# Open Problems on Binary Bent Functions

## Abstract

This chapter gives a survey of the recent results on Boolean bent functions and lists some open problems in this domain. It includes also new results. We recall the definitions and basic results, including known and new characterizations of bent functions; we describe the constructions (primary and secondary; known and new) and give the known infinite classes, in multivariate representation and in trace representation (univariate and bivariate). We also focus on the particular class of rotation symmetric (RS) bent functions and on the related notion of bent idempotent: we give the known infinite classes and secondary constructions of such functions, and we describe the properties of a recently introduced transformation of RS functions into idempotents.

## 1 Introduction

Boolean functions are functions from \(\mathbb{F}_{2}^{n}\) to \(\mathbb{F}_{2}\), where *n* is some positive integer called the number of variables. They play a role in almost all the domains of computer science. We are more interested here in their relationship with error-correcting codes and private-key cryptography. Multi-output Boolean functions are functions from \(\mathbb{F}_{2}^{n}\) to \(\mathbb{F}_{2}^{m}\) for some *m* (to specify that *m* = 1, we can speak of single-output Boolean function, but even without such precision, “Boolean function” without writing “vectorial” will imply single output).

A binary error-correcting code of a given length *N* is a subset *C* of \(\mathbb{F}_{2}^{N}\). Each information to be sent over a noisy channel is encoded before transmission by the sender into an element of *C* (a codeword); if *d* is the minimum Hamming distance between two distinct codewords (called the minimum distance of the code), such encoding allows theoretically the receiver to correct up to \(e = \left [\frac{d-1} {2} \right ]\) binary errors in the transmission of a codeword (*e* is called the error correction capability of the code). When the code has length *N* = 2^{n}, the codewords can be interpreted as Boolean functions (some order on the elements of \(\mathbb{F}_{2}^{n}\) being chosen beforehand). Reed-Muller codes [49] are examples of such codes defined as sets of Boolean functions. Any code of length *N* can be viewed itself as the support of an *N*-variable function, and some notions on codes (e.g., the dual distance) correspond to notions on Boolean functions (e.g., correlation immunity), but we shall not address this here.

Private-key cryptosystems (stream ciphers, which encrypt at a bit level, and block ciphers, which encrypt block by block) allow exchanging confidentially large-size data over a public channel. With such conventional symmetric ciphers, it is necessary to possess the secret encryption key (resp. the secret decryption key, which is in general equal to the encryption key, and is supposed to have been safely shared in advance between the sender and the receiver) for being able to encrypt (resp. decrypt) messages.^{1} For reasons of speed, these cryptosystems involve linear operations, and for reasons of resistance to attacks, they need also to involve some amount of nonlinearity, often brought by single-output or multi-output Boolean functions. There are several ways of quantifying how nonlinear (i.e., different from linear functions) a given Boolean function can be. The main parameter for such quantification is the so-called *nonlinearity*, equal to the minimum Hamming distance between the function and all affine functions (i.e., sums of a linear function and a binary constant). The nonlinearity of any *n*-variable Boolean function is bounded above by \(2^{n-1} - 2^{n/2-1}\). The functions achieving this bound with equality exist only for *n* even since the nonlinearity is an integer (in fact, they exist if and only if *n* is even). They are called *bent*. Such bent functions are not directly used in stream ciphers because bentness makes impossible the function to be balanced (i.e., to have output uniformly distributed over \(\mathbb{F}_{2}\)), and this induces a statistical correlation between the plaintext and the ciphertext; bentness also implies other cryptographic weaknesses. But bent functions can be involved in the substitution boxes (S-boxes) of block ciphers, whose role is also to bring some amount of nonlinearity (allowing to resist the differential and linear attacks), and the study of bent functions and those of Boolean functions for stream ciphers and of S-boxes for block ciphers are closely related.

Bent functions are involved in codes such as the Kerdock codes (see Sect. 3.4). They are also related to combinatorics (e.g., difference sets; see Sect. 2.2.1), design theory (any difference set can be used to construct a symmetric design), and sequence theory (see [16]).

Bent functions have been studied in numerous papers. A survey on Boolean bent functions is given in [11, Sect. 8.6] (and complements on non-binary bent functions, that we do not address here, can be found in [56]). The purpose of this chapter is to complete this survey on Boolean bent functions with results which appeared after the publication of [11] (and with a few original results) and to focus on open problems.

## 2 Boolean Bent Functions: Definitions and Basic Results

### 2.1 Representations of Affine Boolean Functions

*multivariate representation*, that is, writing the input

*x*as a vector \((x_{1},\ldots,x_{n})\) of \(\mathbb{F}_{2}^{n}\), in the form

*n*-dimensional vector space over \(\mathbb{F}_{2}\)). This allows to use the trace function \(\mathrm{Tr}_{1}^{n}(x) = x + x^{2} + x^{2^{2} } + \cdots + x^{2^{n-1} }\) as a basic linear form over \(\mathbb{F}_{2^{n}}\), and any affine function of \(x \in \mathbb{F}_{2^{n}}\) can then be written in the so-called

*univariate trace representation*:

*bivariate trace representation*. For

*n*even, we identify \(\mathbb{F}_{2}^{n}\) with \(\mathbb{F}_{2^{n/2}} \times \mathbb{F}_{2^{n/2}}\), and every affine Boolean function of \((x,y) \in \mathbb{F}_{2^{n/2}} \times \mathbb{F}_{2^{n/2}}\) can then be expressed as

### 2.2 Corresponding Expressions for the Walsh Transform of Boolean Functions, Nonlinearity, and Bentness

The Walsh transform of a Boolean function calculates the correlations between the function and linear Boolean functions.

*m*=

*n*∕2), we take:

*Hamming distance*between two functions equals by definition the

*Hamming weight*of their difference (i.e., their sum):

*nonlinearity nl*(

*f*) of a Boolean function

*f*equals by definition the minimum Hamming distance between

*f*and affine functions. It is a simple matter to show that

^{n}and this implies the so-called

*covering radius bound*:

*n*; the functions achieving it with equality are called

*bent*; the Walsh transforms of bent functions take values ± 2

^{n∕2}, only. The

*dual*\(\tilde{f}\) of a bent function

*f*is the function defined on \(\mathbb{F}_{2}^{n}\) by

*n*∕2 terms in the algebraic normal form (ANF, see also below) of bent functions and their duals are recalled in [11]. Self-dual bent functions are studied in [21].

#### 2.2.1 Characterizations of Bent Functions

Any Boolean function

*f*is bent if and only if for any nonzero vector*a*, the so-called*derivative D*_{a}*f*(*x*) =*f*(*x*) +*f*(*x*+*a*) (sum mod 2) is balanced (i.e., has Hamming weight 2^{n−1}or equivalently satisfies \(\sum _{x\in \mathbb{F}_{2}^{n}}(-1)^{D_{a}f(x)} = 0\)) [59], since we have \(\sum _{a\in \mathbb{F}_{2}^{n}}\left ((-1)^{a\cdot b}\sum _{x\in \mathbb{F}_{2}^{n}}(-1)^{D_{a}f(x)}\right ) =\widehat{\chi _{f}}^{2}(b)\) and \(\sum _{b\in \mathbb{F}_{2}^{n}}\widehat{\chi _{f}}^{2}(b)(-1)^{a\cdot b} = 2^{n}\sum _{x\in \mathbb{F}_{2}^{n}}(-1)^{D_{a}f(x)}\). The fact that \(\sum _{b\in \mathbb{F}_{2}^{n}}(-1)^{a\cdot b}\) equals 2^{n}if*a*= 0 and is null otherwise completes the proof of the equivalence.Bent functions are also called

*perfect nonlinear*and are equivalently the indicators of*difference sets*in elementary Abelian 2-groups [28].An

*n*-variable Boolean function*f*is bent if and only if \(\sum _{a\in \mathbb{F}_{2}^{n}}\widehat{\chi _{f}}^{4}(a)\) equals 2^{3n}(which, by the Cauchy–Schwarz inequality and the Parseval relation, is the minimum possible value).It is shown in [11] that:

### Theorem 1

*A pair of n-variable Boolean functions f and f*^{′}*satisfies, for every*\(a,b \in \mathbb{F}_{2}^{n}\)*, the relation*\(\sum _{x\in \mathbb{F}_{2}^{n}}(-1)^{D_{a}f^{{\prime}}(x)+b\cdot x } =\sum _{x\in \mathbb{F}_{2}^{n}}(-1)^{D_{b}f(x)+a\cdot x}\)*if and only if f and f*^{′}*are bent and are the duals of each other, up to the addition of constant 1. Moreover, for any bent function f, we have*\(\sum _{x\in \mathbb{F}_{2}^{n}}(-1)^{D_{a}\tilde{f}(x)+b\cdot x} =\sum _{x\in \mathbb{F}_{ 2}^{n}}(-1)^{D_{b}f(x)+a\cdot x} = 0\)*when a ⋅ b = 1.*

For

*n*-variable Boolean functions*f*and*f*^{′}, we have \(\sum _{x,y\in \mathbb{F}_{2}^{n}}(-1)^{f(x)+f^{{\prime}}(y)+x\cdot y } = 2^{-n}\sum _{x,y,z\in \mathbb{F}_{2}^{n}}(-1)^{f(x)+(x+z)\cdot y}\widehat{\chi _{f^{{\prime}}}}(z) =\sum _{x\in \mathbb{F}_{2}^{n}}(-1)^{f(x)}\widehat{\chi _{f^{{\prime}}}}(x) \leq \sum _{x\in \mathbb{F}_{2}^{n}}\vert \widehat{\chi _{f^{{\prime}}}}(x)\vert \leq \sqrt{2^{n } \sum _{x\in \mathbb{F}_{2 }^{n } } \widehat{\chi _{f^{{\prime} } } }^{2 } (x)} = 2^{3n/2}\), and this bound \(\sum _{x,y\in \mathbb{F}_{2}^{n}}(-1)^{f(x)+f^{{\prime}}(y)+x\cdot y } \leq 2^{3n/2}\) is achieved with equality if and only if both inequalities above are equalities, that is, if and only if \(\vert \widehat{\chi _{f^{{\prime}}}}(x)\vert\) is constant and (−1)^{f(x)}is the sign of \(\widehat{\chi _{f^{{\prime}}}}(x)\) for every*x*, that is, if and only if*f*^{′}is bent and \(\widetilde{f^{{\prime}}} = f\). This gives one more characterization of bent functions:

### Theorem 2

*For every pair of n-variable Boolean functions f and f*

^{′}

*, we have*

*with equality if and only if f and f*

^{′}

*are bent and are the duals of each other.*

In particular, a Boolean function *f* is bent and self-dual if and only if the so-called *Rayleigh quotient*\(\sum _{x,y\in \mathbb{F}_{2}^{n}}(-1)^{f(x)+f(y)+x\cdot y}\) equals 2^{3n∕2}; this particular result was given in [21], but as far as we know, the general characterization of Theorem 2 is new. It has the interest of characterizing bent functions with a single character sum.

More characterizations are given in [11].

#### 2.2.2 Number of Bent Functions

The number of bent functions is known only for *n* ≤ 8 [43]. For larger values of *n*, only bounds are known. In particular, an upper bound exists [11, 17]. Comparing the bound and the actual value for *n* = 8 shows that the bound is weak (but it could not be improved during the last 10 years).

### Open Problem 1:

Bound more efficiently the number of *n*-variable bent functions (i.e., improve upon the bound of [17]).

#### 2.2.3 Other Properties

We shall not list here all the properties of bent functions. We refer to the survey [11], in particular for the relationship with the sum-of-square indicator, with nonhomomorphicity, with codes, for the description of super-classes of Boolean functions and of bent sequences and for normal extensions of bent functions.

### 2.3 Equivalence of Boolean Functions

It seems elusive to determine all bent functions. This has been done for *n* ≤ 8 only, and doing it for *n* = 8 was a difficult work [43]. An important subject of research is then to find constructions of bent functions leading to infinite classes of bent functions, or to find directly such infinite classes, after computer investigation. When a class is obtained, it remains to see if at least some of its elements are really new. Indeed, given a bent function, some simple transformations allow to obtain other bent functions; we say then that the known function and the functions we can obtain from it are equivalent (when the correspondence results in an equivalence relation); an infinite class is new if some of its elements are inequivalent to all previously known bent functions. We describe now the relevant notions of equivalence for bent functions.

*automorphism group*of the set of bent functions

*general affine group*:

*σ*(

*x*) =

*x*×

*A*+

*a*(

*A*invertible matrix over \(\mathbb{F}_{2}\)) [11]. Two functions

*f*and

*f*∘

*σ*are then called

*affinely equivalent*(and

*f*(

*x*) and

*f*(

*x*×

*A*) are called linearly equivalent).

If *f* is bent and *ℓ* is affine, then *f* + *ℓ* is bent (sum mod 2). Two functions *f* and *f* ∘*σ* + *ℓ* are called *EA-equivalent*, and a class of bent functions is called *complete* if it is globally invariant under EA-equivalence. The completed version of a class is the set of all functions EA-equivalent to the functions in the class.

Another notion of equivalence called CCZ-equivalence [3, 20] exists and is more general than EA-equivalence for vectorial functions, but it is known from [1, 2] that for Boolean functions and for bent (Boolean or vectorial) functions, CCZ-equivalence coincides with EA-equivalence.

Note that X.-D. Hou and P. Langevin have made an observation reported in [11] showing that under some condition on a permutation *σ*, composing a bent function with *σ* may give another bent function. But this cannot be viewed as an equivalence since the condition on *σ* is hard to achieve.

### 2.4 Representations of Boolean Functions

Each representation of affine functions generalizes to a representation of general Boolean functions, useful for studying bent functions.

#### 2.4.1 Multivariate Representation

*ANF*:

*The algebraic degree* of a Boolean function *f* is the global degree of its ANF. The *r th-order Reed-Muller code* of length 2^{n} equals by definition the set of *n*-variable Boolean functions (identified with binary vectors of length 2^{n}) of algebraic degrees at most *r*.

An important property of bent functions is that *their algebraic degrees are bounded above by n∕2* [59].

A function *f* is called *quadratic* if it has algebraic degree 2, *cubic* if it has algebraic degree 3. We are able to characterize the ANF of bent functions only for quadratic functions: a quadratic Boolean function is bent if and only if it is affinely equivalent to \(x_{1}x_{2} + x_{3}x_{4} + \cdots + x_{n-1}x_{n}\) or \(x_{1}x_{2} + x_{3}x_{4} + \cdots + x_{n-1}x_{n} + 1\). Another characterization exists: according to the first result recalled in Sect. 2.2.1 and since all derivatives of a quadratic function are affine and are then balanced if and only if they are nonconstant, any quadratic function *f* is bent if and only if the so-called linear kernel of *f*, equal to the set of elements *a* such that *D*_{a}*f* is constant, equals {0}. See more in [11].

Another representation of Boolean functions called the numerical normal form (NNF) and a related notion of degree called numerical degree exist (see the details in [11]), allowing characterizing bent functions. As far as we know, no recent result has been found on this relationship.

