On the EA-classes of known APN functions in small dimensions

Recently Budaghyan et al. (Cryptogr. Commun. 12, 85–100, 2020) introduced a procedure for investigating if CCZ-equivalence can be more general than EA-equivalence together with inverse transformation (when applicable). In this paper, we show that it is possible to use this procedure for classifying, up to EA-equivalence, all known APN functions in dimension 6. We also give some discussion for dimension 7, 8 and 9. In particular, in these cases it is possible to give an upper bound on the EA-classes contained in the CCZ-classes of the known APN functions.


Introduction
Symmetric cryptographic primitives and in particular block ciphers use substitution boxes (in brief, S-boxes) to bring "confusion" into the systems. Such confusion is necessary to prevent known attacks.
Given n and m two positive integers, the functions from F 2 n to F 2 m are called vectorial Boolean functions. Such functions are used as S-boxes in the design of block ciphers.
Among the properties that these functions have to satisfy we have a low differential uniformity (see definitions in Section 2) to allow resistance to the differential attack [2] and high nonlinearity to resist the linear attack [18]. The lowest differential uniformity for a vectorial Boolean function is 2. Functions reaching such lower bound are called Almost Perfect Nonlinear (APN).
The APN property (in general the differential uniformity) is preserved by different forms of equivalences between (vectorial) Boolean functions, such as EA-equivalence and CCZ-equivalence. Since EA-equivalence is a particular case of CCZ-equivalence, it is possible to partition the space of all functions F 2 n → F 2 m into CCZ-equivalence classes and then partition each CCZ-equivalence class into EA-equivalence classes. For brevity, we will refer to these as "EA-class" and "CCZ-class". It was shown by Budaghyan et al. [3] that for quadratic APN functions CCZ-equivalence is more general than EA-equivalence together with taking inverses of permutations. In [7] the authors investigate further the relation between CCZ-equivalence and EA-equivalence with inverse transformation. While, in [9] the authors give a characterization of CCZ-equivalence in terms of twisting functions. Despite this, CCZ-equivalence is not yet fully well understood and, to the best of our knowledge, partitioning the CCZ-class of a function into its EA-classes is an hard task.
Classification of APN functions is, as well, a hard open problem. Complete classification for APN functions over F 2 n is known only for n ≤ 5 [4], and for n = 6 the CCZclassification of APN functions with algebraic degree at most 3 is known [15]. For n ≤ 5, in [4], the authors give a classification of the APN functions up to EA-equivalence and CCZequivalence. For the case of n = 6, the classification of the known APN functions is given only up to CCZ-equivalence. The classification up to EA-equivalence is not known.
In this work, we use the procedure introduced in [7] for investigating the EA-classes contained in a CCZ-class of a given function. In order to do that, in Section 3 we give some propositions that can be used to improve the the procedure given in [7] and filter some of the results obtained from this procedure. We also obtain that the number of EA-classes contained in the CCZ-class of a function F is upper bounded by the number of simplex codes contained in a linear code associated to F .
In Section 4, we discuss relations between the different equivalence concepts for vectorial Boolean functions and code equivalence. We also introduce a new linear code that can be defined for the case of bijective maps that can be used to verify affine equivalence between two permutations, see Theorem 6. For the case n = 6, in Section 5, we are able to give all the EA-classes of the known APN functions. We also studied further the case of the only APN permutation in even dimension [6]. For such a function we give the representatives of the EA-classes which contain a permutation and we also give the representatives of the affine classes (containing a permutation).
In Section 6, we extend our study also to dimension 7, 8 and 9 (for this last case we focus only on non-Gold APN power functions). In these dimensions checking EA-equivalence, which is based on some code equivalence, requires an amount of computing which is huge, but we are able to give an upper bound on the number of EA-classes. Moreover, for the case of non-Gold APN power functions we can determine the exact number of the EA-classes.

