Value distributions of perfect nonlinear functions

,


Introduction
Let G and H be two additively written finite groups.A mapping L : G → H is called a homomorphism if L(x + a) − L(x) = L(a) for all x, a ∈ G. Homomorphisms L : G → H are essentially linear mappings between the finite groups G and H, which can be equivalently characterized by the property |{x ∈ G : L(x + a) − L(x) = b}| ∈ {0, |G|}.
In this article, we consider functions F : G → H which are as far as possible from all homomorphisms; such functions can be introduced with the notion of perfect nonlinearity as follows [27].A function F : G → H is said to be perfect nonlinear (or simply bent) if In general, the terms "perfect nonlinear" and "bent" are considered to be synonymous.However, in this paper, we will use the term "bent" for mappings between two elementary abelian groups.Bent functions considered in this setting play a very important role in finite geometry (they give rise to commutative semifields [13]), combinatorics (one can use them to construct skew Hadamard difference sets [11]), and applications due to their rich connections to coding theory and cryptography [2,21].arXiv:2302.03121v2[math.CO] 18 Oct 2023

Preliminaries
Let G and H be two finite groups and let F : G → H be a function.For an element β ∈ H, we denote by F −1 (β) the preimage set of β.By value distribution of the function F : G → H we understand the multiset { * |F −1 (β)| : β ∈ H * }.We use no special notation for this multiset, since determining the value distribution just boils down to determining the sizes of all preimages.
In the following, we will frequently consider functions F : G → H, where G and H are two elementary abelian groups.In this case, we use the notation G = F n p and H = F m p , where F p is the finite field with p elements and F n p is the vector space of dimension n over the prime field F p .For x = (x 1 , . . ., x n ), y = (y 1 , . . ., y n ) ∈ F n p , we define the scalar product of F n p by ⟨x, y⟩ n = x 1 y 1 +• • •+x n y n .If necessary, we endow the vector space F n p with the structure of the finite field F p n ; in this case, we define the scalar product of F p n by ⟨x, y⟩ n = Tr(xy), where Tr(z) := Tr n 1 (z) is the absolute trace and Tr n m (z) = n m −1 i=0 z p i•m is the relative trace of z ∈ F p n from F p n into the subfield F p m .If n = 2k is even, the vector space F n p can be identified with F p k × F p k ; in this case, we define the scalar product For an odd prime p, the mappings F : F n p → F p are called p-ary functions, and for p = 2, Boolean functions.For m ≥ 2, the mappings F : F n p → F m p are called vectorial functions.Any vectorial function F : F n p → F m p can be uniquely described by m coordinate functions f i : F n p → F p for 1 ≤ i ≤ m as a vector F (x) := (f 1 (x), . . ., f m (x)).For b ∈ F m p , the function F b (x) := ⟨b, F (x)⟩ m is called a component function of F .
Vectorial and p-ary functions can be also represented with a help of multivariate polynomials in the ring F p [x 1 , . . ., x n ]/(x 1 − x p 1 , . . ., x n − x p n ).This representation is unique and called the algebraic normal form (ANF, for short), namely for p-ary functions f : F n p → F p it is formally defined as f (x) = a∈F n p c a ( n i=1 x ai i ), where x = (x 1 , . . ., x n ) ∈ F n p , c a ∈ F p and a = (a 1 , . . ., a n ) ∈ F n p , while for vectorial functions F : F n p → F m p it is defined coordinate-wise.Besides the coordinate representation and algebraic normal form, we will also consider trace representations.Identifying F n p with F p n , we can uniquely represent any function F : F n p → F n p as a polynomial F : F p n → F p n of the form F (x) = p n −1 i=0 a i x i with coefficients a i ∈ F p n .Clearly, when m|n, any function F : F n p → F m p can be written as a polynomial F : F p n → F p m given by F (x) = Tr n m p n −1 i=0 a i x i .This representation is called the univariate (trace) representation, however, it is not unique in general.Now, we define the following equivalence relation, which preserves the nonlinearity of functions on elementary abelian groups.Functions F, F ′ : F n p → F m p , are called equivalent (extended-affine equivalent, to be more precise), if F ′ = A 1 • F • A 2 + A for some affine permutations A 1 , A 2 and an affine mapping A. Clearly, for affine permutations A 1 and A 2 , the functions F ′ = A 1 • F • A 2 and F have the same value distributions, while the functions F ′ = F + A and F , where A is an affine mapping, generally do not have the same value distributions; the latter will be illustrated with extensive examples in the following sections.
Our main tool for dealing with perfect nonlinear functions defined on elementary abelian groups is the discrete Fourier transform.In this specific setting, it is often called the Walsh transform, which is the term we will use throughout the paper.For a p-ary function f : F n p → F p , the Walsh transform is the complex-valued function W f : F n p → C defined by , where ζ p = e 2πi/p and i 2 = −1.
For vectorial functions F : F n p → F m p , the Walsh transform is defined using the notion of component functions as W F (b, a) = W F b (a) for all a ∈ F n p , b ∈ F m p .