### Open Problem 2:

The following question is posed by Tokareva in [63]: do the sums of two bent functions cover all Boolean functions of algebraic degrees at most *n*∕2? Intuitively, the reply to this question would seem negative, for general *n*. However, the reply is shown by Tokareva to be yes for *n* = 4, 6 and for several classes of bent functions; it seems difficult to prove that the reply is no, in general: the usual parameters and properties of Boolean functions (ANF, NNF and numerical degree, generalized degree, divisibility of the Fourier transform or of the coefficients of the NNF, other properties of the Fourier or Walsh transform values) do not seem to allow discriminating sums of two bent functions from other Boolean functions of degrees at most *n*∕2. Note that a positive reply to Tokareva’s question would automatically imply a lower bound on the number of bent functions.

#### 2.4.2 Univariate and Bivariate Representations: Trace Representations

*univariate representation*

*f*is Boolean if and only if:

*trace representation*:

\(a_{2^{n}-1} \in \mathbb{F}_{2}\) equals the Hamming weight of

*f*modulo 2,\(\Gamma _{n}\) is the set of integers obtained by choosing one element in each cyclotomic coset of 2 mod 2

^{n}− 1,*o*(*j*) is the size of the cyclotomic coset containing*j*,and \(a_{j} \in \mathbb{F}_{2^{o(j)}}\).

In both univariate and trace representations (1), resp. (2), the algebraic degree equals: \(\max \{w_{2}(j);\;j\,\vert \,a_{j}\neq 0\},\) where *w*_{2}(*j*) is the Hamming weight of the binary expansion of *j* [11] (in particular, the univariate trace representation of a bent function does not involve the term \(x^{2^{n}-1 }\)).

We have also \(f(x) = \mathrm{Tr}_{1}^{n}(P(x))\) for some polynomial *P*(*x*), but this representation is not unique and does not allow a general (simple) expression for the algebraic degree.

*The bivariate representation*is based on the identification \(\mathbb{F}_{2}^{n} \approx \mathbb{F}_{2^{m}} \times \mathbb{F}_{2^{m}}\) and has the form:

*a*

_{i, j}in (3) can be derived from the univariate representation: choosing a basis (

*α*,

*β*) of \(\mathbb{F}_{2^{n}}\) over \(\mathbb{F}_{2^{m}}\) allows to express the input of

*f*in the form

*α x*+

*β y*, and expanding (

*α x*+

*β y*)

^{i}in (1) gives (3) after reduction modulo \(x^{2^{m} } + x\) and \(y^{2^{m} } + y\). The uniqueness comes from the fact that the number of polynomials (3) equals the number \((2^{n})^{2^{m}\times 2^{m} }\) of functions from \(\mathbb{F}_{2^{m}} \times \mathbb{F}_{2^{m}}\) to \(\mathbb{F}_{2^{n}}\) and that a surjective mapping from a finite set to a set of the same size is a bijection.

The function is Boolean if and only if the expression \((\sum _{0\leq i,j\leq 2^{m}-1}a_{i,j}x^{i}y^{j})^{2}\) equals \(\sum _{0\leq i,j\leq 2^{m}-1}a_{i,j}x^{i}y^{j}\) in the quotient algebra \(\mathbb{F}_{2^{n}}[x,y]/(x^{2^{m} } + x,y^{2^{m} } + y)\), that is, if *a*_{i, j}^{2} = *a*_{2i, 2j} for every (*i*, *j*), where 2*i* (resp. 2*j*) is replaced by 2*i* − (2^{m} − 1) if 2*i* ≥ *m* (resp. if 2*j* ≥ *m*).

This condition implies in particular that \(a_{i,j}^{2^{m} } = a_{i,j}\), that is, \(a_{i,j} \in \mathbb{F}_{2^{m}}\) (which can be directly deduced from \((\sum _{0\leq i,j\leq 2^{m}-1}a_{i,j}x^{i}y^{j})^{2} \equiv \sum _{0\leq i,j\leq 2^{m}-1}a_{i,j}x^{i}y^{j}\) [mod \((x^{2^{m} } + x,y^{2^{m} } + y)\)]).

*bivariate trace representation*:

\(a_{2^{m}-1,2^{m}-1} \in \mathbb{F}_{2}\) equals the Hamming weight of

*f*modulo 2,\(\Gamma _{m}^{{\prime}}\) is a set obtained by choosing one ordered pair in each cyclotomic class of 2 modulo 2

^{m}− 1 in \(\{0,\ldots,2^{m} - 2\} \times \{ 0,\ldots,2^{m} - 2\}\),\(\Gamma _{m}\) is a set obtained by choosing one element in each cyclotomic coset of 2 modulo 2

^{m}− 1 (in \(\{0,\ldots,2^{m} - 2\}\)),*o*(*i*,*j*) is the size of the equivalence class containing (*i*,*j*), and*o*(*i*) is the size of the cyclotomic coset containing*i*,and \(a_{i,j} \in \mathbb{F}_{2^{o(i,j)}}\), \(a_{j} \in \mathbb{F}_{2^{o(j)}}\).

The algebraic degree of *f*(*x*, *y*) equals \(\max _{(i,j)\,\vert \,a_{i,j}\neq 0}(w_{2}(i) + w_{2}(j))\) in (3) and (4). In particular, the bivariate trace representation of a bent function does not involve any of the terms \(x^{2^{m}-1 }y^{2^{m}-1 }\), \(y^{2^{m}-1 }\mathrm{Tr}_{1}^{o(i)}(a_{i,2^{m}-1}x^{i})\), *i* ≠ 0 and \(x^{2^{m}-1 }\mathrm{Tr}_{1}^{o(j)}(a_{2^{m}-1,j}y^{j})\), *j* ≠ 0).

As in the case of univariate representation, the simpler representation \(f(x,y) = \mathrm{Tr}_{1}^{m}(P(x,y))\) (where *P*(*x*, *y*) is a polynomial over \(\mathbb{F}_{2^{m}}\)) exists but is not unique.

## 3 Known Infinite Classes of Boolean Bent Functions

In all the rest of this chapter, *n* is even and we denote *n*∕2 by *m*.

### 3.1 Basic Constructions in Multivariate Representation

*Maiorana–McFarland*(MM) construction, the input is represented in the form (

*x*,

*y*) where \(x,y \in \mathbb{F}_{2}^{m}\). Given \(\pi: \mathbb{F}_{2}^{m}\mapsto \mathbb{F}_{2}^{m}\) and \(g: \mathbb{F}_{2}^{m}\mapsto \mathbb{F}_{2}\), the function:

*π*is a permutation on \(\mathbb{F}_{2}^{m}\).

The dual function equals: \(\tilde{f}(x,y) = y \cdot \pi ^{-1}(x) + g(\pi ^{-1}(x))\).

The truth table of an MM function is the concatenation of the truth tables of the affine functions \(x\mapsto x \cdot \pi (y) + g(y)\) (in *m* variables). Completed MM class is the *widest known class* of bent functions. It covers all bent functions for *n* ≤ 6 and all quadratic bent functions; but, for *n* = 8, it has size negligible with respect to all bent functions.

*Generalizations of MM construction*(see [11]):

MM class has been modified by the addition of indicators of flats

- it has been generalized in diverse ways:
concatenations of quadratic functions,

concatenations of indicators of flats,

more complex concatenations (these constructions are more efficient for designing resilient functions than bent functions, though),

it has also been generalized into a secondary construction (see Sect. 4).

A construction including MM and PS

_{ap}(see below) was given by Dobbertin.

### 3.2 Known Infinite Classes of Bent Functions in Univariate Trace Form

\(f(x) = \mathrm{Tr}_{1}^{n}\left (\mathit{ax}^{2^{j}+1 }\right )\), where \(a \in \mathbb{F}_{2^{n}}\setminus \{x^{2^{j}+1 };\,x \in \mathbb{F}_{2^{n}}\}\), \(\frac{n} {\gcd (j,n)}\) even (the bentness of such function is directly deduced from the characterization recalled above of bent quadratic functions). This class has been generalized by Yu and Gong in [65] to functions of the form \(\mathrm{Tr}_{1}^{n}(\sum _{i=1}^{m-1}a_{i}x^{2^{i}+1 }) + c_{m}Tr_{1}^{m}(a_{m}x^{2^{m}+1 })\). Being quadratic, these functions belong to the completed MM class.

\(f(x) = \mathrm{Tr}_{1}^{n}\left (\mathit{ax}^{2^{2j}-2^{j}+1 }\right )\), where \(a \in \mathbb{F}_{2^{n}}\setminus \{x^{3};\,x \in \mathbb{F}_{2^{n}}\}\), gcd(

*j*,*n*) = 1 [29].\(f(x) = \mathrm{Tr}_{1}^{n}\left (\mathit{ax}^{(2^{n/4}+1)^{2} }\right ),\) where

*n*≡ 4 [mod 8], \(a = a^{{\prime}}b^{(2^{n/4}+1)^{2} }\), \(a^{{\prime}}\in w\mathbb{F}_{2^{n/4}}\), \(w \in \mathbb{F}_{4}\setminus \mathbb{F}_{2}\), \(b \in \mathbb{F}_{2^{n}}\) (Leander [44], see also [24]); the functions in this class belong to the completed MM class.\(f(x) = \mathrm{Tr}_{1}^{n}\left (\mathit{ax}^{2^{n/3}+2^{n/6}+1 }\right )\), where 6 |

*n*, \(a = a^{{\prime}}b^{2^{n/3}+2^{n/6}+1 }\), \(a^{{\prime}}\in \mathbb{F}_{2^{m}}\), \(\mathrm{Tr}_{m/3}^{m}(a^{{\prime}}) = 0\), \(b \in \mathbb{F}_{2^{n}}\) [6]; the functions in this class belong to the completed MM class.\(f(x) = \mathrm{Tr}_{1}^{n}\left (a[x^{2^{i}+1 } + (x^{2^{i} } + x + 1)\mathrm{Tr}_{1}^{n}(x^{2^{i}+1 })]\right )\), where

*n*≥ 6,*m*does not divide*i*, \(\frac{n} {\gcd (i,n)}\) even, \(a \in \mathbb{F}_{2^{n}}\setminus \mathbb{F}_{2^{i}}\), \(\{a,a + 1\} \cap \{ x^{2^{i}+1 };\,x \in \mathbb{F}_{2^{n}}\} = \varnothing\) [2]. These functions belong to the completed MM class when \(a \in \mathbb{F}_{2^{m}}\).\(f(x) = \mathrm{Tr}_{1}^{n}\big(a\big[\big(x + \mathrm{Tr}_{3}^{n}\big(x^{2(2^{i}+1) } + x^{4(2^{i}+1) }\big)\)

\(+\mathrm{Tr}_{1}^{n}(x)\mathrm{Tr}_{3}^{n}\big(x^{2^{i}+1 } + x^{2^{2i}(2^{i}+1) }\big)\big)^{2^{i}+1 }\big]\big)\), where 6 |

*n*,*m*does not divide*i*, \(\frac{n} {\gcd (i,n)}\) even, \(b + d + d^{2}\not\in \{x^{2^{i}+1 };\,x \in \mathbb{F}_{2^{n}}\}\) for every \(d \in \mathbb{F}_{2^{3}}\) [2]. These functions are EA-inequivalent to functions in MM.*Niho bent functions*[31] whose restrictions to the cosets \(u\mathbb{F}_{2^{m}}\) are linear. These functions can be written:$$\displaystyle{f(x) = \mathrm{Tr}_{1}^{m}(\mathit{ax}^{2^{m}+1 }) + \mathrm{Tr}_{1}^{n}(bx^{d});\;b = 0\text{ or }a = b^{2^{m}+1 } \in \mathbb{F}_{2^{m}}^{\star }.}$$The values of*d*are such that:- 1.
*d*= (2^{m}− 1) 3 + 1 (the original condition \(\exists u \in \mathbb{F}_{2^{n}}\,s.t.\,b = u^{5}\) if*m*≡ 2 [mod 4] has been shown not useful by Helleseth–Kholosha–Mesnager [40]), - 2.
\(d = (2^{m} - 1)\frac{1} {4} + 1\) (

*m*odd), - 3.
\(d = (2^{m} - 1)\frac{1} {6} + 1\) (

*m*even).

Classes 1 and 3 are not EA-equivalent to MM functions [5]. Class 2 is in completed MM class. In classes 1 (for

*m*≢ 2 [mod 4]), 2, and 3, we can up to EA-equivalence fix*b*= 1.Extension of the second class [45]:where$$\displaystyle{\mathrm{Tr}_{1}^{m}(x^{2^{m}+1 }) + \mathrm{Tr}_{1}^{n}\big(\sum _{ i=1}^{2^{r-1}-1 }t^{s_{i} }\big),}$$*r*> 1 and gcd(*r*,*m*) = 1,\(s_{i} = (2^{m} - 1)\left ( \frac{i} {2^{r}}[\mod 2^{m} + 1]\right ) + 1\), \(i \in \{ 1,\ldots,2^{r-1} - 1\}\).

- 1.
*Dillon’s and generalized Dillon’s functions*[23, 28, 46]: let gcd(*r*, 2^{m}+ 1) = 1 and \(a \in \mathbb{F}_{2^{n}}^{{\ast}}\), thenis bent if and only if$$\displaystyle{f(x) = \mathrm{Tr}_{1}^{n}(\mathit{ax}^{r(2^{m}-1) })}$$where \(K(u) =\sum _{x\in \mathbb{F}_{2^{m}}}\mathrm{Tr}_{1}^{m}\left (ux + \frac{1} {x}\right )\), \(u \in \mathbb{F}_{2^{m}}\), is a Kloosterman sum.$$\displaystyle{K(a^{2^{m}+1 }) = 0,}$$This class has been generalized to functions:where$$\displaystyle\begin{array}{rcl} & \mathrm{Tr}_{1}^{n}\left (\sum _{r\in R}a_{r}x^{r(2^{m}-1) }\right ), & {}\\ &\mathrm{Tr }_{1 }^{n }\left (\mathit{ax}^{r(2^{m}-1) } + \mathit{bx}^{\left (\frac{q+1} {e} -l\right )(2^{m}-1) } + cx^{\left (\frac{q+1} {e} +l\right )(2^{m}-1) }\right ) + \mathrm{Tr}_{1}^{\ell}\left (\epsilon x^{\frac{2^{n}-1} {e} }\right ),& {}\\ & \mathrm{Tr}_{1}^{n}\left (\sum _{i\in D}\mathit{ax}^{(ri+s)(2^{m}-1) }\right ) + \mathrm{Tr}_{1}^{\ell}\left (\epsilon x^{\frac{2^{n}-1} {e} }\right ), & {}\\ \end{array}$$*ℓ*|*n*and*e*| 2^{ℓ}− 1.Two explicit classes are given in [37]: \(\sum _{i=1}^{2^{m-1}-1 }\mathrm{Tr}_{1}^{n}\left (\beta x^{i(2^{m}-1) }\right )\), where \(\beta \in \mathbb{F}_{2^{m}}\setminus \mathbb{F}_{2}\) and \(\sum _{i=1}^{2^{m-2}-1 }\mathrm{Tr}_{1}^{n}\left (\beta x^{i(2^{m}-1) }\right )\), where

*m*is odd, \(\beta \in \mathbb{F}_{2^{m}}^{{\ast}}\), \(\mathrm{Tr}_{1}^{m}\left (\beta ^{(2^{m}-4)^{-1} }\right ) = 0\).*Mesnager’s functions*[52, 53]: let \(\gcd (r,2^{m} + 1) = 1;\;m\text{ odd }> 3;\;a \in \mathbb{F}_{2^{n}}^{{\ast}},b \in \mathbb{F}_{2^{2}}^{{\ast}}\), thenis bent if and only if$$\displaystyle{f(x) = \mathrm{Tr}_{1}^{n}(\mathit{ax}^{r(2^{m}-1) }) + \mathrm{Tr}_{1}^{2}(\mathit{bx}^{\frac{2^{n}-1} {3} })}$$$$\displaystyle{K(a^{2^{m}+1 }) = 4.}$$This class can be extended to the case

*m*even, but no necessary and sufficient condition is known in this case.Generalizations exist by Mesnager [51] and Mesnager–Flori [55] to functions using trace functions in other subfields, including the class of functions \(f(x) = \mathrm{Tr}_{1}^{n}(\mathit{ax}^{r(2^{m}-1) }) + \mathrm{Tr}_{1}^{4}(\mathit{bx}^{\frac{2^{n}-1} {5} })\).

