Image sets of perfectly nonlinear maps

We consider image sets of differentially d-uniform maps of finite fields. We present a lower bound on the image size of such maps and study their preimage distribution. Further, we focus on a particularly interesting case of APN maps on binary fields F2n\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$\mathbb {F}_{2^n}$$\end{document}. We show that APN maps with the minimal image size are very close to being 3-to-1. We prove that for n even the image sets of several important families of APN maps are minimal, and as a consequence they have the classical Walsh spectrum. Finally, we present upper bounds on the image size of APN maps. For a non-bijective almost bent map f, these results imply 2n+13+1≤|Im(f)|≤2n-2(n-1)/2\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$\frac{2^n+1}{3}+1 \le |{\text {Im}}(f)| \le 2^n-2^{(n-1)/2}$$\end{document}.


Introduction
Let p be a prime and q = p n .A map f : A 1-uniform map f : Fq → Fq is called planar, that is f is planar if f (x+a)−f(x) is a permutation for any a ∈ F * q .Planar maps exist if and only if q is odd.A map f is called almost perfect nonlinear (APN) if f is 2-uniform.Observe that if q is even, then an equation f (x + a) + f (x) = b has always an even number of solutions, since x solves it if and only if x +a does so.In particular there are no 1-uniform maps for q even, and the APN maps have the smallest possible uniformity on binary fields.APN maps and more generally maps in characteristic 2 with low uniformity are an important research object in cryptography, mainly because they provide good resistance to differential attacks when used as an S-box of a block cipher.For a thorough survey detailing the importance of such maps for cryptography, we refer to [5].Moreover, maps with low uniformity are intimately connected to certain codes [10,11].Planar maps can be used for the construction of various structures in combinatorics and algebra, for example difference sets, projective planes and semifields [30].
A celebrated result of Ding and Yuan obtained in [23] shows that image sets of planar maps yield skew Hadamard difference sets which are inequivalent to the Paley-Hadamard difference sets.This disproved a longstanding conjecture on the classification of skew Hadamard difference sets and motivated an interest to a better understanding of image sets of planar maps, see for example [20,28,34].The image sets of d-uniform maps with d > 1 can be used to construct optimal combinatorial objects too, as shown in [13].However the case d > 1 is less studied compared to d = 1, although also d = 1 is far from being completely understood too.Here we extend some of results on the image sets of planar maps with d = 1 to cover a general d.The behavior of the image sets of d-uniform maps and proofs are more complex for d > 1.This is simply explained by the fact that the preimage distribution of a difference map fa : x → f (x + a) − f (x) is not unique and more difficult to control when d > 1.The smaller values d are easier to handle.
In this paper we obtain a lower bound for the size of d-uniform maps, which is sharp for several classes of d-uniform maps.However there are cases, where we expect that our bound can be improved.We prove several results on the preimage distribution of d-uniform maps.We observe that some classes of d-uniform Dembowski-Ostrom polynomials are uniquely characterized by the size of their image set.Further we consider in more detail the case d = 2, that is APN maps, on binary fields.For an APN map f : F 2 n → F 2 n the lower bound is n is odd, n is even.
The first published proof for this bound appears in [14, Lemma 5], where a lower bound on the differential uniformity via image set size is presented.Since the study of image sets of APN maps was not a goal of [14], the lower bound in it remained unnoticed by most of researchers on APN maps.A systematic study of the image sets of APN maps is originated in [22].Beside the lower bound in [22] several properties and examples of the image sets of APN maps are presented.In this paper we develop the study of image sets of APN maps further.Our results indicate that the APN maps with minimal image size play a major role for understanding fundamental properties of APN maps.We believe that a deeper analysis of the image sets of APN maps is an interesting research direction which will allow to progress in several of current challenges on APN maps.
Presently, the only known primary families of APN maps are monomials x → x k or Dembowski-Ostrom polynomials.These maps serve as a basis for a handful known secondary constructions of APN maps [5,30].Whereas the image sets of monomial maps are multiplicative subgroups extended with the zero element and so they are uniquely determined by gcd(q − 1, k), the behavior of the image sets of Dembowski-Ostrom polynomials is complex and not very well understood yet.Results from [13] imply that if n is even, then APN Dembowski-Ostrom polynomials of shape f (x 3 ) have the minimal size (2 n + 2)/3.For an odd n, the image size of APN Dembowski-Ostrom polynomials with exponents divisible by 3 (as integers) is not unique.We present such families with image sizes 2 n , 2 n−1 and 5 • 2 n−3 in this paper.
At beginning of our studies we were quite certain that having an image set of minimal size is a rare property and not many of known APN maps will satisfy it.Despite our intuition we found that APN maps constructed by Zhou-Pott and their generalizations suggested by Göloglu are such maps.This is quite remarkable since these families contain large number of inequivalent maps as shown in [25].
The set of component-wise plateaued maps includes quadratic maps, and hence also Dembowski-Ostrom polynomials.For n even, component-wise plateaued maps with certain preimage distribution have a very special Walsh spectrum.For APN maps this result implies that almost-3-to-1 component-wise plateaued maps have the classical Walsh spectrum, as observed in [9].This combined with the knowledge on the behavior of image sets explains why several important families of APN maps have the classical Walsh spectrum.For n odd we find a direct connection between the image set of an almost bent map and the number of its balanced component functions.As a consequence, we show that any almost bent map has a balanced component function.We conclude our paper with an upper bound on the image size of non-bijective almost bent maps and component-wise plateaued APN maps.To our knowledge these are the only currently known non-trivial upper bounds on the image size of APN maps.

