Bent functions in the partial spread class generated by linear recurring sequences

We present a construction of partial spread bent functions using subspaces generated by linear recurring sequences (LRS). We first show that the kernels of the linear mappings defined by two LRS have a trivial intersection if and only if their feedback polynomials are relatively prime. Then, we characterize the appropriate parameters for a family of pairwise coprime polynomials to generate a partial spread required for the support of a bent function, showing that such families exist if and only if the degrees of the underlying polynomials are either 1 or 2. We then count the resulting sets of polynomials and prove that, for degree 1, our LRS construction coincides with the Desarguesian partial spread. Finally, we perform a computer search of all PS-\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$\mathcal{PS}\mathcal{}^-$$\end{document} and PS+\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$\mathcal{PS}\mathcal{}^+$$\end{document} bent functions of n=8\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$n=8$$\end{document} variables generated by our construction and compute their 2-ranks. The results show that many of these functions defined by polynomials of degree d=2\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$d=2$$\end{document} are not EA-equivalent to any Maiorana–McFarland or Desarguesian partial spread function.


Introduction
Boolean functions play an important role in cryptography, coding theory, and combinatorial designs [15].Among them, bent functions are of partic-ular interest since they lie at the highest possible Hamming distance from the set of all affine functions, or equivalently they reach the highest possible nonlinearity.For this reason, bent functions have been extensively used in the past for designing stream and block ciphers since highly nonlinear Boolean functions are useful to withstand fast-correlation and linear cryptanalysis attacks.Even though bent functions are unbalanced, highly nonlinear balanced functions can be derived from them [8].For this reason, bent functions have been used in the past for designing stream and block ciphers since highly nonlinear Boolean functions are useful to withstand fastcorrelation and linear cryptanalysis attacks [4].Besides cryptography, bent functions are connected in coding theory to the covering radius of first-order Reed-Muller codes, whose codewords are affine Boolean functions.
Over the last decades, many constructions of bent functions have been described in the related literature (see, e.g., [3,15,4] for a survey of the main ones).A distinction is usually made between the primary and secondary constructions.Primary constructions build sets of bent functions from scratch, usually by leveraging on related combinatorial structures.Some of the most well-known primary constructions for bent functions include the Maiorana-McFarland construction [14], which exploits permutations over F n 2 , and Dillon's construction [7], based on the class of partial spreads PS.On the contrary, secondary constructions build new bent functions starting from existing ones.For example, the Rothaus's construction [17] takes three bent functions of n variables whose sum is also bent and yields a bent function of n + 2 variables.
The search for novel methods to design bent functions is still an interesting and active research area nowadays, for a twofold motivation: • Discovering new functions.Notwithstanding the multitude of existing constructions, they only cover a tiny fraction of the total number of bent functions [15], and the complete enumeration of bent functions remains an open question for n ≥ 10 variables [16].Therefore, finding new constructions that yield previously unknown bent functions is still an interesting research avenue to pursue.However, one must remark that this direction is becoming increasingly difficult precisely because many constructions are already in place.This makes the discovery of new bent functions both unlikely and cumbersome since, in principle, one has to check inequivalence against a large number of known classes.
• Finding new constructions for known functions.Novel constructions that generate already known bent functions are an interesting research line as well, for several reasons.For example, from an implementation point of view, such constructions could highlight more efficient ways to design the corresponding bent functions, other than by classic lookup tables.More generally, a novel construction could provide a new perspective on understanding the structure of a known class of bent functions and spawning new research questions linked both to the construction of new bent functions and other interesting combinatorial objects.As we will argue in the following, we deem our work an example of this approach.
In this paper, we present a new primary construction of bent functions in the partial spread class PS by using the subspaces spanned by Linear Recurring Sequences (LRS) over finite fields.The main idea is to define a linear mapping through the feedback polynomial of an LRS and then to use its kernel as a subspace in a partial spread.The main contributions of this paper can be summarized as follows: • We prove that the kernels of two linear mappings have a trivial intersection if and only if the feedback polynomials of their LRS are pairwise coprime.
• We show that a family of pairwise coprime polynomials large enough to define the partial spread for a bent function exists if and only if the degree of the involved polynomials is either b = 1 or b = 2, assuming that all polynomials have a nonzero constant term.
• We prove that for degree b = 1, the functions given by our LRS construction coincide with the Desarguesian partial spread class.
• We perform a computer search of all bent functions of n = 6, 8 variables generated by our LRS construction, remarking that they always have maximal degree n/2, even for PS + -type functions.
• We analyze the distribution of the 2-ranks for the LRS bent functions of n = 8 variables.For the degree b = 1, we independently verify the distribution reported by Weng et al. [19] for functions in the Desarguesian partial spread.For degree b = 2, we remark that many of the obtained bent functions have a rank higher than 42, and thus they are not EA-equivalent to any Maiorana-McFarland or Desarguesian partial spread function.