### Open Problem 3:

Characterize the cases of bentness for Mesnager’s functions when *m* is even.

*Mesnager’s functions, second class*[50]: let*m*odd, \(a \in \mathbb{F}_{2^{n}}^{{\ast}},b \in \mathbb{F}_{2^{2}}^{{\ast}}\), thenis bent if and only if \(m\not\equiv 3\text{ [mod 6] and }\Big(\mathrm{Tr}_{1}^{m}(a^{\frac{2^{m}+1} {3} }) = 0\text{ and }K\Big(a^{2^{m}+1 }\Big) = 4\Big)\text{ or }\Big(\mathrm{Tr}_{1}^{m}(a^{\frac{2^{m}+1} {3} }) = 1\text{ and }a\not\in \mathbb{F}_{2^{m}}\text{ and }K\Big(a^{2^{m}+1 }\Big)+C\Big(a^{2^{m}+1 }\Big) = 4\Big),\) where \(C(u) =\sum _{x\in \mathbb{F}_{2^{m}}}\mathrm{Tr}_{1}^{m}\left (u(x^{3} + x)\right )\).$$\displaystyle{f(x) = \mathrm{Tr}_{1}^{n}(\mathit{ax}^{3(2^{m}-1) }) + \mathrm{Tr}_{1}^{2}(\mathit{bx}^{\frac{2^{n}-1} {3} })}$$Finally, bent functions have been also obtained by Dillon and McGuire [30] as the restrictions of functions on \(\mathbb{F}_{2^{n+1}}\), with

*n*+ 1 odd, to a hyperplane of this field: these functions are the Kasami functions \(\mathit{tr}_{n}\left (x^{2^{2k}-2^{k}+1 }\right )\), and the hyperplane has equation*tr*_{n}(*x*) = 0. The restriction is bent under the condition that*n*+ 1 = 3*k*± 1.

### Remark 1

These classes are small for each *n*. Moreover, many of them belong to completed MM class, when viewed in multivariate representation, and their bentness may then seem easily explained. However, finding bent functions in univariate trace form is in general difficult and presents theoretical interest, since it gives more insight on bent functions. Note also that the output to such functions is often faster to compute thanks to their particular form.

### Open Problem 4:

find more univariate classes. It has been checked that all *monomial* bent functions \(\mathrm{Tr}_{1}^{n}(\mathit{ax}^{i})\) are covered by the four first classes of bent functions described above and by Dillon’s class for *n* ≤ 20.

### 3.3 Known Infinite Classes of Bent Functions in Bivariate Trace Form

MM class can be viewed in bivariate form. Its elements are the functions \(f(x,y) = \mathrm{Tr}_{1}^{m}(x\,\pi (y)) + g(y);\;x,y \in \mathbb{F}_{2^{m}}\), where

*π*is a permutation on \(\mathbb{F}_{2^{m}}\).*Dillon’s PS*_{ap}*class*: \(f(x,y) = g(\mathit{xy}^{2^{m}-2 }) = g\left (\frac{x} {y}\right )\), where*g*is any balanced Boolean function on \(\mathbb{F}_{2^{m}}\). The dual equals \(g\left (\frac{y} {x}\right )\).This class is much larger than the classes above but much smaller than the MM class. It contains, up to EA-equivalence, the generalized Dillon’s functions and the Mesnager functions. The functions in this class are, when viewed in univariate form, those bent functions whose restrictions to the cosets \(u\mathbb{F}_{2^{m}}^{{\ast}}\) are constant. They are

*hyperbent*:*f*(*x*^{s}) is bent for every*s*co-prime with 2^{n}− 1 (see more in [14, 64] on hyperbent functions).

### Open Problem 5:

Find hyperbent functions EA-inequivalent to *PS*_{ap} functions in more than 4 variables (a sporadic example exists in 4 variables [14]).

*PS*_{ap} class is included in the more general Dillon’s *PS* class (see [28]), which has itself been generalized to the *GPS* class (see [11]), which covers all bent functions up to EA-equivalence [38].

An isolated class [11]: \(f(x,y) = \mathrm{Tr}_{1}^{m}(x^{2^{i}+1 } + y^{2^{i}+1 } + \mathit{xy})\), \(x,y \in \mathbb{F}_{2^{m}}\), where

*n*is co-prime with 3 and*i*is co-prime with*m*.*Functions related to Dillon’s H class and o-polynomials*: In his thesis [28], J. Dillon had introduced several classes of functions. Some of these classes were merely constructions since the functions in them needed to satisfy some conditions difficult to achieve. One of such classes was class*H*, whose elements had linear restrictions to the lines through the origin of the \(\mathbb{F}_{2^{m}}\)-vector space \(\mathbb{F}_{2^{m}} \times \mathbb{F}_{2^{m}}\). J. Dillon had not found inside it functions which were not already in previously defined classes. More than 35 years later, the condition for a function to be in class*H*was connected with a classical notion in finite geometry.

### Definition 1

Let *m* be any positive integer. A permutation polynomial *G* over \(\mathbb{F}_{2^{m}}\) is called an o-polynomial if, for every \(\gamma \in \mathbb{F}_{2^{m}}\), the function \(z \in \mathbb{F}_{2^{m}}\mapsto \left \{\begin{array}{l} \frac{G(z+\gamma )+G(\gamma )} {z} \text{ if }z\neq 0\\ 0\text{ if } z = 0 \end{array} \right.\) is a permutation.

### Theorem 3 ([18])

*Any Boolean function of the form*

*that is, having linear restrictions to the lines through the origin of the two-dimensional vector space*\(\mathbb{F}_{2^{m}} \times \mathbb{F}_{2^{m}}\)

*, is bent if and only if G(z):= H(z) + μz is an o-polynomial.*

The class of such functions is denoted by \(\mathcal{H}\); its elements are EA-equivalent to functions in class *H*.

- 1.
*m*odd:\(f(x,y) = \mathrm{Tr}_{1}^{m}(x^{-5}y^{6})\);

\(f(x,y) = \mathrm{Tr}_{1}^{m}(x^{\frac{5} {6} }\,y^{\frac{1} {6} })\);

- 2.
*m*= 2*k*− 1:\(f(x,y) = \mathrm{Tr}_{1}^{m}(x^{-3\cdot (2^{k}+1) }y^{3\cdot 2^{k}+4 })\);

\(f(x,y) = \mathrm{Tr}_{1}^{m}(x^{2^{m}-3\cdot 2^{k-1}+2 }y^{3\cdot 2^{k-1}-2 })\);

- 3.
*m*= 4*k*− 1:\(f(x,y) = \mathrm{Tr}_{1}^{m}(x^{2^{m}-2^{k}-2^{2k} }y^{2^{k}+2^{2k} })\);

\(f(x,y) = \mathrm{Tr}_{1}^{m}(x^{2^{3k-1}-2^{2k}+2^{k} }y^{2^{m}-2^{3k-1}+2^{2k}-2^{k} })\);

- 4.
*m*= 4*k*+ 1:\(f(x,y) = \mathrm{Tr}_{1}^{m}(x^{2^{m}-2^{2k+1}-2^{3k+1} }y^{2^{2k+1}+2^{3k+1} })\);

\(f(x,y) = \mathrm{Tr}_{1}^{m}(x^{2^{3k+1}-2^{2k+1}+2^{k} }y^{2^{m}-2^{3k+1}+2^{2k+1}-2^{k} })\);

- 5.
*m*= 2*k*− 1:\(f(x,y) = \mathrm{Tr}_{1}^{m}(x^{1-2^{k} }y^{2^{k} } + x^{-(2^{k}+1) }y^{2^{k}+2 } + x^{-3\cdot (2^{k}+1) }y^{3\cdot 2^{k}+4 })\);

\(f(x,y) = \mathrm{Tr}_{1}^{m}\left (\frac{x\left (\frac{y} {x}+1+\frac{y^{2^{k} }} {x^{2^{k}}}\right )\frac{y^{2^{k-1} }} {x^{2^{k-1}}} } { \frac{y^{2^{k}}} {x^{2^{k}}}+\frac{y^{2}} {x^{2}} +1} \right )\);

- 6.
*m*odd:\(f(x,y) = \mathrm{Tr}_{1}^{m}(x^{\frac{5} {6} }y^{\frac{1} {6} } + x^{\frac{3} {6} }y^{\frac{3} {6} } + x^{\frac{1} {6} }y^{\frac{5} {6} }) = D_{5}((y/x)^{6})\);

\(f(x,y) = \mathrm{Tr}_{1}^{m}\left (x\left [D_{\frac{1} {5} }\left (\frac{y} {x}\right )\right ]^{6}\right )\); \(D_{\frac{1} {5} }\) Dickson polynomial.

- 7.Four functions related to the two more o-polynomials:
\(\frac{\delta ^{2}(z^{4}+z)+\delta ^{2}(1+\delta +\delta ^{2})(z^{3}+z^{2})} {z^{4}+\delta ^{2}z^{2}+1} + z^{1/2}\), where \(\mathrm{Tr}_{1}^{m}(1/\delta ) = 1\) and, if

*m*≡ 2 [mod 4], then \(\delta \not\in \mathbb{F}_{4^{}}\);\(\frac{\mathrm{Tr}_{m}^{n}(v^{r})(z+1)+\mathrm{Tr}_{ m}^{n}\left [(vz+v^{2^{m}})^{r}\right ]\left (z+\mathrm{Tr}_{ m}^{n}(v)z^{1/2}+1\right )^{1-r}} {\mathrm{Tr}_{m}^{n}(v)} + z^{1/2}\), where

*m*is even, \(r = \pm \frac{2^{m}-1} {3}\), \(v \in \mathbb{F}_{2^{2m}}\), \(v^{2^{m}+1 } = 1\), and*v*≠ 1.

### Open Problem 6:

Clarify the relation between EA-equivalence of Niho bent functions and equivalence of the corresponding o-polynomials/hyperovals.

### Open Problem 7:

Find more univariate Niho bent functions having simple expression, related to the two last classes of o-polynomials.

*Bent functions associated to AB functions*:

### Definition 2

*nonlinearity*of a

*vectorial function*\(F: \mathbb{F}_{2}^{n} \rightarrow \mathbb{F}_{2}^{n}\) (resp. \(\mathbb{F}_{2^{n}} \rightarrow \mathbb{F}_{2^{n}}\text{)}\) equals:

*F*is

*almost bent (AB)*if \(\mathit{nl}(F) = 2^{n-1} - 2^{\frac{n-1} {2} }\), which is the best possible value (see more in [12]).

### Theorem 4 ([20])

*Let F be a function from*\(\mathbb{F}_{2}^{m}\)

*to itself. Then F is AB if and only if*\(\gamma _{F}: \left (\mathbb{F}_{2^{m}}\right )^{2} \rightarrow \mathbb{F}_{2}\)

*defined by*

*is bent. The dual function satisfies*

The known AB power functions *F*(*x*) = *x*^{d}, \(x \in \mathbb{F}_{2^{m}}\) are given in Table 1.

Known AB power functions *x*^{d} on \(\mathbb{F}_{2^{m}}\)

Functions | Exponents | Conditions | |
---|---|---|---|

Gold | 2 | gcd( | |

Kasami | 2 | gcd( | |

Welch | 2 |
| |

Niho | \(2^{k} + 2^{\frac{k} {2} } - 1\), |
| |

\(2^{k} + 2^{\frac{3k+1} {2} } - 1\), |

*γ*

_{F}are studied in [4]. We give them below:

*Gold:*\(\gamma _{F}(a,b) = \mathrm{Tr}_{1}^{m}\big( \frac{b} {a^{2^{i}+1}} \big)\) with \(\frac{1} {0} = 0\);

*Kasami, Welch, Niho*:\(F(x + 1) + F(x) = q(x^{2^{s} } + x)\) (

*q*permutation determined by Dobbertin, gcd(*s*,*m*) = 1);

*F*(

*x*+ 1) +

*F*(

*x*) =

*b*has solutions if and only if \(\mathrm{Tr}_{1}^{m}(q^{-1}(b)) = 0\).

- Kasami:
*s*=*i*, \(q(x) = \frac{x^{2^{i}+1}} {\sum _{j=1}^{i^{{\prime}}}x^{2^{ji}}+\alpha \mathrm{Tr}_{ 1}^{m}(x)} + 1,\) where$$\displaystyle{i^{{\prime}}\equiv 1/i\mod m,\,\alpha = \left \{\begin{array}{l} 0\text{ if }i^{{\prime}}\text{ is odd} \\ 1\text{ otherwise} \end{array} \right..}$$ Welch:

*s*=*k*, \(q(x) = x^{2^{k+1}+1 } + x^{3} + x + 1\).- Niho:
*s*=*k*∕2 if*k*is even and*s*= (3*k*+ 1)∕2 if*k*is odd, \(q(x) = \left \{\begin{array}{ll} \frac{1} {g(x^{2^{s}-1})+1} + 1&\text{ if }x\notin \mathbb{F}_{2} \\ 1 &\text{ otherwise } \end{array} \right.\) where$$\displaystyle{g(x) = x^{2^{2s+1}+2^{s+1}+1 } + x^{2^{2s+1}+2^{s+1}-1 } + x^{2^{2s+1}+1 } + x^{2^{2s+1}-1 } + x}$$The functions

*γ*_{F}associated to Kasami, Welch, and Niho functions with*m*= 7, 9 are neither in the completed MM class nor in the completed PSap class.

*γ*

_{F}belong to the completed MM class.

*Open Problem 8*:Find infinite classes of bent functions whose bivariate trace representation (4) involves several values of

*o*(*i*,*j*).

### 3.4 Bent Functions in Hybrid Form and Kerdock Codes

*u*is bent as well.

It is easily shown that any code of length 2^{n} (i.e., any set of Boolean functions) equal to the union of at least two cosets of the first-order Reed-Muller code RM(1,n) has minimum distance bounded above by \(2^{n-1} - 2^{m-1}\), with equality if and only if all the differences between the elements of two distinct cosets are bent functions.