Images of d-uniform functions
In this section we extend some of the results from [20,28,34] on the image sets of planar maps with d = 1 to cover a general d.The behavior of the image sets of d-uniform maps and the proofs are more complex for d > 1.This is simply explained by the fact that the preimage distribution of a difference map fa : x → f (x + a) − f (x) is not unique and more difficult to control when d > 1.
Let Im(f) be the image set of a map f : Fq → Fq.For r ≥ 1 we denote by Mr(f ) the number of y ∈ Fq with exactly r preimages.Further, let N (f) denote the number of pairs (x, y) ∈ F 2 q , such that f (x) = f (y).Note N (f) ≥ q and N (f) = q exactly when f is a permutation on Fq.Let m be the degree of the map f , that is the degree of its polynomial representation of degree not exceeding q − 1.Then Mr(f ) = 0 for every r > m.The following identities follow directly from the definition of Mr(f ) and N (f) The quantities Mr and N (f) appear naturally when studying the image sets of maps on finite fields, see for example [12,20,28].A map f : Proof It follows from the Cauchy-Schwarz inequality with (1), ( 2) and ( 3) that The equality above holds if and only if there is The following proof is an adaption for any d of [28, Lemma 2], where planar functions with d = 1 were considered.
where t 0 (f) is the number of elements a = 0 in Fq for which f (x + a) − f (x) = 0 has a solution x in Fq.The equality holds if and only if every of these t 0 (f) equations has exactly d solutions.
Proof Note that Observe that for a planar map N (f) = 2q − 1, since f (v + a) − f (v) = 0 has a unique solution for every non-zero a. Generalizing this, a map f : Fq → Fq is called zero-difference d-balanced if the equation f (x + a) − f (x) = 0 has exactly d solutions for every non-zero a, see [13].Hence N (f) = q + (q − 1)d = (d + 1)q − d for a zero-difference d-balanced map.
The equality holds if and only if f is zero-difference d-balanced.
Proof The statement follows from Lemma 2 and t 0 (f) ≤ q − 1.