The remainder of this work is structured as follows.Section 2 reviews the background definitions on bent functions and linear recurring sequences used throughout the paper.Section 3 defines our LRS construction, proving that the kernels of two LRS linear mapping have a trivial intersection if and only if the associated feedback polynomials are coprime.Section 4 characterizes the families of pairwise coprime polynomials that are required for the LRS construction and provides the corresponding counting result.Section 5 shows that the LRS construction equals the Desarguesian partial spread construction when using polynomials of degree 1. Section 6 discusses the computer search experiments for bent functions of n = 6, 8 variables generated by the LRS construction, reporting the distribution of the 2-ranks.Finally, Section 7 summarizes the main results presented in this paper and points out several avenues for future research, discussing the connection with the cellular automata approach used in [9].

Background
This section covers the necessary background notions used throughout the paper.We begin by introducing the basic definitions and results related to bent Boolean functions, describing the main known primary constructions (namely, the Maiorana-McFarland construction and Dillon's partial spread class), the extended affine equivalence relation, and a to check (in)equivalence of a bent function against a class of other known functions.We then move to linear recurring sequences and their vector spaces, representing the main combinatorial objects used to define our new construction of bent functions.

Bent Functions
We refer the reader to [4] for a thorough treatment of the results recalled in this section about Boolean functions.In what follows, let F q be the finite field with q elements (where q = p α is a power of a prime number), and denote by F n q the n-dimensional vector space over F q , with 0 being its null vector.For q = 2, sum and multiplication on F 2 correspond to the XOR and logical AND operations, respectively.Following the literature convention about Boolean functions, we will denote the sum operation over F 2 by ⊕, while for a generic finite field F q we will adopt the normal sum symbol +.On the other hand, we will denote the multiplication operation in all finite fields by concatenation of the operands.A Boolean function of n variables is a mapping f : F n 2 → F 2 .The most natural way to uniquely represent a Boolean function f is by means of its truth table, which is the vector Ω f ∈ F 2 n 2 that lists the output of f evaluated over all 2 n input vectors x ∈ F n 2 in lexicographic order.The support of f is the subset of input vectors that map to 1, that is, supp(f , the number of ones in the truth table of f .Functions with the Hamming weight equal to w H = 2 n−1 are also called balanced, since their truth table is composed of an equal number of zeros and ones, and they play an important role in the design of stream and block ciphers [4].The polarity truth table with P([n]) = 2 [n] being the power set of [n] = {1, • • • , n}.The algebraic degree of f is defined as the cardinality of the largest subset I such that a I = 0.In particular, affine functions are defined as those Boolean functions with degree at most 1.Notice that the ANF is a unique representation of a Boolean function, and in particular one can retrieve the truth table back from the ANF coefficients through the Möbius transform: A third common method to uniquely represent Boolean functions used in cryptography is the Walsh-Hadamard transform.Formally, the Walsh-Hadamard transform of a Boolean function f : where a • x = n i=1 a i x i is the scalar product between a and x.One may easily see that a function f is balanced if and only if its Walsh-Hadamard transform vanishes on the null vector, i.e., if and only if W f (0) = 0.In particular, the Walsh-Hadamard coefficient W f (a) quantifies the correlation between f and the linear function a • x.The lower the absolute value of W f (a), the lower will be the correlation of f from a • x (and from its affine counterpart 1 ⊕ a • x), and thus the higher will be the Hamming distance between the truth tables of the two functions.In particular, the nonlinearity of a Boolean function f : F n 2 → F 2 is defined as the minimum Hamming distance of f from the set of all affine functions, and it can be computed as follows: Therefore, a Boolean function with high nonlinearity must be characterized by a low maximum absolute value among its Walsh-Hadamard coefficients.Parseval's relation states that the sum of the squared Walsh-Hadamard spectrum is constant for any Boolean function f : F n 2 → F 2 , and it equals: From Parseval's relation, one can remark that the lowest maximum absolute value of the Walsh-Hadamard transform occurs when the constant 2 2n is uniformly "spread" among all 2 n coefficients, that is when each coefficient equals 2 n 2 in absolute value.This observation yields the covering radius bound for the nonlinearity of an n-variable Boolean function: Functions satisfying with equality Equation ( 6) -or equivalently, whose Walsh-Hadamard coefficients all equal 2 n 2 in absolute value -are called bent functions.When n is even, such functions exist since the Walsh-Hadamard coefficients must be integer numbers.Although achieving the highest possible nonlinearity granted by the covering radius bound, bent functions cannot be employed directly in the design of stream or block ciphers since they are always imbalanced.As a matter of fact, we have W f (0) = ±2 n 2 for any bent function, which means that its Hamming weight is There are several ways to construct bent functions proposed in the literature.Usually, such methods are divided in primary and secondary constructions.Recall, a primary construction builds "from scratch" new bent functions by leveraging other kinds of combinatorial objects.On the other hand, a secondary construction derives new bent functions starting from already existing ones.This paper focuses on the former case.