Preliminaries
Let n ≥ 2, we denote by F 2 n the finite field with 2 n elements, by F 2 n its multiplicative group and by F 2 n [x] the polynomial ring defined over F 2 n . Any function F : F 2 n → F 2 n can be represented as a univariate polynomial of degree at most 2 n − 1 in F 2 n [x], that is For any i, 0 ≤ i ≤ 2 n − 1, the 2-weight of i is the (Hamming) weight of its binary representation. The algebraic degree of a function F is equal to the maximum 2-weight of the exponent i such that c i = 0. Functions of algebraic degree 1 are called affine and of degree 2 quadratic. Linear functions are affine functions without the constant term and they can be represented as L(x) = n−1 i=0 c i x 2 i . We denote the trace function by T r(x) = x + x 2 + · · · + x 2 n−1 .
Let λ ∈ F 2 n and F be a function from F 2 n to itself, the λ-component of F is the Boolean function F λ : For any function F : For any Boolean function f : F 2 n → F 2 the Walsh transform in a ∈ F 2 n is given by The Walsh spectrum of a function F is the set of all possible values of the Walsh transform. The Walsh spectrum of a (vectorial) Boolean function F is strictly related to the notion of nonlinearity of F , denoted by N L (F ), indeed we have If W f (0) = 0 then the Boolean function is called balanced. For any function F : F 2 n → F 2 n it is well know that F is a bijection if and only if all its component functions are balanced.
The concept of differential uniformity of a function F is related to the number of solutions of the equation F (x + a) + F (x) = b for a ∈ F 2 n and b ∈ F 2 n . Definition 1 For a function F from F 2 n to itself, and any a ∈ F 2 n and b ∈ F 2 n , we denote by δ F (a, b) the number of solutions of the equation F (x + a) + F (x) = b. The maximum value δ among the δ F (a, b)'s is called the differential uniformity of F , and F is said to be differentially δ-uniform. A function F is called almost perfect nonlinear (APN) if δ = 2.
There are several equivalence relations of functions for which the differential uniformity (and thus the APN property) is preserved. Two functions F and F from F 2 n to itself are called: where the mappings A : F 2 n → F 2 n is affine and F is affine equivalent to F ; -Carlet-Charpin-Zinoviev equivalent (CCZ-equivalent) if for some affine permutation L of F 2 n × F 2 n the image of the graph of F is the graph of F , that is, Obviously, the affine equivalence is included in EA-equivalence, and it is also well known that EA-equivalence is a particular case of CCZ-equivalence and every permutation is CCZ-equivalent to its inverse [10].
Recently, Yoshiara [20] and Dempwolff [12] have shown, independently, that two power APN functions are CCZ-equivalent if and only if they are EA-equivalent or one is EAequivalent to the inverse of the second one. Moreover, for the case of quadratic APN functions, CCZ-equivalence coincides with EA-equivalence [19].

Properties and remarks on the CCZ-equivalence
In this section we will recall the procedure given in [7] and give some remarks and properties regarding CCZ-equivalence that will be useful in the investigation of the EA-classes contained in a CCZ-class.
Since we are interested in the EA-classes, without loss of generality, we assume that the affine permutation in the definition of CCZ-equivalence is linear. Indeed, using affine permutations instead of linear one we simply obtain a shift by a constant in the input and output of the resulting function (see for instance [7]). [7]) Let L 1 , L 2 : (F 2 n ) 2 → F 2 n be linear maps and a, b ∈ F 2 n , such that L (x, y) = (L 1 (x, y) + a, L 2 (x, y) + b) is a permutation. Let F and F be CCZequivalent functions such that L maps the graph of F to the graph of F . Then the linear part L of L maps the graph of F to the graph of F (x) = F (x + a) + b.

Lemma 1 (Lemma 3.1 in
A linear map L defined over (F 2 n ) 2 can be described as a formal matrix where A i are linear maps over F 2 n for 1 ≤ i ≤ 4, and In particular, and From the definition of CCZ-equivalence we have that a linear permutation L is admissible for producing a CCZ-equivalent function from F if and only if F 1 (x) is a permutation. In terms of Walsh coefficients we have the following observation.