⊓ ⊔
Remark 1 Note that several of the results in this paper hold for any map f with N (f) ≤ (d + 1)q − d, and not only for d-uniform ones.Some of our proofs can easily be adapted if N (f) = kq ± ε is known.
⊓ ⊔ The proof of Theorem 1 shows that the gap between | Im(f)| and q d+1 is small, when f is close to being k-to-1 and N (f) is about (d + 1)q − d.Furthermore, the bound in Theorem 1 is sharp; if d + 1 is a divisor of q − 1, then the map m(x) = x d+1 reaches the lower bound of Theorem 1 and it is d-uniform.To see that m(x) is indeed d-uniform observe that for any non-zero a the difference map m(x + a) − m(x) = (x + a) d+1 − x d+1 has degree d and if ω = 1 with ω d+1 = 1 then x := (ω − 1) −1 satisfies (x + 1) d+1 − x d+1 = 0. Theorem 2 extends [28,Theorem 2] to cover an arbitrary d.Besides of giving a different proof for Theorem 1, it additionally provides information on the possible preimage distribution of a d-uniform map with minimal image set.
For a map f : Fq → Fq and S ⊆ Fq, a ∈ Fq, we denote by f −1 (S) the preimage of S under f and by ω(a) the size of f −1 ({a}).
Proof By Corollary 1 Since we get Later we use the following observation: Let f be a d-uniform map and Then we have The following theorem is a generalization of [20,Theorem 1] and it provides information on the possible preimage distribution of a d-uniform map.
The equality in (7) holds if and only if N (f) = (d + 1)q − d and Mr(f ) = 0 for all r ≥ d + 2; and the equality in (8) holds if and only if N (f) = (d + 1)q − d and Mr(f ) = 0 for r > d + 2. The latter case reduces to Proof Let m be the degree of f .With Corollary 1 we have N (f) ≤ (d + 1)q − d.Using (2) and (3) we get As the right hand side is non-negative, we have in particular with equality if and only if Mr(f ) = 0 for all r ≥ d + 2 and N (f) = (d + 1)q − d.
Note that for r ≥ d + 2 it holds that r 2 − (d + 1)r ≥ r, so that (9) turns into Adding d+1 r=1 rMr(f ) on both sides of (10) and using (2) gives For equality to hold, we need equality in (10).The first equality in (10) holds if and only if N (f) = (d + 1)q − d, the second equality holds if and only if is called Dembowski-Ostrom (DO), if it can be written as a ij x p i +p j when q is odd and when q even.Note that x2 is a DO polynomial for any odd q, but not for even q.
Maps obtained as the sum of a DO map with an Fp-affine one are called quadratic.
Let k be a divisor of q − 1.We call a map f k-divisible, if it can be written as Fq and all ω ∈ F * q whose order divides k.Further, we call a map f almost-k-to-11 , if there is a unique element in Im(f) with exactly 1 preimage and all other images have exactly k preimages.Note that if f (x) is duniform, then so is f (x + c) + u for arbitrary c, u ∈ Fq.Hence we may without loss of generality assume that f (0) = 0 and that 0 is the unique element with exactly one preimage, when considering the d-uniform property of an almost-k-to-1 map f .For a non-zero a ∈ Fq we define which we call a differential set of f in direction a.It is well-known and easy to see that the differential sets of quadratic maps are Fp-affine subspaces.The following result can be partly deduced from Proposition 3 and Corollary 1 and their proofs in [13].We include its proof for the convenience of the reader.
Lemma 3 Let q = p n with p prime, d + 1 be a divisor of q − 1 and f : Fq → Fq be a (b) f is d-uniform and all its differential sets are Fp-linear subspaces; (c) d = p i for some i ≥ 0.
Proof First we prove statements (a) and (b): Since f is a DO polynomial, it is d-uniform in the case it is zero-difference d-balanced.First we show that for any non-zero a the equation fa(x) = f (x + a) − f (x) = 0 has a solution (equivalently, Da(f ) is a subspace).Indeed, let 1 = ω ∈ Fq be a zero of x d+1 − 1 and set x = (ω − 1) −1 a.This x fulfills x + a = ωx, and hence fa(x) = f (ωx) − f (x) = 0.In particular, fa(x) = 0 hast at least d solutions.On the other side, since f is (d + 1)-divisible and almost-(d + 1)-to-1, the equation f (x + a) = f (x) is fulfilled if and only if x + a = ωx for an element ω satisfying ω d+1 = 1.This implies that a solution x must be given by a(ω − 1) −1 .And hence there are at most d solution for fa(x) = 0.
The statement in (c) follows from (b).Indeed, the differential sets of f are linear subspaces of size p n /d, and hence d = p i for some i ≥ 0.

⊓ ⊔
The following result holds if f is not a DO polynomial too: A fascinating property of DO planar polynomials proved in [20,35] is: A DO polynomial is planar if and only if it is almost-2-to-1.Observe that for an odd q a DO polynomial is always 2-divisible.Corollary 1 in [13] proves an analog of this result for the d-uniform case; Theorem 5 is a reformulation of it using the terminology introduced in this paper.
Proof It follows directly from Theorem 4 and Lemma 3.
In the following sections we study the image sets of APN maps on binary fields.Such maps are of particular interest because of their applications in cryptography and combinatorics.
The first systematic study of the image sets of APN maps was originated in [22], where it is shown that the image set of an APN map on F 2 n contains at least ⌈(2 n + 1)/3⌉ elements.This lower bound is proved by methods of linear programming in [22], which is a novel approach for studying image sets of maps on finite fields.The APN monomials have the image size (2 n +2)/3 for n even, showing that the lower bound is sharp for n even.Several numerical results presented in [22] suggest that the minimal image size of APN maps is much larger, probably around 2 n−1 , if n is odd.Preprint [15] comments that the lower bound on the image sets of APN maps appears (in an equivalent form) already in [14, Lemma 5], where a lower bound on the differential uniformity via image set size is presented.The arguments proving Lemma 5 in [14] are similar to ours presented for Lemma 1 and Corollary 2. These are more or less standard for studying image sets of maps with special additive properties on finite sets, see [28,34] .
Results of Section 2 allow, beside the lower bound on the image size, to describe also the possible preimage distributions of APN maps meeting it, see Theorem 6.For the APN maps on F 2 n Theorem 3 reduces to: and hence there is at least one element with exactly 1 or 2 preimages.For n even, the inequality is sharp if and only if f is almost-3-to-1.For n odd, the inequality is sharp if and only if there is a unique element in Im(f) with exactly two preimages and the remaining elements have exactly three preimages.(b) The equality holds if and only if Proof The inequalities as well as the equality case in (b) follow directly from Theorem 3. Let M 1 (f)+M 2 (f) = 1.Then Mr(f ) = 0 for every r ≥ 4 by Theorem 3. To complete the proof note that the value 2 n (mod 3) forces (M depending on the parity of n.