One of the main primary constructions investigated in in the literature is the Maiorana-McFarland construction, which is the set of all bent functions f : F n 2 → F 2 , with n = 2m, defined as: for all x, y ∈ F m 2 , where π : Therefore, for any m ∈ N there are (2 m )! bent functions of 2m variables in M.
A second well-known primary construction that give rise to a large number of bent functions was introduced by Dillon in his PhD thesis [7], and it is based on partial spreads.A partial spread of F n 2 , with n = 2m, is a family P of m-dimensional subspaces S 1 , S 2 , • • • , S t ⊆ F n 2 with pairwise trivial intersection (i.e., for all i = j one has S i ∩ S j = {0}).Further, a partial spread is a spread if the union of its subspaces results in the whole space F n 2 .The main result proved by Dillon is that one can construct a bent function f : F n 2 → F 2 , with n = 2m, from a partial spread P of F n 2 by defining the support of f as the union of the subspaces in P .Remark that the partial spread must be large enough to reach the Hamming weight required for a bent function.In particular, a bent function f : F n 2 → F 2 , n = 2m, belongs to the class PS − if f (0) = 0 and its support is the union of t = 2 m−1 subspaces of a partial spread P of F n 2 .Functions in the PS − reach the maximum possible algebraic degree for a bent function of n = 2m variables, namely m.Bent functions belonging to the class PS + are defined similarly, with f (0) = 1 and their support being the union of t = 2 m−1 + 1 m-dimensional subspaces of a partial spread of F n 2 .Contrarily to PS − , functions in PS + can have algebraic degrees other than m.The union of PS − and PS + gives the whole partial spread class PS.
Currently, the structure of the class PS is still far from being completely characterized, and several methods have been investigated to define partial spreads that are large enough to obtain PS − and PS + bent functions.Here, we introduce only the Desarguesian spread, which is perhaps the best-known example of spread used to construct PS − bent functions (see, e.g., [6] for a general overview of other partial spreads).Given n = 2m, one can use the bivariate form to represent the Desarguesian spread [15].The vector space F n 2 is identified with the Cartesian product F 2 m × F 2 m , and the Desarguesian spread is defined as: where : Then, any subset of 2 m−1 elements of DS is a partial spread whose union defines the support of a bent function.More in particular, these functions belong to the so-called class PS ap (where ap stands for "affine plane"), which is a subset of PS − .Besides reaching maximal degree n/2, functions in the PS ap class have the additional interesting property of being hyper-bent, as shown, e.g., in [5].A Boolean function f : ) is bent for all exponent i coprime with 2 n − 1 [20].
As such, hyper-bent functions have the highest possible distance not only from all affine functions (which corresponds to the case i = 1), but also from all bijective monomial functions.
Given the great variety of primary constructions available in the literature, a crucial question when investigating a new construction is to assess whether the bent functions produced by it are essentially different from those belonging to other known classes.This is accomplished by using equivalence relations.The underlying idea is to classify the bent functions produced by the known constructions up to equivalence and then verify if the bent functions generated by a new construction belong to any of these classes or to different ones.The main equivalence relation used in this context is the extended affine equivalence (EA-equivalence).Two Boolean functions f, g : , and an element c ∈ F 2 such that: for all x ∈ F n 2 .A bent function f : One possible method to check EA-equivalence of a function concerning other classes resorts to the notion of rank, introduced by Weng et al. [19].More precisely, the 2-rank of a Boolean function f : F n 2 → F 2 is the rank of the 2 n × 2 n binary matrix A f whose rows and columns are indexed by the vectors of F n 2 , and which is defined as 2 .This matrix is also the incidence matrix of the symmetric 2-design associated with a Boolean function.Weng

Linear Recurring Sequences
This section covers only the basic notions of linear recurring sequences essential to present our construction.An excellent overview of this topic can be found in the book by Lidl and Niederreiter on finite fields [11].
Let a, a 0 , • • • , a d−1 ∈ F q .A sequence {x i } i∈N of elements in F q is called a linear recurring sequence (LRS) of order d ∈ N if it satisfies the following relation: for all i ∈ N. The first d elements x 0 , • • • , x d−1 act as the initial values of the sequence, while all subsequent ones are determined by applying the linear recurrence defined in Equation (10).In what follows, we will assume that a = 0, i.e., that the LRS is homogeneous.The feedback polynomial of the LRS ( 10) is defined as: that is, f (X) is the polynomial in F q [X] of degree d − 1 whose monomials are defined by the coefficients of the LRS.