Value distributions of bent functions: the known cases
With the Walsh transform, bent functions can be equivalently defined in the following way, for details we refer to [16,20,22].First, we consider in detail the Walsh transform of single-output bent functions.In the Boolean case, i.e., p = 2 we have that ζ 2 = −1, from what follows that W f (b) is an integer.Consequently, for every b ∈ F n 2 a Boolean bent function f on F n 2 satisfies W f (b) = 2 n/2 (−1) f * (b) , where f * : F n 2 → F 2 is called the dual of f , what implies that n must be even.The dual function f * is bent [29], moreover the equality (f * ) * = f holds.In the p odd case, the Walsh transform W f (a) at b ∈ F n p of a p-ary bent function f : F n p → F p satisfies [16]: where f * : F n p → F p , is called the dual of f .Opposite to the Boolean case, p-ary bent functions f : F n p → F p exist for all integers n ∈ N, however, the dual of a p-ary bent function is not necessarily bent.A bent function f : F n p → F p is called dual-bent if the dual f * is bent as well, otherwise, it is called non-dual-bent.Consider the following important classes of dual-bent functions, namely weakly regular and regular bent functions.A bent function f : If no such a fixed ϵ ∈ {±1, ±i} exists, then f is called non-weakly regular bent; such functions can be either dual-bent or non-dual-bent.For further references on p-ary bent functions and their duals, we refer to [19].For the sake of simplicity, we will include Boolean functions when talking about regular functions from F n p to F m p .With the notion of component functions, vectorial bent functions can be defined in the following way [16,20,22].
we have necessarily m ≤ n/2 (this fact is also known as the Nyberg's bound, see [22]), while for p-ary vectorial bent functions F : F n p → F m p , it is possible that n = m; in this case bent functions F : F n p → F n p are called planar.For a survey on bent and planar functions, we refer to [28].
Note that bent functions belong to a larger class of plateaued functions.A function F : an integer s b with 0 ≤ s b ≤ n.Bent functions F : F n p → F m p are exactly 0-plateaued functions, i.e., s b = 0 for all b ∈ F m p \ {0}.Now, we survey the known results about value distributions of bent functions.The sizes of the preimage sets of Boolean bent functions were determined by Dillon in his thesis [10], whereas the case of p-ary bent functions was addressed by Nyberg [22].
Theorem 1.3.[22, Theorems 3.2-3.5]Let p be a prime and f : F n p → F p be a bent function, and for Moreover, a regular bent function has the upper signs. and is the Legendre symbol.
Value distributions of vectorial bent functions were considered mostly for the classes of bent functions with certain prescribed properties.For instance, Nyberg [23,Theorem 3.2] proved that for a bent function F : F n p → F m p that has only regular (non-zero) component functions, all preimage set sizes are divisible by p n/2−m and derived both lower and upper bounds on preimage set sizes in this setting.Recently, preimage sets of vectorial bent functions attracted a lot of attention due to the connection with partial difference sets observed in [7].For instance in [7,30], the value distributions of bent functions F : F n p → F m p with the following properties have been considered: • l-forms, i.e., F satisfies F (αx) = α l F (x) for all α ∈ F m p and some fixed integer l with gcd(p m − 1, l − 1) = 1, and, • vectorial dual-bent functions, i.e., the set of the dual functions of the component functions of F together with the zero function forms a vector space of bent functions dimension m.
Particularly, in [30, Corollary 1], it was shown that a vectorial dual-bent function F : F n p → F m p , which satisfies F (0) = 0, F (−x) = F (x) and all component functions are regular (in this case, ε = +1) or weakly regular but not regular (in this case, ε = −1) satisfies Finally, in the case n = m, it was shown in [17,Theorem 2] that planar functions F : F n p → F n p with the minimal image set, i.e., | Im(F )| = (p n + 1)/2, have special value distributions, namely, they are 2-to-1 mappings.
As these results show, the value distributions of bent functions F : F n p → F m p are well-understood in the extremal cases, namely in the single-output case m = 1 as well as in the planar case m = n, for p odd.However, the knowledge of value distributions in the "in-between" cases 1 < m < n, is limited to the bent functions with specific additional properties (e.g., vectorial dual bent, l-forms).Moreover, the non-elementary abelian case has not been addressed at all.
In this paper, we develop a purely combinatorial general framework for the study of value distributions of perfect nonlinear functions.With our approach, we are able to unify the known results on value distributions of bent functions in different settings, which were previously obtained with different techniques.In the process, we strengthen many known results and prove new structural properties of functions with specific value distributions.Moreover, we show that our framework is also applicable for perfect nonlinear functions defined on non-elementary abelian groups.
The rest of the paper is organized in the following way.In Section 2, we derive general, sharp upper and lower bounds on the cardinalities of the preimage sets of perfect nonlinear functions on arbitrary groups (Theorem 2.4).We show that for functions meeting these bounds, all but one values in the image set are equally distributed between preimages.Additionally, we investigate the surjectivity of perfect nonlinear functions.In Section 3, we introduce the notion of almost balanced perfect nonlinear functions; these are the perfect nonlinear functions which achieve upper/lower bounds on the cardinalities of the preimage sets with equality and thus are extremal objects of particular interest.Considering the elementary abelian framework, we show in Subsection 3.1 that many primary constructions of bent functions are almost balanced.In Subsection 3.2, we demonstrate how one can construct new almost balanced bent functions from known ones using secondary constructions.In particular, combining primary and secondary constructions, we are able to show that almost balanced bent functions exist for all admissable elementary abelian groups (Theorem 3.12).In Section 4, we study the connection between value distributions and the Walsh transform of bent functions.Using these spectral properties, we generalize Nyberg's result on the possible sizes of preimage sets of bent functions, giving stronger and more general conditions on preimage set sizes in both the Boolean case as well as the general pary case (Theorems 4.6, 4.8, 4.9).We are also able to prove that in some cases, knowing the value distribution of two vectorial bent functions is enough to settle the (in general difficult) equivalence question (Corollary 4.4).In Section 5, we determine possible value distributions for bent functions with small output groups.In particular, we give a complete characterization of all possible value distributions for Boolean bent functions with output dimension at most 4. In Section 6, we consider planar functions.Using the techniques developed in this paper, we unify several known results on the characterization of planar functions with extremal value distributions and give a more precise description of planar functions with the maximum possible image set size.Finally, we provide new characterizations of planar functions of special shapes, again generalizing several well-known results.For instance, we are able to show that plateaued 2-to-1 functions are automatically planar (Theorem 6.4).In Section 7, we conclude the paper and give a list of open problems on perfect nonlinear functions and their value distributions.

Bounds on the cardinality of preimage sets
In this section, we derive upper and lower bounds on the cardinalities of the preimage sets of perfect nonlinear functions on arbitrary groups and show that in the cases when the bounds are attained, we have that all but one values are equally distributed.We begin with the following simple result.It has already appeared in [4]; we add a short proof for the convenience of the reader.Proposition 2.1.Let G and H be two finite groups, and let F : G → H be a perfect nonlinear function.Then the following holds Since F is perfect nonlinear, we have that This result can be applied to get minimum and maximum sizes of preimage set sizes of perfect nonlinear functions.For the sake of brevity, denote for a function F : G → H the preimage set sizes by X 1 , X 2 , . . ., X |H| , where we use an arbitrary ordering.By Proposition 2.1, for a perfect nonlinear function, we get where the second equation follows from the fact that all preimages exhaust G.We will now look for bounds and explicit solutions of the X i . Remark Considering Equations (2.1) and (2.2), it is clear that if X 1 , . . ., X p m are a solution, the average value of X i is p n−m .As the next proposition shows, handling these equations is made a lot easier when one considers the deviations from this mean instead of the X i directly.
Rearranging yields Note that all solutions of Equations (2.3) and (2.4) come in pairs since one can change the signs of all the H i .
The following theorem gives general bounds on the minimum and maximum preimage set sizes of perfect nonlinear functions in the most general setting.We will see later that the bounds achieved here are (at least for elementary abelian groups) sharp.Note that here and in other proofs later, we will repeatedly use the second moment method.
Theorem 2.4.Let G and H be two finite groups, and let F : G → H be a perfect nonlinear function.Then for every β ∈ H the following inequality holds (2.5) If the equality takes place, then |H| divides |G|, and consequently |G| is a square.
Proof.We consider Equations (2.3) and (2.4).By the Cauchy-Schwarz inequality, we have with equality if and only if all X i , i > 1 are identical.Then This inequality is quadratic in H 1 and can be solved with elementary techniques, the result is which leads for the preimage set sizes X i to the distributions In the extremal cases, equality in the Cauchy-Schwarz inequality has to hold, so all H i , i > 1 are identical (and thus also the X i ) and we get The result follows by plugging in the extremal values for X 1 .
In the case of equality, we then necessarily have that |G| is a square and |H| divides |G|.
For the sake of convenience, we give the bounds for bent functions F : F n p → F m p which will be considered in details in the following sections.
Theorem 2.5.Let F : F n p → F m p be a bent function and F −1 (β) the preimage set of β ∈ F m p .Then for every β ∈ F m p the following inequality holds (2.6) If equality takes place, then m ≤ n/2 and n is even.
Remark 2.6. 1.If we look for a moment at the Boolean case, i.e., G = F n 2 and H = F 2 , we see that the two extremal cases in Theorem 2.5 recover the well-known value distributions of Boolean bent functions.Indeed, for a Boolean bent function f : F n 2 → F 2 , we have 1 which are exactly the two extremal cases in Theorem 2.5.

