Bent and bent4 spectra of Boolean functions over ...

Finite Fields and Their Applications 46 (2017) 163–178

Contents lists available at ScienceDirect

Finite Fields and Their Applications www.elsevier.com/locate/ffa

Bent and bent4 spectra of Boolean functions over finite fields Nurdagül Anbar a,c,∗ , Wilfried Meidl b,c a

Technical University of Denmark, Matematiktorvet, Building 303B, DK-2800, Lyngby, Denmark b Johann Radon Institute for Computational and Applied Mathematics, Austrian Academy of Sciences, Altenbergerstrasse 69, 4040-Linz, Austria c Otto-von-Guericke University Magdeburg, Universitätsplatz 2, 39106 Magdeburg, Germany

a r t i c l e

i n f o

Article history: Received 17 November 2016 Received in revised form 11 March 2017 Accepted 23 March 2017 Available online xxxx Communicated by Pascale Charpin MSC: 06E30 11T06 05B10 Keywords: Bent function Negabent function Bent4 Boolean function Walsh transform Quadratic functions

a b s t r a c t For c ∈ F2n , a c-bent4 function f from the finite field F2n to F2 is a function with a flat spectrum with respect to the unitary transform Vfc , which is designed to describe the component functions of modified planar functions. For c = 0 the transform Vfc reduces to the conventional Walsh transform, and hence a 0-bent4 function is bent. In this article we generalize the concept of partially bent functions to the transforms Vfc . We show that every quadratic function is partially bent, and hence it is plateaued with respect to any of the transforms Vfc . In detail we analyse two quadratic monomials. The first has values as small as possible in its spectra with respect to all transforms Vfc , and the second has a flat spectrum for a large number of c. Moreover, we show that every quadratic function is c-bent4 for at least three distinct c. In the last part we analyse a cubic monomial. We show that it is c-bent4 only for c = 1, the function is then called negabent, which shows that non-quadratic functions exhibit a different behaviour. © 2017 Elsevier Inc. All rights reserved.

* Corresponding author. E-mail addresses: [email protected] (N. Anbar), [email protected] (W. Meidl). http://dx.doi.org/10.1016/j.ffa.2017.03.008 1071-5797/© 2017 Elsevier Inc. All rights reserved.

164

N. Anbar, W. Meidl / Finite Fields and Their Applications 46 (2017) 163–178

1. Introduction Let f be a function from the finite field F2n to its prime field F2 . For an element c ∈ F2n , in [1] the unitary transform Vfc has been defined as the complex valued function Vfc (u) =

(−1)f (x)+σ(c,x) iTrn (cx) (−1)Trn (ux) ,

x∈F2n

√ where i = −1, the function Trn (z) denotes the absolute trace of z ∈ F2n and σ(c, x) is the Boolean function defined by σ(c, x) =

i

j

(cx)2 (cx)2 .

0≤i 1 odd, which is presented in [15], is not c-bent4 for any c different from 1. 2. c-linear spaces and partially bent4 functions Recall that an element a ∈ F2n is called a linear structure of f : F2n → F2 if Da f (x) = f (x + a) + f (x) is constant. The set of linear structures forms a subspace Λ of F2n (seen as a vector space over F2 ). The function f is called partially bent if for all a ∈ F2n the function f (x + a) + f (x) is either constant or balanced. A partially bent function f is always s-plateaued, where s is the dimension of Λ, i.e. |Wf (u)| ∈ {0, 2(n+s)/2 }. In this section we generalize these concepts. For a function f : F2n → F2 and c ∈ F2n we define Λc (f ) := {a ∈ F2n | f (x + a) + f (x) + Trn (c2 ax) is a constant function} .

(2)

If f is fixed we will simply write Λc . Lemma 1. For every function f : F2n → F2 and c ∈ F2n , the set Λc is a subspace of F2n . Proof. Obviously 0 ∈ Λc . Suppose that a1 , a2 ∈ Λc , i.e. for some constants d1 , d2 ∈ F2 we have d1 = f (x + a1 ) + f (x) + Trn (c2 xa1 )

and

d2 = f (x + a2 ) + f (x) + Trn (c2 xa2 ) . Then for any x ∈ F2n we have the following equalities. f (x + a1 + a2 ) + f (x) + Trn (c2 x(a1 + a2 )) = f (x + a1 + a2 ) + f (x + a1 ) + f (x + a1 ) + f (x) + Trn (c2 x(a1 + a2 )) = f (x + a1 + a2 ) + f (x + a1 ) + Trn (c2 (x + a1 )a2 ) + Trn (c2 a1 a2 ) + f (x + a1 ) + f (x) + Trn (c2 xa1 ) = d2 + d1 + Trn (c2 a1 a2 ) That shows that a1 + a2 is also in Λc .