⊓ ⊔
The observation that an APN map must have at least one element with exactly 1 or 2 preimages was done already in [22].
The next theorem is a consequence of Theorem 1 and Theorem 2. Corollary 2 along with identity (6) and inequality (5) yield the possible preimage distributions of an APN map meeting the lower bound.
n is odd, n is even.
If n is odd, by (5) we get Hence there is at most one y 0 ∈ Im(f) such that ω(y) = 3 and it must satisfy ω(y 0 ) ∈ {2, 4}.Corollary 2 completes the proof.Let n be even.Then from ( 5) and ( 6) we get

⊓ ⊔
The APN monomials meet the lower bound for n even; we present several further such families later in this paper.All these examples of APN maps are almost-3-to-1.We believe that cases 2. and 3. for n even never occur.
Open Problem: Let n be even and f : F 2 n → F 2 n be APN map with | Im(f)| = (2 n + 2)/3.Can f have the preimage distribution described in case 2. or 3. of Theorem 6 ?Numerical results suggest that there are no APN maps meeting the lower bound for n odd.We show later in this paper that the image sizes of almost bent maps never fulfill the lower bound in Theorem 6.The APN maps with smallest sizes which we found are -for n = 7 the map x → x 3 + x 64 + x 16 + x 4 with the image size 57 = 2 6 − 7; -for n = 11 the map x → x 3 + x 256 with the image size 1013 = 2 10 − 11.
In [22] it is shown that the APN binomial b(x) = x 3 + x 4 is 2-to-1 if n is odd.This binomial is studied in [26]: For an even n the image set of b(x The lower bound in Theorem 6 can be used to prove several structural results for APN maps.For example, it gives an easy proof for the following well-known property of monomial APN maps. , Theorem 6 forces gcd(k, q − 1) ≤ 3.For n odd we get gcd(k, q − 1) = 1.Now let n be even and gcd(k, q − 1) = 1.Then f is an APN permutation on all subfields of Fq.In particular it must be an APN permutation on F 4 .It is easy to check that such a permutation does not exist.Hence gcd(k, q − 1) = 3.

⊓ ⊔
The following characterization for APN 3-divisible DO polynomials is a direct consequence of Theorem 5: Corollary 4 Let n be even and f : F 2 n → F 2 n be a 3-divisible DO polynomial.Then We take a closer look at 3-divisible APN maps in the next section.
Next we observe that Zhou-Pott APN quadratic maps constructed in [36] provide examples of almost-3-to-1 APN maps which are not 3-divisible.
The corresponding to f (x, y) map on F 2 2m has a univariate representation which is not a DO-polynomial.
(b) Then g : is almost-3-to-1.The corresponding to g(x, y) map on F 2 2m has a univariate representation which is a DO-polynomial that is not 3-divisible.
(a) Let (x, y), (u, v) ∈ F 2 m × F 2 m with f (x, y) = f (u, v).Then we have First suppose v = 0, and hence x = 0 or y = 0 too.For x = 0, we get which forces y = u = 0, since α is a non-cube.For x, u = 0 and y = 0 we get which is satisfied if and only if x = ωu with ω ∈ F * 4 .Now let v = 0. Setting u = xy v and rearranging the first equation we get or equivalently we can divide by it and obtain Note that (13) has no solution, since all cubes and α is not a cube.Finally observe that y v 2 k +1 = 1 holds if and only if y = ωv with ω ∈ F * 4 .Next we show that the corresponding to f (x, y) map on F 2 2m is not given by a univariate DO polynomial.Let (u 1 , u 2 ) be a basis of F 2 2m over F 2 m and (v 1 , v 2 ) its dual basis.Then an element z of F 2 2m has the representation (v Since k = 0, there will be no term z 2 in the summand for u 1 , and hence the above polynomial contains a non-zero term with z 2 , showing that f (z) is not a DO-polynomial.
(b) Note that g(x, y) is obtained from f (x, y) by a linear bijective transformation (x, y) → (x, y 2 m−i ).In particular, g(x, y) is almost 3-to-1, too.Next we describe the univariate representation of the corresponding to g(x, y) map on F 2 2m .Again let (u 1 , u 2 ) be a basis of F 2 2m over F 2 m and (v 1 , v 2 ) its dual basis.Then we get which is a DO polynomial.Finally, note that g(x, y) = g(ωx, ωy) for ω ∈ F 4 \ F 2 , and hence the DO polynomial g(z) is not 3-divisible.