Observation 1 (Observation 3.2 in [7]) The function F 1 in (1) is a permutation if and only if all its component are balanced, that is
Denoting by L * the adjoint operator of a linear map L (i.e. T r(yL(x)) = T r(xL * (y)) for all x, y ∈ F 2 n ), we have In [7], the authors introduce a procedure that permits to investigate the relation between CCZ-equivalence and EA-equivalence together with the inverse transformation (when applicable). Using this procedure it is possible, at least in small dimensions, to investigate the EA-classes contained in the CCZ-class of a given function.
The procedure given in [7] is useful for constructing linear permutations mapping the graph of F onto the graph of another function F . In particular, the procedure constructs the linear functions A 1 and A 2 defined over F 2 n so that is a permutation. Indeed, if we are able to construct L 1 with such a property, then it is always possible to determine L 2 in order to have L a linear permutation. We are focusing on the EA-classes that are contained in the CCZ-class of some given function F . In the following, we will show some properties that permit to determine whether from two admissible permutation L and L we can obtain EA-equivalent functions.
) is a permutation, then the functions defined by the graphs L (G F ) and L (G F ) are EA-equivalent. This means that for all possible L 1 , for covering the EA-classes of a given function F , we need to construct a single L 2 .
Remark 1 can be easily extended with the following proposition.

Proposition 1 Let F be a function over F 2 n and let
for some linear permutation L, then the functions defined by the graphs L (G F ) and L (G F ) are EA-equivalent.
is a linear permutation and from Remark 1 we have that the functions defined by the graphs L (G F ) and L (G F ) are EA-equivalent. Now, where I is the identity map, which implies that the functions defined by the graphs L (G F ) and L (G F ) are affine equivalent.
We will show, now the procedure introduced in [7]. From now on, we consider a fixed basis {β 1 , ..., β n } of F 2 n as vector space over F 2 .
For any λ ∈ F 2 n we define the set Then we can define the following set is a permutation then Im(A * 2 ) ⊆ S F . So, any subspace U in S F could be a possible candidate for Im(A * 2 ). Along this section we will denote by Span(v 1 , . . . , v m ) the vector (sub)space over F 2 generated by the elements v 1 , . . . , v m ∈ F 2 n .
For any u ∈ U \ {0} we consider the set ZW(u), as defined before. To construct A 1 we need to determine the images, with the adjoint operator A * 1 , of the vectors β i 's. In order to do that, we need to select any possible k-tuple a 1 ∈ ZW(u 1 ), ..., a k ∈ ZW(u k ) such that , not all zero. These a 1 , ..., a k will be the images by A * 1 of β 1 , ..., β k , respectively. After that, for any of these k-tuples, we need to determine all possible (n − k)-tuples of elements a k+1 , ..., a n satisfying: (P2) a k+1 , ..., a n are linearly independent; (P3) for any a ∈ Span(a k+1 , ..., a n )\{0}, a In the following we will give some observations in order to see how it is possible from Procedure 2 to obtain the EA-classes contained in the CCZ-class of a given function.

which is again a permutation, and
From the previous observation we have that if L 1 is such that Im(A * 2 ) = U , then from the procedure applied to the subspace U , with some fixed basis, we obtain at least one function L 1 such that L 1 = L • L 1 for some linear permutation L. Thus, from Proposition 1 we obtain the same EA-class of L 1 from L 1 .

Observation 4 From the procedure we can see that in (P3) we need to check the subspaces of dimension
then we can consider only one basis of W for constructing the elements a k+1 , ..., a n in Procedure 2. Indeed, let {a k+1 , ..., a n } and {a k+1 , ..., a n } be two basis of W . Let A 1 and A 1 constructed from the procedure applied to a fixed space U (and so also A 2 (y)) and from Proposition 1 we will obtain the same EA-class from these functions.
From the same function A 2 we could obtain several L 1 's. We will show how it is possible to filter some of the L 1 obtained from the procedure. F (x)) are permutations and the linear codes C F 1 and C F 1 are equal, where the code C F is generated by the matrix having as columns the vectors