2

We call a function f : F2n → F2 partially c-bent4 if for all a ∈ F2n the function Da f (x) +Trn (c2 ax) is either constant or balanced. We next show that a partially c-bent4 function is s-plateaued with respect to the transform Vfc .


167

Proposition 2. Let f : F2n → F2 be a partially c-bent4 function. Then |Vfc (u)| ∈ {0, 2(n+s)/2 } for all u ∈ F2n , where s is the dimension of Λc . Proof. Using that, see [1, Lemma 5], σ(c, x1 + x2 ) = σ(c, x1 ) + σ(c, x2 ) + Trn (cx1 )Trn (cx2 ) + Trn (c2 x1 x2 )

(3)

for any c, x1 , x2 ∈ F2n , by the conventional squaring method we get the following equalities. 2 Vfc (u)Vfc (u) = (−1)σ(c,z)+Trn (uz) iTrn (cz) (−1)f (x)+f (x+z)+Trn (c xz) z∈F2n

=

x∈F2n

(−1)f (z)+σ(c,z)+Trn (uz) iTrn (cz)

z∈F2n

(−1)f (z)+f (x)+f (x+z)+Trn (c

2

xz)

,

x∈F2n

where Vfc (u) is the complex conjugate of Vfc (u). By our assumption that f is partially c-bent4 , f (z) + f (x) + f (x + z) + Trn (c2 xz) is balanced if z ∈ / Λc , and constant f (0) if z ∈ Λc . Without loss of generality we may assume that f (0) = 0. Consequently, Vfc (u)Vfc (u) = 2n

(−1)f (z)+σ(c,z)+Trn (uz) iTrn (cz) .

z∈Λc

From f (z) + f (x) + f (x + z) + Trn (c2 xz) = 0

(4)

for z ∈ Λc (and any x ∈ F2n ), with x = z, we get Trn (c2 z 2 ) = Trn (cz) = 0 . Hence Vfc (u)Vfc (u) = 2n

(−1)f (z)+σ(c,z)+Trn (uz) .

z∈Λ

Next we show that the function (z) := f (z) + σ(c, z) is linear on Λc . Let z1 , z2 ∈ Λc . Using Equations (3) and (4) we obtain the following equalities: (z1 + z2 ) = f (z1 + z2 ) + σ(c, z1 + z2 ) = f (z1 ) + f (z2 ) + Trn (c2 z1 z2 ) + σ(c, z1 ) + σ(c, z2 ) + Trn (cz1 )Trn (cz2 ) + Trn (c2 z1 z2 ) = f (z1 ) + f (z2 ) + σ(c, z1 ) + σ(c, z2 ) = (z1 ) + (z2 ) .


168

Note that in the third equality we used the fact that Trn (cz) = 0 for z ∈ Λc . As a consequence, |Vfc (u)| = 0 or 2(n+s)/2 , where s is the dimension of Λc . 2 By Proposition 2, partially bent4 functions behave as partially bent functions with respect to their respective transforms. Another result in this direction is the following corollary. For its version for conventional partially bent functions we refer to [3]. Corollary 3. Let f be a function from F2n to F2 , and let Λc (f ) be the subspace of F2n defined as in (2). Then f is partially c-bent4 if and only if for any complement Λcomp of Λc (f ) in F2n , the function f |Λcomp is c-bent4 . Proof. For an element a ∈ F2n let Pa f (x) = f (x + a) + f (x) + Trn (c2 ax). Then WPa f (0) =

(−1)f (x+a)+f (x)+Trn (c

x∈F2n

=

y∈Λc (f )

z∈Λcomp

2

ax)

(−1)f (y+z+a)+f (y+z)+Trn (c

2

a(y+z))

.

Applying Equation (4) we obtain f (y + z + a) + f (y + z) + Trn (c2 a(y + z)) = f (y) + f (z + a) + Trn (c2 y(z + a)) + f (y) + f (z) + Trn (c2 yz) + Trn (c2 a(y + z)) = f (z) + f (z + a) + Trn (c2 az) , hence WPa f (0) =

(−1)f (z)+f (z+a)+Trn (c

2

az)

2

az)

y∈Λc (f ) z∈Λcomp

= |Λc (f )|

(−1)f (z)+f (z+a)+Trn (c

.