2.
For p odd, n even and m = 1, the two extremal cases in Theorem 2.5 also recover the well-known value distributions of p-ary bent functions given in Theorem 1.3.For p odd, n odd and m = 1, compared to Theorem 1.3, we obtain bounds on the cardinality of preimage sets of bent functions, which are not regular.
3. For the special case p odd and n even, the two extremal cases in Theorem 2.5 also cover the extremal distributions obtained in Equation (1.3) found in [7,30].Moreover, these extremal cases not only recover the bound from [7, Corollary 2], but also show that the remaining elements in the image set are uniformly distributed between the remaining elements in F n p \ {0}.Theorem 2.4 can be used to identify a large class of surjective perfect nonlinear functions.
Corollary 2.7.Let G and H be two finite groups, and let F : G → H be a perfect nonlinear function.
Proof.We apply Theorem 2.4.The function F is surjective, if for all β ∈ H we have From the latter inequality we have that For perfect nonlinear functions beyond the "square root bound", the question about surjectivity becomes much more difficult to answer.In the following statement, we give a bound on the cardinality of the image set of a bent function, which has essentially been proven by Carlet [3] in a different context (namely, to give a connection between nonlinearity and the cardinality of the image sets of mappings ). Proposition 2.8.Let G and H be two finite groups, and let F : G → H be a perfect nonlinear function.Then Proof.We have from Equations (2.1) and (2.2) and again by the Cauchy-Schwarz inequality, the following holds The claim follows by solving Equation (2.9) for | Im(F )|.Now, we give the expression of the bound in Equation (2.8) for bent functions F : F n p → F m p and recover the well-known lower bound [17] for the planar case, i.e., p is odd and n = m.Corollary 2.9.Let F : F n p → F m p be a bent function.Then the following hold.1.The cardinality of the image set of F satisfies |H| in Equation (2.7) becomes negative.That means that our techniques cannot shed more light on the surjectivity of perfect nonlinear functions beyond the "square root bound".In the following example, we show that for small values of p, n and m ≥ ⌊n/2 + 1⌋ surjective vectorial bent functions F : F n p → F m p exist.Example 2.10.Consider the planar function F (x) = x 2 on F p n .Denote by f 1 , . . ., f n : F n p → F p the coordinate functions of F , i.e., F (x) = (f 1 (x), . . ., f n (x)) for x ∈ F p n .Let F k : F p n → F k p be the vectorial bent function formed by the first k coordinate functions of F , i.e., F k (x) := (f 1 (x), . . ., f k (x)).With Magma [1], we checked that for the following values of p and n given in Table 2.1, the functions where k = ⌊n/2⌋ + 1 are surjective.More general, we expect that for a fixed p and a sufficiently large n there exist m > ⌊n/2⌋ + 1, such that the functions F k : F p n → F k p are surjective for all ⌊n/2⌋ + 1 ≤ k ≤ m, but not for k ≥ m + 1.Consider p = 3, n = 13 and m = 10.The functions F k : F p n → F k p are surjective for all 1 ≤ k ≤ 6 by Corollary 2.9.With Magma [1], we checked that for all 7 ≤ k ≤ 10 the functions F k : F p n → F k p are surjective as well.However, the functions F k : F p n → F k p are not surjective for all 11 ≤ k ≤ 13.Based on our observations on surjectivity of vectorial bent functions beyond the "square root bound", we formulate the following open problems for vectorial bent functions F : F n p → F m p , since most of the constructions are studied in this setting.Clearly, the asked questions do not lose their relevance for the case of perfect nonlinear functions beyond the "square root bound" on arbitrary groups.
Open Problem 2.11.Let p be odd.

Find constructions of surjective vectorial bent functions
What is the maximum m such that all vectorial bent functions F : F n p → F m p are surjective?3. What is the minimum m such that all vectorial bent functions F : F n p → F m p are not surjective?
3 Almost balanced perfect nonlinear functions By Theorem 2.4, we know that if one preimage set F −1 (α) of a perfect nonlinear function F : G → H has either minimum or maximum cardinality, then the remaining elements in H \ {α} are uniformly distributed between the remaining elements of G \ F −1 (α).This fact motivates the following definition.A perfect nonlinear function F : G → H is said to be almost balanced, if its value distribution is extremal.Particularly, we say that F is almost balanced of type (−), if its value distribution is extremal of type (−), and almost balanced of type (+), if its value distribution is extremal of type (+).
For an almost balanced perfect nonlinear function, we say that (where the sign depends on the type).
Note that the two extremal distributions (+) and (−) belong to the solution

3) and (2.4).
From now on, we consider bent functions F : F n p → F m p , since the problem of construction of bent functions is mostly considered in this setting.In the following subsections, we prove that many primary constructions of bent functions are, in fact, almost balanced.Moreover, we show how one can construct new almost balanced bent functions from known ones using secondary constructions.

Primary constructions
First, we consider three general classes of vectorial bent functions, namely the Maiorana-McFarland, the Desarguesian partial spread and the o-polynomial construction.We show that all these constructions yield almost balanced bent functions of the (+) type.Proposition 3.2.Let n be even.