Proposition 2 Let F be a function defined over F 2 n with no linear monomials. Let
Then, if Span(Im(A 2 • F )) = Im(A 2 ) the functions defined by the graphs L (G F ) and L (G F ) are EA-equivalent.
Proof Since C F 1 = C F 1 then there exists a linear permutations over F 2 n such that F 1 (x) = L • F 1 (x). In particular, since F has no linear monomials then L • A 2 • F = A 2 • F and L • A 1 = A 1 . Moreover, we have that Span(Im(A 2 • F )) = Im(A 2 ). This means that there exist x 1 , ..., x k such that F (x 1 ), ..., F (x k ) are linearly independent and A 2 • F (x 1 ), ..., A 2 • F (x k ) form a basis for Im(A 2 ). Then, Span ({F (x 1 ), ..., F (x k )}) ⊕ ker(A 2 ) = F 2 n and thus L • A 2 (y) = A 2 (y) for all y ∈ F 2 n . From this, we can conclude that L 1 = L • L 1 and from Proposition 1 it follows that the functions defined by the graphs L (G F ) and L (G F ) are EA-equivalent.
For the case of functions F having nonlinearity different from zero we have that C F 1 = C F 1 is sufficient to guarantee EA-equivalence.
where the code C F is defined as in Proposition 2, then the functions defined by the graphs L (G F ) and L (G F ) are EA-equivalent.
Proof Consider the matrix of size 2n × 2 n with columns the vectors Since N L (F ) = 0 then the rows of this matrix are linear independent. Now, since F 1 is a permutation, the rows of are linear independent and for any row there exists a unique way of combining the rows of M to get it. Thus, there exist a unique linear function L 1 (x, y) such that Since C F 1 = C F 1 we have that there exists a linear permutation L such that From the unicity of L 1 and L 1 we obtain that L 1 = L • L 1 .
Remark 3 For the case of APN functions we have that the N L (F ) = 0 and so we can use this last proposition for filtering the functions obtained from Procedure 2.
Recalling that a simplex code (defined over F 2 ) is a linear code of length 2 n −1 dimension n and all non zero codewords of hamming weight 2 n−1 , we have the following upper bound on the number of EA-classes contained in the CCZ-class of a function F .

Equivalence relations and linear codes
The main cryptographic properties (e.g. the APN property, the nonlinearity, etc.) can be interpreted as conditions on some binary linear codes, as first shown in [10]. Let F be a vectorial Boolean function then we can define the following codes related to F .
-The code C 1 (F ) which is generated by the size of the matrix is (2n + 1) × 2 n .
-The code C 2 (F ) which is generated by The equivalence between two functions F and G can be expressed in terms of linear codes. In particular, the code C 1 was introduced in [5] for determining the CCZ-equivalence between two functions. The codes C 2 and C 3 were introduced in [13] for the case of the EAand affine-equivalence. We summarize the results of [5] and [13] in the following theorem.

Theorem 5 Let F and G be two vectorial Boolean functions. Then we have:
From the previous theorem when F and G are permutations we cannot distinguish if they are affine equivalent to each other or one is equivalent to the inverse of the other.
A necessary and sufficient condition for affine equivalence between permutations is the following.