⊓ ⊔
Remark 2 Observe that our proof of Theorem 7 does not use the property that f (x, y) is APN.Hence Theorems 7 and 12 prove that the maps f (x, y) and g(x, y) are APN.
In [13] a map f : Fq → Fq is called δ-vanishing if for any non-zero a the equation f (x + a) − f (x) = 0 has ta solutions, where 0 < ta ≤ δ.Note that any zero-difference d-balanced map is d-vanishing.Problem 1 in [13] asks whether any quadratic δ-vanishing map must be d-divisible with an appropriate d.Theorem 7 shows that the answer to this problem is negative.Indeed, the Zhou-Pott maps f (x, y) and g(x, y) are quadratic APN maps which are not 3-divisible.These maps are almost-3-to-1 and hence N (f) = N (g) = 3q − 2 and then by Corollary 1 they are zero-difference 2-balanced.
The next sufficient condition for an APN map to be almost-3-to-1 follows immediately from the lower bound in Theorem 6.
Proposition 1 Let n be even and f : F 2 n → F 2 n be an APN map satisfying The Zhou-Pott construction of APN maps was recently generalized in [24].Next we use Proposition 1 to show that the APN maps of this construction are almost-3-to-1 too.
Proof The APN property of these maps (under the given conditions) was proven in [24].For the rest, we check the conditions of Proposition 1.The first condition is clearly satisfied in both cases.We start with f 1 : Direct computations show that A similar calculation yields f 1 (x, y) = f 1 (x + y, x).Thus every y ∈ Im(f 1 ) \ {0} has at least three preimages.Both conditions of Proposition 1 are satisfied for f 1 , completing the proof for f 1 .Consider now f 2 : Similarly to the first case, we have and similarly f 2 (x, y) = f 2 (x + y, x), so both conditions of Proposition 1 are again satisfied.

⊓ ⊔
A further large family of inequivalent almost-3-to-1 APN maps has been found by Faruk Göloglu and the first author, and will be published soon.
A natural question is whether every quadratic APN map of F 2 n with even n is EA-equivalent to an almost-3-to-1 map.The answer is negative.By Theorem 12, all almost-3-to-1 quadratic APN maps have the classical Walsh spectrum.And hence the EA-class of quadratic APN maps with non-classical Walsh spectra do not contain an almost-3-to-1 map.

3-divisible APN maps
Observe that by Corollary 4, every APN DO polynomial f ′ (x 3 ) on F 2 n , n even, is an example with the preimage distribution described in Case 1. of Theorem 6.
Prominent examples for such APN maps are x → x 3 and x → x 3 + Tr(x 9 ).These maps are APN for any n.If n is odd, then x → x 3 is a permutation and x → x 3 + Tr(x 9 ) is 2-to-1, as we will see later in this section.
Next we present an interesting observation which could be helpful for performing numerical searches as well as theoretical studies of 3-divisible APN DO polynomials.In particular it could be used for classifying exceptional APN 3-divisible DO polynomials.
Proof Since the coefficients of f are from F 2 m , it defines an APN map on it.By Corollary 4, The substitution of x 3 in a polynomial of shape f ′ (x) = L 1 (x) + L 2 (x 3 ), where L 1 , L 2 are linearized polynomials, results in a DO polynomial f (x) = f ′ (x 3 ) = L 1 (x 3 ) + L 2 (x 9 ).Hence for even n by Corollary 4 such a map is APN if and only if it is almost 3-to-1.In particular, any permutation of shape L 1 (x) + L 2 (x 3 ) yields directly an APN DO polynomial if n is even.Observe that x 3 and x 3 + Tr(x 9 ) are of this type too.These and further APN DO polynomials L 1 (x 3 ) + L 2 (x 9 ) are studied in [6,7].Corollary 4 suggests a unified approach for understanding such APN maps.
Results from [19] can be used to construct and explain permutations of shape f ′ (x) = L 1 (x) + L 2 (x 3 ).For example, Theorem 6 in [19] with s = 3 and L(x) = x 2 + αx yields the following family of APN 3-divisible DO polynomials.
Theorem 10 Let α, β, γ be non-zero elements in F 2 n with n even.Further let γ ∈ {x 2 is a permutation on F 2 n and consequently An APN map constructed in Theorem 10 is affine equivalent to one of form x 3 + α Tr(α −3 x 9 ) studied in [7].Indeed, the map f ′ (x) can be reduced to where L 1 is linear over F 2 .Using [19,Theorem 5] the map L 1 is bijective.Then and thus where for the last equality we used L 1 (α) = γ.Note that this reduction remains true for n odd too, showing that the examples of Theorem 10 are APN for any n.
As we mentioned earlier the polynomials x 3 and x 3 + Tr(x 9 ) define APN maps on F 2 n for every n ≥ 1.For n odd, the first map is a permutation and the second is 2-to-1, as the following result shows.
Proposition 2 Let n be odd and a ∈ F 2 n non-zero.Then the APN map Proof This follows from Theorem 3 in [18], since a −1 is a 1-linear structure of Tr(a 3 x 3 ) for n odd, which can be easily checked by direct calculations.

