_{2}^{n}}(-1)^{f(x+b)+a\cdot (x+b)+f^{{\prime}}(y)+x\cdot y }\) equals \(2^{m}(-1)^{a\cdot b}\sum _{x\in \mathbb{F}_{2}^{n}}(-1)^{f(x+b)+a\cdot x+\widetilde{f^{{\prime}}}(x) }\). Denoting \(\widetilde{f^{{\prime}}}\) by g, we deduce:

Proposition 1

Let f be any n-variable Boolean function and g be any n-variable bent function. Then the 2n-variable function\(f(x) +\tilde{ g}(y) + x \cdot y\)is bent if and only if f(x + b) + g(x) is bent for every b (or equivalently f(x) + g(x + b) is bent for every b).

Note that the bent function \(f(x,y) = \mathrm{Tr}_{1}^{m}(x^{2^{i}+1 } + y^{2^{i}+1 } + \mathit{xy})\), \(x,y \in \mathbb{F}_{2^{m}}\) (recalled in Sect. 3.3), where n is co-prime with 3 and i is co-prime with m, looks like the function of Proposition 1, but its bentness is not a case of application of Proposition 1 since \(\mathrm{Tr}_{1}^{m}(x^{2^{i}+1 })\) is never bent (its linear kernel containing always 1).

If f is quadratic, then the condition “f(x + b) + g(x) is bent for every b” in Proposition 1 simplifies in “f(x) + g(x) is bent” since f(x) + f(x + b) is affine. We have then, denoting f + g by h:

Corollary 2

If two n-variable bent functions g(x) and h(x) differ by a quadratic function, then the 2n-variable function\((g + h)(x) + \tilde{g}(y) + x \cdot y\)is bent.

Examples of cases of application are:
  • Any pairs of quadratic bent functions; for instance, pairs of functions involved in Kerdock codes (see Sect. 3.4);

  • Maiorana-McFarland functions: let π and π be permutations on \(\mathbb{F}_{2}^{m}\) differing by an affine function (for instance, let π be an orthomorphic permutation and π = π + Id) and let u, v be two Boolean functions on \(\mathbb{F}_{2}^{m}\) differing by a quadratic function, then we can take \(g(x_{1},x_{2}) = x_{1} \cdot \pi (x_{2}) + u(x_{2})\) and \(h(x_{1},x_{2}) = x_{1} \cdot \pi ^{{\prime}}(x_{2}) + v(x_{2})\); \(x_{1},x_{2} \in \mathbb{F}_{2}^{m}\); these functions can be nonquadratic.

Note that Proposition 1 could have also been proved as a corollary of Theorem 6. In fact, Theorem 6 (or more precisely its version obtained by exchanging the roles of x and y) allows proving a slightly more general result:

Theorem 10

Let f be any n-variable Boolean function, let g be any n-variable bent function and let ϕ be any mapping from\(\mathbb{F}_{2}^{n}\)to itself. Then the 2n-variable function\(f(x) +\tilde{ g}(y) +\phi (x) \cdot y\)is bent if and only if f(x) + g(ϕ(x) + b) is bent for every b.

Indeed, for every fixed \(x \in \mathbb{F}_{2}^{n}\), function \(y\mapsto f(x) +\tilde{ g}(y) +\phi (x) \cdot y\) is bent and the value of the dual of this function at \(u \in \mathbb{F}_{2}^{n}\) equals f(x) + g(y +ϕ(x)).

Note that if g is quadratic and ϕ is an affine permutation, then f(x) + g(ϕ(x) + b) is bent if and only if f(x) + g(ϕ(x)) is bent. Let then h(x) be another bent function; then taking f(x) = g(ϕ(x)) + h(x), the condition in Theorem 10 is satisfied. We have then:

Corollary 3

Let g be any quadratic bent function and ϕ any affine permutation. Let h be any bent function; then the 2n-variable function\(g(\phi (x)) + h(x) +\tilde{ g}(y) +\phi (x) \cdot y\)is bent.

This gives one more case of application of Corollary 2 since the two bent functions \(g(\phi (x)) + h(x) +\tilde{ g}(y) +\phi (x) \cdot y\) and \(h(x) +\tilde{ g}(y)\) differ by a quadratic function.

Another case of application of Theorem 10 is when, for every \(b \in \mathbb{F}_{2}^{n}\), the set \(\{\phi (x) + b;\;x \in \mathbb{F}_{2}^{n}\}\) is either included in the support of g or disjoint from it, and f is bent.

Corollary 4

Let f,g be two n-variable bent Boolean functions and let ϕ be any mapping from\(\mathbb{F}_{2}^{n}\)to itself such that\(Im(\phi ) =\{\phi (x);\;x \in \mathbb{F}_{2}^{n}\}\)is either included in or disjoint from any translate of supp (g). Then the 2n-variable function\(f(x) +\tilde{ g}(y) +\phi (x) \cdot y\)is bent.

Denoting, for every \(E,F \subseteq \mathbb{F}_{2}^{n}\), the set \(\{x + x^{{\prime}};\;x \in E,x^{{\prime}}\in F\}\) by E + F, the condition on Im(ϕ) is equivalent to \((Im(\phi ) + Im(\phi )) \cap (\mathrm{supp}(g) + (\mathbb{F}_{2}^{n}\setminus \mathrm{supp}(g))) = \varnothing\).

The construction of Theorem 10 can be turned into a construction of bent functions from arbitrary functions, which generalizes the Maiorana-McFarland construction. Indeed, given two n-variable Boolean functions f and g and a mapping ϕ from \(\mathbb{F}_{2}^{n}\) to itself, let us define
$$\displaystyle{ h(x,y) = f(x) + g(y) +\phi (x) \cdot y. }$$
(6)
This 2n-variable Boolean function has Walsh transform:
$$\displaystyle{\widehat{\chi _{h}}(a,b) =\sum _{x,y\in \mathbb{F}_{2}^{n}}(-1)^{f(x)+g(y)+\phi (x)\cdot y+a\cdot x+b\cdot y} =\sum _{ x\in \mathbb{F}_{2}^{n}}(-1)^{f(x)+a\cdot x}\widehat{\chi _{ g}}(\phi (x) + b).}$$
If g is an affine function, then without loss of generality, up to EA-equivalence, we can take g(y) = 0; the support of \(\widehat{\chi _{g}}\) is then {0}, the value of \(\widehat{\chi _{g}}\) at 0 equals 2n, and h is bent if and only if ϕ is a permutation. This is the Maiorana-McFarland construction.
If g has Walsh support of a pair, then without loss of generality, up to EA-equivalence, we can take \(g(y) = y_{1}y_{2}\), and we have then \(\mathrm{supp}(\widehat{\chi _{g}}) =\{ x \in \mathbb{F}_{2}^{n}\,\vert \,x_{3} =\ldots = x_{n} = 0\}\) and \(\widehat{\chi _{g}}(x_{1},x_{2},0,\ldots,0) = 2^{n-1}(-1)^{x_{1}x_{2}}\); then h is bent if and only if, for every \(a,b \in \mathbb{F}_{2}^{n}\), we have, denoting by ϕi(x) the ith coordinate of ϕ(x):
$$\displaystyle{\sum _{x\in \mathbb{F}_{2}^{n}\,\vert \,\phi _{3}(x)=b_{3},\ldots,\phi _{n}(x)=b_{n}}(-1)^{f(x)+a\cdot x+(\phi _{1}(x)+b_{1})(\phi _{2}(x)+b_{2})} = \pm 2.}$$
For instance, if:
  • every pre-image by the mapping \(x\mapsto (\phi _{3}(x),\ldots,\phi _{n}(x))\) is a two-dimensional affine subspace of \(\mathbb{F}_{2}^{n}\),

  • ϕ1(x) and ϕ2(x) are constant on every such pre-image,

  • and the restriction of f to such pre-image has odd Hamming weight,

then h is bent. But such construction is close to that of Sect. 4.1 (in which y would be replaced by \((x,y_{1},y_{2})\), \(x\) by \((y_{3},\ldots,y_{n})\), g(y) by \(f(x) + y_{1}y_{2}\), ϕ(y) by \((\phi _{3}(x),\ldots,\phi _{n}(x))\) and with 2n in the place of n and r = n + 2). The only difference is with the terms \(\phi _{1}(x)y_{1} +\phi _{2}(x)y_{2}\) which are present here and are not in the construction of Sect. 4.1.

Open Problem 15:

Find secondary constructions based on new ideas, if possible without initial conditions.