Theorem 6
Let F and G be two permutations over F 2 n , with n ≥ 3. F is affine-equivalent to G if and only if the codes C 4 (F ) and C 4 (G + b) are equivalent for some b ∈ F 2 n , where C 4 (F ) is generated by Proof Suppose that F is affine equivalent to G. Then, B(F (Ax + a)) + b = G(x) for some A, B linear permutations and a, b ∈ F 2 n . Suppose that b = 0, otherwise we can consider the function G = G + b.
Considering L 1 = A −1 , L 2 = B linear permutations and a = A −1 a we have applying a permutation on the columns, the last matrix is C 4 (G). Vice versa, suppose that the code C 4 (F ) is equivalent to C 4 (G ), for some G = G + b. We can suppose that G = G otherwise we will obtain the affine equivalence to G which is equivalent to G.
Then Now, we want to understand how we can permute the columns of the matrix above so that we can obtain C 4 (G). From that, we will be able to determine the structure of the matrix M.
First of all, note that the first row of the matrix must have the same weight as the first row of C 4 (G), that is 2 n+1 . Suppose d, e = 0. Then c + d · z and e · y have weight 2 n−1 , so c + d · x + e · F (x) needs to be of weight 2 n . Let S = {y : e · y = 0}, which is a subspace of dimension n − 1. A column relative to any y ∈ S needs to have L 2 (y) = 0, because for obtaining C 4 (G) we cannot move this column in the left or right part. Thus, rank(L 2 ) ≤ 2.
Moreover, all the columns of the y's not in S need to be moved in the left or right part since the first row in the middle part has to be equal to zero. For any column relative to some y / ∈ S, we have that L 2 (y) = r for some fixed r. But, in the LC and RC part we should obtain two times all the nonzero elements of F 2 n , which would be not possible.
Suppose d = 0, e = 0. As before, let S = {y : e · y = 0}. Thus L 2 (y) = 0 if y ∈ S and L 2 (y) = r for some fixed r if y / ∈ S. Again, the columns of the y's not in S need to be moved in the left or right part, and we cannot obtain all the nonzero elements of F 2 n repeated two times in the center part.
Suppose that d = 0, e = 0 then we obtain only 2 n 1's on the first row, which is not possible.
Then, c = 1 and d = e = 0 and Now, we have that for obtaining C 4 (G) we cannot permute the columns related to the middle part, involving the variable y, with the columns of the other parts. Thus L 2 ≡ 0 and Moreover, since in the MB part we should have all the nonzero elements of F 2 n , and in the LC and RC part all the elements of F 2 n , we have that L 1 and L 4 need to be permutations.
We need now to prove that L 3 (z)+b is constantly equal to 0. First, note that if L 3 (z)+b = b = 0 for all z, then in the RB part of M · C 4 (F ) we would have all columns equals to b. Since we want to permute the columns of M · C 4 (F ) in order to obtain C 4 (G) (which has all zero columns on the RB part) this means that all the columns of the left part of M · C 4 (F ) should be permuted with the columns of the right part, implying L 3 (x)+L 4 (F (x))+b ≡ 0, which is not possible. Similarly if L 3 (z) + b is a permutation.
Suppose, then, that L 3 (z) + b is not null (and not constantly equal to b) or a permutation, which implies ker(L 3 ) = {0}, F 2 n . Then, in order to obtain C 4 (G) we should permute at least all the columns of the right part that are nonzero in the RB part (that involving L 3 (z) + b) with some columns of the left part of the matrix for which , F 2 n we have that for a given non zero element c in Im(A) there exist at least two elements z 1 , z 2 ∈ S such that A(z 1 ) = A(z 2 ) = c. Since for obtaining C 4 (G) we should permute (with the left part) all the columns of the right part related to the elements of S, we would obtain in the LB part two columns with the same value. But since both F and G are permutations then we cannot have repeated column here. Then, L 3 (x) + b needs to be constantly equal to 0. So, for some permutation matrix P , that is, These theorems on the relation between the equivalences defined for Boolean functions and the related codes are quite useful. For instance, the computer algebra package MAGMA implements a function for checking code equivalence, hence for small values of n can be possible to distinguish the different types of equivalence. Note that for the case of the affineequivalence in [1] it is given an algorithm for checking it. We do not compare the complexity of checking the affine equivalence with codes and the algorithm given in [1]. However, the implementation with the code equivalence is very easy in MAGMA.

EA-classes in dimension 6
In this section we give the analysis carried out for the known APN functions in dimension 6. We used Procedure 2 for obtaining the admissible linear functions L 1 . Then, comparing the codes relative to L 1 (x, F (x)) we used Proposition 3 for filtering the maps L 1 . After that EA-equivalence was tested using the linear code C 2 (F ).
In dimension 6 there are 14 known APN functions (13 are quadratics) up to CCZequivalence and they are listed in Table 1. In Table 1 we give also the number of EA-classes contained in the CCZ-class of each function, together with the degrees of the functions in the EA-classes. All the representatives of the EA-classes can be found in Appendix 1 of [8].