The Kerdock code of length 2^{n} (*n* ≥ 4 even) equals the union of all the cosets *f*_{u} + *RM*(1, *n*) where *u* ranges over \(\mathbb{F}_{2^{n-1}}\). It is an optimal code (it was shown by Delsarte that no code exists with better parameters, e.g., with smaller length, same size, and same minimum distance, or larger size, same length, and same minimum distance, or larger minimum distance, same length, and same size).

*Open Problem 9*:Find a code with the same parameters as the Kerdock code (for instance, find a set of 2

^{n−1}− 1 bent functions in*n*variables whose pairwise sums are also bent) and which is not equivalent to a subcode of the second-order Reed-Muller code.

### 3.5 Determining the Duals of Bent Functions in Univariate Form

### Lemma 1

*Let (u,v) be an autodual basis of*\(\mathbb{F}_{2^{n}}\)*over*\(\mathbb{F}_{2^{m}}\)*. Let f be bent over*\(\mathbb{F}_{2^{n}}\)*and g(x,y) = f(ux + vy),*\(x,y \in \mathbb{F}_{2^{m}}\)*.*

*Then:*

*v*be such that \(\mathrm{Tr}_{m}^{n}(v) = 1\) and \(b^{4} = a^{2}v^{2^{m}-1 }\). Then

*f*).

The dual of the Kholosha-Leander extension of class 2 has also been determined [5].

*Open Problem 10*:Determine the duals of Niho bent functions 1 and 3.

The duals of Mesnager’s functions have been determined [50, 52, 53].

## 4 Secondary Constructions of Bent Functions

We call secondary a construction of bent functions from already known bent functions, in the same numbers of variables or not (while primary constructions, like Maiorana-McFarland construction, build bent functions from scratch).

### 4.1 A Maiorana-McFarland-Like Construction

Let *r*, *s* be two positive integers such that *n* = *r* + *s* is even and *r* < *s*. Let \(\phi: \mathbb{F}_{2}^{s}\mapsto \mathbb{F}_{2}^{r}\) be such that *ϕ*^{−1}(*a*) is an (*s* − *r*)-dimensional affine subspace of \(\mathbb{F}_{2}^{s}\), for every \(a \in \mathbb{F}_{2}^{r}\), and let *g* be a Boolean function on \(\mathbb{F}_{2}^{s}\) whose restriction to *ϕ*^{−1}(*a*) is bent, for every \(a \in \mathbb{F}_{2}^{r}\).

Then \(f(x,y) = x \cdot \phi (y) + g(y);\;x \in \mathbb{F}_{2}^{r},y \in \mathbb{F}_{2}^{s},\) is bent on \(\mathbb{F}_{2}^{n}\).

### 4.2 Adding the Indicator of a Flat

The condition for preserving bentness when adding the indicator of an affine subspace of \(\mathbb{F}_{2}^{n}\) is given in [7] and recalled in [11].

### 4.3 A Secondary Construction Which Does Not Increase the Number of Variables

*f*

_{1},

*f*

_{2}, and

*f*

_{3}be three Boolean functions on \(\mathbb{F}_{2}^{n}\). Let \(s_{1} = f_{1} + f_{2} + f_{3}\) and \(s_{2} = f_{1}f_{2} + f_{1}f_{3} + f_{2}f_{3}\). Then

*f*

_{1},

*f*

_{2}, and

*f*

_{3}are bent, then:

if

*s*_{1}is bent and if \(\tilde{s_{1}} =\tilde{ f_{1}} +\tilde{ f_{2}} +\tilde{ f_{3}}\), then*s*_{2}is bent, and \(\tilde{s_{2}} =\tilde{ f_{1}}\tilde{f_{2}} +\tilde{ f_{1}}\tilde{f_{3}} +\tilde{ f_{2}}\tilde{f_{3}}\);if \(\widehat{\mathrm{s}_{2}{{}_{_{\chi }}}}(a)\) is divisible by 2

^{m}for every*a*(*e.g.,*if*s*_{2}is bent), then*s*_{1}is bent [10].

*Open Problem 11*:Deduce significantly new and large classes of bent functions from this construction (classes are found in [10], but they are a little peculiar).

### 4.4 Rothaus’ Construction

*f*

_{1},

*f*

_{2},

*f*

_{3}be bent functions on \(\mathbb{F}_{2}^{n}\) such that \(f_{1} + f_{2} + f_{3}\) is bent as well, then the function on \(\mathbb{F}_{2}^{n+2}\):

#### 4.4.1 Designing the Initial Functions in the Rothaus Construction

### Definition 3

A permutation *π* on \(\mathbb{F}_{2}^{m}\) is called an *orthomorphic permutation* if the function *π* + *Id*, where *Id*(*x*) = *x*, is also a permutation.

### Theorem 5 ([22])

*Let π be a permutation on*\(\mathbb{F}_{2}^{m}\)

*. Let ϕ and ψ be orthomorphic permutations on*\(\mathbb{F}_{2}^{m}\)

*. Let*\(g_{1},g_{2},g_{3}\)

*be three m-variable Boolean functions. Let*

*then the four following MM functions are bent:*

\(\begin{array}{l} h_{1}(x,y) = x \cdot \pi _{1}(y) + g_{1}(y), \\ h_{2}(x,y) = x \cdot \pi _{2}(y) + g_{2}(y), \\ h_{3}(x,y) = x \cdot \pi _{3}(y) + g_{3}(y), \\ h_{1} + h_{2} + h_{3}.\end{array}.\)

*Open Problem 12*:Find more general constructions of initial functions for the Rothaus construction.

### 4.5 The Indirect Sum and Its Generalizations

A very general secondary construction of bent functions with initial conditions was given in [8]:

### Theorem 6

*Let f be a Boolean function on*\(\mathbb{F}_{2}^{r+s} = \mathbb{F}_{2}^{r} \times \mathbb{F}_{2}^{s}\)

*, where r, s are even, such that, for any*\(y \in \mathbb{F}_{2}^{s}\)

*, the function on*\(\mathbb{F}_{2}^{r}\)

*:*

*is bent. Then f is bent if and only if for any element u of*\(\mathbb{F}_{2}^{r}\)

*, the function*

*is bent on*\(\mathbb{F}_{2}^{s}\)

*, and the dual of f is the function*\(\tilde{f}(u,v) =\widetilde{\vartheta _{u}}(v)\)

*.*

The Rothaus construction, which uses four bent functions whose sum is null, is a particular case of this construction, corresponding to *r* = 2 (indeed, any function \((x_{n+1},x_{n+2})\mapsto a_{0} + x_{n+1}x_{n+2} + a_{1}x_{n+1} + a_{2}x_{n+2}\) is bent and has dual \(a_{0} + x_{n+1}x_{n+2} + a_{2}x_{n+1} + a_{1}x_{n+2} + a_{1}a_{2}\)). Another particular case, called the *indirect sum*, uses four bent functions as well but is built differently and does not need any initial condition:

### Corollary 1 ([9])

*Let*\(f_{1},f_{2}\)

*be bent on*\(\mathbb{F}_{2}^{r}\)

*(r even) and*\(g_{1},g_{2}\)

*be bent on*\(\mathbb{F}_{2}^{s}\)

*(s even). Define*

*Then h is bent and*

Indeed, any function \(x\mapsto f_{1}(x) + a_{0} + a_{1}(f_{1} + f_{2})(x)\) is bent and has dual \(\tilde{f}_{1}(x) + a_{0} + a_{1}(\tilde{f}_{1} +\tilde{ f}_{2})(x)\). The name of “indirect sum” comes from the name of the well-known *direct sum*, which corresponds simply to \(h(x,y) = f_{1}(x) + g_{1}(y)\), and that the indirect sum generalizes.

A generalization of the indirect sum needing initial conditions is given in [22]:

### Theorem 7

*Let f*

_{1}

*,f*

_{2}

*, and f*

_{3}

*be bent on*\(\mathbb{F}_{2}^{r}\)

*. Let*\(g_{1},g_{2}\)

*, and g*

_{3}

*be bent on*\(\mathbb{F}_{2}^{s}\)

*. Let*\(\nu _{1} = f_{1} + f_{2} + f_{3}\)

*and*\(\nu _{2} = g_{1} + g_{2} + g_{3}\)

*. If ν*

_{1}

*and ν*

_{2}

*are bent and if*\(\widetilde{\nu _{1}} =\widetilde{ f_{1}} +\widetilde{ f_{2}} +\widetilde{ f_{3}}\)

*, then f(x,y) =*

*is a bent function in r + s variables.*

The indirect sum is a particular case of this construction: it corresponds to the case \(f_{2} = f_{3}\) and/or \(g_{2} = g_{3}\). The Rothaus construction is also a particular case.

*Case of application*: Let *p*(*x*) and *θ*(*x*) be *r*-variable bent functions such that there exists \(a \in \mathbb{F}_{2}^{r}\) nonzero such that \(D_{a}p = D_{a}\theta\). We can take \(f_{1}(x) = p(x),f_{2}(x) = p(x + a),f_{3}(x) =\theta (x)\).

Another generalization of the indirect sum is also given in [22]:

### Theorem 8

*Let f*_{0}*,f*_{1}*, f*_{2}*, and f*_{3}*be bent functions on*\(\mathbb{F}_{2}^{r}\)*and g*_{0}*,g*_{1}*, g*_{2}*, and g*_{3}*be bent functions on*\(\mathbb{F}_{2}^{s}\)*.*

*Let*\(\nu _{j} = f_{j} + f_{(j+1)\mathit{mod}\ 4} + f_{(j+2)\mathit{mod}\ 4}\)

*and*\(\varepsilon _{j} = g_{j} + g_{(j+1)\mathit{mod}\ 4} + g_{(j+2)\mathit{mod}\ 4}\)

*, where j = 0,1,2,3. If ν*

_{j}

*and*\(\varepsilon _{j}\)

*are bent functions and if for every j = 0,1,2,3, we have*\(\widetilde{\nu _{j}} =\widetilde{ f_{j}} + \tilde{f}_{(j+1)\mathit{mod}\ 4} + \tilde{f}_{(j+2)\mathit{mod}\ 4}\)

*, then f(x,y) =*

*Case of application*: under the same conditions as in the case of application of Theorem 7 (let *p*(*x*) and *θ*(*x*) be *r*-variable bent functions such that there exists a nonzero vector \(a \in \mathbb{F}_{2}^{r}\) such that \(D_{a}p = D_{a}\theta\)), we can take \(f_{0}(x) = p(x),f_{1}(x) = p(x + a),f_{2}(x) =\theta (x)\) and *f*_{3}(*x*) = *θ*(*x* + *a*).

#### 4.5.1 A Modification of the Indirect Sum

A modified indirect sum is introduced in [66]:

### Theorem 9

*Let n and m be two positive even numbers and*\(\mu \in \{ 1,2,\ldots,n\}\)

*,*\(\rho \in \{ 1,2,\ldots,\ m\}\)

*. For*\(x = (x_{1},\ldots,x_{n}) \in \mathbb{F}_{2}^{n}\)

*and*\(y = (y_{1},\ldots,y_{m}) \in \mathbb{F}_{2}^{m}\)

*, let*\(x^{{\prime}} = (x_{1},\ldots,x_{\mu -1},x_{\mu +1},\ldots,x_{n}) \in \mathbb{F}_{2}^{n-1}\)

*and*\(y^{{\prime}} = (y_{1},\ldots,y_{\rho -1},\ y_{\rho +1},\ldots,y_{m}) \in \mathbb{F}_{2}^{m-1}\)

*. Let f be an n-variable bent function and g an m-variable bent function. We consider the restrictions of f and g:*\(f_{0}(x^{{\prime}}) = f(x_{1},\ldots,x_{\mu -1},0,x_{\mu +1},\ldots,x_{n})\)

*,*\(f_{1}(x^{{\prime}}) = f(x_{1},\ldots,x_{\mu -1},1,x_{\mu +1},\ \ldots,x_{n})\)

*,*\(g_{0}(y^{{\prime}})\,=\,g(y_{1},\ldots,y_{\rho -1},0,y_{\rho +1},\ \ldots,y_{m})\)

*,*\(g_{1}(y^{{\prime}}) = g(y_{1},\ldots,\ y_{\rho -1},1,y_{\rho +1},\ldots,y_{m})\)

*, and we define*

*Then h is a bent function in n + m − 2 variables. Further, the dual of h is obtained from the functions*\(\overline{f_{0}}(x^{{\prime}}) = \tilde{f}(x_{1},\ldots,x_{\mu -1},0,x_{\mu +1},\ldots,x_{n})\)

*,*\(\overline{f_{1}}(x^{{\prime}}) = \tilde{f}(x_{1},\ldots,x_{\mu -1},1,\ x_{\mu +1},\ldots,x_{n})\)

*,*\(\overline{g_{0}}(y^{{\prime}}) = \tilde{g}(y_{1},\ldots,y_{\rho -1},0,y_{\rho +1},\ldots,\ y_{m})\)

*and*\(\overline{g_{1}}(y^{{\prime}}) = \tilde{g}(y_{1},\ldots,y_{\rho -1},\ 1,y_{\rho +1},\ldots,y_{m})\)

*, by the same formula as h is obtained from*\(f_{0},f_{1},g_{0}\)

*, and g*

_{1}

*.*

#### 4.5.2 A New Secondary Construction

We have seen just before Theorem 2 that, given two Boolean functions *f* and *f*^{′}, we have \(\sum _{x,y\in \mathbb{F}_{2}^{n}}(-1)^{f(x)+f^{{\prime}}(y)+x\cdot y } =\sum _{x\in \mathbb{F}_{2}^{n}}(-1)^{f(x)}\widehat{\chi _{f^{{\prime}}}}(x)\). If *f*^{′} is bent, then we deduce \(\sum _{x,y\in \mathbb{F}_{2}^{n}}(-1)^{f(x)+f^{{\prime}}(y)+x\cdot y } = 2^{m}\sum _{x\in \mathbb{F}_{2}^{n}}(-1)^{f(x)+\widetilde{f^{{\prime}}}(x) }\). This implies that, for every \(a,b \in \mathbb{F}_{2}^{n}\), we have \(\sum _{x,y\in \mathbb{F}_{2}^{n}}(-1)^{f(x)+f^{{\prime}}(y)+x\cdot y+a\cdot x+b\cdot y } =\sum _{x,y\in \mathbb{F}_{2}^{n}}(-1)^{f(x)+a\cdot x+f^{{\prime}}(y)+(x+b)\cdot y } =\sum _{x,y\in \mathbb{F}_{2}^{n}}(-1)^{f(x+b)+a\cdot (x+b)+f^{{\prime}}(y)+x\cdot y }\) equals \(2^{m}(-1)^{a\cdot b}\sum _{x\in \mathbb{F}_{2}^{n}}(-1)^{f(x+b)+a\cdot x+\widetilde{f^{{\prime}}}(x) }\). Denoting \(\widetilde{f^{{\prime}}}\) by *g*, we deduce:

### Proposition 1

*Let f be any n-variable Boolean function and g be any n-variable bent function. Then the 2n-variable function*\(f(x) +\tilde{ g}(y) + x \cdot y\)*is bent if and only if f(x + b) + g(x) is bent for every b (or equivalently f(x) + g(x + b) is bent for every b).*

Note that the bent function \(f(x,y) = \mathrm{Tr}_{1}^{m}(x^{2^{i}+1 } + y^{2^{i}+1 } + \mathit{xy})\), \(x,y \in \mathbb{F}_{2^{m}}\) (recalled in Sect. 3.3), where *n* is co-prime with 3 and *i* is co-prime with *m*, looks like the function of Proposition 1, but its bentness is not a case of application of Proposition 1 since \(\mathrm{Tr}_{1}^{m}(x^{2^{i}+1 })\) is never bent (its linear kernel containing always 1).