5 Rotation Symmetric (RS) Bent Functions and Idempotent Bent Functions

Rotation symmetric (RS) Boolean functions, which have been originally introduced by Filiol and Fontaine in [32, 33] under the name of idempotent functions and soon after studied by Pieprzyk and Qu [58] under their final name, have received some attention since their introduction. RS structure allowed obtaining Boolean functions in odd numbers of variables beating the best known nonlinearities [41].

RS functions also have the interest of needing less space to be stored and of allowing faster computation of the Walsh transform.

There have been recent developments on RS and idempotent bent functions.

5.1 RS Bent Functions

A Boolean function f is RS if it is invariant under the cyclic shift:
$$\displaystyle{f(x_{n-1},x_{0},x_{1},\ldots,x_{n-2}) = f(x_{0},x_{1},\ldots,x_{n-1}).}$$
In other words, the support of an RS function is a cyclic (but not necessarily linear) code.See more on RS functions in [27, 34, 61, 62]

The dual of an RS bent function is an RS bent function.

The next lemma on quadratic RS functions is more or less known, but, as far as we know, it has never been published.

Lemma 2

Let\(f(x) =\sum _{0\leq i<j\leq n-1}a_{i,j}x_{i}x_{j} +\ell (x)\)be any quadratic Boolean function, where\(a_{i,j} \in \mathbb{F}_{2}\)and ℓ is affine. Let M be the associated matrix (see [49]), whose term located at row i and column j equals ai,jif i < j, aj,iif i > j and 0 if i = j. Then f is RS if and only if M is circulant (i.e., each row of M is a cyclic shift of the previous row) and ℓ is RS.

Proof

If f is RS, then is RS and \(a_{i+k,j+k} = a_{i,j}\) for every i < j and every k, where the indices are taken in \(\mathbb{Z}/n\mathbb{Z}\). This equality applied for 1 ≤ k ≤ nj − 1 shows that the part of M located at the right of the diagonal is circulant; applied for nj ≤ k ≤ ni − 1, it shows that \(a_{i^{{\prime}},j^{{\prime}}} = a_{i^{{\prime}}+k,j^{{\prime}}+k}\) for every \(i^{{\prime}}> j^{{\prime}}\) and every k and the part of M located at the left of the diagonal is circulant. And we have also \(a_{i,n-1} = a_{i+1,0}\). Hence, M is circulant. The converse is similar. □ 

5.1.1 Infinite Classes of RS Bent Functions

The situation of RS bent functions is very similar to that of bent functions in trace forms: many of the known classes belong to completed MM class, and their bentness may then seem easily explained. However, finding RS bent functions is difficult and has theoretical and practical interest.

  • Quadratic RS bent functions have been characterized in [35] by the fact that some related polynomial P(X) over \(\mathbb{F}_{2}\) such that \(X^{n}P\big( \frac{1} {X}\big) = P(X)\) is co-prime with Xn + 1: given \(c_{1},\ldots,c_{m}\) in \(\mathbb{F}_{2}\), the function:
    $$\displaystyle{\sum _{i=1}^{m-1}c_{ i}\left (\sum _{j=0}^{n-1}x_{ j}x_{i+j}\right ) + c_{m}\left (\sum _{j=0}^{m-1}x_{ j}x_{m+j}\right )}$$
    is bent if and only if the polynomial \(\sum _{i=1}^{m-1}c_{i}(X^{i} + X^{n-i}) + c_{m}X^{m}\) is co-prime with Xn + 1. This condition is equivalent to the fact that the linearized polynomial \(L(X) =\sum _{ i=1}^{m-1}c_{i}(X^{2^{i} } + X^{2^{n-i} }) + c_{m}X^{2^{m} }\), which we can write \(\sum _{i=0}^{n-1}c_{i}X^{2^{i} }\) by setting \(c_{n-i} = c_{i}\), is a permutation polynomial (a necessary condition is that L(1) ≠ 0, i.e., cm = 1).
    • An example of such polynomial is with ci = 0 for im. Another example is with ci = 1 for \(i = 1,\ldots,n - 1\) since L(X) equals then \(X + \mathrm{Tr}_{1}^{n}(X)\) which is a permutation polynomial since n is even (equivalently, \(\sum _{i=1}^{n-1}X^{i}\) is co-prime with Xn + 1). This provides the two infinite classes
      $$\displaystyle{\sum _{j=0}^{m-1}x_{ j}x_{m+j}}$$
      and
      $$\displaystyle{\sum _{i=1}^{m-1}\left (\sum _{ j=0}^{n-1}x_{ j}x_{i+j}\right ) + \left (\sum _{j=0}^{m-1}x_{ j}x_{m+j}\right )}$$
      of quadratic RS bent functions.
    • More examples can be found. For instance, let k be such that 2k − 2 divides n and 2k − 1 is co-prime with n. Then \(\left (\frac{X^{2^{k}-1}+1} {X+1} \right )^{ \frac{n} {2^{k}-2} } + X^{n} + 1\) has the form \(\sum _{i=1}^{m-1}c_{i}(X^{i} + X^{n-i}) + c_{m}X^{m}\) (indeed, \(\left (\frac{X^{2^{k}-1}+1} {X+1} \right )^{ \frac{n} {2^{k}-2} }\) is self-reciprocal, has degree n, and is normalized) and is co-prime with Xn + 1 (indeed, the zeroes of \(\left (\frac{X^{2^{k}-1}+1} {X+1} \right )^{ \frac{n} {2^{k}-2} }\) in the algebraic closure of \(\mathbb{F}_{2}\) are the elements of \(\mathbb{F}_{2^{k}}\setminus \mathbb{F}_{2}\), and for any \(\xi \in \mathbb{F}_{2^{k}}\setminus \mathbb{F}_{2}\), we have ξn + 1 ≠ 0, since \(\xi \mapsto \xi ^{n}\) is a permutation of \(\mathbb{F}_{2^{k}}^{{\ast}}\)). Taking for example k = 2, we have \(\left (X^{2} + X + 1\right )^{m} + X^{n} + 1 =\sum _{{ 0\leq u,v,w\leq m \atop u+v+w=m,2u+v\not\in \{0,n\}} } \frac{m!} {u!v!w!}X^{2u+v}\), and for n not divisible by 3, the following function is RS bent:
      $$\displaystyle{\sum _{{ 0\leq u,v,w\leq m \atop u+v+w=m,2u+v\in \{1,\ldots,m-1\}} } \frac{m!} {u!v!w!}\left (\sum _{j=0}^{n-1}x_{ j}x_{2u+v+j}\right ) + \left (\sum _{j=0}^{m-1}x_{ j}x_{m+j}\right ),}$$
      where the coefficients are taken modulo 2.
    • If n is a power of 2, then according to [60, Proposition 3.1], the function \(\sum _{i=1}^{m-1}c_{i}\left (\sum _{j=0}^{n-1}x_{j}x_{i+j}\right ) + c_{m}\left (\sum _{j=0}^{m-1}x_{j}x_{m+j}\right )\) is bent if and only if \(\sum _{i=0}^{n-1}c_{i} = 1\), that is, cm = 1. Note that this can also be proved slightly differently: given some normal element α of \(\mathbb{F}_{2^{n}}\) (i.e., some element of \(\mathbb{F}_{2^{n}}\) such that \((\alpha,\alpha ^{2},\ldots,\alpha ^{2^{n-1} })\) is a normal basis, i.e., \(\alpha,\alpha ^{2},\ldots,\alpha ^{2^{n-1} }\) are linearly independent), the condition on L is equivalent to the fact that \(\sum _{i=0}^{n-1}c_{i}\alpha ^{2^{i} }\) is also a normal element (see more in [57]); according to [56, Corollary 5.2.9], an element α of \(\mathbb{F}_{2^{n}}\) is normal if and only if \(\mathrm{Tr}_{1}^{n}(\alpha ) = 1\) (and \(\alpha \not\in \mathbb{F}_{2}\), but this is implied by \(\mathrm{Tr}_{1}^{n}(\alpha ) = 1\) since n is even). Hence, \(\sum _{i=0}^{n-1}c_{i}\alpha ^{2^{i} }\) is normal if and only if \(\mathrm{Tr}_{1}^{n}(\sum _{i=0}^{n-1}c_{i}\alpha ^{2^{i} }) = 1\), that is, cm = 1. See more at Sect. 5.2.1.

    Open Problem 16:

    Find more infinite classes of quadratic RS bent functions, valid for every even n.