z∈Λcomp

Suppose that f is partially c-bent4 and a ∈ / Λc (f ). Then Pa f is balanced, thus WPa f (0) = 2 0, and consequently z∈Λcomp (−1)f (z)+f (z+a)+Trn (c az) = 0. In particular, for all nonzero a ∈ Λcomp the function Pa f restricted to Λcomp is balanced, i.e. f restricted to Λcomp is c-bent4 . Conversely assume that f is c-bent4 restricted to any complement of Λc (f ), let a ∈ / Λc (f ) and let Λcomp be a complement of Λc (f ) that contains a. By the assump 2 tion, z∈Λcomp (−1)f (z)+f (z+a)+Trn (c az) = 0, hence WPa f (0) and consequently Pa f is balanced. 2 We finish this section by showing that every quadratic function, i.e. a function of algebraic degree 2, is plateaued with respect to Vfc . Recall that the algebraic degree of a


169

function f is the largest binary weight of an exponent in the polynomial representation of f . Corollary 4. Every quadratic function f from F2n to F2 is s-plateaued with respect to Vfc for every c ∈ F2n and an integer s (depending only on c and f ). Proof. If f is quadratic, then for every a, c ∈ F2n , the function f (x +a) +f (x) +Trn (c2 ax) is an affine function. Hence the image is either constant or balanced. Therefore f is partially c-bent4 , and by Proposition 2 plateaued with respect to Vfc . 2 A natural question after the introduction of plateaued functions for the transforms Vfc in this section, is the question of the existence and a construction of functions which are plateaued with respect to the transform Vfc but not partially c-bent4 . For c = 0, such functions have been constructed in [13]. The construction in [13], which is based on the Maiorana–McFarland construction, seems not to have an equivalent for nonzero c that is as powerful as the version for c = 0. Hence this question remains open. 3. Spectra of quadratic functions The functions from F2n to F2 which are both bent and negabent have been investigated in [8]. For instance, it has been shown that there exists a quadratic bent-negabent monomial function for all n ≥ 4. In this section we investigate the behaviour of quadratic functions with respect to all transforms Vfc at the same time. We are particularly interested in functions which are c-bent4 for many c ∈ F2n , and in functions for which Vfc (u) has a small maximal absolute value for all c, u ∈ F2n . Recall that, omitting linear and constant terms, every quadratic function f from n/2 i 2 +1 F2n to F2 has a (unique) representation as f (x) = Trn , bi ∈ F2n , i=1 bi x 1 ≤ i ≤ n/2 (if nis even, then bn/2 is only unique modulo F2n/2 ). Now let f (x) = n/2 2i +1 Trn , c ∈ F2n . Then a ∈ Λc (f ) if and only if the following equalities i=1 bi x hold for all x ∈ F2n . f (x) + f (x + a) + Trn (c2 ax) + f (a) ⎞ ⎞ ⎛ ⎛ n/2 n/2 i i i n−i n−i bi (x2 a + xa2 ) + c2 xa⎠ = Trn ⎝ bi a2 x + b2i a2 x + c2 xa⎠ = Trn ⎝ i=1

⎛ = Trn ⎝x

i=1

⎞

n/2

i=1

i

n−i

(bi a2 + b2i

n−i

a2

) + c2 a⎠ = 0

170


This holds if and only if a is in the kernel of the linearized polynomial n/2

i

n−i

(bi T 2 + b2i

n−i

T2

) + c2 T := h(T ) + c2 T .

(5)

i=1

Hence in the case of the quadratic function f , we have Λc(f ) = Kc , where Kc is the kernel of h(T ) + c2 T in F2n . As a consequence, f is s-partially c-bent4 , where s = dim(Kc ). In particular, f is c-bent4 if and only if h(T ) + c2 T is a permutation. For c = 0 we obtain the well-known relations between bentness, and partially bentness of quadratic functions, and the dimension of the kernel of the corresponding linearized functions. We continue with some simple observations. Lemma 5. Let f : F2n → F2 be a quadratic function and let Kc be the kernel of h(T ) +c2 T defined as in Equation (5). (i) If c1 = c2 , then Kc1 ∩ Kc2 = {0}. (ii) c∈F2n Kc = F2n , i.e. F2n is the union of the (pairwise trivially intersecting) kernels Kc . (iii) Let sc be the dimension of Kc for c ∈ F2n . Then c∈F2n 2sc = 2n+1 − 1. (iv) Every quadratic function is c-bent4 for an odd number of c ∈ F2n . In particular, every quadratic function is c-bent4 for some c. (v) The quadratic function f is c-bent4 if and only if the equation h(T )/T = c2 has no nonzero solution in F2n . More general, the quadratic function f is s-partially c-bent4 if and only if the equation h(T )/T = c2 has exactly 2s − 1 nonzero solutions in F2n . Proof. (i) and (ii) hold since h(a) + c2 a = 0 has a unique solution c for every nonzero a. If sc is the dimension of Kc , then c∈F2n (|Kc | − 1) = c∈F2n (2sc − 1) = 2n − 1, which implies (iii). From (iii) we infer that sc = dim(Kc ) = 0 for an odd number of c, hence (iv). A nonzero element a ∈ F2n is in the kernel Kc of h(T ) +c2 T if and only if h(a)/a +c2 = 0, which implies (v). 2 Our first objective is to determine min max |Vfc (u)| f