If *f* is quadratic, then the condition “*f*(*x* + *b*) + *g*(*x*) is bent for every *b*” in Proposition 1 simplifies in “*f*(*x*) + *g*(*x*) is bent” since *f*(*x*) + *f*(*x* + *b*) is affine. We have then, denoting *f* + *g* by *h*:

### Corollary 2

*If two n-variable bent functions g(x) and h(x) differ by a quadratic function, then the 2n-variable function*\((g + h)(x) + \tilde{g}(y) + x \cdot y\)*is bent.*

Any pairs of quadratic bent functions; for instance, pairs of functions involved in Kerdock codes (see Sect. 3.4);

Maiorana-McFarland functions: let

*π*and*π*^{′}be permutations on \(\mathbb{F}_{2}^{m}\) differing by an affine function (for instance, let*π*be an orthomorphic permutation and*π*^{′}=*π*+*Id*) and let*u*,*v*be two Boolean functions on \(\mathbb{F}_{2}^{m}\) differing by a quadratic function, then we can take \(g(x_{1},x_{2}) = x_{1} \cdot \pi (x_{2}) + u(x_{2})\) and \(h(x_{1},x_{2}) = x_{1} \cdot \pi ^{{\prime}}(x_{2}) + v(x_{2})\); \(x_{1},x_{2} \in \mathbb{F}_{2}^{m}\); these functions can be nonquadratic.

Note that Proposition 1 could have also been proved as a corollary of Theorem 6. In fact, Theorem 6 (or more precisely its version obtained by exchanging the roles of *x* and *y*) allows proving a slightly more general result:

### Theorem 10

*Let f be any n-variable Boolean function, let g be any n-variable bent function and let ϕ be any mapping from*\(\mathbb{F}_{2}^{n}\)*to itself. Then the 2n-variable function*\(f(x) +\tilde{ g}(y) +\phi (x) \cdot y\)*is bent if and only if f(x) + g(ϕ(x) + b) is bent for every b.*

Indeed, for every fixed \(x \in \mathbb{F}_{2}^{n}\), function \(y\mapsto f(x) +\tilde{ g}(y) +\phi (x) \cdot y\) is bent and the value of the dual of this function at \(u \in \mathbb{F}_{2}^{n}\) equals *f*(*x*) + *g*(*y* +*ϕ*(*x*)).

Note that if *g* is quadratic and *ϕ* is an affine permutation, then *f*(*x*) + *g*(*ϕ*(*x*) + *b*) is bent if and only if *f*(*x*) + *g*(*ϕ*(*x*)) is bent. Let then *h*(*x*) be another bent function; then taking *f*(*x*) = *g*(*ϕ*(*x*)) + *h*(*x*), the condition in Theorem 10 is satisfied. We have then:

### Corollary 3

*Let g be any quadratic bent function and ϕ any affine permutation. Let h be any bent function; then the 2n-variable function*\(g(\phi (x)) + h(x) +\tilde{ g}(y) +\phi (x) \cdot y\)*is bent.*

This gives one more case of application of Corollary 2 since the two bent functions \(g(\phi (x)) + h(x) +\tilde{ g}(y) +\phi (x) \cdot y\) and \(h(x) +\tilde{ g}(y)\) differ by a quadratic function.

Another case of application of Theorem 10 is when, for every \(b \in \mathbb{F}_{2}^{n}\), the set \(\{\phi (x) + b;\;x \in \mathbb{F}_{2}^{n}\}\) is either included in the support of *g* or disjoint from it, and *f* is bent.

### Corollary 4

*Let f,g be two n-variable bent Boolean functions and let ϕ be any mapping from*\(\mathbb{F}_{2}^{n}\)*to itself such that*\(Im(\phi ) =\{\phi (x);\;x \in \mathbb{F}_{2}^{n}\}\)*is either included in or disjoint from any translate of* supp *(g). Then the 2n-variable function*\(f(x) +\tilde{ g}(y) +\phi (x) \cdot y\)*is bent.*

Denoting, for every \(E,F \subseteq \mathbb{F}_{2}^{n}\), the set \(\{x + x^{{\prime}};\;x \in E,x^{{\prime}}\in F\}\) by *E* + *F*, the condition on *Im*(*ϕ*) is equivalent to \((Im(\phi ) + Im(\phi )) \cap (\mathrm{supp}(g) + (\mathbb{F}_{2}^{n}\setminus \mathrm{supp}(g))) = \varnothing\).

*n*-variable Boolean functions

*f*and

*g*and a mapping

*ϕ*from \(\mathbb{F}_{2}^{n}\) to itself, let us define

*n*-variable Boolean function has Walsh transform:

*g*is an affine function, then without loss of generality, up to EA-equivalence, we can take

*g*(

*y*) = 0; the support of \(\widehat{\chi _{g}}\) is then {0}, the value of \(\widehat{\chi _{g}}\) at 0 equals 2

^{n}, and

*h*is bent if and only if

*ϕ*is a permutation. This is the Maiorana-McFarland construction.

*g*has Walsh support of a pair, then without loss of generality, up to EA-equivalence, we can take \(g(y) = y_{1}y_{2}\), and we have then \(\mathrm{supp}(\widehat{\chi _{g}}) =\{ x \in \mathbb{F}_{2}^{n}\,\vert \,x_{3} =\ldots = x_{n} = 0\}\) and \(\widehat{\chi _{g}}(x_{1},x_{2},0,\ldots,0) = 2^{n-1}(-1)^{x_{1}x_{2}}\); then

*h*is bent if and only if, for every \(a,b \in \mathbb{F}_{2}^{n}\), we have, denoting by

*ϕ*

_{i}(

*x*) the

*i*th coordinate of

*ϕ*(

*x*):

every pre-image by the mapping \(x\mapsto (\phi _{3}(x),\ldots,\phi _{n}(x))\) is a two-dimensional affine subspace of \(\mathbb{F}_{2}^{n}\),

*ϕ*_{1}(*x*) and*ϕ*_{2}(*x*) are constant on every such pre-image,and the restriction of

*f*to such pre-image has odd Hamming weight,

then *h* is bent. But such construction is close to that of Sect. 4.1 (in which *y* would be replaced by \((x,y_{1},y_{2})\), \(x\) by \((y_{3},\ldots,y_{n})\), *g*(*y*) by \(f(x) + y_{1}y_{2}\), *ϕ*(*y*) by \((\phi _{3}(x),\ldots,\phi _{n}(x))\) and with 2*n* in the place of *n* and *r* = *n* + 2). The only difference is with the terms \(\phi _{1}(x)y_{1} +\phi _{2}(x)y_{2}\) which are present here and are not in the construction of Sect. 4.1.

*Open Problem 15*:Find secondary constructions based on new ideas, if possible without initial conditions.

## 5 Rotation Symmetric (RS) Bent Functions and Idempotent Bent Functions

Rotation symmetric (RS) Boolean functions, which have been originally introduced by Filiol and Fontaine in [32, 33] under the name of idempotent functions and soon after studied by Pieprzyk and Qu [58] under their final name, have received some attention since their introduction. RS structure allowed obtaining Boolean functions in odd numbers of variables beating the best known nonlinearities [41].

RS functions also have the interest of needing less space to be stored and of allowing faster computation of the Walsh transform.

There have been recent developments on RS and idempotent bent functions.

### 5.1 RS Bent Functions

*f*is RS if it is invariant under the cyclic shift:

The dual of an RS bent function is an RS bent function.

The next lemma on quadratic RS functions is more or less known, but, as far as we know, it has never been published.

### Lemma 2

*Let*\(f(x) =\sum _{0\leq i<j\leq n-1}a_{i,j}x_{i}x_{j} +\ell (x)\)*be any quadratic Boolean function, where*\(a_{i,j} \in \mathbb{F}_{2}\)*and ℓ is affine. Let M be the associated matrix (see* [49]), *whose term located at row i and column j equals a*_{i,j}*if i < j, a*_{j,i}*if i > j and 0 if i = j. Then f is RS if and only if M is circulant (i.e., each row of M is a cyclic shift of the previous row) and ℓ is RS.*

### Proof

If *f* is RS, then *ℓ* is RS and \(a_{i+k,j+k} = a_{i,j}\) for every *i* < *j* and every *k*, where the indices are taken in \(\mathbb{Z}/n\mathbb{Z}\). This equality applied for 1 ≤ *k* ≤ *n* − *j* − 1 shows that the part of *M* located at the right of the diagonal is circulant; applied for *n* − *j* ≤ *k* ≤ *n* − *i* − 1, it shows that \(a_{i^{{\prime}},j^{{\prime}}} = a_{i^{{\prime}}+k,j^{{\prime}}+k}\) for every \(i^{{\prime}}> j^{{\prime}}\) and every *k* and the part of *M* located at the left of the diagonal is circulant. And we have also \(a_{i,n-1} = a_{i+1,0}\). Hence, *M* is circulant. The converse is similar. □

#### 5.1.1 Infinite Classes of RS Bent Functions

The situation of RS bent functions is very similar to that of bent functions in trace forms: many of the known classes belong to completed MM class, and their bentness may then seem easily explained. However, finding RS bent functions is difficult and has theoretical and practical interest.

- Quadratic RS bent functions have been characterized in [35] by the fact that some related polynomial
*P*(*X*) over \(\mathbb{F}_{2}\) such that \(X^{n}P\big( \frac{1} {X}\big) = P(X)\) is co-prime with*X*^{n}+ 1: given \(c_{1},\ldots,c_{m}\) in \(\mathbb{F}_{2}\), the function:is bent if and only if the polynomial \(\sum _{i=1}^{m-1}c_{i}(X^{i} + X^{n-i}) + c_{m}X^{m}\) is co-prime with$$\displaystyle{\sum _{i=1}^{m-1}c_{ i}\left (\sum _{j=0}^{n-1}x_{ j}x_{i+j}\right ) + c_{m}\left (\sum _{j=0}^{m-1}x_{ j}x_{m+j}\right )}$$*X*^{n}+ 1. This condition is equivalent to the fact that the linearized polynomial \(L(X) =\sum _{ i=1}^{m-1}c_{i}(X^{2^{i} } + X^{2^{n-i} }) + c_{m}X^{2^{m} }\), which we can write \(\sum _{i=0}^{n-1}c_{i}X^{2^{i} }\) by setting \(c_{n-i} = c_{i}\), is a permutation polynomial (a necessary condition is that*L*(1) ≠ 0, i.e.,*c*_{m}= 1).- An example of such polynomial is with
*c*_{i}= 0 for*i*≠*m*. Another example is with*c*_{i}= 1 for \(i = 1,\ldots,n - 1\) since*L*(*X*) equals then \(X + \mathrm{Tr}_{1}^{n}(X)\) which is a permutation polynomial since*n*is even (equivalently, \(\sum _{i=1}^{n-1}X^{i}\) is co-prime with*X*^{n}+ 1). This provides the two infinite classesand$$\displaystyle{\sum _{j=0}^{m-1}x_{ j}x_{m+j}}$$of quadratic RS bent functions.$$\displaystyle{\sum _{i=1}^{m-1}\left (\sum _{ j=0}^{n-1}x_{ j}x_{i+j}\right ) + \left (\sum _{j=0}^{m-1}x_{ j}x_{m+j}\right )}$$ - More examples can be found. For instance, let
*k*be such that 2^{k}− 2 divides*n*and 2^{k}− 1 is co-prime with*n*. Then \(\left (\frac{X^{2^{k}-1}+1} {X+1} \right )^{ \frac{n} {2^{k}-2} } + X^{n} + 1\) has the form \(\sum _{i=1}^{m-1}c_{i}(X^{i} + X^{n-i}) + c_{m}X^{m}\) (indeed, \(\left (\frac{X^{2^{k}-1}+1} {X+1} \right )^{ \frac{n} {2^{k}-2} }\) is self-reciprocal, has degree*n*, and is normalized) and is co-prime with*X*^{n}+ 1 (indeed, the zeroes of \(\left (\frac{X^{2^{k}-1}+1} {X+1} \right )^{ \frac{n} {2^{k}-2} }\) in the algebraic closure of \(\mathbb{F}_{2}\) are the elements of \(\mathbb{F}_{2^{k}}\setminus \mathbb{F}_{2}\), and for any \(\xi \in \mathbb{F}_{2^{k}}\setminus \mathbb{F}_{2}\), we have*ξ*^{n}+ 1 ≠ 0, since \(\xi \mapsto \xi ^{n}\) is a permutation of \(\mathbb{F}_{2^{k}}^{{\ast}}\)). Taking for example*k*= 2, we have \(\left (X^{2} + X + 1\right )^{m} + X^{n} + 1 =\sum _{{ 0\leq u,v,w\leq m \atop u+v+w=m,2u+v\not\in \{0,n\}} } \frac{m!} {u!v!w!}X^{2u+v}\), and for*n*not divisible by 3, the following function is RS bent:where the coefficients are taken modulo 2.$$\displaystyle{\sum _{{ 0\leq u,v,w\leq m \atop u+v+w=m,2u+v\in \{1,\ldots,m-1\}} } \frac{m!} {u!v!w!}\left (\sum _{j=0}^{n-1}x_{ j}x_{2u+v+j}\right ) + \left (\sum _{j=0}^{m-1}x_{ j}x_{m+j}\right ),}$$ If

*n*is a power of 2, then according to [60, Proposition 3.1], the function \(\sum _{i=1}^{m-1}c_{i}\left (\sum _{j=0}^{n-1}x_{j}x_{i+j}\right ) + c_{m}\left (\sum _{j=0}^{m-1}x_{j}x_{m+j}\right )\) is bent if and only if \(\sum _{i=0}^{n-1}c_{i} = 1\), that is,*c*_{m}= 1. Note that this can also be proved slightly differently: given some normal element*α*of \(\mathbb{F}_{2^{n}}\) (i.e., some element of \(\mathbb{F}_{2^{n}}\) such that \((\alpha,\alpha ^{2},\ldots,\alpha ^{2^{n-1} })\) is a normal basis, i.e., \(\alpha,\alpha ^{2},\ldots,\alpha ^{2^{n-1} }\) are linearly independent), the condition on*L*is equivalent to the fact that \(\sum _{i=0}^{n-1}c_{i}\alpha ^{2^{i} }\) is also a normal element (see more in [57]); according to [56, Corollary 5.2.9], an element*α*of \(\mathbb{F}_{2^{n}}\) is normal if and only if \(\mathrm{Tr}_{1}^{n}(\alpha ) = 1\) (and \(\alpha \not\in \mathbb{F}_{2}\), but this is implied by \(\mathrm{Tr}_{1}^{n}(\alpha ) = 1\) since*n*is even). Hence, \(\sum _{i=0}^{n-1}c_{i}\alpha ^{2^{i} }\) is normal if and only if \(\mathrm{Tr}_{1}^{n}(\sum _{i=0}^{n-1}c_{i}\alpha ^{2^{i} }) = 1\), that is,*c*_{m}= 1. See more at Sect. 5.2.1.