  • Two infinite classes of cubic RS bent functions belonging to the completed MM class were found recently:

    • \(\sum _{i=0}^{n-1}(x_{ i}x_{t+i}x_{m+i} + x_{i}x_{t+i}) +\sum _{ i=0}^{m-1}x_{ i}x_{m+i},\) where m∕gcd(m, t) is odd [35];

    • \(\sum _{i=0}^{n-1}x_{ i}x_{i+r}x_{i+2r} +\sum _{ i=0}^{2r-1}x_{ i}x_{i+2r}x_{i+4r} +\sum _{ i=0}^{m-1}x_{ i}x_{i+m},\) where m = 3r [36].

Open Problem 17:

Find more classes of cubic RS bent functions.

5.2 Univariate RS Functions (Idempotents), Bivariate Expressions

Definition 4

Let f(x) be a Boolean function on \(\mathbb{F}_{2^{n}}\). We say that f is an idempotent if
$$\displaystyle{f(x) = f(x^{2}),\quad \text{ for all }x \in \mathbb{F}_{ 2^{n}}.}$$

A function \(f(x) =\sum _{ j=0}^{2^{n}-1 }a_{j}\;x^{j}\) or \(f(x) =\sum _{j\in \Gamma _{n}}\mathrm{Tr}_{1}^{o(j)}(a_{j}x^{j}) + a_{2^{m}-1}x^{2^{m}-1 }\) is an idempotent if and only if every coefficient aj belongs to \(\mathbb{F}_{2}\).

For any Boolean function f(x) over \(\mathbb{F}_{2^{n}}\) and every normal basis \((\alpha,\alpha ^{2},\ldots,\alpha ^{2^{n-1} })\) of \(\mathbb{F}_{2^{n}}\), the function
$$\displaystyle{(x_{0},\ldots,x_{n-1})\mapsto f\left (\sum _{i=0}^{n-1}x_{ i}\alpha ^{2^{i} }\right )}$$
is RS if and only if f is an idempotent.

Remark 2

This property leads to a notion of equivalence between RS functions: if two RS functions are linked as above to the same idempotent, through the choices of two normal bases, these two RS functions can be considered as equivalent (note that this is a subcase of linear equivalence). More precisely, given a normal element α, another normal element can be written \(\alpha ^{{\prime}} =\sum _{j\in \mathbb{Z}/n\mathbb{Z}}c_{j}\alpha ^{2^{j} }\) where \(x\mapsto \sum _{j\in \mathbb{Z}/n\mathbb{Z}}c_{j}x^{2^{j} }\) is a permutation (if n is a power of 2, then this condition is equivalent to \(\sum _{j\in \mathbb{Z}/n\mathbb{Z}}c_{j} = 1\)); the two functions \(g(x_{0},\ldots,x_{n-1}) = f\left (\sum _{i=0}^{n-1}x_{i}\alpha ^{2^{i} }\right )\) and \(g^{{\prime}}(x_{0},\ldots,x_{n-1}) = f\left (\sum _{i=0}^{n-1}x_{i}\alpha ^{{\prime}}{}^{2^{i} }\right )\) are related by the relation \(g^{{\prime}}(\ldots,x_{j},\ldots ) = g(\ldots,\sum _{i\in \mathbb{Z}/n\mathbb{Z}}x_{i}c_{j-i},\ldots )\). In other words, g is deduced from g by multiplying the input by a nonsingular circulant matrix (so we can call circulant-equivalence this equivalence). We can check that the rotation symmetry of g is equivalent to that of g since the shift on the input of g corresponds to the inverse shift on the input of g and vice versa.

The related equivalence classes can be large: if, for instance, n is a power of 2, then we have recalled above that any element \(\alpha \in \mathbb{F}_{2^{n}}\) is normal if and only if \(\mathrm{Tr}_{1}^{n}(\alpha ) = 1\); there are then 2n−1 normal bases, and an equivalence class can potentially have a size near \(\frac{2^{n-1}} {n}\).

Linear equivalence between RS functions is more general than the equivalence above. Even equivalence under permutation of the variables is. For instance, the 8-variable RS functions \(\sum _{i=0}^{7}x_{i}x_{i+1}x_{i+2}x_{i+5}\) and \(\sum _{i=0}^{7}x_{i}x_{i+1}x_{i+3}x_{i+4}\) are equivalent under permutation and not under circulant-equivalence; see [26, Remark 1.10]. Refer more generally to [26] and the references therein for linear and affine equivalences of RS functions.

Remark 3

Knowing an infinite class of idempotent bent functions is not equivalent to knowing an infinite class of RS bent functions, since there is no expression valid for an infinite number of values of n of the decomposition of \(\left (\sum _{i=0}^{n-1}x_{i}\alpha ^{2^{i} }\right )^{j}\) over the normal basis \((\alpha,\alpha ^{2},\ldots,\alpha ^{2^{n-1} })\), except for j null or equal to a power of 2.

5.2.1 Known Bent Idempotents

  • The function \(f^{{\prime}}(z) = \mathrm{Tr}_{1}^{m}(z^{2^{m}+1 })\) and the function \(f^{{\prime}}(z) = \mathrm{Tr}_{1}^{m}(z^{2^{m}+1 }) +\sum _{ i=1}^{m-1}\mathrm{Tr}_{1}^{n}(z^{2^{i}+1 })\) are bent quadratic idempotents. More generally, given \(c_{1},\ldots,c_{m}\) in \(\mathbb{F}_{2}\), the function equal to \(c_{m}Tr_{1}^{m}(x^{2^{m}+1 }) +\sum _{ i=1}^{m-1}c_{i}Tr_{1}^{n}(x^{2^{i}+1 })\) is bent if and only if \(\gcd (\sum _{i=1}^{m-1}c_{i}(X^{i} + X^{n-i}) + c_{m}X^{m},X^{n} + 1) = 1\) [48]. This condition is the same as that obtained for quadratic RS bent functions in Sect. 5.1.1. The two first classes described in that subsection correspond to the classes of bent idempotents given above. The third example in Sect. 5.1.1 gives a third general example here. For instance, for n not divisible by 3, we have the following bent idempotent:
    $$\displaystyle{\mathrm{Tr}_{1}^{m}(z^{2^{m}+1 }) +\sum _{{ 0\leq u,v,w\leq m \atop u+v+w=m,2u+v\in \{1,\ldots,m-1\}} } \frac{m!} {u!v!w!}\mathrm{Tr}_{1}^{n}(z^{2^{2u+v}+1 }),}$$
    where the coefficients are taken modulo 2. Of course, what is written at Sect. 5.1.1 when n is a power of 2 is valid here. Note that more results, valid for more general values of n, can be found in [65].
  • The Niho bent functions [31] recalled at Sect. 3.2
    $$\displaystyle{\mathrm{Tr}_{1}^{m}(az^{2^{m}+1 }) + \mathrm{Tr}_{1}^{n}(bz^{d})}$$
    are bent idempotents when the coefficients a and b equal 1. The extension of the second class by Leander et al. [45] gives also a bent idempotent.
  • The generalized Dillon and Mesnager functions are potentially bent idempotents, under conditions involving Kloosterman sums:
    • For every m such that Km(1) is null, \(g_{1}(x) = \mathrm{Tr}_{1}^{n}(x^{r(2^{m}-1) })\) is bent when \(\gcd (r,2^{m} + 1) = 1\).

    • For every m odd such that Km(1) = 4, \(g_{2}(x) = \mathrm{Tr}_{1}^{n}(x^{r(2^{m}-1) }) + \mathrm{Tr}_{1}^{2}(x^{\frac{2^{n}-1} {3} })\) is bent when gcd(r, 2m + 1) = 1.

    But the condition Km(1) = 0 never happens as shown in [47, Theorem 2.2], and it can be checked by computer that the condition Km(1) = 4 never happens as well for 5 ≤ m ≤ 20. 

  • For n = 2m = 6r, r ≥ 1, \(\mathrm{Tr}_{1}^{n}(z^{1+2^{r}+2^{2r} })+\mathrm{Tr}_{1}^{2r}(z^{1+2^{2r}+2^{4r} })+\mathrm{Tr}_{1}^{m}(z^{1+2^{t} }) = \mathrm{Tr}_{1}^{r}((z +z^{2^{3r} })^{1+2^{r}+2^{2r} })+\mathrm{Tr}_{1}^{m}(z^{1+2^{t} })\) is a bent idempotent [36].