Let
where π : p is an arbitrary function, and L : p be a Desarguesian partial spread bent function defined by where Ψ : m for each β ̸ = 0, and hence F is almost balanced of (+) type.
Recall the following definition of an o-polynomial [5].For an extensive summary of the known o-polynomials and in particular their relations to (hyper)ovals in finite geometry, we refer to [21].
In the following statement, we show that bent functions obtained with the o-polynomial construction are also almost balanced of the (+) type.Proposition 3.4.Let n be even and F : where Ψ : , and hence F is almost balanced of (+) type.
Proof.We have F (x, y) = xΨ(yx 2 n/2−1 ), where Ψ is an o-polynomial.Recall that as an o-polynomial Ψ satisfies Ψ(x) = 0 if and only if x = 0.The equation F (x, y) = 0 is thus only solvable if xy = 0, so it has 2 n/2+1 − 1 solutions.The uniformity of the other preimages follows then immediately from Theorem 2.5.Now, we consider some monomial bent functions in even and odd characteristics.Again we find that these infinite families give almost balanced bent functions, but this time both (+) and (−) types occur.Proposition 3.5.Let n be even.
1. Let n = 2 r+1 s with r ≥ 0 and s odd.Define F : , and hence F is almost balanced of type (−).
2. Let n/2 be odd and define F : , and hence F is almost balanced of type (−).
3. Let p be odd and F : F p n → F p n/2 be a vectorial bent function defined via F (x) = Tr n n/2 (λx d ) with gcd(d, p n/2 − 1) = 2.If p n/2 ≡ 3 (mod 4) and λ is a square, or p n/2 ≡ 1 (mod 4) and λ is a non-square, then F is almost balanced of type (+).In the other cases, F is almost balanced of type (−).
Remark 3.6.Note that all planar monomials x → x d on F p n satisfy gcd(d, p n − 1) = 2 (for a proof, see Corollary 6.6 later) so Proposition 3.5 in particular holds for the vectorial bent functions derived from all planar monomials.This means that Case 3 of Proposition 3.5 yields almost balanced functions for all odd p and all even n, since x → x 2 always yields a planar function (among other examples).

Secondary constructions
In this subsection, we show how one can construct almost balanced bent functions from the known ones.First, we consider the direct sum construction.Definition 3.7.For two functions F 1 : In the following statement, we give an expression of the cardinality of a preimage set of a direct sum F (x, y) = F 1 (x) + F 2 (y) in terms of cardinalities of preimage sets of F 1 and F 2 .
Proof.Let c ∈ F m p .Clearly, F (x, y) = c can be written as F (x, y) = a + b, where a = F 1 (x), b = F 2 (y) and c = a + b.In this way, the cardinality of the preimage set F −1 (c) is given by completing the proof.
Recall the following well-known result on the direct sum of two bent functions.
[29] Let F 1 : F n p → F m p , F 2 : F k p → F m p be two bent functions and let F : Then F is bent if and only if both F 1 and F 2 are bent.
In the following statement, we show that the direct sum of two almost balanced bent functions is almost balanced again.Proposition 3.10.Let F 1 : F n p → F m p , F 2 : F k p → F m p be two almost balanced bent functions and let F : F n p × F k p → F m p be defined as F (x, y) = F 1 (x) + F 2 (y) for x ∈ F n p and y ∈ F k p .Then the following hold.
1.If F 1 and F 2 are both of the (+) type, then the direct sum F is of the (+) type as well.2. If F 1 and F 2 are both of the (−) type, then the direct sum F is of the (+) type.3.If F 1 is of the (+) type, and F 2 is of the (−) type, then the direct sum F is of the (−) type.
Proof.Let F −1 1 (a 1 ) and F −1 2 (a 2 ) be the unique preimages of F 1 and F 2 , respectively.Define c * ∈ F m p as c * = a 1 + a 2 .Since F is bent by Proposition 3.9, it is enough to show that , F is almost balanced of (+) type, since by Theorem 2.5 the uniformity of the other preimages is forced automatically.From Equation 3.2, we have where a ∈ F m p \ {a 1 }. 1.Since F 1 and F 2 are both of the (+) type, we get from Equation (3.3) that the cardinality of F −1 (c * ) is given by from what follows that F is almost balanced of the (+) type.

2.
Since F 1 and F 2 are both of the (−) type, we get from Equation (3.3) that the cardinality of F −1 (c * ) is given by from what follows that F is almost balanced of the (+) type.

3.
Since F 1 is of the (+) type, and F 2 is of the (−) type, we get from Equation (3.3) that the cardinality of F −1 (c * ) is given by from what follows that F is almost balanced of the (−) type.
Finally, we show that all possible bent functions which are "contained" in a given almost bent function are almost balanced of the same type.
where In particular, these results show that almost balanced bent functions of both types exist for all possible choices of p, n, m (of course, the trivial restrictions n even and m ≤ n/2 follow immediately from the definition of the two types).