*Open Problem 16*:Find more infinite classes of quadratic RS bent functions, valid for every even

*n*.

Two infinite classes of cubic RS bent functions belonging to the completed MM class were found recently:

*Open Problem 17*:Find more classes of cubic RS bent functions.

### 5.2 Univariate RS Functions (Idempotents), Bivariate Expressions

### Definition 4

*f*(

*x*) be a Boolean function on \(\mathbb{F}_{2^{n}}\). We say that

*f*is an idempotent if

A function \(f(x) =\sum _{ j=0}^{2^{n}-1 }a_{j}\;x^{j}\) or \(f(x) =\sum _{j\in \Gamma _{n}}\mathrm{Tr}_{1}^{o(j)}(a_{j}x^{j}) + a_{2^{m}-1}x^{2^{m}-1 }\) is an idempotent if and only if every coefficient *a*_{j} belongs to \(\mathbb{F}_{2}\).

*f*(

*x*) over \(\mathbb{F}_{2^{n}}\) and every normal basis \((\alpha,\alpha ^{2},\ldots,\alpha ^{2^{n-1} })\) of \(\mathbb{F}_{2^{n}}\), the function

*f*is an idempotent.

### Remark 2

This property leads to a notion of equivalence between RS functions: if two RS functions are linked as above to the same idempotent, through the choices of two normal bases, these two RS functions can be considered as equivalent (note that this is a subcase of linear equivalence). More precisely, given a normal element *α*, another normal element can be written \(\alpha ^{{\prime}} =\sum _{j\in \mathbb{Z}/n\mathbb{Z}}c_{j}\alpha ^{2^{j} }\) where \(x\mapsto \sum _{j\in \mathbb{Z}/n\mathbb{Z}}c_{j}x^{2^{j} }\) is a permutation (if *n* is a power of 2, then this condition is equivalent to \(\sum _{j\in \mathbb{Z}/n\mathbb{Z}}c_{j} = 1\)); the two functions \(g(x_{0},\ldots,x_{n-1}) = f\left (\sum _{i=0}^{n-1}x_{i}\alpha ^{2^{i} }\right )\) and \(g^{{\prime}}(x_{0},\ldots,x_{n-1}) = f\left (\sum _{i=0}^{n-1}x_{i}\alpha ^{{\prime}}{}^{2^{i} }\right )\) are related by the relation \(g^{{\prime}}(\ldots,x_{j},\ldots ) = g(\ldots,\sum _{i\in \mathbb{Z}/n\mathbb{Z}}x_{i}c_{j-i},\ldots )\). In other words, *g*^{′} is deduced from *g* by multiplying the input by a nonsingular circulant matrix (so we can call *circulant-equivalence* this equivalence). We can check that the rotation symmetry of *g* is equivalent to that of *g*^{′} since the shift on the input of *g* corresponds to the inverse shift on the input of *g*^{′} and vice versa.

The related equivalence classes can be large: if, for instance, *n* is a power of 2, then we have recalled above that any element \(\alpha \in \mathbb{F}_{2^{n}}\) is normal if and only if \(\mathrm{Tr}_{1}^{n}(\alpha ) = 1\); there are then 2^{n−1} normal bases, and an equivalence class can potentially have a size near \(\frac{2^{n-1}} {n}\).

Linear equivalence between RS functions is more general than the equivalence above. Even equivalence under permutation of the variables is. For instance, the 8-variable RS functions \(\sum _{i=0}^{7}x_{i}x_{i+1}x_{i+2}x_{i+5}\) and \(\sum _{i=0}^{7}x_{i}x_{i+1}x_{i+3}x_{i+4}\) are equivalent under permutation and not under circulant-equivalence; see [26, Remark 1.10]. Refer more generally to [26] and the references therein for linear and affine equivalences of RS functions.

### Remark 3

Knowing an infinite class of idempotent bent functions is not equivalent to knowing an infinite class of RS bent functions, since there is no expression valid for an infinite number of values of *n* of the decomposition of \(\left (\sum _{i=0}^{n-1}x_{i}\alpha ^{2^{i} }\right )^{j}\) over the normal basis \((\alpha,\alpha ^{2},\ldots,\alpha ^{2^{n-1} })\), except for *j* null or equal to a power of 2.

#### 5.2.1 Known Bent Idempotents

- The function \(f^{{\prime}}(z) = \mathrm{Tr}_{1}^{m}(z^{2^{m}+1 })\) and the function \(f^{{\prime}}(z) = \mathrm{Tr}_{1}^{m}(z^{2^{m}+1 }) +\sum _{ i=1}^{m-1}\mathrm{Tr}_{1}^{n}(z^{2^{i}+1 })\) are bent quadratic idempotents. More generally, given \(c_{1},\ldots,c_{m}\) in \(\mathbb{F}_{2}\), the function equal to \(c_{m}Tr_{1}^{m}(x^{2^{m}+1 }) +\sum _{ i=1}^{m-1}c_{i}Tr_{1}^{n}(x^{2^{i}+1 })\) is bent if and only if \(\gcd (\sum _{i=1}^{m-1}c_{i}(X^{i} + X^{n-i}) + c_{m}X^{m},X^{n} + 1) = 1\) [48]. This condition is the same as that obtained for quadratic RS bent functions in Sect. 5.1.1. The two first classes described in that subsection correspond to the classes of bent idempotents given above. The third example in Sect. 5.1.1 gives a third general example here. For instance, for
*n*not divisible by 3, we have the following bent idempotent:where the coefficients are taken modulo 2. Of course, what is written at Sect. 5.1.1 when$$\displaystyle{\mathrm{Tr}_{1}^{m}(z^{2^{m}+1 }) +\sum _{{ 0\leq u,v,w\leq m \atop u+v+w=m,2u+v\in \{1,\ldots,m-1\}} } \frac{m!} {u!v!w!}\mathrm{Tr}_{1}^{n}(z^{2^{2u+v}+1 }),}$$*n*is a power of 2 is valid here. Note that more results, valid for more general values of*n*, can be found in [65]. - The generalized Dillon and Mesnager functions are potentially bent idempotents, under conditions involving Kloosterman sums:
For every

*m*such that*K*_{m}(1) is null, \(g_{1}(x) = \mathrm{Tr}_{1}^{n}(x^{r(2^{m}-1) })\) is bent when \(\gcd (r,2^{m} + 1) = 1\).For every

*m*odd such that*K*_{m}(1) = 4, \(g_{2}(x) = \mathrm{Tr}_{1}^{n}(x^{r(2^{m}-1) }) + \mathrm{Tr}_{1}^{2}(x^{\frac{2^{n}-1} {3} })\) is bent when gcd(*r*, 2^{m}+ 1) = 1.

But the condition

*K*_{m}(1) = 0 never happens as shown in [47, Theorem 2.2], and it can be checked by computer that the condition*K*_{m}(1) = 4 never happens as well for 5 ≤*m*≤ 20. For

*n*= 2*m*= 6*r*,*r*≥ 1, \(\mathrm{Tr}_{1}^{n}(z^{1+2^{r}+2^{2r} })+\mathrm{Tr}_{1}^{2r}(z^{1+2^{2r}+2^{4r} })+\mathrm{Tr}_{1}^{m}(z^{1+2^{t} }) = \mathrm{Tr}_{1}^{r}((z +z^{2^{3r} })^{1+2^{r}+2^{2r} })+\mathrm{Tr}_{1}^{m}(z^{1+2^{t} })\) is a bent idempotent [36].

### 5.3 Secondary Constructions of Rotation Symmetric and Idempotent Bent Functions

We precise the relationship between RS functions and the bivariate representation of idempotent functions; a proper relationship is between weak RS functions (invariant under circular permutation of indices by two positions) and weak idempotents (a natural notion that we introduce). This gives a way of constructing a new RS *n*-variable function where *n* ≡ 2 [mod 4], from two known semi-bent RS functions in *m* variables, by using the indirect sum (the definition of semi-bent functions is recalled below). It provides an infinite class of RS bent functions of algebraic degree 4 and an infinite class of bent idempotents of algebraic degree 4 as well. This section and the next one are a recall and an extension of results from [15].

#### 5.3.1 Bivariate Representation of Idempotents

Most bent functions being known in bivariate form, it is useful to characterize the bivariate representation of idempotent and RS functions. The situation is easier when *m* is odd (which is the case of most known bent functions).

*w*

^{2}=

*w*+ 1,

*w*

^{4}=

*w*, and we can take (

*w*,

*w*

^{2}) for basis of \(\mathbb{F}_{2^{n}}\) over \(\mathbb{F}_{2^{m}}\), since we have \(\frac{w^{2}} {w} = w\not\in \mathbb{F}_{2^{m}}\) for

*m*odd. Any element of \(\mathbb{F}_{2^{n}}\) can then be written in the form

*xw*+

*yw*

^{2}, where \(x,y \in \mathbb{F}_{2^{m}}\). Note that, given a normal basis \((\alpha,\ldots,\alpha ^{2^{m-1} })\) of \(\mathbb{F}_{2^{m}}\), a natural normal basis of \(\mathbb{F}_{2^{n}}\) over \(\mathbb{F}_{2}\) is

*f*(

*x*,

*y*) in bivariate form, the related Boolean function over \(\mathbb{F}_{2}^{n}\) obtained by decomposing the input

*xw*+

*yw*

^{2}over the basis (7) is then RS if and only if

*f*(

*x*,

*y*) =

*f*(

*y*

^{2},

*x*

^{2}). Note that applying this identity

*m*times gives

*f*(

*x*,

*y*) =

*f*(

*y*,

*x*) and applying it

*m*+ 1 times gives \(f(x,y) = f(x^{2},y^{2})\); the double condition “

*f*(

*x*,

*y*) =

*f*(

*y*,

*x*) and \(f(x,y) = f(x^{2},y^{2})\)” is then necessary and is also sufficient.

*Open Problem 18*:Handle the case

*m*even.

*m*and

*k*be two co-prime integers and

*n*=

*mk*. Let

*α*be a normal element of \(\mathbb{F}_{2^{m}}\) over \(\mathbb{F}_{2}\) and

*w*a normal element of \(\mathbb{F}_{2^{k}}\) over \(\mathbb{F}_{2}\). We know that

*α w*is a normal element of \(\mathbb{F}_{2^{n}}\) over \(\mathbb{F}_{2}\) (see [56, Proposition 5.2.3]. We have then the normal bases \((\alpha,\ldots,\alpha ^{2^{m-1} })\) of \(\mathbb{F}_{2^{m}}\) over \(\mathbb{F}_{2}\) (which is in the same time a basis of \(\mathbb{F}_{2^{n}}\) over \(\mathbb{F}_{2^{k}}\)), \((w,\ldots,w^{2^{k-1} })\) of \(\mathbb{F}_{2^{k}}\) over \(\mathbb{F}_{2}\) (also a basis of \(\mathbb{F}_{2^{n}}\) over \(\mathbb{F}_{2^{m}}\)), and

*k*-variate form (where \(x_{i} \in \mathbb{F}_{2^{m}}\)), the related Boolean function over \(\mathbb{F}_{2}^{n}\) obtained by decomposing \(\sum _{i=0}^{k-1}x_{i}w^{2^{i} }\) over (7) is then RS if and only if

### Proposition 2

*Let m and k be two co-prime integers and n = mk. Let α be a normal element of*\(\mathbb{F}_{2^{m}}\)*over*\(\mathbb{F}_{2}\)*and w a normal element of*\(\mathbb{F}_{2^{k}}\)*over*\(\mathbb{F}_{2}\)*. Then the n-variable Boolean idempotents are those polynomials f(z) representing Boolean functions over*\(\mathbb{F}_{2^{n}}\)*whose associate k-variate expressions, defined as*\(f(x_{0},\ldots,x_{k-1}) = f(\sum _{i=0}^{k-1}x_{i}w^{2^{i} })\)*, satisfy*\(f(x_{0},\ldots,x_{k-1}) = f(\rho _{k}(x_{0}^{2},\ldots,x_{k-1}^{2}))\)*. In particular, if k = 2, the n-variable Boolean idempotents are those polynomials f(z) representing Boolean functions over*\(\mathbb{F}_{2^{n}}\)*whose associate bivariate expressions f(x,y) = f(wx + w*^{2}*y) satisfy*\(f(x,y) = f(y^{2},x^{2})\)*.*

Applying the identity *m* times gives \(f(x_{0},\ldots,x_{k-1}) = f(\rho _{k}^{m}(x_{0},\ldots,x_{k-1}))\), and applying it *k* times gives \(f(x_{0},\ldots,x_{k-1}) = f(x_{0}^{2^{k} },\ldots,x_{k-1}^{2^{k} })\). Since *m* and *k* are co-prime, there exist integers *u* and *v* such that *um* + *vk* = 1. Then applying *u* times the identity \(f(x_{0},\ldots,x_{k-1}) = f(\rho _{k}^{m}(x_{0},\ldots,x_{k-1}))\) and *v* times \(f(x_{0},\ldots,x_{k-1}) = f(x_{0}^{2^{k} },\ldots,x_{k-1}^{2^{k} })\) gives \(f(x_{0},\ldots,x_{k-1}) = f(\rho _{k}(x_{0},\ldots,x_{k-1}))\) and \(f(x_{0},\ldots,x_{k-1}) = f(x_{0}^{2},\ldots,x_{k-1}^{2})\). The double condition “\(f(x_{0},\ldots,x_{k-1}) = f(\rho _{k}(x_{0},\ldots,x_{k-1}))\) and \(f(x_{0},\ldots,x_{k-1}) = f(x_{0}^{2},\ldots,x_{k-1}^{2})\)” is then necessary, and it is also clearly sufficient.

### Definition 5

Under the hypotheses of Proposition 2, we call any polynomial *f*(*z*) whose *k*-variate expression satisfies \(f(x_{0},\ldots,x_{k-1}) = f(x_{0}^{2},\ldots,x_{k-1}^{2})\) a *k -weak idempotent*.

Note that the condition \(f(x_{0},\ldots,x_{k-1}) = f(x_{0}^{2},\ldots,x_{k-1}^{2})\) is equivalent to \(f(x_{0},\ldots,x_{k-1}) = f(x_{0}^{2^{k} },\ldots,x_{k-1}^{2^{k} })\) since *m* and *k* are co-prime.

### Proposition 3

*The set of n-variable idempotent functions is included in that of k-weak idempotents. An idempotent is a k-weak-idempotent invariant under the shift ρ*_{k}*.*

The corresponding definition at the bit level is obtained by decomposing the univariate representation over the normal basis (7) and the *k*-variate representation over the basis \((\alpha,\ldots,\alpha ^{2^{m-1} })\):

### Definition 6

*m*and

*k*be two co-prime integers and

*n*=

*mk*. A Boolean function

*k*and each second index is reduced modulo

*m*) over \(\mathbb{F}_{2}^{n}\) is

*k*-weak RS if it is invariant under the cyclic shift by

*k*positions.