u,c∈F2n

where the minimum is evaluated over all quadratic functions f from F2n to F2 . Quadratic functions attaining this value have a spectrum as flat as possible with respect to all unitary transforms Vfc . As obvious, since we have to distribute all nonzero elements of F2n among the kernels Kc , we cannot have a quadratic function that is c-bent4 for all c ∈ F2n . However, for c ∈ F2n we may assign to every kernel Kc , exactly one nonzero element of F2n , except for one kernel, say Kc˜, which will only contain the element 0. By


171

Lemma 5(v) this applies if and only if for every c but c˜, the equation h(T )/T = c2 has exactly one (nonzero) solution in F2n , i.e. the mapping ϕ˜ : F2n \ {0} → F2n \ {˜ c2 } given as x → h(x)/x is one-to-one. Equivalently,

ϕ(T ) :=

h(T ) T

if T = 0, otherwise

+ c˜2 ,

0

(6)

is then a permutation of F2n . First note that Wf (u) = Vf0 (u) is always an integer. Hence K0 has even dimension when n is even and odd dimension otherwise. As a consequence when n is even, then Equation (6) can only be a permutation for c˜ = 0, i.e. f is bent. If n is odd, then f must be semi-bent, hence f is c˜-bent4 for a unique c˜ = 0. As the next proposition shows, this situation never occurs. Proposition 6. Let h(T ) =

n/2 i=1

i

n−i

(bi T 2 + b2i

ϕ(T ) =

h(T ) T

n−i

T2

) and c ∈ F2n . Then the function

if T = 0, otherwise

+ c2 ,

0

is not a permutation of F2n . Proof. We first investigate the case n even, in which case we have to show the statement for c = 0. Hence i n−i n−i h(T ) = bi T 2 −1 + b2i T 2 −1 . T i=1

n/2

ϕ(T ) =

Let j be the integer such that bi = 0 for all 1 ≤ i < j and bj = 0. We assume that j < n/2 n/2 since otherwise, f is a monomial f (x) = Trn (γx2 +1 ), which we later will analyse in detail. To show that h(T )/T is not a permutation, we will use Hermite’s criterion. We j consider (h(T )/T )2 +1 , which is given by the following equalities.

h(T ) T

2j +1

2j h(T ) h(T ) = T T ⎛ ⎞⎛ ⎞ n/2 n/2 j i+j j n−i+j n−i+j k n−k n−k −2j ⎠ ⎝ b2i T 2 −2 + b2i T2 bk T 2 −1 + b2k T 2 −1 ⎠ =⎝

i=j

=

n/2

k=j

j

i+j

[b2i bk T 2

−2j +2k −1

j

n−k

+ b2i b2k

i+j

T2

−2j +2n−k −1

(7)

i,k=j n−i+j

+ b2i

n−i+j

bk T 2

−2j +2k −1

n−i+j

+ b2i

n−k

b2k

n−i+j

T2

−2j +2n−k −1

]


172

The summand for i = k = j in Equation (7) is j

bj2

+1

2j

T2

−1

j

+ b2j

+2n−j

2j

T2

−2j +2n−j −1

n

+ b2j

+1

n

T2

−1

n

+2n−j

+ b2j

n

T2

−2j +2n−j −1

.

(8)

Since T 2 −2 +2 −1 ≡ T −2 +2 mod T 2 + T and the exponents 22j − 1, 22j − 2j + n−j j n−j 2 − 1, −2 + 2 are less than 2n − 1, the degree of the summand in Equation (8) is equal to 2n − 1. Hence it is enough to show that the other summands in Equation (7) have degree less than 2n − 1. We have four different kinds of exponents: n

(i) (ii) (iii) (vi)

j

n−j

j

n−j

n

2i+j − 2j + 2k − 1, 2i+j − 2j + 2n−k − 1, 2n−i+j − 2j + 2k − 1, and 2n−i+j − 2j + 2n−k − 1.

Since 1 ≤ j < n/2 and j ≤ i, k ≤ n/2, we have 2i+j − 1 < 2n−1 ,

2k − 2j < 2n−1 and 2n−k − 2j < 2n−1 .