Value distributions and the Walsh transform
In this section, we develop the connection between the Walsh transform of a bent function and its value distribution.Particularly, we show that with the knowledge of the Walsh transform, one can get precise information about the value distribution, and vice versa.
Recall the following well-known result, which will play an important role in the connection between value distributions and the Walsh transform.Lemma 4.1.[22] Let p be an odd prime.Then has a (unique) integer solution a r = r p for all r, where r p ∈ {−1, 1} is the Legendre symbol.As we have seen previously, many of the known constructions yield almost balanced bent functions.Interestingly, these preimage set distributions actually force a plateaued function to be bent.Since plateaued functions are much more prevalent than bent functions, this again underscores the special nature of the almost balanced bent functions we introduced.Since F is plateaued, W F (b, 0) can only attain the values with absolute value p (n+k)/2 with k ≥ 0 or 0 for b ̸ = 0. Clearly, W F (b, 0) = 0 is not possible.By the congruence above, Let us first focus on the case p = 2, so ) is constant 0, in particular, the image sets of bF (x) would be contained in a hyperplane of size 2 n−1 .This contradicts Proposition 2.8.We conclude that k = 0 and W F (b, 0) = −2 n/2 for all b ̸ = 0. Since F is plateaued, it is thus bent.Now consider p > 2. Then C = We conclude that p m + (p n/2 + 1)a r ∓ p m+k/2 = 0 for all r, that is, We can now argue as in the p = 2 case that, for divisibility reasons, we must have the minus sign in the equation and k = 0, leading to a bent function and W F (b, 0) = −p n/2 .It remains to exclude the case W F (b, 0) / ∈ Z.Let us first deal with the case ϵ = ±1.Then, again from Equation (4.2), we have that for some 1 ≤ t ≤ p − 1, leading to p m + (p n/2 + 1)a r = 0 for any r ̸ = t.This is clearly never satisfied for a r ∈ Z, so this case cannot occur.Let us now assume ϵ = ±i.Then must be divisible by p n/2 + 1, which is clearly not the case.We get again a contradiction.This concludes the (−) case.
The second extremal case |F −1 (0)| = p n−m + p n/2 − p n/2−m and |F −1 (y)| = p n−m − p n/2−m for each y ̸ = 0 can be dealt with in a similar fashion.This time, we have and with the same argumentation as above with only a change of signs throughout, F is bent where W F (b, 0) = p n/2 for all b ̸ = 0. Remark 4.3.Note that the condition in Theorem 4.2 that the unique preimage is the preimage of 0 is not restrictive.Indeed, one can shift a plateaued function always to achieve this without changing the preimage set sizes or losing the plateaued property.Of course, such a shift will however change the signs of the Walsh transform.
The following result is a direct consequence of Theorem 4.2, which gives a purely combinatorial way (via preimage set sizes) to check for the regularity of bent functions.Proof.This follows from Theorem 4.2 and the fact that for p odd and n even regularity is preserved under equivalence, see [6, p. 233] Theorem 4.2 also shows that almost balanced bent functions of type (+) or (−) have a very special Walsh transform in the sense that (potentially after a shift) W F (b, 0) is always plus or minus p n/2 .Interestingly, this is a precise characterization of these distributions, i.e., the converse also holds: Proposition 4.5.Let F : F p n → F p m be a bent function such that W F (b, 0) = p n/2 (resp.−p n/2 ) for all b ∈ F * p m .Then F is almost balanced of type (+) (resp.(−)) and the unique preimage is F −1 (0).
Proof.We only deal with the (+) case, the (−) case works identically up to changing the sign throughout.We have Counting another way, we also have Comparing these two equations yields By Theorem 2.5, it follows that F is necessarily of type (+).
For bent functions, where every component function is weakly regular with the same sign (for instance, if all component functions are regular), the possible preimage set sizes are actually very limited.Note that this in particular holds for all Boolean bent functions, where we consider all component functions to be regular by default.p with ϵ ∈ {±1, ±i} for all b ∈ F * p m .Then n is even, m ≤ n/2 and for any a ∈ F p m we have We start with the ϵ ∈ {1, i} case.We have Counting another way, we also have where Observe that the left-hand side of Equation (4.5) is an integer, so the right-hand side also has to be an integer.We divide the proof now into two cases: n even: Now ϵ = 1 and p n/2−m is rational, implying that p−1 r=1 l r ζ r p has to be an integer, which in turn implies that all l r = l 1 =: l, for all r > 0 and as claimed where 0 ≤ l ≤ p m −1 p−1 .Note that pl + 1 is not divisible by p, so p n/2−m has to be an integer, leading to m ≤ n/2.n odd: Now p n/2−m is not rational, so Equation (4.5) implies that p−1 r=0 l r ζ r p has to be 0 or √ p times an integer.In the first case, all l r have to be the same, contradicting p m − 1 = p−1 r=0 l r .In the other case, we have necessarily by Lemma 4.1 that l r = l • r p + l 0 for all r > 0 and some l.Then This is a contradiction since p does not divide the left-hand side.
Clearly, shifting the function preserves the bentness as well as the sizes of the preimage sets, so we get the result not only for the preimage of 0 but for all preimages.
For ϵ ∈ {−1, −i}, we get on the right-hand side of Equation (4.4) p n − p n/2 p−1 r=0 ϵl r ζ r p , i.e., just a change of signs.Then, the same argument as for the regular case leads to the result.
The minimal image set size in the regular case is clearly reached by setting l = p m −1 p−1 and substituting this into the equation yields Similarly, the maximal image set size for ϵ ∈ {−1, −i} case is reached by setting l = p m −1 p−1 and the result follows again immediately.
Remark 4.7.The condition that W F (b, 0) = ϵp n/2 ζ r b p with ϵ ∈ {±1, ±i} for all b ∈ F * p m is less restrictive than it might appear.It holds in particular for vectorial bent function where all component functions are regular, and for all Boolean bent functions.
Note that Theorem 4.6 in particular gives a simple proof of Nyberg's bound, i.e., it shows that m ≤ n/2 for Boolean bent functions.In fact, the result is a stronger version of Nyberg's original result [23,Theorem 3.2.]which showed that all preimage set sizes of vectorial bent functions that have only regular component functions are of the form p n−m/2 • k where k is not divisible by p. Theorem 4.6 gives both more precise information on the preimage set sizes as well as generalizes the result to a wider set of bent functions.
For p = 2, the constraints on the Walsh transform in Theorem 4.6 are trivial and can be dropped.In this case, the possible values coincide and the bounds coincide with the ones from Theorem 2.5 (while in the p-ary case the bounds from Theorem 4.6 are better).In the Boolean case we can in fact derive an extra condition.
Theorem 4.8.Let F : F 2 n → F 2 m be a Boolean bent function.Then for any a ∈ F 2 m we have where Tr(ab) }| and all k a have the same parity.
Proof.The result on the preimage set sizes follows immediately from Theorem 4.6.It remains to show that all k a have the same parity.We have In particular, we see that W By comparison, we see that s a = k a , so all k a have the same parity as claimed.
In the case that n is odd (which necessarily implies that p is odd) we also get more precise information on the possible size of the preimages.Note that here we do not need any additional conditions on the Walsh transform.Theorem 4.9.Let F : F p n → F p m be a bent function with p, n odd.Then for any a ∈ F p m we have Proof.We get again (like Equation (4.5) just without assuming additional conditions on the Walsh transform) where k r are non-negative integers satisfying r k r ≤ p m − 1, ϵ r ∈ {1, −1} and δ ∈ {1, i} depending on p. Since n is odd, we know that p n/2−m = √ p • p (n−1)/2−m is not rational.Then, either all k r = 0 (leading to |F −1 (0)| = p n−m ) or, using Lemma 4.1, we have ϵ r k r = ϵ 1 k r p + k 0 for all r > 0 with Again, shifting does not affect the preimage set sizes, so we get the same conditions also on the preimages of non-zero elements.
5 Value distributions of bent functions F :