In this work, we are interested in a particular variant of LRS of order d: we start from a vector of initial values and we apply Equation (10) on x for d − 1 times.In other words, we define the map F : for all output coordinates i ∈ {0, • • • , d − 1}.Since the map F is linear, we can describe it as ) matrix of the following form: Therefore, we can compactly represent the linear map F by the coefficients of the feedback polynomial f , i.e., f → M F .Notice that M F has the form of the parity-check matrix of a cyclic code, with f playing the role of the parity check polynomial.However, the code associated with f is not cyclic in general.This happens, in particular, if and only if the generator polynomial (which is defined as the reciprocal of f ) divides X N − 1, where N = 2(d − 1) − 1.On the other hand, evaluating F on a particular vector x ∈ F 2(d−1) q corresponds to computing the syndrome of x.In particular x will be a valid codeword if and only if M F • x ⊤ = 0, i.e., if and only if x belongs to the kernel of F .In what follows, we will consider the kernels of the F q -subspaces associated with this kind of linear mappings to generate partial spreads.As a final note, remark that F may also be regarded as a linear cellular automaton (CA) [13].The connection between the LRS used to define bent functions in this paper, and CA will be briefly discussed in the conclusions.

The LRS Construction
The first step of our construction requires to characterize when the kernels of two LRS subspaces have a trivial intersection.The next result shows that this is equivalent to computing the greatest common divisor of the respective feedback polynomials.
] be two polynomials over F q of degree d, respectively defined as: be the linear maps defined by the polynomials f and g, respectively.Then, the kernels of F and G have trivial intersection if and only if gcd(f, g) = 1, i.e., if and only if f and g are relatively prime.
Proof.The linear maps F and G are respectively defined as , where M F and M G are the two (d−1)×2(d−1) matrices of the form.Define now the linear function H : , where In other words, the matrix M H is simply the superposition of the two matrices M F and M G .Remark that M H is also the Sylvester matrix of the polynomials f and g.It is a well-known fact that the determinant of the Sylvester matrix (also called the resultant in this context) is nonzero if and only if f and g are relatively prime [10].
Suppose now that ker(F as well.Indeed, assume that ker(H) contains a nonzero vector x ′ ∈ F 2(d−1) q \ {0}.Since M H is the superposition of M F and M G , this implies that x ′ ∈ ker(F ) and x ′ ∈ ker(G), contradicting the hypothesis that the two kernels have trivial intersection.Consequently, the kernel of H has dimension zero, and by the rank-nullity theorem the dimension of the image of H is 2(d − 1), or equivalently M H is invertible and its determinant is nonzero.Thus, since M H is the Sylvester matrix of f and g, it follows that gcd(f, g) = 1.
The other direction of the implication follows a symmetric reasoning: if gcd(f, g) = 1 it follows that M H is invertible, and thus the kernel of H is trivial.Hence, the intersection of the kernels of F and G is also the trivial space Therefore, we need to find a family of pairwise coprime polynomials of degree b = d − 1 that is large enough to define a bent function.Following what we recalled in Section 2.1, for a PS − function we need t = 2 m−1 coprime polynomials of degree b.To this aim, let us take the finite field F q with q = 2 l , for l ∈ N.This is because a partial spread for a bent function must be defined over the vector space F n 2 , n = 2m.In particular, each vector x ∈ F 2b 2 l must also be converted in a corresponding binary vector x ∈ F n 2 since the union of the vectors in the partial spread will form the support of the bent function.In other words, we require that lb = m.By identifying F 2 l with the vector space F l 2 , a vector x in F 2b 2 l is a 2b-tuple whose components are in turn binary l-tuples: We now associate to each element x ∈ F 2b 2 l an element of F 2lb 2 through the flattening operator ϕ : F 2b 2 l → F 2lb 2 , which simply drops the parentheses inside the vector representation of x: It is then easy to see that ϕ is bijective.We can now characterize the partial spreads arising from our construction: If there are t = 2 lb−1 (respectively, t = 2 lb−1 + 1)) coprime polynomials of degree b over F q where q = 2 l , then there exists a partial spread P over F n 2 , n = 2m, whose union of its subspaces defines a bent function in the class PS − (respectively, PS + ).
Proof.Let f 1 , • • • , f t be the coprime polynomials of degree b over F q , and let q → F b q be the corresponding linear maps associated to them.Define the following family of subspaces of F n 2 , with n = 2m = 2lb: where Φ(ker(F i )) = {y ∈ F n 2 : y = ϕ(x), x ∈ ker(F i )}, for 1lei ≤ t.In other terms, the subspace Φ(ker(F i )) is obtained by taking the kernel of F i and applying the flattening operator to each vector in it.Since the polynomials f 1 , • • • , f t are pairwise coprime, by Lemma 1, the kernels of the F i have pairwise trivial intersection.Clearly, the same property holds for the subspaces Φ(ker(F i )) in P since they are just a different representation of the same kernels through the flattening operator.Therefore, P is a partial spread over F n 2 , and depending on its size (t = 2 lb−1 or t = 2 lb−1 + 1), it can be used to define the support of a PS − or PS + bent function, respectively.
In the remainder of this section, we show two examples of bent functions obtained through our construction.