This proves that the exponents of the form (i) and (ii) are smaller than 2n − 1. Similarly for i > j one has n − i + j ≤ n − 1, and hence 2n−i+j − 1 ≤ 2n−1 − 1. This shows that 2n−i+j − 1 + 2k − 2j < 2n − 1 and 2n−i+j − 1 + 2n−k − 2j < 2n − 1 . Now in the case i = j the exponents in (iii) and (iv) are of the form 2n − 1 + 2k − 2j and 2n − 1 + 2n−k − 2j , respectively. Both are not congruent 0 modulo 2n − 1, since in this case we suppose that k = j. This gives the desired result for the case n even. Now we consider the case n odd, in which case we can write ϕ(T ) as the polynomial ϕ(T ) = c2

(n−1)/2

(T + a) +

a∈F2n \{0}

i

bi T 2

−1

n−i

+ b2i

n−i

T2

−1

+ c2

i=1

which is of degree 2n − 1, and hence ϕ(T ) is not a permutation. 2 The next corollary immediately follows. Corollary 7. Every quadratic function from F2n to F2 is c-bent4 for at least three distinct c ∈ F2n . For every quadratic function f from F2n to F2 there exists c ∈ F2n such that f is s-plateaued with respect to Vfc for some s ≥ 2. As a consequence, min max |Vfc (u)| ≥ 2 f

u,c∈F2n

n+2 2

,

where the minimum is determined over all quadratic functions.


173

We continue with a detailed analysis of two quadratic monomials for which we give the complete distribution of the dimension of the kernels Kc . The first one is the monomial Trn (αx3 ) for some nonzero α ∈ F2n . These monomials are the components of the classical example F (x) = x3 of an almost bent function (a space of semibent functions of dimension n) for n odd. Trn (αx3 ) is hence a semibent function. As is also well known, when n is even, then Trn (αx3 ) is bent if and only if α is not a cube in F2n , see [5], otherwise Trn (αx3 ) is semibent. As we will see, for the monomials of the form Trn (αx3 ), every kernel Kc has dimension at most 2, i.e. these monomials attain the bound in Corollary 7, and hence the bound is tight. Secondly, we investigate the bek haviour of the component functions of γx2 +1 , n = 2k. Recall that for γ ∈ F∗2k with k Trk (γ) = 0 the function γx2 +1 , n = 2k, is the modified planar function in [10, Theorem 1]. As we will see, its component functions are c-bent4 for the vast majority of c ∈ F2n . Theorem 8. Let f (x) = Trn (αx3 ) for some α ∈ F∗2n . Then f is s-partially c-bent4 with s ≤ 2, and hence min max |Vfc (u)| = 2 f

u,c∈F2n

n+2 2

,

(where the minimum is determined over all quadratic functions) for both, n even and n odd. More precisely, if n is odd then – f is c-bent4 for (2n + 1)/3 different c ∈ F2n , – f is 1-partially c-bent4 for 2n−1 different c ∈ F2n , and – f is 2-partially c-bent4 for (2n−1 − 1)/3 different c ∈ F2n . For even n, let ζ be a primitive third root of unity in F2n . Set Qi := ζ i (F∗2n )3 for i = 0, 1, 2. If α ∈ Qi , then – f is c-bent4 for 2Ni + 1 different c ∈ F2n , – f is 1-partially c-bent4 for (2n − 1) − 3Ni different c ∈ F2n , and – f is 2-partially c-bent4 for Ni different c ∈ F2n , where Ni is the number of elements in Qi whose (absolute) trace is zero. Proof. For f = Trn (αx3 ), the kernel Kc is the zero set of the polynomial hc (x) := n−1 n−1 + c2 x (see Equation (5)). Since x2 permutes F2n we can consider αx2 + α2 x2 n−1 hc (x2 ) = αx4 + c2 x2 + α2 x, which has at most 4 solutions x. Hence for any c ∈ F2n , the dimension rc of Kc can be at most 2. This proves our first claim. Our next target is to determine the number A of c for which rc = 2, the number B of c for which rc = 1 and the number C = 2n − A − B of c for which f is c-bent4 (for a n−1 fixed α). Observe that A, B and C are the number of c for which x3 + (c2 /α)x + α2 −1

174


has 3, 1 and 0 solutions in F2n , respectively. Since gcd(2n−1 − 1, 2n − 1) = 1, the function n−1 x2 −1 is a permutation. Hence we can alternatively consider the polynomials of the form a, c˜ ∈ F2n and a = 0 .

x3 + c˜x + a with

(9)