small values of m
While listing all possible preimage size distributions for vectorial bent functions in complete generality seems to be a very difficult and out-of-reach task, for small values of m such results are possible to obtain from our work in the previous sections.We want to remind the reader that the case m = 1 is well-known (see Theorem 1.3), while the situation for m > 1 has up until now not been determined.
For bent functions from F n p to F m p one can use the results from the previous section to derive very strong conditions on the preimage distributions if certain spectral conditions are satisfied.Note that this again covers the important cases of Boolean vectorial bent functions, p-ary bent functions with regular component functions.
Then, the preimage set sizes are X i = p n−m + p n/2−m (pT i − 1) for all i ∈ {1, . . ., p m } where the T i are integers satisfying the two equations Proof.Assume Equations (2.3) and (2.4) hold for H 1 , . . ., H p m .By Theorem 4.6, we have Observe that H ′ i ≡ −1 (mod p) and set H ′ i = pT i − 1. Plugging this into the equations above yields the desired equations on the T i .Retracing the substitutions yields The extremal distribution (+) solves Equations (5.1) and (5.2) with T 1 = p m−1 and T i = 0 for all i > 0 (recall that the (−) case cannot occur here if p is odd by Theorem 4.2).For p = 2, the solution where the T i are integers satisfying the two equations Proof.Assume Equations (2.3) and (2.4) hold for H 1 , . . ., H p m .By Theorem 4.6 we have Plugging this into Equations (2.3) and (2.4) yields Observe that H ′ i ≡ 1 (mod p) and set H ′ i = −pT i + 1. Plugging this into the equations above yields the desired equations on the T i .Retracing the substitutions yields Here, the extremal distribution (−) solves Equations (5.3) and (5.4) with T 1 = p m−1 and T i = 0 for all i > 0 (here the (+) case cannot occur if p is odd).For p = 2, the solution For p = 2 and low values of m (and arbitrary n) we can use these results to determine all possible preimage distributions of vectorial Boolean bent functions.Since the conditions on the Walsh transform hold trivially in this case, we can use both Theorem 5.1 and Theorem 5.2 and get the same results.Note also that the symmetry (with respect to the signs) from Equations (2.3) and (2.4) is still visible in the binary case: Indeed, if {T 1 , . . ., T 2 m } is a valid solution then so is {−T 1 + 1, −T 2 + 1, . . ., −T 2 m + 1}.Note that all T i have the same parity by Theorem 4.8.By the symmetry above, we can concentrate on even T i since the solutions with odd T i are covered by the symmetry above.
While this direct connection does not exist anymore in the p-ary case, the solutions here still come in pairs since a solution of the Equations (5.1) and (5.2) yield different distributions for the two Theorems 5.1 and Theorem 5.2 (while the distributions in the Boolean case overlap).
Theorem 5.3.Let F : F n 2 → F 2 2 be a bent function.Then there are only two possible preimage distributions which are exactly the two extremal distributions (+) and (−).Both distributions occur for any even n ≥ 4.
Proof.From Theorem 5.1 we get the equations in the T i : It is easy to see that the only possible integer solutions are (up to permutation of the T i ): These distributions belong to the two extremal distributions (+) and (−).Conversely, Theorem 3.12 shows that vectorial bent functions F : of types (+) and (−) exist for all n ≥ 4.
This allows us to deduce a simple corollary.
Corollary 5.4.Let F : F n 2 → F m 2 with m ∈ {1, 2} be a plateaued function.Then F is bent if and only if F is of type (−) or (+).
Proof.Follows from Theorem 4.2 together with Remark 2.6 and Theorem 5.3, respectively.Theorem 5.5.Let F : F n 2 → F 3 2 be a bent function.Then there are only four possible preimage distributions which are the distributions (+) and (−), and the distributions with preimage set sizes X i = 2 n−3 + 2 n/2−3 (2T i − 1) where Proof.From Theorem 5.1 we get the equations in the T i : From Theorem 4.8 and the discussion above we can concentrate on even T i , getting the odd solutions via symmetry.This effectively makes the set of equations even easier.With little effort, one gets the solutions.Up to a permutation, we only get the two solutions belonging to (+) and (−): , as well as the even solution Remark 5.6.We have checked with a computer program that by adding linear functions to representatives of the equivalence classes of vectorial bent functions F : F 6 2 → F 3 2 from [26], it is possible to obtain all four distributions in Theorem 5.5.We conjecture that all four preimage distributions from Theorem 5.5 occur for all vectorial bent functions F : F n 2 → F 3 2 with even n ≥ 6.Of course, it was only left to prove the existence of the two non-extremal distributions since the two extremal distributions are covered by Theorem 3.12.
In the following statement, we also analyse value distributions of vectorial Boolean bent functions Theorem 5.7.Let F : F 2 n → F 24 be a bent function.Then there are only 14 possible preimage distributions which are the distributions with preimage set sizes X i = 2 n−4 + 2 n/2−4 (2T i − 1) where the T i are one of the following: for all 7 solutions above.
Proof.We again solve the equations on the T i , focusing only on even T i .The solutions for odd T i follow again using the symmetry {T 1 , . . ., T 16 } → {−T 1 + 1, −T 2 + 1, . . ., −T 16 + 1}.Setting T i = 2T ′ i , we get Clearly, |T ′ i | ≤ 4 for any i.Define c j for −4 ≤ j ≤ 4 such that c j is the number of times that T i = j in the previous set of equations.We can then rephrase these two equations as three easier equations, namely Here, the first equation corresponds to the fact that there are 1 ≤ i ≤ 16 in the original set of equations and the second and third equation capture the previous equations.The solutions of these three equations can be found quite easily by computer (or with a bit of effort by hand), keeping in mind that the c j are non-negative integers.Retranslating these in terms of T i , we get in total 14 solutions.7 of them correspond to the ones given in the statement of the theorem, as well as the following 7 additional ones: In particular, it is impossible that k a = 12 for a ̸ = 0.This means that there can only be at most one i such that T i = −4, excluding the case i).
We can write {x, y, z} = F * 2 4 \K and let H be a hyperplane of F 2 4 containing x, y, z.Then |H ∩K| = 4 and (denoting H = F 2 4 \ H) clearly |H ∩ K| = 8.By the considerations above this means that there exists an a such that k a = 4, corresponding to a T j = 4.We conclude that if one T i = −4 there also has to exist a j with T j = 4.This excludes the cases ii) and iv).
Assume now that we have another value of j such that T j = 4 (still T i = −4), corresponding to a k a = 4. Then (as outlined above) there is a hyperplane H with |H ∩ K| = 4 and H must contain x, y, z.If x, y, z are linearly independent, this H = ⟨x, y, z⟩ is uniquely determined.If x + y = z then there are precisely 3 choices for H.We conclude that if T i = −4 there are either one or three j such that T j = 4.This excludes the case iii).
Let us now deal with the last three cases v), vi) and vii).All have in common that there is no i with T i = −4 but there is an i with T i = 4. Let us thus assume that k 0 = 4, which corresponds to a T i = 4.We can thus set K = {x, y, z, w}.We have k a = 12 (corresponding to T j = −4) if and only if Tr(ax) = Tr(ay) = Tr(az) = Tr(aw) = 0 for some a ̸ = 0, i.e., K is contained in a hyperplane.Since T j = −4 does not occur, this means K is not contained in a hyperplane which means that x, y, z, w are linearly independent.Similarly, we have k a = 4 (corresponding to a second T j = 4) for a ̸ = 0 if and only if Tr(ax) = Tr(ay) = Tr(az) = Tr(aw) = 1 for some a, i.e., K is contained in an affine hyperplane.This occurs if and only if x+y, x+z, x+w are contained in the hyperplane H a = {b : Tr(ab) = 0} and x / ∈ H a .But x + y, x + z, x + w are linearly independent, so H a = ⟨x + y, x + z, x + w⟩ is uniquely determined.This means that there is at most one second j (next to i) such that T j = 4, excluding case vi).If there is no j ̸ = i such that T j = 4 then (by the argument above) K is not contained in an affine hyperplane, in other words, |H ∩ K| ≥ 1 for all hyperplanes H.But set again H = ⟨x + y, x + z, x + w⟩ and since x, y, z, w are linearly independent, we have H ∩ K = ∅, yielding a contradiction.We conclude that there must be exactly one second j ̸ = i such that T j = 4 .This excludes the last remaining two cases v) and vii) .
It is easy to observe that the symmetric cases {−T 1 + 1, −T 2 + 1, . . ., −T 16 + 1} to the 7 cases we just excluded also cannot occur.Indeed, we can repeat the arguments above, just replacing i.e., a change of a sign.
We have checked by computer that all the 14 cases in Theorem 5.7 do in fact occur for vectorial Boolean bent functions in 8 variables.
Verification.Consider the following vectorial bent function F : F 8 2 → F 4 2 (this is the first function in the list [24] obtained in [25]), which is given by its algebraic normal form as follows: With a help of a computer program, it is possible to check that by adding random linear functions to the bent function F defined in (5.5), one soon gets all possible distributions given in the statement of Theorem 5.7.
Remark 5.9.In view of Proposition 5.8 and Theorem 5.7, we conjecture that all 14 preimage distributions from Theorem 5.7 occur for all vectorial bent functions F : F n 2 → F 4 2 with even n ≥ 8. Finally, we demonstrate that in some cases it is possible to determine possible value distributions of bent functions without the exact knowledge of spectral properties of the considered functions.This allows us to extend the proof of Theorem 5.
One can see that the only possible solutions (up to permutation of the H i ) are . This means that the only possible solutions for the general case are