⊓ ⊔
We believe that if n is odd, then 2 n−1 is the minimal possible image size of an APN DO polynomial of shape L 1 (x 3 ) + L 2 (x 9 ).However, an analog of Corollary 4 is not true for the size 2 n−1 .There are such DO polynomials with image size 2 n−1 , which are not APN.For example, if n is odd, the DO polynomial (x 2 + x) • x 3 is 2-to-1, but not APN.
Next we observe that for n odd there are APN DO polynomials of shape L 1 (x 3 ) + L 2 (x 9 ), that are neither bijective nor have image size 2 n−1 .For a divisor t of n we denote by Tr 2 n /2 t (x) the trace map from F 2 n into the subfield F 2 t , that is In [7], it is shown that for any non-zero a ∈ F 2 3m , m arbitrary, the DO polynomials define APN maps on F 2 3m .Moreover, the maps f ′ 1 and f ′ 2 are bijective when m is even.For m odd, the image sets of these maps contain 5 • 2 3m−3 elements, as Propositions 3 and 4 show.
Proposition 3 Let m be an odd integer and a ∈ F * 2 3m be arbitrary.Then the APN map f : F 2 3m → F 2 3m given by Proof We consider the equation f (x) = f (y) on F 2 3m .Since x → x 3 is a permutation on F 2 n with n odd, it is sufficient to look at f ′ (x) = f ′ (y), where or equivalently, Tr 2 3m /2 3 (a 3 x 3 + a 6 x 6 + a 3 y 3 + a 6 y 6 ) = a(x + y). ( In particular, Taking the absolute trace on both sides of ( 14), we get If az = 0 we have z = 0 and x = y.So let z = a −1 β k with k ∈ {1, 2, 4}.Note that x → x k is a linear permutation on F 2 3m .We have As β 3 = β + 1, we get β 6 = β 2 + 1 and therefore , so that We now need to ensure that ( 14) holds.Using (15) and m odd this turns into The proof of next result is almost identical to the one of Proposition 3: Proposition 4 Let m be an odd integer and a ∈ F * 2 3m be arbitrary.Then the APN map f : F 2 3m → F 2 3m given by 6 Relations between the image sets of APN maps and their Walsh spectrum 2 n are called the component functions of f .We call f λ a balanced component of f , if it takes the values 0 and 1 equally often, that is both 2 n−1 times.The Walsh transform of f is defined by , n even.We say that the map f has the classical Walsh spectrum if for any b ∈ F * 2 n , a ∈ F 2 n and the extended Walsh spectrum of f contains the values 0, 2 n/2 , 2 (n+2)/2 precisely (2 n − 1) Most of the known APN maps in even dimension have the classical Walsh spectrum, including the monomial APN maps with Gold and Kasami exponents.There are APN maps with non-classical Walsh spectra, see e.g.[3] for such examples.
For n odd the map f is called almost bent if all its components f λ are plateaued with t = 1.For n even, a plateaued component with t = 0 is called a bent component.
It is well known that an almost bent map is necessarily APN, and there are APN maps, which are not almost bent.Quadratic maps are always componentwise plateaued.Also a crooked map, which is defined by the property that all its differential sets are affine hyperplanes, is component-wise plateaued [2,27].Properties of component functions of crooked maps are studied in [17].Further examples of component-wise plateaued maps can be found in [9].
The next result gives a sufficient condition for a map to be APN in terms of its component functions.The Parseval equation states for any b ∈ F 2 n .It implies that a component-wise plateaued map f with (2/3)(2 n − 1) bent components and (1/3)(2 n − 1) plateaued components with amplitude t = 2 has always the classical Walsh spectrum.
To prove the next theorem we use the following well known lemma.