First we consider the case n odd. Since x3 permutes F2n , Equation (9) has a unique solution if c˜ = 0, i.e. r0 = 1. Suppose that c˜ is nonzero. Then we consider the change of variable which sends x to βx and we get x3 + x + a ˜ where a ˜=

a , β3

(10)

and β is the element of F2n satisfying β 2 = c˜2 /α. By [2, Theorem 2], Equation (10) has a unique solution if and only if Trn (˜ a−1 ) = Trn (1), i.e. Trn (˜ a−1 ) = 0. Since the map x2 n−1 is a permutation of F2n sending zero to zero, there are 2 − 1 choices for nonzero c for n−1 n which rc = 1, i.e. B = 2 . Since F2 is the union of the pairwise trivially intersecting kernels Kc , we have 2n − 1 = 3A + B , hence A = (2n−1 − 1)/3. For the remaining (2n + 1)/3 elements c ∈ F2n the function f is c-bent4 . Now we consider the case n even, and restrict ourselves to the case that α is a cube. In this case, the element a in Equation (9) is also a cube, and hence we obtain r0 = 2. In this case Equation (10) has a unique solution if and only if Trn (˜ a−1 ) = 1. Note that each such an element a ˜ gives rise to three distinct c’s for which rc = 1. Hence we obtain n B = (2 − 1) − 3N0 , where N0 is the number of cubes whose trace is zero. By a similar argument as before we conclude that the number A of c with rc = 2 is N0 and the number C of c with rc = 0 is 2N0 + 1. The result for α ∈ Qi for i = 1, 2 is obtained in the same way. 2 k

Theorem 9. Let n = 2k, and let f = Trn (αx2

+1

) for some nonzero α ∈ F2n .

(i) If α ∈ / F2k , then f is c-bent4 for 2n − 2k − 1 choices of c ∈ F2n and k-partially c-bent4 for the remaining 2k + 1 choices of c. k (ii) If α ∈ F2k , then f (x) = Trn (αx2 +1 ) = 0, and f is c-bent4 for all nonzero c. k

Proof. (i) For α ∈ / F2k , we set γ := α + α2 . Then h(T ) + c2 T defined as in Equation (5) is given by k

γT 2 + c2 T .

(11)


175

Suppose that x0 ∈ F2n is a nonzero solution of Equation (11), i.e. k

x02

−1

=

c2 . γ

Since 2k − 1 divides 2n − 1, the field F2n contains a primitive (2k − 1)-th root of unity ζ, and all nonzero solutions of Equation (11) are then given by ζ j x0 , j = 0, . . . , 2k − 2. Consequently h(T ) + c2 T is either a permutation, in which case f is c-bent4 , or its kernel Kc has dimension k. The latter case applies if and only if c2 /γ is a (2k − 1)-th power in F2n , hence for 2k + 1 distinct values for c. For the remaining 2n − 2k − 1 values for c (including c = 0), the function f is then c-bent4 . k (ii) If α ∈ F2k , then αx2 +1 ∈ F2k , hence its absolute trace (from F2n to F2 ) is zero. Consequently, f is trivially c-bent4 for all nonzero c. 2 In [8,15] negabent functions have been investigated, where they are defined via Equation (1) for c = 1. In particular it is shown in [8] that quadratic (monomial) bent-negabent functions from F2n to F2 , n ≥ 4, even, always exist. We close this section by showing that every quadratic bent function is essentially bent-negabent. Lemma 10. Let f be a function from F2n to F2 , d ∈ F∗2n . Then f is c-bent4 if and only if f (dx) is cd-bent4 . Proof. The proof is straightforward. The function f is c-bent4 if and only if f (x + a) + f (x) + Trn (c2 xa) is balanced for any nonzero a ∈ F2n . This is equivalent to f (d(x + ˜. d−1 a)) + f (dx) + Trn ((cd)2 xd−1 a) being balanced for any nonzero d and every d−1 a = a Hence f (dx) is cd-bent4 . 2 Corollary 11. Let f : F2n → F2 , n even, be a bent function, and suppose that f is additionally c-bent4 for some nonzero c ∈ F2n . Then f (c−1 x) is a bent-negabent function. In particular, if f is a quadratic bent function, then f (dx) is bent-negabent for some appropriate choices of d ∈ F2n . Remark 12. If f : F2n → F2 , n even, is c-bent4 , then by [1, Corollary 15], the function f (x) + σ(c, x) is bent. Hence we can convert any quadratic function from F2n to F2 into a bent-negabent function f˜(x) = f (dx) + σ(c, dx) for appropriate d ∈ F2n . 4. A cubic monomial k

In [15, Theorem 6] it is shown that the monomial f (x) = Trn (x2 +3 ) for k = n/2, n ≡ 2 mod 4, which is cubic when n > 2, is negabent. We close this article showing that this cubic monomial is c-bent4 only for c = 1. This in particular shows that being c-bent4 for several c does in general not apply to non-quadratic (bent4 ) functions.