Value distributions of planar functions
In this section, we discuss the particularly interesting case of planar functions, i.e., vectorial bent functions with p odd and n = m.Planar functions have important applications both for difference sets (as they give rise to examples of skew Hadamard difference sets that are inequivalent to Paley difference sets [11]) and commutative semifields (see, e.g., [13]) which play an important role in finite geometry.The image sets of planar functions were considered in [17] and [9] where lower and upper bounds (respectively) of the image set sizes of planar functions were derived.Using the tools we developed in the previous sections we are able to unify these results and give an alternative proof of one of the main results in [17,Theorem 2] as well as [9], while giving (for the upper bound) more precise information on the preimage set distribution that occurs in the extremal cases.Recall that we call a function F : F p n → F p n with p odd 2-to-1 on F p n if one unique element has one preimage and (p n − 1)/2 elements have 2 preimages.Proposition 6.1.Let F : F p n → F p n be a planar function.Then The lower bound is satisfied with equality if and only if F is 2-to-1 on F p n and the upper bound is satisfied with equality if and only if all but one element in the image set have a unique preimage.
Proof.We consider Equations (2.3) and (2.4).Since H We get from Equations (2.3) and (2.4) − s, only leaving s ∈ {0, 1} as possibilities.If s = 0, then Equation (6.2) cannot be satisfied as all H i ≥ 1 and the sum contains p m +1 2 = k + 1 terms.Thus s = 1 and it is easy to see that H i = 1 for all i > k + s, meaning that X i = 2 for these i and F is 2-to-1.
Let us consider the upper bound now.Define M i as the number of elements y ∈ Im(F ) with precisely i preimages.Then (by Proposition 2.1) p n +p n−m (p n −1) = k i=1 i 2 M i where r is the maximum preimage set size of F .Note that r i=1 iM i = p n , so still with equality if and only if M i = 0 for all 2 ≤ i < r.Clearly, the bound is best if r is maximal, i.e., if the maximum preimage set size is as high as possible, which means maximizing one H i in Equation (6.1).This occurs if Equations (6.1) and (6.2) only have one term on the left-hand side, which yields . Equality is achieved if and only if there is one element with and all other elements in the image set have a unique preimage.Remark 6.2.We are not aware of any planar functions attaining the upper bound.A necessary condition is that 4p n − 3 = 4(p n − 1) + 1 = 8( p n −1 2 ) + 1 is a square.As already observed by Coulter and Senger in a slightly different context [9], this is the case if and only if p n −1 2 is a triangular number, i.e., a number of the form u(u − 1)/2.This would mean p n − 1 = u(u − 1), i.e., this occurs if and only if p n − 1 is the product of two consecutive numbers.This can clearly never occur if n is even since then p n − 1 = (p n/2 − 1)(p n/2 + 1) and it is clear that p n − 1 is not the product of two consecutive numbers.For n odd, this can however happen, simple examples include 7 − 1 = 2 • 3 and 7 3 − 1 = 18 • 19.
Note that many examples of planar functions satisfying the lower bound are known, in fact, all planar Dembowski-Ostrom polynomials (i.e., polynomials of the form F , where a i,j ∈ F p n and x ∈ F p n ) are necessarily 2-to-1 which is well known [17, Corollary 1] , as well as the (non-Dembowski-Ostrom) Coulter-Matthews planar function.We add a short proof of the Dembowski-Ostrom case using our techniques here as well.
Proof.We again consider Equations (2.3) and (2.4).We have F (x) = F (−x) for all x ∈ F p n , so the number of preimages is odd only precisely once.Then the H i = 1 + X i are all odd with exactly one exception.By Equation (2.3), one H i has to be 0 and all other satisfy H 2 i = 1 and then by Equation (2.4), necessarily p n −1 2 choices of H i are 1 and the same holds for −1.Keeping in mind that X i = 1 + H i , we conclude that F is 2-to-1.
Again, the 2-to-1 property (i.e., information on the preimage size distribution) is enough to force planarity as long as we only consider plateaued functions.This is in many ways surprising since both the 2-to-1 functions as well as plateaued functions seem to be much more prevalent than planar functions.The result and proof idea is an analogue of a similar result for 3-to-1 almost perfect nonlinear functions achieved in [15].This allows us to state the following corollary.Note that this is a strict generalization of one of the main results in [31,Theorem 2.3.]which showed the statement only for DO polynomials, which are a subclass of plateaued functions satisfying F (x) = F (−x).Corollary 6.5.Let F : F p n → F p n be a plateaued function such that F (x) = F (−x) for all x ∈ F p n .Then F is planar if and only if F is 2-to-1.
Proof.Follows from Theorem 6.4 and Proposition 6.3.Corollary 6.5 is indeed a generalization from the DO case since plateaued planar functions that are not DO polynomials do in fact exist, an example is the Coulter-Matthews planar monomial [8].
In particular, for monomials, proving planarity can then essentially be reduced to proving the plateaued condition (recall that planar functions cannot be bijective by Proposition 6.1).Corollary 6.6.Let F : F p n → F p n be a plateaued monomial F = x d .Then F is planar if and only if gcd(d, p n − 1) = 2.
Proof.Follows from Theorem 6.4 and Proposition 6.1.