For *n* = 2*m*, *m* odd, we can see that a function \(f(x_{0},y_{1},x_{2},y_{3},\ldots,x_{n-2},y_{n-1})\) (where each index is reduced modulo *m*; we skip the first index) over \(\mathbb{F}_{2}^{n}\) is 2-weak RS if it is invariant under the transformation \(\left \{\begin{array}{l} x_{j}\mapsto x_{j+1} \\ y_{j}\mapsto y_{j+1} \end{array} \right.\).

Such 2-weak RS function is RS if and only if in bivariate form, it is invariant under \((x,y)\mapsto (y,x)\).

### Proposition 4

*A Boolean function*\(f(x_{0,0},y_{1,1},\ldots,x_{n-1,n-1})\)*is RS if and only if it is m-weak RS and k-weak RS.*

We shall call the 2-weak idempotents (resp. the 2-weak RS functions) simply weak idempotents (resp. weak RS functions). An example of a weak RS function is the direct sum *f*(*x*) + *g*(*y*) where *f* and *g* are RS *m*-variable functions; such function is RS when *f* = *g*.

### Remark 4

All the functions derived from o-polynomials with coefficients equal to 1 are bent weak idempotents.

#### 5.3.2 A Secondary Construction of RS and Idempotent Functions

*n*= 2

*m*, an

*n*-variable weak idempotent from two

*m*-variable idempotents. The indirect sum allows constructing, for

*n*= 2

*m*, an

*n*-variable weak idempotent

*h*from four

*m*-variable idempotents \(f_{1},f_{2},g_{1},g_{2}\):

*n*-variable function from two RS

*m*-variable functions (

*n*= 2

*m*,

*m*odd). This function is bent if the two functions are semi-bent.

### Definition 7

For odd *m*, a Boolean function on \(\mathbb{F}_{2}^{m}\) is called semi-bent if its Walsh transform takes values 0 and \(\pm 2^{\frac{m+1} {2} }\) only. See more on semi-bent functions in [19, 25, 42, 54].

### Proposition 5 ([15])

*Let f*_{1}*and f*_{2}*be two m-variable RS semi-bent functions, m odd, and let n = 2m. If the Walsh supports of f*_{1}*and f*_{2}*are complementary, then*\(h(x_{0},y_{1},x_{2},y_{3},\ldots,x_{n-2},y_{n-1}) = f_{1}(x_{0},\ldots,x_{m-1})+f_{1}(y_{0},\ldots,y_{m-1})+(f_{1}+f_{2})(x_{0},\ldots,x_{m-1})(f_{1}+f_{2})(y_{0},\ldots,y_{m-1})\)*is bent RS.*

Indeed, the Walsh transform \(\widehat{\chi _{h}}(a_{0},b_{1},a_{2},b_{3},\ldots,a_{n-2},b_{n-1})\) of *h* is equal to \(\frac{1} {2}\widehat{\chi _{f_{1}}}(a)\left [\widehat{\chi _{f_{1}}}(b) +\widehat{\chi _{f_{2}}}(b)\right ] + \frac{1} {2}\widehat{\chi _{f_{2}}}(a)\left [\widehat{\chi _{f_{1}}}(b) -\widehat{\chi _{f_{2}}}(b)\right ]\) (see [11]).

Note that, according to Parseval’s relation, the Walsh supports of *f*_{1} and *f*_{2} have size 2^{m−1} and then can be complementary. Note also that the secondary construction of Proposition 5 is closely related to that of Theorem 9. It is well known that two *m*-variable functions *f*_{1} and *f*_{2} (*m* odd) are semi-bent with complementary Walsh supports if and only if the (*m* + 1)-variable function \(f(x,x_{m+1}) = f_{1}(x) + x_{m+1}f_{2}(x)\); \(x \in \mathbb{F}_{2^{m}},x_{m+1} \in \mathbb{F}_{2}\), is bent. Indeed, we have \(W_{f}(a,a_{m+1}) = W_{f_{1}}(a) + (-1)^{a_{m+1}}W_{f_{ 2}}(a)\), implying that *f* is bent when *f*_{1} and *f*_{2} are semi-bent with complementary Walsh supports; and we have \(W_{f_{1}}(a) = \frac{1} {2}\left (W_{f}(a,0) + W_{f}(a,1)\right )\) and \(W_{f_{2}}(a) = \frac{1} {2}\left (W_{f}(a,0) - W_{f}(a,1)\right )\), implying that *f*_{1} and *f*_{2} are semi-bent with complementary Walsh supports when *f* is bent. But note that when *f* is RS, *f*_{1} and *f*_{2} are in general not RS, and when *f*_{1} and *f*_{2} are RS, *f* is in general not RS.

*f*

_{1}and

*f*

_{2}to the hyperplanes of equations

*x*

_{m+1}= 0 and

*x*

_{m+1}= 1 are idempotent functions of

*x*. But the resulting function

*h*derived by the indirect sum is quadratic, because \(f_{1} + f_{2}\) is linear, and this reduces its interest. Another example, found in [15], of such a pair \((f_{1},f_{2})\) will yield an infinite class of idempotent bent functions of algebraic degree 4:

### Proposition 6

*For every odd m, the following m-variable idempotent functions*\(f_{1}(x) = \mathit{tr}(x) + \mathit{tr}(x^{2^{(m-1)/2}+1 })\)*and*\(f_{2}(x) = \mathit{tr}(x^{3})\)*are semi-bent functions with complementary Walsh supports.*

### Proof

We know (see [11, Theorem 8.23]) that a quadratic Boolean function *f* over \(\mathbb{F}_{2^{m}}\) has for Walsh support the set of elements \(a \in \mathbb{F}_{2^{m}}\) such that *tr*(*ax*) + *f*(*x*) is constant on *E*_{f} where \(E_{f} =\{ x \in \mathbb{F}_{2^{m}}/\forall y \in \mathbb{F}_{2^{m}},f(x + y) + f(x) + f(y) + f(0) = 0\}\) is the so-called linear kernel of *f*. We also know that function *f* is semi-bent, for *m* odd, if and only if *E*_{f} has dimension 1 (i.e., has size 2). Functions *f*_{1} and *f*_{2} have kernels of equations \(x^{2^{(m-1)/2} } + x^{2^{(m+1)/2} } = 0\) and \(x^{2} + x^{2^{m-1} } = 0\), which are, respectively, equivalent to the equations *x* + *x*^{2} = 0 and *x* + *x*^{4} = 0. These two equations have the same set of solutions, equal to \(\mathbb{F}_{2}\) (using that *m* is odd for the second one). Hence, both functions are semi-bent. The first function *f*_{1} has then Walsh support {*a*∕*tr*(*a*) = 0}, and the second one *f*_{2} has Walsh support {*a*∕*tr*(*a*) + *tr*(1) = 0}; these Walsh supports are complementary since *tr*(1) = 1. □

### Theorem 11 ([15])

*Let n = 2m, m odd. We define the m-variable idempotent functions*\(f_{1}(x) = \mathrm{Tr}_{1}^{m}(x) + \mathrm{Tr}_{1}^{m}(x^{2^{(m-1)/2}+1 })\)*and*\(f_{2}(x) = \mathrm{Tr}_{1}^{m}(x^{3})\)*. Then*\(h(x,y) = f_{1}(x) + f_{1}(y) + (f_{1} + f_{2})(x)\,(f_{1} + f_{2})(y)\)*is a bent idempotent with algebraic degree 4.*

*Similarly, we define the RS functions*\(f_{1}^{{\ast}}(x) =\sum _{ i=0}^{m-1}(x_{i} + x_{i}x_{(m-1)/2+i})\)*and*\(f_{2}^{{\ast}}(x) =\sum _{ i=0}^{m-1}x_{i}x_{1+i}\)*, where the subscripts are taken modulo m. Then function*\(h^{{\ast}}(x_{0},y_{1},x_{2},y_{3},\ldots,x_{n-2},y_{n-1}) = f_{1}^{{\ast}}(x_{0},\ldots,x_{m-1})+f_{1}^{{\ast}}(y_{0},\ldots,y_{m-1})+(f_{1}^{{\ast}}+f_{2}^{{\ast}})(x_{0},\ldots,x_{m-1})(f_{1}^{{\ast}}+f_{2}^{{\ast}})(y_{0},\ldots,y_{m-1})\)*is an RS bent function of algebraic degree 4.*

*Open Problem 19*:Construct classes of RS bent functions of all algebraic degrees between 5 and

*m*.

## 6 A Transformation on Rotation Symmetric Bent Functions

We can observe a correspondence in Theorem 11 between the functions \(f_{1},f_{2},h\) from one hand side and the functions \(f_{1}^{{\ast}},f_{2}^{{\ast}},h^{{\ast}}\) for the other hand side. It is simpler to describe how \(f_{1},f_{2},h\) can be obtained from \(f_{1}^{{\ast}},f_{2}^{{\ast}},h^{{\ast}}\) rather than vice versa. Given an RS Boolean function *f*, we consider the function *f*^{′}(*z*) over the finite field of order 2^{n}, expressed in trace representation and obtained from the ANF of \(f(x_{0},\ldots,x_{n-1})\) by replacing \(x_{i}\) by \(z^{2^{i} }\). Functions \(f_{1},f_{2},h\) are obtained from \(f_{1}^{{\ast}},f_{2}^{{\ast}},h^{{\ast}}\) by the transformation \(f\mapsto f^{{\prime}}\). Given an RS Boolean function *f*, function *f*^{′} happens to be always a Boolean idempotent function (its idempotence is merely related to the fact that *f* is Boolean, and its binarity is related to the fact that *f* is RS).

### Proposition 7 ([15])

*Let*\(f(x_{0},\ldots,x_{n-1})\)

*be any Boolean RS function over*\(\mathbb{F}_{2}^{n}\)

*, then*

*is a Boolean idempotent. In other words, if:*

*is a Boolean idempotent, and any idempotent Boolean function can be obtained this way.*

Note that the trace representation of *f*^{′} is directly deduced from the ANF of *f*, even for infinite classes of functions *f*, and has a very similar shape (note that this is not at all the case between an idempotent function and the related RS function obtained by decomposing the input over a normal basis); the question whether *f* and *f*^{′} (or more coherently the RS function obtained from *f*^{′} by decomposing the input over a normal basis) are the same function up to affine equivalence is then natural. We show now with examples that the two functions are in general affinely inequivalent.

### Examples

If

*f*is the indicator of \(\{(1,0,1,0,\ldots,1,0),(0,1,0,1,\ldots,0,1)\}\), then, as observed in [15], we have \(f^{{\prime}}(z) = z^{\frac{2^{n}-1} {3} }(1 + z)^{\frac{2^{n}-1} {3} }\left ((1 + z)^{\frac{2^{n}-1} {3} } + z^{\frac{2^{n}-1} {3} }\right )\), which has Hamming weight \(2^{n} - 2 -\frac{2^{n}-4} {3}\).If*f*is the indicator of \(\{(0,\ldots,0),(1,\ldots,1)\}\), then*f*^{′}is the indicator of \(\mathbb{F}_{2}\).Hence,

*f*and*f*^{′}can be affinely equivalent or not, and two functions*f*and*g*can be affinely equivalent without that*f*^{′}and*g*^{′}be EA-equivalent.If \(f(x) =\sum _{ i=1}^{n}\left (\prod _{j\neq i}x_{i}\right )\), then

*f*^{′}is the inverse function \(\mathit{tr}(z^{2^{n}-2 })\).

### 6.1 Relationship Between the Bentness of *f* and *f*^{′}

We study the relationship between the bentness of *f* and that of *f*^{′}: we check with infinite classes of RS functions that *f* can be bent when *f*^{′} is not and that *f*^{′} can be bent when *f* is not; we show that if *f* is quadratic, then it is bent if and only if *f*^{′} is bent, and we study classes of bent RS non-quadratic functions *f* for which *f*^{′} is bent.

#### 6.1.1 Quadratic Functions

The characterizations recalled in Sects. 5.1.1 and 5.2.1 for the bentness of quadratic RS functions and bent idempotents, given, respectively, in [35] and [48], are the same. Then:

### Theorem 12

*If f is a quadratic RS function, then f is bent if and only if f*^{′}*is bent.*

#### 6.1.2 An Infinite Class of Cubic Bent RS Functions *f* Such That *f*^{′} Is Not Bent

*n*= 2

*m*and 0 <

*t*<

*m*is such that

*m*∕gcd(

*m*,

*t*) is odd. Then we have recalled that

*f*is bent and it is shown in [15] that

#### 6.1.3 An Infinite Class of Cubic Bent Idempotents *f*^{′} Such That *f* Is Not Bent

*π*is not a permutation, and

*f*is then not bent.

#### 6.1.4 Infinite Classes of Bent RS Functions *f* Such That *f*^{′} Is Bent

A first example is given by Theorem 11. Let us give another example.

*n*= 2

*m*= 6

*r*with

*r*≥ 1.

We know that *f* and \(f^{{\prime}}(z) = \mathrm{Tr}_{1}^{n}(z^{1+2^{r}+2^{2r} })+\mathrm{Tr}_{1}^{2r}(z^{1+2^{2r}+2^{4r} })+\mathrm{Tr}_{1}^{m}(z^{1+2^{t} }) = \mathrm{Tr}_{1}^{r}((z+z^{2^{3r} })^{1+2^{r}+2^{2r} })+\mathrm{Tr}_{1}^{\nu (t)}(z^{1+2^{t} })\) are bent.

Our investigations suggest that searching RS bent functions *f* provides larger probability of success when we choose them such that *f*^{′} is bent and vice versa.

The transformation \(f\mapsto f^{{\prime}}\) is however not an equivalence between RS bent functions; the bent functions are likely to be new under affine equivalence.

*Open Question*:what are the relationships between the cryptographic parameters of

*f*^{′}and those of*f*?

### Conclusion

The research on bent functions continues to be very active. Much work has been done recently. The less recent results which are not recalled in this chapter can be found in [11], and results on bent vectorial functions can be found in [12, 13]. There are many connections with other domains of mathematics and computer science (designs, difference sets, Kloosterman sums, coding, cryptography, sequences, etc.) that we could not detail in this chapter. Important open problems remain (a few evoked in this chapter). Super-classes (partially-bent functions, plateaued functions, etc.), related classes (semi-bent functions), and subclasses (hyperbent functions) pose many problems not evoked here either (see [11]). A complete classification remains elusive.

## Footnotes

- 1.
In public-key cryptography, the only key which must be kept secret is the decryption key, but as far as we know, bent functions play no big role in such ciphers.

## Notes

### Acknowledgments

We thank Thomas Cusick, Guangpu Gao, and Sihem Mesnager for useful information.