⊓ ⊔
The next theorem shows that almost-(2 r +1)-to-1 component-wise plateaued maps have a very special Walsh spectrum.The key step in its proof is the fact that the components of such maps have weights divisible by 2 r + 1.This together with Lemma 4 and some basic identities for Walsh values allow to control the Walsh spectrum of f .Our proof is an adaption of the one of Theorem 2 from [13], where (p r + 1)-divisible quadratic maps of finite fields with an arbitrary characteristic p are considered.

⊓ ⊔
Note that the conditions f (0) = 0 and ω(0) = 1 are not restrictive when we consider the extended Walsh spectrum: Indeed, otherwise we consider f (x + c) + d with suitable c, d ∈ F 2 n , which is also component-wise plateaued and has the same extended Walsh spectrum as f : The two boundary cases m = 1 and r = 1 of Theorem 11 imply interesting extremal cases.For m = 1, we get that a component-wise plateaued almost-(2 n/2 + 1)-to-1 map on F 2 n has 2 n −2 n/2 bent components, which is the maximum number of bent components that a map on F 2 n can have [29].For m = 1 the following result holds too: Proposition 6 Let r ∈ N, n = 2r and f : F 2 n → F 2 n be an almost-(2 r + 1)-to-1 map.Then f is component-wise plateaued if and only if it has 2 n − 2 n/2 bent components.
Proof One direction is covered by Theorem 11.Assume that f has 2 n − 2 n/2 bent components.As mentioned before, we can assume without loss of generality that f (0) = 0 and ω(0) = 1.By the proof of Theorem 11 we have . The sum has 2 n/2 − 1 terms and each term is less or equal to 2 n , so necessarily it must hold W f (b, 0) = 2 n for every b ∈ F * 2 n that does not define a bent component.Then, by Parseval's equation, W f (b, a) = 0 for these b and every a ∈ F * 2 n , so these components are also plateaued.

⊓ ⊔
The case r = 1 of Theorem 11 shows that almost-3-to-1 component-wise plateaued maps are APN and they have the classical Walsh spectrum: Theorem 12 Let n = 2m and f : F 2 n → F 2 n be an almost-3-to-1 component-wise plateaued map.Then f is an APN map with the classical Walsh spectrum.Moreover, if f (0) = 0 and ω(0) = 1, i.e. 0 is the only element with precisely one preimage, then Proof The result follows from Theorem 11 for r = 1 and Proposition 5.