The ANF of g is defined as follows: It is possible to verify that this function is bent in a number of ways.For example, one can observe that g is equivalent to the function g ′ (x 1 , x 2 , x 3 , x 4 ) = x 1 x 2 ⊕ x 2 x 3 ⊕ x 3 x 4 , up to a permutation of the input variables (in particular, it suffices to permute x 2 with x 3 ).It is well known in the literature (see, e.g., [18]) that the function g Example 2. The bent function g defined in Example 1 belongs to the PS − class, since its support is the union of 2 2−1 = 2 subspaces of dimension 2 with trivial intersection.If we want to obtain a PS + function, we need an additional polynomial of degree b = 2 that is coprime both to f 1 and f 2 .To this end, we can select for instance f 3 (X) = X 2 .The kernel of the associated linear map F 3 is as follows: ker(F 3 ) = {0000, 0001, 0010, 0011} , which again has trivial intersection with both ker(F 1 ) and ker(F 2 ).Therefore, we can define a PS + bent function h : F 4 2 → F 2 by setting h(0000) = 1 and defining the rest of its support as the union of the three kernels minus their trivial intersection.We thus obtain the following truth table: with the ANF of h being:

Counting Bent Functions in the LRS Construction
The first research question spawning from Theorem 1 is whether for all even n ∈ N there are at least t = 2 m−1 (respectively, t = 2 m−1 + 1) pairwise coprime polynomials of degree b = m/l over F 2 l to construct a PS − (respectively, PS + ) bent functions.In what follows, we focus on the case of monic polynomials with nonzero constant term that are pairwise coprime to exploit the counting results proved in [12].The authors proposed a construction for such families of polynomials based on the multiplication of two irreducible polynomials of degree k and b − k, respectively.In particular, they showed that the maximum size of the families that can be generated through this construction equals: In the formula above, I k denotes the number of irreducible monic polynomials of degree n and with nonzero constant term over F q , which is I k = q − 1 for k = 1, while for k ≥ 2 it is given by Gauss's formula: with µ denoting the Möbius function.Further, in [12] it is proved that such construction is optimal, meaning that N b actually corresponds to the maximum size attainable by any family of monic coprime polynomials of degree b with nonzero constant term over F q .Thus, one can study Equation (20) with respect to the parameters l, b, and m to address the existence question for families of polynomials that satisfy the conditions of Theorem 1.We now characterize such families for the case of PS − functions in terms of the degrees of their polynomials: Theorem 2. Let l, b, m ∈ N such that lb = m, and let q = 2 l .Then there exists a family of t = 2 m−1 pairwise coprime polynomials of degree b and nonzero constant term over F q if and only if b ∈ {1, 2}.
Proof.We need to show that N b ≥ 1 2 q b if and only if b ≤ 2. We first settle the cases of b ≤ 4 one by one.
For b = 1, we obtain For b = 2, we obtain For b = 3, we obtain For b = 4, we obtain We now move on to the case where b ≥ 5. Denoting the smallest nontrivial divisor of b by p, we first get the following upper bound on I b : We also obtain the following upper bound: Combining, we obtain Hence, bent functions can be obtained from our LRS construction for all number of variables n = 2m, where m = l when b = 1, and m = 2l when b = 2.This leads us to the following counting result: Theorem 3. Let l, m ∈ N and b ∈ {1, 2} such that lb = m, and let q = 2 l .Then, the number of P S − bent functions of n = 2m variables that can be obtained by Theorem 1 with polynomials of degree b and nonzero constant term is 2 m −1 2 m−1 when b = 1 and Proof.By Theorem 2 b = 1 and b = 2 are the only cases we need to address.Let b = 1 (and thus m = l).Then, by Equation ( 20), the largest family F 1 of coprime polynomials of degree 1 with nonzero constant term over F q is composed of N 1 = q − 1 = 2 m − 1 elements.The number of subsets of 2 m−1 elements of F 1 that can be selected to apply Theorem 1 is 2 m −1 2 m−1 .For b = 2, any family of t = 2 m−1 coprime polynomials of degree 2 with nonzero constant term over F q consists of: 1.A ≤ I 2 irreducible polynomials of degree 2; 2. B ≤ I 1 polynomials of the form f 2 , where f is an irreducible polynomial of degree 1; 3. C = t−B−A polynomials of the form gh, where g and h are irreducible polynomials of degree 1; and obviously, the same irreducible polynomial of degree 1 only appears once.There are I 2 A choices for the first part of the family, I 1 B choices for the second part of the family, and choices for the third part of the family.Combining all three parts, we obtain the formula.
The results above refer to the number of families of coprime polynomials with a nonzero constant term that is large enough to construct PS − bent functions.Although such functions will be the focus of our computer investigations in the next sections, one could also augment such families with other types of polynomials, as long as they are pairwise coprime with all the others.This could be used, for instance, to construct further PS − functions or PS + functions with polynomials of degree b = 1, 2. Additionally, one could combine these other types of coprime polynomials with families of degrees higher than 2.