### References

- 1.L. Budaghyan, C. Carlet, CCZ-equivalence of single and multi output Boolean functions. AMS Contemp. Math.
**518**, 43–54 (2010). Post-proceedings of the Conference Fq9Google Scholar - 2.L. Budaghyan, C. Carlet, CCZ-equivalence of bent vectorial functions and related constructions. Des. Codes Cryptogr.
**59**(1–3), 69–87 (2011). Post-proceedings of WCC 2009Google Scholar - 3.L. Budaghyan, C. Carlet, A. Pott, New classes of almost bent and almost perfect nonlinear functions. IEEE Trans. Inf. Theory
**52**(3), 1141–1152 (2006)CrossRefMATHMathSciNetGoogle Scholar - 4.L. Budaghyan, C. Carlet, T. Helleseth, On bent functions associated to AB functions, in
*Proceedings of IEEE Information Theory Workshop*, ITW’11, Paraty, October 2011Google Scholar - 5.L. Budaghyan, C. Carlet, T. Helleseth, A. Kholosha, S. Mesnager, Further results on Niho bent functions. IEEE Trans. Inf. Theory
**58**(11), 6979–6985 (2012)CrossRefMathSciNetGoogle Scholar - 6.A. Canteaut, P. Charpin, G. Kyureghyan, A new class of monomial bent functions. Finite Fields Appl.
**14**(1), 221–241 (2008)CrossRefMATHMathSciNetGoogle Scholar - 7.C. Carlet, Two new classes of bent functions, in
*Proceedings of EUROCRYPT’93*. Lecture Notes in Computer Science, vol. 765 (1994), pp. 77–101Google Scholar - 8.C. Carlet, A construction of bent functions, in
*Finite Fields and Applications*. London Mathematical Society. Lecture Series, vol. 233 (Cambridge University Press, Cambridge, 1996), pp. 47–58Google Scholar - 9.C. Carlet, On the secondary constructions of resilient and bent functions, in
*Proceedings of the Workshop on Coding, Cryptography and Combinatorics 2003*(Birkhäuser, Basel, 2004), pp. 3–28Google Scholar - 10.C. Carlet, On bent and highly nonlinear balanced/resilient functions and their algebraic immunities, in
*Proceedings of AAECC 16*. Lecture Notes in Computer Science, vol. 3857 (2006), pp. 1–28CrossRefMathSciNetGoogle Scholar - 11.C. Carlet, Boolean functions for cryptography and error correcting codes. Chapter of the monography, in
*Boolean Models and Methods in Mathematics, Computer Science, and Engineering*, ed. by Y. Crama, P. Hammer (Cambridge University Press, Cambridge, 2010), pp. 257–397. Preliminary version available at http://www-rocq.inria.fr/codes/Claude.Carlet/pubs.html - 12.C. Carlet, Vectorial Boolean functions for cryptography. Chapter of the monography, in
*Boolean Models and Methods in Mathematics, Computer Science, and Engineering*, ed. by Y. Crama, P. Hammer (Cambridge University Press, Cambridge, 2010), pp. 398–469. Preliminary version available at http://www-rocq.inria.fr/codes/Claude.Carlet/pubs.html - 13.C. Carlet, C. Ding, Highly nonlinear mappings. J. Complex.
**20**, 205–244 (2004). Special Issue “Complexity Issues in Coding and Cryptography”, dedicated to Prof. Harald Niederreiter on the occasion of his 60th birthdayGoogle Scholar - 14.C. Carlet, P. Gaborit, Hyper-bent functions and cyclic codes. J. Combin. Theory Ser. A
**113**(3), 466–482 (2006)CrossRefMATHMathSciNetGoogle Scholar - 15.C. Carlet, G. Gao and W. Liu. A secondary construction and a transformation on rotation symmetric functions, and their action on bent and semi-bent functions.
*Journal of Combinatorial Theory, Series A, vol.*127(1), pp. 161–175 (2014).Google Scholar - 16.C. Carlet, T. Helleseth, Sequences, Boolean functions, and cryptography, in
*Handbook of Codes, Sequences and Their Applications*, ed. by S. Boztas (CRC Press, to appear)Google Scholar - 17.C. Carlet, A. Klapper, Upper bounds on the numbers of resilient functions and of bent functions. This paper was meant to appear in an issue of Lecture Notes in Computer Sciences dedicated to Philippe Delsarte, Editor Jean-Jacques Quisquater. But this issue finally never appeared. A shorter version has appeared in the
*Proceedings of the 23rd Symposium on Information Theory in the Benelux*, Louvain-La-Neuve, Belgium, 2002. The results are given in [11]Google Scholar - 18.C. Carlet, S. Mesnager, On Dillon’s class
*H*of bent functions, Niho bent functions and o-polynomials. J. Combin. Theory Ser. A**118**, 2392–2410 (2011)CrossRefMATHMathSciNetGoogle Scholar - 19.C. Carlet, S. Mesnager, On semi-bent Boolean functions. IEEE Trans. Inform. Theory
**58**, 3287–3292 (2012)CrossRefMathSciNetGoogle Scholar - 20.C. Carlet, P. Charpin, V. Zinoviev, Codes, bent functions and permutations suitable for DES-like cryptosystems. Des. Codes Cryptogr.
**15**(2), 125–156 (1998)CrossRefMATHMathSciNetGoogle Scholar - 21.C. Carlet, L.E. Danielsen, M.G. Parker, P. Solé, Self dual bent functions. Int. J. Inf. Coding Theory
**1**(4), 384–399 (2010). Special Issue, dedicated to Vera PlessGoogle Scholar - 22.C. Carlet, F. Zhang, Y. Hu, Secondary constructions of bent functions and their enforcement. Adv. Math. Commun.
**6**(3), 305–314 (2012)CrossRefMATHMathSciNetGoogle Scholar - 23.P. Charpin, G. Gong, Hyperbent functions, Kloosterman sums and Dickson polynomials. IEEE Trans. Inf. Theory
**54**(9), 4230–4238 (2008)CrossRefMATHMathSciNetGoogle Scholar - 24.P. Charpin, G.M. Kyureghyan, Cubic monomial bent functions: a subclass of M. SIAM J. Discrete Math.
**22**(2), 650–665 (2008)CrossRefMATHMathSciNetGoogle Scholar - 25.P. Charpin, E. Pasalic, C. Tavernier, On bent and semi-bent quadratic Boolean functions. IEEE Trans. Inform. Theory
**51**, 4286–4298 (2005)CrossRefMATHMathSciNetGoogle Scholar - 26.T. Cusick, Y. Cheon, Affine equivalence of quartic homogeneous rotation symmetric Boolean functions. Inf. Sci.
**259**, 192–211 (2014)CrossRefMathSciNetGoogle Scholar - 27.D.K. Dalai, S. Maitra, S. Sarkar, Results on rotation symmetric bent functions. Discrete Math.
**309**, 2398–2409 (2009)CrossRefMATHMathSciNetGoogle Scholar - 28.J. Dillon, Elementary Hadamard difference sets. Ph.D. dissertation, University of Maryland, 1974Google Scholar
- 29.J.F. Dillon, H. Dobbertin, New cyclic difference sets with Singer parameters. Finite Fields Appl.
**10**(3), 342–389 (2004)CrossRefMATHMathSciNetGoogle Scholar - 30.J.F. Dillon, G. McGuire, Near bent functions on a hyperplane. Finite Fields Appl.
**14**(3), 715–720 (2008)CrossRefMATHMathSciNetGoogle Scholar - 31.H. Dobbertin, G. Leander, A. Canteaut, C. Carlet, P. Felke, P. Gaborit, Construction of bent functions via Niho power functions. J. Combin. Theory Ser. A
**113**, 779–798 (2006)CrossRefMATHMathSciNetGoogle Scholar - 32.E. Filiol, C. Fontaine, Highly nonlinear balanced Boolean functions with a good correlation-immunity, in
*Proceedings of EUROCRYPT’98*. Lecture Notes in Computer Science, vol. 1403 (1998), pp. 475–488Google Scholar - 33.C. Fontaine, On some cosets of the first-order Reed-Muller code with high minimum weight. IEEE Trans. Inform. Theory
**45**, 1237–1243 (1999)CrossRefMATHMathSciNetGoogle Scholar - 34.S. Fu, L. Qu, C. Li, B. Sun, Balanced 2
*p*-variable rotation symmetric Boolean functions with maximum algebraic immunity. Appl. Math. Lett.**24**, 2093–2096 (2011)CrossRefMATHMathSciNetGoogle Scholar - 35.G. Gao, X. Zhang, W. Liu, C. Carlet, Constructions of quadratic and cubic rotation symmetric bent functions. IEEE Trans. Inform. Theory
**58**, 4908–4913 (2012)CrossRefMathSciNetGoogle Scholar - 36.C. Carlet, G. Gao and W. Liu. Results on Constructions of Rotation Symmetric Bent and Semi-bent Functions. To appear in the proceedings of Sequences and Their Applications - Seta 2014: 8th International Conference, Melbourne, Vic, Australia, November 24–28, LNCS 8865, 2014.Google Scholar
- 37.F. Gologlu, Almost bent and almost perfect nonlinear functions, exponential sums, geometries and sequences. Ph.D. dissertation, University of Magdeburg, 2009Google Scholar
- 38.P. Guillot, Completed GPS covers all bent functions. J. Combin. Theory Ser. A
**93**, 242–260 (2001)CrossRefMATHMathSciNetGoogle Scholar - 39.T. Helleseth, A. Kholosha, Private communication (2013)Google Scholar
- 40.T. Helleseth, A. Kholosha, S. Mesnager, Niho bent functions and Subiaco hyperovals. Contemp. Math. AMS
**579**, 91–101 (2012). Proceedings of the 10-th International Conference on Finite Fields and Their Applications (Fq’10)Google Scholar - 41.S. Kavut, S. Maitra, M.D. Yücel, Search for Boolean functions with excellent profiles in the rotation symmetric class. IEEE Trans. Inf. Theory
**53**(5), 1743–1751 (2007)CrossRefMATHGoogle Scholar - 42.K. Khoo, G. Gong, D. Stinson, A new characterization of semi-bent and bent functions on finite fields. Des. Codes Cryptogr.
**38**, 279–295 (2006)CrossRefMATHMathSciNetGoogle Scholar - 43.P. Langevin, G. Leander, Counting all bent functions in dimension eight 99270589265934370305785861242880. Des. Codes Cryptogr.
**59**(1–3), 193–205 (2011)CrossRefMATHMathSciNetGoogle Scholar - 44.G. Leander, Monomial bent functions, in
*Proceedings of WCC 2006*(2005), pp. 462–470; and IEEE Trans. Inf. Theory**52**(2), 738–743 (2006)Google Scholar - 45.G. Leander, A. Kholosha, Bent functions with 2
^{r}Niho exponents. IEEE Trans. Inform. Theory**52**, 5529–5532 (2006)CrossRefMATHMathSciNetGoogle Scholar - 46.N. Li, T. Helleseth, X. Tang, A. Kholosha, Several new classes of bent functions From Dillon exponents. IEEE Trans. Inf. Theory
**59**(3), 1818–1831 (2013)CrossRefMathSciNetGoogle Scholar - 47.P. Lisoněk, M. Marko, On zeros of Kloosterman sums. Des. Codes Cryptogr.
**59**, 223–230 (2011)CrossRefMATHMathSciNetGoogle Scholar - 48.W. Ma, M. Lee, F. Zhang, A new class of bent functions. EICE Trans. Fundam.
**E88-A**(7), 2039–2040 (2005)CrossRefGoogle Scholar - 49.F.J. MacWilliams, N.J. Sloane,
*The Theory of Error-Correcting Codes*(North-Holland, Amsterdam, 1977)MATHGoogle Scholar - 50.S. Mesnager, A new family of hyper-bent Boolean functions in polynomial form, in
*Proceedings of Twelfth International Conference on Cryptography and Coding (IMACC 2009)*. Lecture Notes in Computer Science, vol. 5921 (Springer, Heidelberg, 2009), pp. 402–417Google Scholar - 51.S. Mesnager, Hyper-bent Boolean functions with multiple trace terms, in
*Proceedings of International Workshop on the Arithmetic of Finite Fields (WAIFI 2010)*. Lecture Notes in Computer Science, vol. 6087 (2010), pp. 97–113Google Scholar - 52.S. Mesnager, A new class of bent and hyper-bent Boolean functions in polynomial forms. Des. Codes Cryptogr.
**59**(1–3), 265–279 (2011) (see also proceedings of WCC 2009)Google Scholar - 53.S. Mesnager, Bent and hyper-bent functions in polynomial form and their link with some exponential sums and Dickson polynomials. IEEE Trans. Inf. Theory
**57**(9), 5996–6009 (2011)CrossRefMathSciNetGoogle Scholar - 54.S. Mesnager, Semi-bent functions from Dillon and Niho exponents, Kloosterman sums, and Dickson polynomials. IEEE Trans. Inform. Theory
**57**, 7443–7458 (2011)CrossRefMathSciNetGoogle Scholar - 55.S. Mesnager, J.P. Flori, Hyper-bent functions via Dillon-like exponents. IEEE Trans. Inf. Theory
**59**(5), 3215–3232 (2013)CrossRefMathSciNetGoogle Scholar - 56.G.L. Mullen, D. Panario,
*Handbook of Finite Fields*. Series: Discrete Mathematics and Its Applications (CRC Press, West Palm Beach, 2013)MATHGoogle Scholar - 57.S. Perlis, Normal bases of cyclic fields of prime-power degree. Duke Math J.
**9**, 507–517 (1942)CrossRefMATHMathSciNetGoogle Scholar - 58.J. Pieprzyk, C. Qu, Fast Hashing and rotation symmetric functions. J. Univ. Comput. Sci.
**5**, 20–31 (1999)MathSciNetGoogle Scholar - 59.O.S. Rothaus, On bent functions. J. Combin. Theory Ser. A
**20**, 300–305 (1976)CrossRefMATHMathSciNetGoogle Scholar - 60.R. Singh, B. Sarma, A. Saikia, Public key cryptography using permutation p-polynomials over finite fields. IACR Cryptology ePrint Archive 2009: 208 (2009)Google Scholar
- 61.P. Stǎnicǎ, S. Maitra, Rotation symmetric Boolean functions-count and cryptographic properties. Discrete Appl. Math.
**156**, 1567–1580 (2008)CrossRefMathSciNetGoogle Scholar - 62.P. Stǎnicǎ, S. Maitra, J. Clark, Results on rotation symmetric bent and correlation immune Boolean functions, in
*Proceedings of Fast Software Encryption 2004*. Lecture Notes in Computer Science, vol. 3017 (2004), pp. 161–177CrossRefGoogle Scholar - 63.N. Tokareva, On the number of bent functions from iterative constructions: lower bounds and hypotheses. Adv. Math. Commun.
**5**(4), 609–621 (2011)CrossRefMATHMathSciNetGoogle Scholar - 64.A.M. Youssef, G. Gong, Hyper-bent functions, in
*Proceedings of EUROCRYPT 2001*. Lecture Notes in Computer Science, vol. 2045 (2001), pp. 406–419CrossRefMathSciNetGoogle Scholar - 65.N.Y. Yu, G. Gong, Construction of quadratic bent functions in polynomial forms. IEEE Trans. Inf. Theory
**7**(52), 3291–3299 (2006)MathSciNetGoogle Scholar - 66.F. Zhang, C. Carlet, Y. Hu, W. Zhang, New secondary constructions of bent functions. Preprint, 2013Google Scholar