5.3 Secondary Constructions of Rotation Symmetric and Idempotent Bent Functions

We precise the relationship between RS functions and the bivariate representation of idempotent functions; a proper relationship is between weak RS functions (invariant under circular permutation of indices by two positions) and weak idempotents (a natural notion that we introduce). This gives a way of constructing a new RS n-variable function where n ≡ 2 [mod 4], from two known semi-bent RS functions in m variables, by using the indirect sum (the definition of semi-bent functions is recalled below). It provides an infinite class of RS bent functions of algebraic degree 4 and an infinite class of bent idempotents of algebraic degree 4 as well. This section and the next one are a recall and an extension of results from [15].

5.3.1 Bivariate Representation of Idempotents

Most bent functions being known in bivariate form, it is useful to characterize the bivariate representation of idempotent and RS functions. The situation is easier when m is odd (which is the case of most known bent functions).

Given \(w \in \mathbb{F}_{2^{2}}\setminus \mathbb{F}_{2}\), we have w2 = w + 1, w4 = w, and we can take (w, w2) for basis of \(\mathbb{F}_{2^{n}}\) over \(\mathbb{F}_{2^{m}}\), since we have \(\frac{w^{2}} {w} = w\not\in \mathbb{F}_{2^{m}}\) for m odd. Any element of \(\mathbb{F}_{2^{n}}\) can then be written in the form xw + yw2, where \(x,y \in \mathbb{F}_{2^{m}}\). Note that, given a normal basis \((\alpha,\ldots,\alpha ^{2^{m-1} })\) of \(\mathbb{F}_{2^{m}}\), a natural normal basis of \(\mathbb{F}_{2^{n}}\) over \(\mathbb{F}_{2}\) is
$$\displaystyle{(\alpha w,(\alpha w)^{2},(\alpha w)^{4},(\alpha w)^{8},\ldots,(\alpha w)^{2^{m-1} },(\alpha w)^{2^{m} },(\alpha w)^{2^{m+1} },\ldots,(\alpha w)^{2^{n-1} }) =}$$
$$\displaystyle{ (\alpha w,\alpha ^{2}w^{2},\alpha ^{4}w,\alpha ^{8}w^{2},\ldots,\alpha ^{2^{m-1} }w,\alpha w^{2},\alpha ^{2}w,\ldots,\alpha ^{2^{m-1} }w^{2}). }$$
(7)
Since \((xw + yw^{2})^{2} = y^{2}w + x^{2}w^{2}\), the shift \(z\mapsto z^{2}\) corresponds to the mapping \((x,y)\mapsto (y^{2},x^{2})\). Given a function f(x, y) in bivariate form, the related Boolean function over \(\mathbb{F}_{2}^{n}\) obtained by decomposing the input xw + yw2 over the basis (7) is then RS if and only if f(x, y) = f(y2, x2). Note that applying this identity m times gives f(x, y) = f(y, x) and applying it m + 1 times gives \(f(x,y) = f(x^{2},y^{2})\); the double condition “f(x, y) = f(y, x) and \(f(x,y) = f(x^{2},y^{2})\)” is then necessary and is also sufficient.
Open Problem 18:

Handle the case m even.

More generally, let m and k be two co-prime integers and n = mk. Let α be a normal element of \(\mathbb{F}_{2^{m}}\) over \(\mathbb{F}_{2}\) and w a normal element of \(\mathbb{F}_{2^{k}}\) over \(\mathbb{F}_{2}\). We know that α w is a normal element of \(\mathbb{F}_{2^{n}}\) over \(\mathbb{F}_{2}\) (see [56, Proposition 5.2.3]. We have then the normal bases \((\alpha,\ldots,\alpha ^{2^{m-1} })\) of \(\mathbb{F}_{2^{m}}\) over \(\mathbb{F}_{2}\) (which is in the same time a basis of \(\mathbb{F}_{2^{n}}\) over \(\mathbb{F}_{2^{k}}\)), \((w,\ldots,w^{2^{k-1} })\) of \(\mathbb{F}_{2^{k}}\) over \(\mathbb{F}_{2}\) (also a basis of \(\mathbb{F}_{2^{n}}\) over \(\mathbb{F}_{2^{m}}\)), and
$$\displaystyle{(\alpha w,\alpha ^{2}w^{2},\ldots,\alpha ^{2^{i\pmod m} }w^{2^{i\pmod k} },\ldots,\alpha ^{2^{n-1\pmod m} }w^{2^{n-1\pmod k} })}$$
of \(\mathbb{F}_{2^{n}}\)   over \(\mathbb{F}_{2}\). Any element of \(\mathbb{F}_{2^{n}}\) can be written in the form \(\sum _{i=0}^{k-1}x_{i}w^{2^{i} }\), where \(x_{i} \in \mathbb{F}_{2^{m}}\). Since \((\sum _{i=0}^{k-1}x_{i}w^{2^{i} })^{2} =\sum _{ i=0}^{k-1}x_{i}^{2}w^{2^{i+1\pmod k} }\), the univariate shift \(z\mapsto z^{2}\) corresponds to the mapping
$$\displaystyle{(x_{0},\ldots,x_{k-1})\mapsto \rho _{k}(x_{0}^{2},\ldots,x_{ k-1}^{2}),}$$
where \(\rho _{k}(x_{0},\ldots,x_{k-1}) = (x_{k-1},x_{0},\ldots,x_{k-2})\) is the cyclic shift over \(\mathbb{F}_{2^{m}}^{k}\).
Given a Boolean function \(f(x_{0},\ldots,x_{k-1})\) in k-variate form (where \(x_{i} \in \mathbb{F}_{2^{m}}\)), the related Boolean function over \(\mathbb{F}_{2}^{n}\) obtained by decomposing \(\sum _{i=0}^{k-1}x_{i}w^{2^{i} }\) over (7) is then RS if and only if
$$\displaystyle{f(x_{0},\ldots,x_{k-1}) = f(\rho _{k}(x_{0}^{2},\ldots,x_{ k-1}^{2})).}$$

Proposition 2

Let m and k be two co-prime integers and n = mk. Let α be a normal element of\(\mathbb{F}_{2^{m}}\)over\(\mathbb{F}_{2}\)and w a normal element of\(\mathbb{F}_{2^{k}}\)over\(\mathbb{F}_{2}\). Then the n-variable Boolean idempotents are those polynomials f(z) representing Boolean functions over\(\mathbb{F}_{2^{n}}\)whose associate k-variate expressions, defined as\(f(x_{0},\ldots,x_{k-1}) = f(\sum _{i=0}^{k-1}x_{i}w^{2^{i} })\), satisfy\(f(x_{0},\ldots,x_{k-1}) = f(\rho _{k}(x_{0}^{2},\ldots,x_{k-1}^{2}))\). In particular, if k = 2, the n-variable Boolean idempotents are those polynomials f(z) representing Boolean functions over\(\mathbb{F}_{2^{n}}\)whose associate bivariate expressions f(x,y) = f(wx + w2y) satisfy\(f(x,y) = f(y^{2},x^{2})\).

Applying the identity m times gives \(f(x_{0},\ldots,x_{k-1}) = f(\rho _{k}^{m}(x_{0},\ldots,x_{k-1}))\), and applying it k times gives \(f(x_{0},\ldots,x_{k-1}) = f(x_{0}^{2^{k} },\ldots,x_{k-1}^{2^{k} })\). Since m and k are co-prime, there exist integers u and v such that um + vk = 1. Then applying u times the identity \(f(x_{0},\ldots,x_{k-1}) = f(\rho _{k}^{m}(x_{0},\ldots,x_{k-1}))\) and v times \(f(x_{0},\ldots,x_{k-1}) = f(x_{0}^{2^{k} },\ldots,x_{k-1}^{2^{k} })\) gives \(f(x_{0},\ldots,x_{k-1}) = f(\rho _{k}(x_{0},\ldots,x_{k-1}))\) and \(f(x_{0},\ldots,x_{k-1}) = f(x_{0}^{2},\ldots,x_{k-1}^{2})\). The double condition “\(f(x_{0},\ldots,x_{k-1}) = f(\rho _{k}(x_{0},\ldots,x_{k-1}))\) and \(f(x_{0},\ldots,x_{k-1}) = f(x_{0}^{2},\ldots,x_{k-1}^{2})\)” is then necessary, and it is also clearly sufficient.

Definition 5

Under the hypotheses of Proposition 2, we call any polynomial f(z) whose k-variate expression satisfies \(f(x_{0},\ldots,x_{k-1}) = f(x_{0}^{2},\ldots,x_{k-1}^{2})\) a k -weak idempotent.