One simple idea to achieve this is to augment each family with the constant polynomial 1 and the polynomial X b .Although the former is not of degree b while the latter does not have a constant term, it is easy to see that they are coprime both among themselves and to all other polynomials in the families considered in Theorems 2 and 3.This idea spawns from the orthogonal array (OA) characterization of our construction adopted in [9], where the first two columns of the OA corresponds to the LRS subspaces defined by 1 and X b .We will elaborate further on this connection in the conclusions section.
We already used in Example 1 the polynomial X 2 to construct a PS + function of 4 variables, by adding it to the family {X 2 + 1, X 2 + X + 1}.
One could also add the constant polynomial 1, thereby obtaining a family of 4 coprime polynomials of degree b = 2. Since to define a PS + function of 4 variables with our LRS construction we need 2 2−1 + 1 = 3 pairwise coprime polynomials, we can build 4  3 = 4 PS + functions by selecting all subsets of three polynomials in {1, X 2 , X 2 + 1, X 2 + X + 1}.Alternatively, one could build 4  2 = 6 PS − functions from this family, since in this case we only need a subset of two polynomials.
The next example shows how the two polynomials 1 and X b can be used to augment a family of coprime polynomials with a nonzero constant term of degree b > 2, so that we have enough of them to apply our construction.
5 Equivalence to DS Functions for Degree b = 1 We now show that our LRS construction coincides with the Desarguesian partial spread class when considering polynomials of degree b = 1.In this case, to generate a bent function f : F n 2 → F 2 of n = 2m variables, by Theorem 1 we need to find a set of t = 2 m−1 irreducible polynomials of degree 1 over F 2 m .This basically amounts to choose a subset of cardinality t from the family: Thus, let Recall that each polynomial is used as an abstract representation for the coefficients of a LRS of order d = b + 1, used to define the corresponding linear map.In particular, for f i (X) = a i + X, we have that F i equals: for all pairs (x 1 , x 2 ) ∈ F 2 m × F 2 m .By Theorem 1, the kernels of F i ≡ f i for i ∈ {1, • • • , t} form a partial spread, and each of them is obtained by taking We have that: where E a i is a member of the Desarguesian spread as defined by Equation ( 8) in bivariate form.We have thus obtained the following result: , be a bent function defined as in Theorem 1 with degree b = 1.Then, f ∈ PS ap .
Therefore, when considering the family I 1 of 2 l − 1 irreducible polynomials of degree 1 over F 2 l with the nonzero constant term, our LRS construction is a particular case of the partial spread induced by the Desarguesian spread.Further, the two classes coincide if one adds the polynomial X to the family I 1 since in that case, one can construct 2 l 2 l−1 PS ap functions.However, for degree 2, the above reasoning on the Desarguesian spread does not hold.When b = 2, the LRS is defined by three coefficients instead of two, with the input vector of the linear map consisting of 4 coordinates.Consequently, the LRS is evaluated over three variables x 1 , x 2 , x 3 , and there does not seem to be a straightforward way to express the kernel of the linear map as a set of pairs of the type (x, ax).To the best of our knowledge, there are no other constructions in the literature that represent partial spreads in a way analogous to our construction with degree b = 2.

Computational Results on Ranks and EA-Equivalence for n = 8
To investigate more in detail the bent functions induced by our LRS construction, we performed a computer search for n = 6 and n = 8 variables, with polynomials of degrees b = 1, 2, generating both PS − and PS + functions.Recall that while for PS − functions always have degree n/2 in general, PS + ones can also have different degrees, but this does not seem to be the case with the functions of our LRS construction, judging from our experiments.Indeed, the first interesting remark of our computer search is that the algebraic degree of the generated functions is always n/2, also in the PS + case.It is known that up to n = 6 variables, all bent functions of degree n/2 belong to the completed Maiorana-McFarland class [16].Therefore, the smallest interesting case to consider concerning EA-equivalence is n = 8 variables.
As a first assessment, we generated all PS − functions by using families of coprime polynomials of degree b = 1.Although by Lemma 2, we know that all such functions are in PS ap and coincide with the Desarguesian spread class, we computed their ranks to have independent verification of the count reported by Weng et al. [19].In this case, we have m = l = 4 and t = 2 m−1 = 8.Hence, to construct a function from the Desarguesian spread, we need 8 coprime polynomials of degree d = 1 with coefficients over F 2 4 .Since there are 16 such polynomials (i.e., 2 4 − 1 irreducible polynomials with nonzero constant term and the polynomial X), one can obtain 16  8 = 12870 PS ap functions with our construction.Table 1 reports the distribution of the 2-ranks for all such functions, and indeed it coincides with the table given by the authors of [19].The upper bound on the rank of a Maiorana-McFarland function of n = 8 variables given in [19] is 2 m+1 −2 = 30 for n = 8 variables.Hence, one can see from Table 1 that most of the functions in the Desarguesian spread are inequivalent to Maiorana-McFarland functions.