Conclusion and open problems
In this paper, we systematically developed the theory of value distributions for perfect nonlinear functions.Particularly, we provided a purely combinatorial framework for checking the equivalence of perfect nonlinear functions F : F n p → F m p in terms of the value distributions.Moreover, we were able to describe all possible value distributions for several large classes of perfect nonlinear functions.In general, however, it seems to be a very difficult problem to determine all possible and impossible value distributions completely since the techniques we used rely on precise spectral information and solving systems of quadratic Diophantine equations, whose possible number of solutions grows with the increasing output group's order.To conclude, we believe that answering the following questions (in addition to already mentioned open problems and conjectures in the previous sections) will help to provide a better understanding of perfect nonlinear functions, and, more generally, cryptographically significant classes of functions.
1.The theory of value distributions of perfect nonlinear functions F : F n p → F m p (and in general, on arbitrary groups) developed in this article actually only hinges on the fact that F (x) = F (y) has precisely p n + p n−m (p n − 1) solutions.This is, however, not unique for bent functions.Are there other functions of interest with this property?It would be also interesting to investigate in a similar manner other classes of cryptographically significant functions F : F n p → F m p , for instance, plateaued and differentially uniform functions.
2. So far, the known constructions of almost balanced perfect nonlinear functions F : F n p → F m p are mostly dominated by the (+) type constructions.It would be interesting to provide more primary constructions of almost balanced bent functions of the type (−), especially in the p odd case.
3.Besides the "direct sum" construction, there exist many other secondary constructions of bent functions, which can be described without loss of generality in the following form F (F 1 (x 1 ), . . ., F k (x k )) where F i : F ni p → F m p are perfect nonlinear functions, and F is some function.It would be interesting to provide initial conditions on bent functions F 1 , . . ., F k , which guarantee that the obtained perfect nonlinear functions of the form (x 1 , . . ., x k ) ∈ F n1 p × • • • × F n k p → F (F 1 (x 1 ), . . ., F k (x k )) are almost balanced of (+) and (−) types, and hence are inequivalent (in the p odd case).
4. Many of the known constructions of vectorial bent functions, whose preimage sets can be used to construct partial difference sets, are, in fact, almost balanced, see [7,30].In this regard, it is natural to find other constructions of almost balanced bent functions, which give rise to partial difference sets.

5.
Our computer experiments show that in the Boolean case, it is possible to obtain both extremal value distributions by adding suitable linear functions from a single given vectorial Boolean bent function, opposite to the p-ary case.It would be interesting to investigate whether for every vectorial Boolean bent function one can add linear functions to obtain both (+) and (−) extremal value distributions, or whether there exist vectorial Boolean functions which cannot reach both extremal value distributions with a help of the addition of suitable linear functions.
6.We showed that many primary and secondary constructions of perfect nonlinear functions appear to have extremal value distributions, which implies that the "almost balanced" property unifies many algebraically different constructions.With this observation, it is essential to construct more perfect nonlinear functions in a purely combinatorial manner, using the "almost balanced" property.

Definition 1 . 1 .
A function f : F n p → F p is called a bent function, if the Walsh transform satisfies |W f (b)| = p n/2 for all b ∈ F n p .

Definition 3 . 1 .
Let G and H be two finite groups.For a perfect nonlinear function F : G → H, we call the first extremal value distribution in Theorem 2.4 of type (−), and the second extremal value distribution of type (+).

Proposition 3 . 11 .
Let F : F n p → F m p be an almost balanced surjective bent function and let L : F m p → F k p be a surjective linear mapping.Then the following hold.1.If F is of the (+) type, then L • F :F n p → F k p is of the (+) type as well.2. If F is of the (−) type, then L • F : F n p → F k p isof the (−) type as well.Consequently, if F is of the (+) type (resp.(−) type), then every component bent function is of the (+) type (resp.(−) type).Proof.For b ∈ F m p , let F −1 (b) be the unique preimage of F .Denote by c = L(b) ∈ F k p .Since every non-zero component function of F is bent, we have that L • F is bent as well, and hence it is enough to show that |(L • F ) −1 (c)| = p n−k ± p n/2 ∓ p n/2−k , since by Theorem 2.5 the uniformity of the other preimages is forced automatically.Since L : F m p → F k p is a surjective linear mapping, it is balanced, and hence |L −1 (a)| = p m−k for all a ∈ F k p .In this way, the cardinality of (L • F ) −1 (c) is given by

Theorem 3 . 12 .
Almost balanced bent functions F : F n p → F m p of types (+) and (−) exist for all m ≤ n/2, where n ∈ N is an arbitrary even number and p is an arbitrary prime number.Proof.Follows from the application of Proposition 3.11 to almost balanced vectorial bent functions F : F n p → F n/2 p from primary constructions given in Propositions 3.2, 3.4 and 3.5, all of which are surjective.

Theorem 4 . 2 .
Let F : F p n → F p m be a plateaued function with the preimage distribution of type (+) or (−) where the unique preimage is F −1 (0).Then F is bent.More precisely, we have W F (b, 0) = −p n/2 for all b ∈ F * p m for the type (−) function and W F (b, 0) = p n/2 for all b ∈ F * p m for the type (+) function.Proof.Let us first consider the type (−) distribution, so |F −1 (0)| = p n−m −p n/2 +p n/2−m and |F −1 (y)| = p n−m + p n/2−m for non-zero y.Then |{x / ∈ F −1 (0) : Tr(bF (x)) = c}| is divisible by p n−m + p n/2−m for any c ∈ F p and any b ∈ F * p m .In particular, W F (b, 0) ≡ p n−m − p n/2 + p n/2−m ≡ −p n/2 (mod p n−m + p n/2−m ).
Lemma 4.1, where c r = r p .If t = 0 this means p m + (p n/2 + 1)a r ∓ p n+k−1 2 c r = 0 for all r.This is equivalent to a r = p m c r ±p n+k−m−1 2 −cr p n/2 +1 .Since both c r = −1, 1 occur, this cannot always be an integer for a fixed k, yielding a contradiction.If t ̸ = 0, then ζ n p occurs on the right hand side of Equation (4.3), yielding p m + (p n/2 + 1)a r ∓ p n+k−1 2 c r = ±1 for all but one r.Since both c r = −1, 1 occur, 2p n+k−1 2

Corollary 4 . 4 .
Let p be odd and n be even.Let F :F n p → F m p be a bent function.1.If F is of type (+) it is inequivalent to a function of the (−) type.2.If F is of the (+) type (or equivalent to a (+) type function) then each weakly regular component function of F is regular.3.If F is of the (−) type (or equivalent to a (−) type function) then each weakly regular component function of F is not regular.

Theorem 4 . 6 .
Let F : F p n → F p m be a bent function where W F (b, 0) = ϵp n/2 ζ r b

Table 2 .
1: Surjective vectorial bent functions F ⌊n/2⌋+1 : F p n → F 3 to arbitrary groups of sizes |G| = 2 n and |H| = 4. Theorem 5.10.Let G and H be two finite groups with |G| = 2 n and |H| = 4. Let F : G → H be a perfect nonlinear function.Then there are only two possible preimage distributions which are exactly the two extremal distributions from Theorem 2.4.Proof.Assume Equations (2.3) and (2.4) hold for H 1 , . . ., H 4 and n > 4. Then H 4 is thus a solution of Equations (2.3) and (2.4) for n if and only if H ′ 1 , . . ., H ′ 4 is a solution of Equations (2.3), (2.4) for n − 2. We can continue this procedure until n = 4, since in this case 2 n−2 is no longer divisible by 8. We arrive at