Note that the condition \(f(x_{0},\ldots,x_{k-1}) = f(x_{0}^{2},\ldots,x_{k-1}^{2})\) is equivalent to \(f(x_{0},\ldots,x_{k-1}) = f(x_{0}^{2^{k} },\ldots,x_{k-1}^{2^{k} })\) since m and k are co-prime.

Proposition 3

The set of n-variable idempotent functions is included in that of k-weak idempotents. An idempotent is a k-weak-idempotent invariant under the shift ρk.

The corresponding definition at the bit level is obtained by decomposing the univariate representation over the normal basis (7) and the k-variate representation over the basis \((\alpha,\ldots,\alpha ^{2^{m-1} })\):

Definition 6

Let m and k be two co-prime integers and n = mk. A Boolean function
$$\displaystyle{f(x_{0,0},y_{1,1},\ldots,x_{n-1,n-1})}$$
(where each first index is reduced modulo k and each second index is reduced modulo m) over \(\mathbb{F}_{2}^{n}\) is k-weak RS if it is invariant under the cyclic shift by k positions.

For n = 2m, m odd, we can see that a function \(f(x_{0},y_{1},x_{2},y_{3},\ldots,x_{n-2},y_{n-1})\) (where each index is reduced modulo m; we skip the first index) over \(\mathbb{F}_{2}^{n}\) is 2-weak RS if it is invariant under the transformation \(\left \{\begin{array}{l} x_{j}\mapsto x_{j+1} \\ y_{j}\mapsto y_{j+1} \end{array} \right.\).

Such 2-weak RS function is RS if and only if in bivariate form, it is invariant under \((x,y)\mapsto (y,x)\).

Proposition 4

A Boolean function\(f(x_{0,0},y_{1,1},\ldots,x_{n-1,n-1})\)is RS if and only if it is m-weak RS and k-weak RS.

We shall call the 2-weak idempotents (resp. the 2-weak RS functions) simply weak idempotents (resp. weak RS functions). An example of a weak RS function is the direct sum f(x) + g(y) where f and g are RS m-variable functions; such function is RS when f = g.

Remark 4

All the functions derived from o-polynomials with coefficients equal to 1 are bent weak idempotents.

5.3.2 A Secondary Construction of RS and Idempotent Functions

We have seen that the direct sum allows constructing, for n = 2m, an n-variable weak idempotent from two m-variable idempotents. The indirect sum allows constructing, for n = 2m, an n-variable weak idempotent h from four m-variable idempotents \(f_{1},f_{2},g_{1},g_{2}\):
$$\displaystyle{h(x,y) = f_{1}(x) + g_{1}(y) + (f_{1} + f_{2})(x)\,(g_{1} + g_{2})(y);\;x,y \in \mathbb{F}_{2^{m}}.}$$
If \(f_{1} = g_{1}\) and \(f_{2} = g_{2}\), then we obtain the idempotent \(h(x,y) = f_{1}(x) + f_{1}(y) + (f_{1} + f_{2})(x)\,(f_{1} + f_{2})(y)\). This gives also a secondary construction of an RS n-variable function from two RS m-variable functions (n = 2m, m odd). This function is bent if the two functions are semi-bent.

Definition 7

For odd m, a Boolean function on \(\mathbb{F}_{2}^{m}\) is called semi-bent if its Walsh transform takes values 0 and \(\pm 2^{\frac{m+1} {2} }\) only. See more on semi-bent functions in [19, 25, 42, 54].

Proposition 5 ([15])

Let f1and f2be two m-variable RS semi-bent functions, m odd, and let n = 2m. If the Walsh supports of f1and f2are complementary, then\(h(x_{0},y_{1},x_{2},y_{3},\ldots,x_{n-2},y_{n-1}) = f_{1}(x_{0},\ldots,x_{m-1})+f_{1}(y_{0},\ldots,y_{m-1})+(f_{1}+f_{2})(x_{0},\ldots,x_{m-1})(f_{1}+f_{2})(y_{0},\ldots,y_{m-1})\)is bent RS.

Indeed, the Walsh transform \(\widehat{\chi _{h}}(a_{0},b_{1},a_{2},b_{3},\ldots,a_{n-2},b_{n-1})\) of h is equal to \(\frac{1} {2}\widehat{\chi _{f_{1}}}(a)\left [\widehat{\chi _{f_{1}}}(b) +\widehat{\chi _{f_{2}}}(b)\right ] + \frac{1} {2}\widehat{\chi _{f_{2}}}(a)\left [\widehat{\chi _{f_{1}}}(b) -\widehat{\chi _{f_{2}}}(b)\right ]\) (see [11]).

Note that, according to Parseval’s relation, the Walsh supports of f1 and f2 have size 2m−1 and then can be complementary. Note also that the secondary construction of Proposition 5 is closely related to that of Theorem 9. It is well known that two m-variable functions f1 and f2 (m odd) are semi-bent with complementary Walsh supports if and only if the (m + 1)-variable function \(f(x,x_{m+1}) = f_{1}(x) + x_{m+1}f_{2}(x)\); \(x \in \mathbb{F}_{2^{m}},x_{m+1} \in \mathbb{F}_{2}\), is bent. Indeed, we have \(W_{f}(a,a_{m+1}) = W_{f_{1}}(a) + (-1)^{a_{m+1}}W_{f_{ 2}}(a)\), implying that f is bent when f1 and f2 are semi-bent with complementary Walsh supports; and we have \(W_{f_{1}}(a) = \frac{1} {2}\left (W_{f}(a,0) + W_{f}(a,1)\right )\) and \(W_{f_{2}}(a) = \frac{1} {2}\left (W_{f}(a,0) - W_{f}(a,1)\right )\), implying that f1 and f2 are semi-bent with complementary Walsh supports when f is bent. But note that when f is RS, f1 and f2 are in general not RS, and when f1 and f2 are RS, f is in general not RS.

A case of application of the construction of Proposition 5 happens with the bent quadratic function involved in the definition of the Kerdock code (see Sect. 3.4):
$$\displaystyle{f(x,x_{m+1}) =\sum _{ i=1}^{\frac{m-1} {2} }\mathrm{Tr}_{1}^{m}(x^{2^{i}+1 }) + x_{m+1}\mathrm{Tr}_{1}^{m}(x).}$$
This function is bent and its semi-bent restrictions f1 and f2 to the hyperplanes of equations xm+1 = 0 and xm+1 = 1 are idempotent functions of x. But the resulting function h derived by the indirect sum is quadratic, because \(f_{1} + f_{2}\) is linear, and this reduces its interest. Another example, found in [15], of such a pair \((f_{1},f_{2})\) will yield an infinite class of idempotent bent functions of algebraic degree 4:

Proposition 6

For every odd m, the following m-variable idempotent functions\(f_{1}(x) = \mathit{tr}(x) + \mathit{tr}(x^{2^{(m-1)/2}+1 })\)and\(f_{2}(x) = \mathit{tr}(x^{3})\)are semi-bent functions with complementary Walsh supports.

Proof

We know (see [11, Theorem 8.23]) that a quadratic Boolean function f over \(\mathbb{F}_{2^{m}}\) has for Walsh support the set of elements \(a \in \mathbb{F}_{2^{m}}\) such that tr(ax) + f(x) is constant on Ef where \(E_{f} =\{ x \in \mathbb{F}_{2^{m}}/\forall y \in \mathbb{F}_{2^{m}},f(x + y) + f(x) + f(y) + f(0) = 0\}\) is the so-called linear kernel of f. We also know that function f is semi-bent, for m odd, if and only if Ef has dimension 1 (i.e., has size 2). Functions f1 and f2 have kernels of equations \(x^{2^{(m-1)/2} } + x^{2^{(m+1)/2} } = 0\) and \(x^{2} + x^{2^{m-1} } = 0\), which are, respectively, equivalent to the equations x + x2 = 0 and x + x4 = 0. These two equations have the same set of solutions, equal to \(\mathbb{F}_{2}\) (using that m is odd for the second one). Hence, both functions are semi-bent. The first function f1 has then Walsh support {atr(a) = 0}, and the second one f2 has Walsh support {atr(a) + tr(1) = 0}; these Walsh supports are complementary since tr(1) = 1. □ 

Theorem 11 ([15])

Let n = 2m, m odd. We define the m-variable idempotent functions\(f_{1}(x) = \mathrm{Tr}_{1}^{m}(x) + \mathrm{Tr}_{1}^{m}(x^{2^{(m-1)/2}+1 })\)and\(f_{2}(x) = \mathrm{Tr}_{1}^{m}(x^{3})\). Then\(h(x,y) = f_{1}(x) + f_{1}(y) + (f_{1} + f_{2})(x)\,(f_{1} + f_{2})(y)\)is a bent idempotent with algebraic degree 4.