176


k

Theorem 13. Let n = 2k, k > 1 odd, and let f (x) = Trn (x2 and not c-bent4 for any c different from 1.

+3

). Then f is negabent,

Proof. We use the same technique used in [15], i.e. we consider F2n = F2k (α)

with

α2 + α + 1 = 0 .

Then any element x ∈ F2n is uniquely represented as x = x1 + x2 α for some x1 , x2 ∈ F2k . Note that from the minimal polynomial T 2 + T + 1 of α over F2k we conclude that the relative trace Trn/k (α) of α from F2n to F2k is equal to 1. Then we obtain Trn (x1 + x2 α) = Trk (x2 Trn/k (α)) = Trk (x2 ) . For x = x1 + x2 α, a = a1 + a2 α and c = c1 + c2 α by straightforward calculations we then derive that f (x + a) + f (x) + Trn (cax) = Trk (B) , where B is the element of F2k given by B =x1 a2 + a2 x22 + a22 x2 + a32 + c1 a2 + c2 a1 + c2 a2 + a1 x2 + a1 x32 + a1 a2 x22 + a1 a22 x2 + c1 a2 x2 + c1 a1 x2 + c2 a1 x2 . The function f is negabent by [15, Theorem 6]. We have to show that for any c ∈ F2n \{1}, there exists a nonzero a ∈ F2n such that Trk (B) is not balanced. We distinguish two cases depending on the value of c1 + c2 . Case I: c1 + c2 = 1. In this case we consider the elements a = a1 + a2 α such that a1 = 0. Then the element B is given by B = x1 a2 + a2 x22 + a22 x2 + a32 + c1 a2 + c2 a2 + c1 a2 x2 . ˜ is balanced, Note that a2 = 0. The function Trk (B) is balanced if and only if Trk (B) ˜ where B is obtained by substituting x2 by a2 x2 , i.e. c1 + c2 + 1 3 2 ˜ + c1 a22 x2 . B = x 1 a2 x 2 + x 2 + 1 + a22 ˜ If x22 + x2 + 1 + (c1 + c2 + 1)/a22 is irreducible over F2k then for any fixed x2 , Trk (B) ˜ is 0 for exactly half of the x1 ∈ F2k , and hence Trk (B) is balanced. That is, we need to choose a2 such that x22 + x2 + 1 + (c1 + c2 + 1)/a22 splits in F2k . This holds if and only if c1 + c2 + 1 c1 + c2 + 1 = Trk (1) + Trk =0, Trk 1 + a22 a22


177

i.e. Trk ((c1 + c2 + 1)/a22 ) = 1. The roots of the polynomial x22 + x2 + 1 + (c1 + c2 + 1)/a22 ˜ is 0 for exactly half of are then of the form β and β + 1 for some β ∈ F2k . Since Trk (B) ˜ the x1 ∈ F2k for any fixed x2 = β, β + 1, in order that Trk (B) is not balanced, we require that Trk (c1 a22 β) = Trk (c1 a22 (β + 1)), i.e. Trk (c1 a22 ) = 0. Since the map x → x2 permutes the elements of F2k , it is equivalent to show that there exists a nonzero element x ∈ F2k such that Trk (c1 x) = 0 and

Trk

c1 + c2 + 1 x

=1.

Suppose that there does not exist such an element. That means that any zero of Trk (c1 x) n is also a zero of Trk ((c1 + c2 + 1)x2 −2 ). Observing that the zero sets of Trk (c1 x) (a n hyperplane) and Trk ((c1 + c2 + 1)x2 −2 ) have the same cardinality, we infer that the set n of zeros of Trk (c1 x) and of Trk ((c1 + c2 + 1)x2 −2 ) form the same linear subspace of F2k , n which is a contradiction since Trk ((c1 + c2 + 1)x2 −2 ) is not linear. Case II: c1 + c2 = 1. Since by [15, Theorem 6] the monomial f is negabent, we exclude c = 1, i.e. we exclude c2 = 0. We consider the elements a = a1 + a2 α such that a1 = a2 . Then Trk (B) ˜ is balanced, where B ˜ is obtained by substituting x2 by is balanced if and only if Trk (B) a1 x2 , i.e. ˜ = x1 a31 x22 + x2 + 1 + c2 + a41 x32 + a41 x22 + a41 x2 + c1 a21 x2 . B a21 By the same argument as above, we require that the polynomial x22 +x2 +1+c2 /a21 splits in F2k . This holds if and only if Trk (c2 /a21 ) = 1. In this case, the roots are of the form β, β+1 ˜ to be unbalanced, Trk (a4 x3 + a4 x2 + a4 x2 + c1 a2 x2 ) for some β ∈ F2k . Then for Trk (B) 1 2 1 2 1 1 should be the same for x2 = β, β + 1. Note that the facts that x22 + x2 + 1 = c2 /a21 and c1 + c2 = 1 imply that the required condition holds if and only if Trk (a21 ) = 0. Since the map x → x2 is a permutation on F2k , it is sufficient to find an element x ∈ F2k such that Trk (x) = 0 and