Next, we focused our attention on coprime polynomials of degree b = 2.As we discussed in Section 5, this case is not directly amenable to the Desarguesian spread, and it is therefore an interesting candidate to find potentially new PS − and PS + functions.By Theorem 2, we have w = 3, t = 8, and l = 2. Consequently, a PS − bent function is obtained by finding a set of eight pairwise coprime polynomials over F 4 of degree 2. Let F 4 = {0, 1, α, α 2 }, where α is a root of an irreducible polynomial p(X) ∈ F 2 [X] of degree 2.Then, by Gauss's formula, there are six irreducible polynomials of degree 2 over F 4 : These polynomials are, of course, pairwise coprime since they are irreducible.
Let us denote them by I 2 = {p 1 , p 2 , p 3 , p 4 , p 5 , p 6 }.Further, there are three irreducible polynomials of degree 1 and nonzero constant term over F 4 that can be squared to obtain polynomials of degree 2 that are coprime among themselves and with those in I 2 : Analogously, we denote by I 2 1 the set {p 7 , p 8 , p 9 }.Further, we can augment our set with the polynomials 1 and X 2 .Although the former is not of degree 2 and the latter does not have a constant term, they are coprime with all polynomials in I 1 ∪ I 2 2 .Finally, we can take the 3 2 = 3 pairs of I 1 and multiply the polynomials in them, obtaining: with I 1,1 = {p 10 , p 11 , p 12 }.These three polynomials are not pairwise coprime among themselves, but each of them is relatively prime to all polynomials in I 2 ∪ {1, X 2 }, and to exactly one polynomial in I 2 1 .Summarizing, for the PS − case, we can construct 174 functions with the following families of t = 8 pairwise coprime polynomials: • 11  8 = 165 subsets of 8 elements in the union I 2 ∪ I 2 1 ∪ {1, X 2 }.
• 6 families obtained by adding to I 2 one element from {1, X 2 } and one element from I Similarly, we can obtain 64 PS + functions by the following families of t = 9 pairwise coprime polynomials: • 11 9 = 55 subsets of 9 elements in the union • 3 families obtained by adjoining to I 2 ∪ {1, X 2 } one element from I  Table 2 reports the distribution of the ranks for the PS − and PS + functions obtained from the families of polynomials described above.
The first significant observation that can be drawn from the table is that none of these bent functions is equivalent to a Maiorana-McFarland function, since the smallest rank is 36.It is even more interesting to observe that many functions are inequivalent to the ones induced by the Desarguesian spread, namely those reaching a rank higher than 42.In particular, our computer search found 60 PS − functions of rank 44 and 60 of rank 46, and 19 PS + functions of rank 44.Thus, we can conclude that our LRS construction can generate bent functions that are not EA-equivalent neither to Maiorana-McFarland functions nor to Desarguesian spread ones.While this is not sufficient to conclude that we found a class of previously unknown bent functions, we consider it as the first step toward that goal.Hopefully, our results will motivate further research in this direction.

Conclusions and Perspectives
This paper described a method to construct bent functions from linear recurring sequences.The construction leverages on the subspaces spanned by linear mappings defined by a family of LRS.In particular, we proved that if the polynomials defining the linear recurrence equations are pairwise coprime, the kernels of the corresponding linear mappings have a pairwise trivial intersection.This result depends on the observation that the superposition of two LRS mappings is the Sylvester matrix associated with their polynomials, which is invertible if and only if the polynomials are coprime.
Consequently, the kernels induced by a family of LRS subspaces whose polynomials are pairwise coprime form a partial spread, and thus a bent function in the class PS.
The key question concerning our LRS construction is to determine when a large enough family of LRS kernels exists, depending on the number of variables of the function, the degree of the polynomials and the extension field of their coefficients.Assuming that all polynomials have a nonzero constant term, we showed that such families exist if and only if the degree of the polynomials is either 1 or 2, and we derived the counting formulas for both cases.We then remarked that at least two other polynomials can always be added to these families, namely X b and 1.This allows one to obtain also PS + functions and, in certain situations, to employ families of polynomials with degrees larger than 2. We then proved that our LRS construction coincides with the Desarguesian partial spread when the degree of the involved polynomials is b = 1, and thus the functions obtained in this case all belong to the class PS ap .Therefore, candidates for potentially new bent functions generated by our construction should be sought with polynomials of degree b = 2.
After remarking that the bent functions of n = 6, 8 variables given by our LRS construction always have maximal degree n/2 (even for PS + ones), we performed a computational analysis of the 2-ranks of the functions for the n = 8 case, to determine the number of equivalence classes and their sizes.In particular, for degree b = 1, we verified the rank distribution reported by Weng et al. [19] for bent functions in the Desarguesian spread, remarking that most of them are not EA-equivalent to any Maiorana-McFarland function.For degree b = 2, we generated both PS − and PS + types of functions and remarked that many of them have a rank greater than 42, which means that they are not EA-equivalent to functions in the Desarguesian spread either.Hence, such bent functions are the most promising candidates to be potentially novel.