Similarly, we define the RS functions\(f_{1}^{{\ast}}(x) =\sum _{ i=0}^{m-1}(x_{i} + x_{i}x_{(m-1)/2+i})\)and\(f_{2}^{{\ast}}(x) =\sum _{ i=0}^{m-1}x_{i}x_{1+i}\), where the subscripts are taken modulo m. Then function\(h^{{\ast}}(x_{0},y_{1},x_{2},y_{3},\ldots,x_{n-2},y_{n-1}) = f_{1}^{{\ast}}(x_{0},\ldots,x_{m-1})+f_{1}^{{\ast}}(y_{0},\ldots,y_{m-1})+(f_{1}^{{\ast}}+f_{2}^{{\ast}})(x_{0},\ldots,x_{m-1})(f_{1}^{{\ast}}+f_{2}^{{\ast}})(y_{0},\ldots,y_{m-1})\)is an RS bent function of algebraic degree 4.

Open Problem 19:

Construct classes of RS bent functions of all algebraic degrees between 5 and m.

6 A Transformation on Rotation Symmetric Bent Functions

We can observe a correspondence in Theorem 11 between the functions \(f_{1},f_{2},h\) from one hand side and the functions \(f_{1}^{{\ast}},f_{2}^{{\ast}},h^{{\ast}}\) for the other hand side. It is simpler to describe how \(f_{1},f_{2},h\) can be obtained from \(f_{1}^{{\ast}},f_{2}^{{\ast}},h^{{\ast}}\) rather than vice versa. Given an RS Boolean function f, we consider the function f(z) over the finite field of order 2n, expressed in trace representation and obtained from the ANF of \(f(x_{0},\ldots,x_{n-1})\) by replacing \(x_{i}\) by \(z^{2^{i} }\). Functions \(f_{1},f_{2},h\) are obtained from \(f_{1}^{{\ast}},f_{2}^{{\ast}},h^{{\ast}}\) by the transformation \(f\mapsto f^{{\prime}}\). Given an RS Boolean function f, function f happens to be always a Boolean idempotent function (its idempotence is merely related to the fact that f is Boolean, and its binarity is related to the fact that f is RS).

Proposition 7 ([15])

Let\(f(x_{0},\ldots,x_{n-1})\)be any Boolean RS function over\(\mathbb{F}_{2}^{n}\), then
$$\displaystyle{f^{{\prime}}(z) = f(z,z^{2},\ldots,z^{2^{n-1} })}$$
is a Boolean idempotent. In other words, if:
$$\displaystyle\begin{array}{rcl} & f(x_{0},\ldots,x_{n-1}) =\sum _{u\in \mathbb{F}_{2}^{n}}a_{u}x^{u},\text{ then:}& {}\\ & f^{{\prime}}(z) =\sum _{u\in \mathbb{F}_{2}^{n}}a_{u}z^{\sum _{i=0}^{n-1}u_{ i}2^{i} } & {}\\ \end{array}$$
is a Boolean idempotent, and any idempotent Boolean function can be obtained this way.

Note that the trace representation of f is directly deduced from the ANF of f, even for infinite classes of functions f, and has a very similar shape (note that this is not at all the case between an idempotent function and the related RS function obtained by decomposing the input over a normal basis); the question whether f and f (or more coherently the RS function obtained from f by decomposing the input over a normal basis) are the same function up to affine equivalence is then natural. We show now with examples that the two functions are in general affinely inequivalent.

Examples

 
  • If f is the indicator of \(\{(1,0,1,0,\ldots,1,0),(0,1,0,1,\ldots,0,1)\}\), then, as observed in [15], we have \(f^{{\prime}}(z) = z^{\frac{2^{n}-1} {3} }(1 + z)^{\frac{2^{n}-1} {3} }\left ((1 + z)^{\frac{2^{n}-1} {3} } + z^{\frac{2^{n}-1} {3} }\right )\), which has Hamming weight \(2^{n} - 2 -\frac{2^{n}-4} {3}\).If f is the indicator of \(\{(0,\ldots,0),(1,\ldots,1)\}\), then f is the indicator of \(\mathbb{F}_{2}\).

    Hence, f and f can be affinely equivalent or not, and two functions f and g can be affinely equivalent without that f and g be EA-equivalent.

  • If \(f(x) =\sum _{ i=1}^{n}\left (\prod _{j\neq i}x_{i}\right )\), then f is the inverse function \(\mathit{tr}(z^{2^{n}-2 })\).

6.1 Relationship Between the Bentness of f and f

We study the relationship between the bentness of f and that of f: we check with infinite classes of RS functions that f can be bent when f is not and that f can be bent when f is not; we show that if f is quadratic, then it is bent if and only if f is bent, and we study classes of bent RS non-quadratic functions f for which f is bent.

6.1.1 Quadratic Functions

The characterizations recalled in Sects. 5.1.1 and 5.2.1 for the bentness of quadratic RS functions and bent idempotents, given, respectively, in [35] and [48], are the same. Then:

Theorem 12

If f is a quadratic RS function, then f is bent if and only if fis bent.

6.1.2 An Infinite Class of Cubic Bent RS Functions f Such That f Is Not Bent

Let
$$\displaystyle{f_{t}(x) =\sum _{ i=0}^{n-1}(x_{ i}x_{t+i}x_{m+i} + x_{i}x_{t+i}) +\sum _{ i=0}^{m-1}x_{ i}x_{m+i}}$$
over \(\mathbb{F}_{2}^{n}\), where n = 2m and 0 < t < m is such that m∕gcd(m, t) is odd. Then we have recalled that f is bent and it is shown in [15] that
$$\displaystyle{f_{t}^{{\prime}}(z) = \mathrm{Tr}_{ 1}^{n}(z^{1+2^{t}+2^{m} }) + \mathrm{Tr}_{1}^{n}(z^{1+2^{t} }) + \mathrm{Tr}_{1}^{m}(z^{1+2^{m} })}$$
is not bent.

6.1.3 An Infinite Class of Cubic Bent Idempotents f Such That f Is Not Bent

Let
$$\displaystyle{f^{{\prime}}(z) = \mathrm{Tr}_{ 1}^{m}(x^{1+2^{m} }) + \mathrm{Tr}_{1}^{n}(x^{d});\;d = (2^{m} - 1)/4 + 1}$$
be the second Niho bent function given in [31]; then, as shown in [15]
$$\displaystyle{f(x) =\sum _{ i=0}^{n-1}x_{ i}x_{1+i}x_{m+i} +\sum _{ i=0}^{m-1}x_{ i}x_{m+i}}$$
can be written in the MM form where π is not a permutation, and f is then not bent.

6.1.4 Infinite Classes of Bent RS Functions f Such That f Is Bent

A first example is given by Theorem 11. Let us give another example.

Let
$$\displaystyle{f(x) =\sum _{ i=0}^{n-1}x_{ i}x_{r}x_{i+2r} +\sum _{ i=0}^{2r-1}x_{ i}x_{i+2r}x_{i+4r} +\sum _{ i=0}^{m-1}x_{ i}x_{i+m},}$$
where n = 2m = 6r with r ≥ 1.

We know that f and \(f^{{\prime}}(z) = \mathrm{Tr}_{1}^{n}(z^{1+2^{r}+2^{2r} })+\mathrm{Tr}_{1}^{2r}(z^{1+2^{2r}+2^{4r} })+\mathrm{Tr}_{1}^{m}(z^{1+2^{t} }) = \mathrm{Tr}_{1}^{r}((z+z^{2^{3r} })^{1+2^{r}+2^{2r} })+\mathrm{Tr}_{1}^{\nu (t)}(z^{1+2^{t} })\) are bent.

Our investigations suggest that searching RS bent functions f provides larger probability of success when we choose them such that f is bent and vice versa.

The transformation \(f\mapsto f^{{\prime}}\) is however not an equivalence between RS bent functions; the bent functions are likely to be new under affine equivalence.

Open Question:

what are the relationships between the cryptographic parameters of f and those of f?

Conclusion

The research on bent functions continues to be very active. Much work has been done recently. The less recent results which are not recalled in this chapter can be found in [11], and results on bent vectorial functions can be found in [12, 13]. There are many connections with other domains of mathematics and computer science (designs, difference sets, Kloosterman sums, coding, cryptography, sequences, etc.) that we could not detail in this chapter. Important open problems remain (a few evoked in this chapter). Super-classes (partially-bent functions, plateaued functions, etc.), related classes (semi-bent functions), and subclasses (hyperbent functions) pose many problems not evoked here either (see [11]). A complete classification remains elusive.