Trk

c 2

x

=1.

Using that c2 = 0, by a similar argument as in the Case I, such an element x exists.

2

Remark 14. We remark that, though we use the same method as in [15], showing that the k monomial f (x) = Trn (x2 +3 ) is c-bent4 only for c = 1 is not straightforward. Moreover, k by Lemma 10 together with the fact that x2 +3 is a permutation of F2n , we conclude that k the monomial Trn (γx2 +3 ) is only negabent for γ = 1. This has been observed in [15] for n ≤ 14 by using MAGMA. Our result solves this question for all n (n ≡ 2 mod 4).

178


Acknowledgments Nurdagül Anbar gratefully acknowledges the support from The Danish Council for Independent Research (Grant No. DFF-4002-00367) and H.C. Ørsted COFUND Post-doc Fellowship from the project “Algebraic curves with many rational points”. Wilfried Meidl is supported by the Austrian Science Fund (FWF) Project no. M 1767-N26. The authors would like to thank anonymous referees for their valuable comments and suggestions. In particular, we thank for pointing to reference [2] by which the proof of Theorem 8 was considerably improved. References [1] N. Anbar, W. Meidl, Modified planar functions and their components, Cryptogr. Commun. (2017), http://dx.doi.org/10.1007/s12095-017-0218-9. [2] E.R. Berlekamp, H. Rumsey, G. Solomon, On the solution of algebraic equations over finite fields, Inf. Control 10 (1967) 553–564. [3] C. Carlet, Partially bent functions, Des. Codes Cryptogr. 78 (2016) 135–145. [4] S. Gangopadhyay, E. Pasalic, P. Stănică, A note on generalized bent criteria for Boolean functions, IEEE Trans. Inf. Theory 59 (2013) 3233–3236. [5] G. Leander, Monomial bent functions, IEEE Trans. Inf. Theory 52 (2006) 738–743. [6] M.G. Parker, A. Pott, On Boolean functions which are bent and negabent, in: Sequences, Subsequences, and Consequences, in: Lect. Notes Comput. Sci., vol. 4893, Springer, Berlin, 2007, pp. 9–23. [7] C. Riera, M.G. Parker, Generalized bent criteria for Boolean functions. I, IEEE Trans. Inf. Theory 52 (2006) 4142–4159. [8] S. Sarkar, Characterizing negabent Boolean functions over finite fields, in: Sequences and Their Applications – SETA 2012, in: Lect. Notes Comput. Sci., vol. 7280, Springer, Heidelberg, 2012, pp. 77–88. [9] K.U. Schmidt, M.G. Parker, A. Pott, Negabent functions in the Maiorana–McFarland class, in: Sequences and Their Applications – SETA 2008, in: Lect. Notes Comput. Sci., vol. 5203, Springer, Berlin, 2008, pp. 390–402. [10] K.U. Schmidt, Y. Zhou, Planar functions over fields of characteristic two, J. Algebraic Comb. 40 (2014) 503–526. [11] W. Su, A. Pott, X. Tang, Characterization of negabent functions and construction of bent-negabent functions with maximum algebraic degree, IEEE Trans. Inf. Theory 59 (2013) 3387–3395. [12] F. Zhang, Y. Wei, E. Pasalic, Constructions of bent-negabent functions and their relation to the completed Maiorana–McFarland class, IEEE Trans. Inf. Theory 61 (2015) 1496–1506. [13] Y. Zheng, X.M. Zhang, On plateaued functions, IEEE Trans. Inf. Theory 47 (2001) 1215–1223. [14] Y. Zhou, (2n , 2n , 2n , 1)-relative difference sets and their representations, J. Comb. Des. 21 (2013) 563–584. [15] Y. Zhou, L. Qu, Constructions of negabent functions over finite fields, Cryptogr. Commun. 9 (2017) 165–180.