There are several open questions to address regarding this LRS construction in future research.The first interesting direction is to investigate more in detail the functions obtained by polynomials of degree b = 2. Indeed, although we showed that many of them are inequivalent to both Maiorana-McFarland and Desarguesian spread functions, it could still be the case that they are EA-equivalent to some other known classes.To this end, it would be interesting to compare our functions to those generated by other partial spread-based constructions, a list of which can be found in [15].Besides computing the 2-rank, employing more discriminating invariants would also be interesting.These include, for instance, the Smith normal form of the development of the graph G f of a Boolean function f , which is used by Polujan and Pott in [16] to classify homogeneous cubic bent functions.
We conclude by discussing the connection of our LRS construction with the cellular automata (CA) approach that we adopted in [9].Our initial idea was to start from a recent construction of Mutually Orthogonal Latin Squares (MOLS) based on linear CA that we set forth in [12].A cellular automaton can be defined as a shift-invariant vectorial transformation, where the same local rule is applied at all sites (or cells) of the input array.If the local rule is linear, then the CA global function is defined by a transition matrix with the same form of the matrix in Equation (13).In particular, the CA global function may be regarded as the linear map induced by an LRS, with Equation ( 12) representing the application of the local rule on the i-th cell of the input.
The authors of [12] first showed that such a linear CA F : F defines a Latin square of order q d−1 if and only if the leftmost and rightmost coefficients a 0 , a d−1 of its local rule are not null.Further, they proved that the Latin squares generated by two such CA are orthogonal if and only if the polynomials associated with their local rules are relatively prime.Thus, determining the maximum size of a family of pairwise coprime polynomials of degree d − 1 and the nonzero constant term is equivalent to finding the size of the largest family of MOLS of order q d−1 induced by linear CA.
The connection between MOLS generated by linear CA and bent functions traces back to a theorem proved by Bush [2], where he showed that a large enough orthogonal array (OA, which is equivalent to a set of MOLS) could be used to define a Hadamard matrix.It is well known that a Boolean function is bent if and only if the polar form of its translate design is a Hadamard matrix.What we proved in [9] is that the Hadamard matrix defined by the MOLS of a family of linear CA indeed has the translate design structure required for a bent function.This result is basically the "CA version" of Theorem 1 proved in the present manuscript.
The characterization through kernels of LRS is clearly a much more compact way to describe our construction than the CA approach, and it is also more general.Indeed, in this paper, we focused on the assumption that the feedback polynomials of the LRS have a nonzero constant term to leverage on the counting results proved in [12] for CA-based MOLS.However, Lemma 1 does not need this hypothesis to characterize LRS kernels with a trivial intersection, which is what matters in the end to construct a partial spread.In particular, one can use any family of pairwise coprime polynomials with degree b, regardless of their constant term.This is enough to guarantee that the associated Sylvester matrix is invertible.We implicitly dropped this assumption by augmenting our families with the polynomials X b and 1 since they are easily seen to be coprime with all other polynomials.However, besides those analyzed here, several other families of coprime polynomials can be considered.We plan to investigate this issue in future research, as we suspect that this would simplify the counting results reported in Section 4, by using the q-to-1 relationship between non-coprime and coprime pairs of polynomials over F q proved in [1].
et al. proved that EA-equivalent bent functions have the same rank.Therefore, one can prove that two bent functions are not equivalent by checking that their ranks differ.The paper by Weng et al. further characterizes the lower and upper bounds for different types of bent functions.In particular, the rank of any Maiorana-McFarland bent function of n = 2m variables ranges between LB M = 2m + 2 and U B M = 2 m+1 − 2. On the other hand, bent functions defined over the Desarguesian partial spread have ranks between LB DS = 2 m+1 − 2 and U B DS = m i=0 m i 2 min{i,m−i} .An interesting consequence of the fact that the two intervals overlap only on 2 m+1 − 2 is that almost all bent functions arising from the Desarguesian partial spread class are inequivalent to any Maiorana-McFarland function.Moreover, one can show that a bent function is inequivalent to all Maiorana McFarland and Desarguesian spread functions by showing that its rank is higher than U B DS .

Example 3 .
Let m = 3, and l, b such that lb = m.There are only two possibilities, namely l = 3 and b = 1, and l = 1 and b = 3.The first one is already covered by Theorem 2 since b = 1.Let us consider the case l = 1 and b = 3.From Equation (20), we have N 3 = I 3 + I 1 = 2 + 1 = 3 coprime polynomials of degree 3 over F 2 with nonzero constant term, which are the following ones:

Table 1 :
Distribution of 2-ranks for bent functions of n = 8 variables in the Desarguesian spread, obtained through the LRS construction with irreducible polynomials of degree b = 1 over F 2 4 .The bold value corresponds to the upper bound for the rank of a Maiorana-McFarland function.

Table 2 :
Distribution of 2-ranks for PS − and PS − bent functions of n = 8 variables obtained through the LRS construction with coprime polynomials of degree b = 2 over F 4 .The bold value corresponds to the upper bound for the rank of the Desarguesian bent function.