Footnotes

  1. 1.

    In public-key cryptography, the only key which must be kept secret is the decryption key, but as far as we know, bent functions play no big role in such ciphers.

Notes

Acknowledgments

We thank Thomas Cusick, Guangpu Gao, and Sihem Mesnager for useful information.

References

  1. 1.
    L. Budaghyan, C. Carlet, CCZ-equivalence of single and multi output Boolean functions. AMS Contemp. Math. 518, 43–54 (2010). Post-proceedings of the Conference Fq9Google Scholar
  2. 2.
    L. Budaghyan, C. Carlet, CCZ-equivalence of bent vectorial functions and related constructions. Des. Codes Cryptogr. 59(1–3), 69–87 (2011). Post-proceedings of WCC 2009Google Scholar
  3. 3.
    L. Budaghyan, C. Carlet, A. Pott, New classes of almost bent and almost perfect nonlinear functions. IEEE Trans. Inf. Theory 52(3), 1141–1152 (2006)CrossRefMATHMathSciNetGoogle Scholar
  4. 4.
    L. Budaghyan, C. Carlet, T. Helleseth, On bent functions associated to AB functions, in Proceedings of IEEE Information Theory Workshop, ITW’11, Paraty, October 2011Google Scholar
  5. 5.
    L. Budaghyan, C. Carlet, T. Helleseth, A. Kholosha, S. Mesnager, Further results on Niho bent functions. IEEE Trans. Inf. Theory 58(11), 6979–6985 (2012)CrossRefMathSciNetGoogle Scholar
  6. 6.
    A. Canteaut, P. Charpin, G. Kyureghyan, A new class of monomial bent functions. Finite Fields Appl. 14(1), 221–241 (2008)CrossRefMATHMathSciNetGoogle Scholar
  7. 7.
    C. Carlet, Two new classes of bent functions, in Proceedings of EUROCRYPT’93. Lecture Notes in Computer Science, vol. 765 (1994), pp. 77–101Google Scholar
  8. 8.
    C. Carlet, A construction of bent functions, in Finite Fields and Applications. London Mathematical Society. Lecture Series, vol. 233 (Cambridge University Press, Cambridge, 1996), pp. 47–58Google Scholar
  9. 9.
    C. Carlet, On the secondary constructions of resilient and bent functions, in Proceedings of the Workshop on Coding, Cryptography and Combinatorics 2003 (Birkhäuser, Basel, 2004), pp. 3–28Google Scholar
  10. 10.
    C. Carlet, On bent and highly nonlinear balanced/resilient functions and their algebraic immunities, in Proceedings of AAECC 16. Lecture Notes in Computer Science, vol. 3857 (2006), pp. 1–28CrossRefMathSciNetGoogle Scholar
  11. 11.
    C. Carlet, Boolean functions for cryptography and error correcting codes. Chapter of the monography, in Boolean Models and Methods in Mathematics, Computer Science, and Engineering, ed. by Y. Crama, P. Hammer (Cambridge University Press, Cambridge, 2010), pp. 257–397. Preliminary version available at http://www-rocq.inria.fr/codes/Claude.Carlet/pubs.html
  12. 12.
    C. Carlet, Vectorial Boolean functions for cryptography. Chapter of the monography, in Boolean Models and Methods in Mathematics, Computer Science, and Engineering, ed. by Y. Crama, P. Hammer (Cambridge University Press, Cambridge, 2010), pp. 398–469. Preliminary version available at http://www-rocq.inria.fr/codes/Claude.Carlet/pubs.html
  13. 13.
    C. Carlet, C. Ding, Highly nonlinear mappings. J. Complex. 20, 205–244 (2004). Special Issue “Complexity Issues in Coding and Cryptography”, dedicated to Prof. Harald Niederreiter on the occasion of his 60th birthdayGoogle Scholar
  14. 14.
    C. Carlet, P. Gaborit, Hyper-bent functions and cyclic codes. J. Combin. Theory Ser. A 113(3), 466–482 (2006)CrossRefMATHMathSciNetGoogle Scholar
  15. 15.
    C. Carlet, G. Gao and W. Liu. A secondary construction and a transformation on rotation symmetric functions, and their action on bent and semi-bent functions. Journal of Combinatorial Theory, Series A, vol. 127(1), pp. 161–175 (2014).Google Scholar
  16. 16.
    C. Carlet, T. Helleseth, Sequences, Boolean functions, and cryptography, in Handbook of Codes, Sequences and Their Applications, ed. by S. Boztas (CRC Press, to appear)Google Scholar
  17. 17.
    C. Carlet, A. Klapper, Upper bounds on the numbers of resilient functions and of bent functions. This paper was meant to appear in an issue of Lecture Notes in Computer Sciences dedicated to Philippe Delsarte, Editor Jean-Jacques Quisquater. But this issue finally never appeared. A shorter version has appeared in the Proceedings of the 23rd Symposium on Information Theory in the Benelux, Louvain-La-Neuve, Belgium, 2002. The results are given in [11]Google Scholar
  18. 18.
    C. Carlet, S. Mesnager, On Dillon’s class H of bent functions, Niho bent functions and o-polynomials. J. Combin. Theory Ser. A 118, 2392–2410 (2011)CrossRefMATHMathSciNetGoogle Scholar
  19. 19.
    C. Carlet, S. Mesnager, On semi-bent Boolean functions. IEEE Trans. Inform. Theory 58, 3287–3292 (2012)CrossRefMathSciNetGoogle Scholar
  20. 20.
    C. Carlet, P. Charpin, V. Zinoviev, Codes, bent functions and permutations suitable for DES-like cryptosystems. Des. Codes Cryptogr. 15(2), 125–156 (1998)CrossRefMATHMathSciNetGoogle Scholar
  21. 21.
    C. Carlet, L.E. Danielsen, M.G. Parker, P. Solé, Self dual bent functions. Int. J. Inf. Coding Theory 1(4), 384–399 (2010). Special Issue, dedicated to Vera PlessGoogle Scholar
  22. 22.
    C. Carlet, F. Zhang, Y. Hu, Secondary constructions of bent functions and their enforcement. Adv. Math. Commun. 6(3), 305–314 (2012)CrossRefMATHMathSciNetGoogle Scholar
  23. 23.
    P. Charpin, G. Gong, Hyperbent functions, Kloosterman sums and Dickson polynomials. IEEE Trans. Inf. Theory 54(9), 4230–4238 (2008)CrossRefMATHMathSciNetGoogle Scholar
  24. 24.
    P. Charpin, G.M. Kyureghyan, Cubic monomial bent functions: a subclass of M. SIAM J. Discrete Math. 22(2), 650–665 (2008)CrossRefMATHMathSciNetGoogle Scholar
  25. 25.
    P. Charpin, E. Pasalic, C. Tavernier, On bent and semi-bent quadratic Boolean functions. IEEE Trans. Inform. Theory 51, 4286–4298 (2005)CrossRefMATHMathSciNetGoogle Scholar
  26. 26.
    T. Cusick, Y. Cheon, Affine equivalence of quartic homogeneous rotation symmetric Boolean functions. Inf. Sci. 259, 192–211 (2014)CrossRefMathSciNetGoogle Scholar
  27. 27.
    D.K. Dalai, S. Maitra, S. Sarkar, Results on rotation symmetric bent functions. Discrete Math. 309, 2398–2409 (2009)CrossRefMATHMathSciNetGoogle Scholar
  28. 28.
    J. Dillon, Elementary Hadamard difference sets. Ph.D. dissertation, University of Maryland, 1974Google Scholar
  29. 29.
    J.F. Dillon, H. Dobbertin, New cyclic difference sets with Singer parameters. Finite Fields Appl. 10(3), 342–389 (2004)CrossRefMATHMathSciNetGoogle Scholar
  30. 30.
    J.F. Dillon, G. McGuire, Near bent functions on a hyperplane. Finite Fields Appl. 14(3), 715–720 (2008)CrossRefMATHMathSciNetGoogle Scholar
  31. 31.
    H. Dobbertin, G. Leander, A. Canteaut, C. Carlet, P. Felke, P. Gaborit, Construction of bent functions via Niho power functions. J. Combin. Theory Ser. A 113, 779–798 (2006)CrossRefMATHMathSciNetGoogle Scholar