⊓ ⊔
In [9,Corollary 10 and 11] it is proven that if n is even, then all almost-3-to-1 plateaued maps of F 2 n have the same Walsh spectrum as the cube function x → x 3 .This is exactly the statement of Theorem 12 too.The precise Walsh spectrum of the cube function is determined by Carlitz [16] via a refined evaluation of certain Gauss sums.The proof of Theorem 11 implies an elementary proof for Carlitz's result on the value of the cubic exponential sum S(b) = x∈F 2 n (−1) Tr(bx 3 ) .The latter is the key step for obtaining the Walsh spectrum of the cube function in [16].
It is well known that quadratic (not necessarily APN) maps as well as crooked maps are component-wise plateaued.Hence Theorem 12 implies Note that Corollaries 4 and 5 confirm Conjecture 1 stated in [31], that all APN maps of the form f (x) = L 1 (x 3 )+L 2 (x 9 ) in even dimension have the classical Walsh spectrum.Theorem 12 combined with Theorems 7 and 8 yield that Zhou-Pott and Göloglu APN maps have the classical Walsh spectrum.This is shown for Zhou-Pott and further maps in [1], using Bezout's theorem on intersection points of two projective plane curves.Not all maps considered in [1] are almost-3-to-1.
By Corollary 5 the EA-class of a quadratic APN map with non-classical Walsh spectrum do not contain an almost-3-to-1 map.The following related question is yet open: Open Problem: Let n be even.Is there any APN DO map f : F 2 n → F 2 n with the classical Walsh spectrum, such that for any F 2 -linear map f +l is not almost-3-to-1 (equivalently, that there is no almost-3-to-1 map in the EA-class of f ) ?
We conclude this section with some observations on the almost bent maps on F 2 n with n odd.We use them in the next section to give an upper bound on the image set of such maps.Next lemma describes a direct connection between N (f) and the number N 0 of balanced component functions of almost bent maps.
Lemma 5 Let n be odd and f : F 2 n → F 2 n be almost bent.Set Then these three values are determined by N (f) in the following way: Proof Clearly, we have Further, we have Rewriting this equation yields or, equivalently, Moreover, we have and Subtracting Eq. ( 21) from Eq. ( 20) yields Similarly adding Eq. ( 21) and Eq. ( 22) we get that N (f) must be divisible by 4 and that The value of N − then follows immediately from Eq. ( 20).
⊓ ⊔ Remark 3 Recall that any crooked map is almost bent if n is odd.Property (c) in Corollary 6 implies that at least one differential set of a crooked map on F 2 n with n odd is a complement of a hyperplane.Equivalently, for n odd there is no crooked map such that all its difference sets are hyperplanes.To the contrary if n is odd then there are bijective crooked maps, for which necessarily all differential sets are complements of hyperplanes.Interestingly, this property is the other way around if n is even.Then crooked maps, for which all differential sets are hyperplanes, do exist (for instance, x → x 3 as observed in [27]).But there are no crooked maps with all their differential sets being complements of hyperplanes.The latter is a consequence of the non-existence of bijective crooked maps in even dimension [27].
7 Upper bounds on the image sets of APN maps In previous sections we used the value N (f) to obtain a lower bound for the image size of some special maps.In [21], information on N (f) was used to prove an upper bound on the image size of maps, significantly for planar maps.
If n is even, Theorem 13 implies in particular an upper bound on the image size of a map depending on the number of its bent components as observed in Theorem 15.For an odd n Lemma 5 yields an upper bound for the image size of almost bent maps.Since almost bent maps, contrary to the planar ones, can be permutations, the bound is more involved.
Theorem 14 Let f : F 2 n → F 2 n be an almost bent map.Set k = max{ω(a)|a ∈ F 2 n }, i.e. there exists an element c ∈ F 2 n with k preimages under f and there is no element with more than k preimages.Then In particular, if f is not a permutation, then Proof By Eq.s (2) and ( 3) If f is not a permutation, then k > 1 and k−1 k ≥ 1/2, completing the proof.⊓ ⊔ Remark 4 1.From Theorem 14, it is clear that almost bent maps that satisfy the bound in (23) with equality must satisfy max{ω(a)|a ∈ F 2 n } = 2.For such a map we then necessarily have M 1 (f) = 2 n − 2 (n+1)/2 and M 2 (f) = 2 (n−1)/2 .However we believe that the bound is not sharp.2. The bound of Theorem 14 is similar in style to the well-known general upper bound on the image size of maps by Wan [32], stating that if f : F 2 n → F 2 n is not bijective then where d is the degree of f .Another bound similar to Wan's bound is: If f : F 2 n → F 2 n is not bijective and has index l then see [33] for more details and the definition of the index of maps.For almost bent maps with known small degree or index, these upper bounds are stronger than the one in Theorem 14.
In even dimension, it is well known that maps with bent component functions cannot be permutations since bent functions are never balanced.Using Theorem 13, we present an upper bound on the image size of a map depending on the number of bent component functions.This also yields an upper bound for the image size of component-wise plateaued APN maps in even dimension since such maps have always many bent component functions.Proof We use again the relation If x → Tr(bf(x)) is bent, then W f (b, 0) 2 = 2 n , so implying N (f) ≥ t + 2 n .The remaining follows from Theorem 13.

⊓ ⊔
Theorems 14 and 15 yield an upper bound on the image size for componentwise plateaued APN maps.⊓ ⊔

Corollary 5
Let n = 2m and f :F 2 n → F 2 n .(a) If f is almost-3-to-1 crooked map, then f has the classical Walsh spectrum.(b) If f is almost-3-to-1 quadraticmap, then it is APN with the classical Walsh spectrum.

Corollary 6 + 1 3 .
Let n be odd and f : F 2 n → F 2 n be almost bent.Then (a) N (f) is divisible by 4.(b) The number of balanced component functions of f is odd.In particular, every almost bent function has at least one balanced component function.(c)N (f) ≤ 3 • 2 n − 4 and f is not zero-difference 2-balanced.(d) | Im(f)| > 2 nProof Statement (a) holds since N + and N − in Lemma 5 are integers.Then (b) is a direct consequence of (a) and Lemma 5. Using Corollary 1 and (a), we get that N (f) ≤ 3 • 2 n − 4 and hence f is not zero-difference 2-balanced.Theorem 6 with (c) imply (d), since if the lower bound is fulfilled then necessarily N

Theorem 15
Let n be even and f : F 2 n → F 2 n be a map with t bent component functions.Then N (f) ≥ t + 2 n and | Im(f)| ≤ 2 n −
then ω(y) = 2 for every y ∈ D. Note that |D| = 3 is not possible, since ω(y) ∈ {2, 4} for all y ∈ D, contradicting the second equation since 3|D| − 2 is odd in this case.If |D| = 4, we have again ω(y) ∈ {2, 4} for all y ∈ D and the only solution to the second equation is ω(y) = 2 for 3 elements and ω(y) = 4 for one element.|D| > 4 violates the first equation, so we exhausted all possibilities.