Classification results for Dillon's APN permutation
Further analysis was done for the case of the Kim function x 3 + ζ x 24 + x 10 . Indeed, this function is equivalent to a permutation [6]. This is the only known example of APN function equivalent to a permutation in even dimension.
In this case we studied also the affine equivalence classes. The reason why we are interested in this classification is that some characteristics of the vectorial Boolean functions, interesting for designing block ciphers, such as to be a permutation, the boomerang uniformity [11], the threshold implementation [17], etc., are invariants with respect the affine equivalence but not with respect to EA-and CCZ-equivalence.
Thus, classification of (bijective) vectorial Boolean functions up to affine equivalence is an important task.
Using the code equivalence we can see that in the CCZ-class of the Dillon's APN permutation we have 13 EA-classes with two of them containing a permutation, while the number of affine classes containing a permutation is 4. Let Then, the CCZ-class can be represented by F 1 , the EA-classes containing a permutation can be given by F 1 and F −1 1 , and the affine-classes (always with a permutation) are represented by F 1 , F −1 1 , F 2 and F 3 . Note that with the code equivalence of the code C 3 (F ) we would obtain only 3 functions since F 1 is not affine equivalent to its inverse, while using C 4 (F ) we can distinguish the two functions. Using MAGMA we are able to provide the upper bound for all the known functions in n = 7, 8. Note that in dimension 7 and 8 we have a huge list of APN functions from [21]. For space reason here we give the upper bound only for the functions listed in [14].

n=7
In dimension 7, in [14] the authors listed 19 APN functions in Table 2, in [21] the authors found 471 new functions more. For the computer results on all these APN functions see Appendix 2 in [8].

Remark 5
For the x 13 , x 57 and x 63 we can derive the exact number of EA-classes. Indeed, the two simplex subcodes individuated for each ones are those generated by The representatives of the EA-classes that are related to these codes are F and F −1 . For x 57 and x 63 we have that they are cyclotomic equivalent (and thus affine equivalent) to their inverse, implying that the CCZ-class and and the EA-class coincide. For the case of x 13 , its inverse is given by x 88 . Since the cyclotomic classes of these two functions are distinct we can conclude that they are not EA-equivalent. Thus for x 13 we have 2 EA-classes in the CCZ-class.  In [16] the authors investigate EA-equivalence of the inverse function to a permutation. They concluded that for n ≥ 5 the inverse function is EA-equivalent to a permutation if and only if it is affine equivalent to it. As the authors state at the end of their paper, an interesting problem is whether or not there exists a permutation that is CCZ-equivalent to x −1 but not affine equivalent. From our computational results we can conclude the following.
Theorem 7 Let 5 ≤ n ≤ 9. A permutation polynomial F defined over F 2 n is CCZequivalent to x −1 if and only if F is affine-equivalent to x −1 .
Proof For 5 ≤ n ≤ 9 we obtain only the two simplex codes generated by F (x) x∈F 2 n or x x∈F 2 n .
This implies that we have only the EA-class of x −1 since it is an involution. Now, the permutations in the EA-class of x −1 can be obtained only with the affine equivalence [16].
From this result we give the following conjecture.
Conjecture 1 For n ≥ 5, a permutation polynomial F defined over F 2 n is CCZ-equivalent to x −1 if and only if F is affine-equivalent to x −1 .
Moreover, in [7] the authors conjectured that the CCZ-class of non-Gold APN power functions can be obtained using iteratively EA-equivalence together with the inverse transformation. In particular, using Procedure 2 they proved that for n ≤ 8 the conjecture is true. From the results obtained here we were able to verify that this is true up to dimension 9 and in particular we have at most two EA-classes whose representatives are F and F −1 .
Theorem 8 Let n ≤ 9 and F (x) = x d be a non-Gold APN function defined over F 2 n . Then the CCZ-class of F is partitioned in at most two EA-classes represented by F and F −1 (when it exists).

Conclusion
We gave the full classification, up to EA-equivalence, of the known APN functions in dimension 6 (see Table 1). Moreover, for the case of the unique APN permutation in even dimension, we gave also the classification of the affine classes (containing a permutation). For this purpose, in Theorem 6 we introduced a new code linked to a vectorial Boolean function that permits to investigate the affine equivalence in the context of bijective maps. For dimension 7, 8 and 9, since checking EA-equivalence using the codes equivalence requires a huge amount of computing, we gave an upper bound on the number of the EAclasses of the known APN functions (in dimension 9 we consider only non-Gold APN power functions), see Tables 2, 3 and 4. For the case of APN power mapping we observed that at most we have two EA-classes in the CCZ-class, Theorem 8. Moreover, for the inverse function for 5 ≤ n ≤ 9 we obtained that the EA-class coincides with the CCZ-class, implying that for these dimensions the inverse function is CCZ-equivalent to a permutation if and only if they are affine equivalent, Theorem 7.