  32. 32.
    E. Filiol, C. Fontaine, Highly nonlinear balanced Boolean functions with a good correlation-immunity, in Proceedings of EUROCRYPT’98. Lecture Notes in Computer Science, vol. 1403 (1998), pp. 475–488Google Scholar
  33. 33.
    C. Fontaine, On some cosets of the first-order Reed-Muller code with high minimum weight. IEEE Trans. Inform. Theory 45, 1237–1243 (1999)CrossRefMATHMathSciNetGoogle Scholar
  34. 34.
    S. Fu, L. Qu, C. Li, B. Sun, Balanced 2p-variable rotation symmetric Boolean functions with maximum algebraic immunity. Appl. Math. Lett. 24, 2093–2096 (2011)CrossRefMATHMathSciNetGoogle Scholar
  35. 35.
    G. Gao, X. Zhang, W. Liu, C. Carlet, Constructions of quadratic and cubic rotation symmetric bent functions. IEEE Trans. Inform. Theory 58, 4908–4913 (2012)CrossRefMathSciNetGoogle Scholar
  36. 36.
    C. Carlet, G. Gao and W. Liu. Results on Constructions of Rotation Symmetric Bent and Semi-bent Functions. To appear in the proceedings of Sequences and Their Applications - Seta 2014: 8th International Conference, Melbourne, Vic, Australia, November 24–28, LNCS 8865, 2014.Google Scholar
  37. 37.
    F. Gologlu, Almost bent and almost perfect nonlinear functions, exponential sums, geometries and sequences. Ph.D. dissertation, University of Magdeburg, 2009Google Scholar
  38. 38.
    P. Guillot, Completed GPS covers all bent functions. J. Combin. Theory Ser. A 93, 242–260 (2001)CrossRefMATHMathSciNetGoogle Scholar
  39. 39.
    T. Helleseth, A. Kholosha, Private communication (2013)Google Scholar
  40. 40.
    T. Helleseth, A. Kholosha, S. Mesnager, Niho bent functions and Subiaco hyperovals. Contemp. Math. AMS 579, 91–101 (2012). Proceedings of the 10-th International Conference on Finite Fields and Their Applications (Fq’10)Google Scholar
  41. 41.
    S. Kavut, S. Maitra, M.D. Yücel, Search for Boolean functions with excellent profiles in the rotation symmetric class. IEEE Trans. Inf. Theory 53(5), 1743–1751 (2007)CrossRefMATHGoogle Scholar
  42. 42.
    K. Khoo, G. Gong, D. Stinson, A new characterization of semi-bent and bent functions on finite fields. Des. Codes Cryptogr. 38, 279–295 (2006)CrossRefMATHMathSciNetGoogle Scholar
  43. 43.
    P. Langevin, G. Leander, Counting all bent functions in dimension eight 99270589265934370305785861242880. Des. Codes Cryptogr. 59(1–3), 193–205 (2011)CrossRefMATHMathSciNetGoogle Scholar
  44. 44.
    G. Leander, Monomial bent functions, in Proceedings of WCC 2006 (2005), pp. 462–470; and IEEE Trans. Inf. Theory 52(2), 738–743 (2006)Google Scholar
  45. 45.
    G. Leander, A. Kholosha, Bent functions with 2r Niho exponents. IEEE Trans. Inform. Theory 52, 5529–5532 (2006)CrossRefMATHMathSciNetGoogle Scholar
  46. 46.
    N. Li, T. Helleseth, X. Tang, A. Kholosha, Several new classes of bent functions From Dillon exponents. IEEE Trans. Inf. Theory 59(3), 1818–1831 (2013)CrossRefMathSciNetGoogle Scholar
  47. 47.
    P. Lisoněk, M. Marko, On zeros of Kloosterman sums. Des. Codes Cryptogr. 59, 223–230 (2011)CrossRefMATHMathSciNetGoogle Scholar
  48. 48.
    W. Ma, M. Lee, F. Zhang, A new class of bent functions. EICE Trans. Fundam. E88-A(7), 2039–2040 (2005)CrossRefGoogle Scholar
  49. 49.
    F.J. MacWilliams, N.J. Sloane, The Theory of Error-Correcting Codes (North-Holland, Amsterdam, 1977)MATHGoogle Scholar
  50. 50.
    S. Mesnager, A new family of hyper-bent Boolean functions in polynomial form, in Proceedings of Twelfth International Conference on Cryptography and Coding (IMACC 2009). Lecture Notes in Computer Science, vol. 5921 (Springer, Heidelberg, 2009), pp. 402–417Google Scholar
  51. 51.
    S. Mesnager, Hyper-bent Boolean functions with multiple trace terms, in Proceedings of International Workshop on the Arithmetic of Finite Fields (WAIFI 2010). Lecture Notes in Computer Science, vol. 6087 (2010), pp. 97–113Google Scholar
  52. 52.
    S. Mesnager, A new class of bent and hyper-bent Boolean functions in polynomial forms. Des. Codes Cryptogr. 59(1–3), 265–279 (2011) (see also proceedings of WCC 2009)Google Scholar
  53. 53.
    S. Mesnager, Bent and hyper-bent functions in polynomial form and their link with some exponential sums and Dickson polynomials. IEEE Trans. Inf. Theory 57(9), 5996–6009 (2011)CrossRefMathSciNetGoogle Scholar
  54. 54.
    S. Mesnager, Semi-bent functions from Dillon and Niho exponents, Kloosterman sums, and Dickson polynomials. IEEE Trans. Inform. Theory 57, 7443–7458 (2011)CrossRefMathSciNetGoogle Scholar
  55. 55.
    S. Mesnager, J.P. Flori, Hyper-bent functions via Dillon-like exponents. IEEE Trans. Inf. Theory 59(5), 3215–3232 (2013)CrossRefMathSciNetGoogle Scholar
  56. 56.
    G.L. Mullen, D. Panario, Handbook of Finite Fields. Series: Discrete Mathematics and Its Applications (CRC Press, West Palm Beach, 2013)MATHGoogle Scholar
  57. 57.
    S. Perlis, Normal bases of cyclic fields of prime-power degree. Duke Math J. 9, 507–517 (1942)CrossRefMATHMathSciNetGoogle Scholar
  58. 58.
    J. Pieprzyk, C. Qu, Fast Hashing and rotation symmetric functions. J. Univ. Comput. Sci. 5, 20–31 (1999)MathSciNetGoogle Scholar
  59. 59.
    O.S. Rothaus, On bent functions. J. Combin. Theory Ser. A 20, 300–305 (1976)CrossRefMATHMathSciNetGoogle Scholar
  60. 60.
    R. Singh, B. Sarma, A. Saikia, Public key cryptography using permutation p-polynomials over finite fields. IACR Cryptology ePrint Archive 2009: 208 (2009)Google Scholar
  61. 61.
    P. Stǎnicǎ, S. Maitra, Rotation symmetric Boolean functions-count and cryptographic properties. Discrete Appl. Math. 156, 1567–1580 (2008)CrossRefMathSciNetGoogle Scholar
  62. 62.
    P. Stǎnicǎ, S. Maitra, J. Clark, Results on rotation symmetric bent and correlation immune Boolean functions, in Proceedings of Fast Software Encryption 2004. Lecture Notes in Computer Science, vol. 3017 (2004), pp. 161–177CrossRefGoogle Scholar
  63. 63.
    N. Tokareva, On the number of bent functions from iterative constructions: lower bounds and hypotheses. Adv. Math. Commun. 5(4), 609–621 (2011)CrossRefMATHMathSciNetGoogle Scholar
  64. 64.
    A.M. Youssef, G. Gong, Hyper-bent functions, in Proceedings of EUROCRYPT 2001. Lecture Notes in Computer Science, vol. 2045 (2001), pp. 406–419CrossRefMathSciNetGoogle Scholar
  65. 65.
    N.Y. Yu, G. Gong, Construction of quadratic bent functions in polynomial forms. IEEE Trans. Inf. Theory 7(52), 3291–3299 (2006)MathSciNetGoogle Scholar
  66. 66.
    F. Zhang, C. Carlet, Y. Hu, W. Zhang, New secondary constructions of bent functions. Preprint, 2013Google Scholar

Copyright information

© Springer International Publishing Switzerland 2014

Authors and Affiliations

  1. 1.LAGAUniversities of Paris 8 and Paris 13, CNRS, UMR 7539ParisFrance
  2. 2.Department of MathematicsUniversity of Paris 8Saint-Denis cedex 02France

Personalised recommendations