Bent Functions of maximal degree

Transcription

1 IEEE TRANSACTIONS ON INFORMATION THEORY 1 Bent Functions of maximal degree Ayça Çeşmelioğlu and Wilfried Meidl Abstract In this article a technique for constructing -ary bent functions from lateaued functions is resented. This generalizes earlier techniques of constructing bent from nearbent functions. The Fourier sectrum of quadratic monomials is analysed, examles of quadratic functions with highest ossible absolute values in their Fourier sectrum are given. Alying the construction of bent functions to the latter class of functions yields bent functions attaining uer bounds for the algebraic degree when 3, 5. Until now no construction of bent functions attaining these bounds was known. Index Terms Bent functions, Fourier transform, algebraic degree, quadratic functions, lateaued functions I. INTRODUCTION Let be a rime, and let V n be any n-dimensional vector sace over F and f be a function from V n to F. If we call f a binary or Boolean function, if is an odd rime we call f a -ary function. The Fourier transform of f is the comlex valued function f on V n given by fb ɛ fx b,x x V n where ɛ e πi/ and, denotes any inner roduct on V n. The function f is called a bent function if fb n for all b V n. Whereas for, when ɛ 1 thus fb is an integer, bent functions can only exist for even n, for odd bent functions exist for both odd and even n, see [7]. The normalized Fourier coefficient at b V n of a function from V n to F is defined by n/ fb. A binary bent function clearly must have normalized Fourier coefficients ±1, and for the -ary case we always have cf. [5], [7, Proerty 8] { n/ ±ɛ fb f b : n even or n odd, 1 mod 4 ±iɛ f b : n odd and 3 mod 4 1 where f is a function from V n to F that by definition gives the exonent of ɛ. A bent function f is called regular if n/ fb ɛ f b for all b V n, i.e., the coefficient of ɛ f b is always +1. Observe that for a binary bent function this holds trivially. As easily seen from 1 a -ary regular bent function can only exist for even n or for odd n when 1 mod 4. A bent function f is called weakly regular if, for all b V n, we have n/ fb ζ ɛ f b. The authors are with Sabancı University, MDBF, Orhanlı, Tuzla, İstanbul, Turkey cesmelioglu@sabanciuniv.edu, wmeidl@sabanciuniv.edu. The article was written when A. Ceşmelioğlu was working at INRIA Paris-Rocquencourt. for some comlex number ζ with absolute value 1 see [7]. By 1, ζ can only be ±1 or ±i. A function f from V n to F is called lateaued if fb A or 0 for all b V n. Using the secial case of Parseval s identity fb n b V n we see that A n+s for an integer s with 0 s n. We will call a lateaued function with fb n+s or 0 an s-lateaued function. The case s 0 corresonds to bent functions by definition, and we have s n if and only if f is an affine function or constant. We remark that for 1-lateaued functions the term near-bent function was used in [1], [8], binary 1-lateaued and -lateaued functions are referred to as semi-bent functions in []. It is well known that the maximal algebraic degree of a binary bent function in dimension n is n/ see [10]. For -ary bent functions, >, Hou [6] showed the following bounds: If f is a bent function from V n to F then the degree degf of f satisfies 1n degf + 1. If f is weakly regular, then 1n degf. 3 As remarked in [6] -ary Maiorana-McFarland bent functions f from F n to F, which are always regular and for which n is always even cf [7], can be used to attain the bound 3. But in [6] it is left as an oen roblem if I the bound can be attained when n > 1, II the bound 3 can be attained when n 3 is odd. Only very recently a bent function from F 7 to F 3 found by comuter search attaining the bound has been resented in [11]. To our best knowledge no general construction of bent functions attaining the bounds, 3 is known by now. In [], [8], [1] a method of constructing bent from nearbent functions has been resented. Alying this method, in [8] the first examles of non-weakly-normal bent functions see [4] in dimensions 10 and 1 have been resented, in [1] the first known infinite classes of non-weakly regular bent functions for arbitrary odd rime have been introduced until then only soradic ternary examles were known, and a recursive method of obtaining an infinite family of nonweakly regular bent functions starting from one non-weakly regular bent function, see [11]. In this article we further develo the method of [], [8], [1], and obtain bent functions from s-lateaued functions. In Section II we give some results on quadratic s-lateaued

2 IEEE TRANSACTIONS ON INFORMATION THEORY functions. In Section III we resent the construction of bent functions from s-lateaued functions. In Section IV we utilize this construction to obtain bent functions of maximal degree. In articular we construct -ary bent functions for 3 attaining the uer bound, and -ary bent functions for 3, 5 in odd dimension that attain the uer bound 3, which artly solves oen roblems I and II. II. PRELIMINARIES As all vector saces of dimension n over F are isomorhic we may associate V n with the finite field F n. We then usually use the inner roduct x, y Tr n xy where Tr n z denotes the absolute trace of z F n. In this framework the Fourier transform of a function f from F n to F is the comlex valued function on F n given by fb x F n ɛ fx Trnbx. Recall that a function f from F n to F of the form fx Tr n l a i x i +1 is called quadratic, its algebraic degree is two if f is not constant, see [], [5]. As well known, every quadratic function from F n to F is lateaued. The value for s can be obtained with the standard squaring technique see [1, Theorem ], [5]: f b x,y F n z F n ɛ fx fy+trnbx y y F n 4 ɛ fy+z fy fz. Straightforward one gets fy + z fy fz l Tr n y a l l i zl+i + a l i i z l i Tr n y l Lz. Consequently f b z F n n z F n Lz0 y l F n ɛ TrnyLz { n+s if fz + Tr n bz 0 on kerl 0 otherwise where in the last ste we used that fz+tr n bz is linear on the kernel kerl of L. Summarizing, the square of the Fourier transform of the quadratic function f in 4 takes absolute values 0 and n+s, where s is the dimension of the kernel of the linear transformation on F n defined by Lx l Clearly this corresonds to a l i xl+i + a l i i x l i. 5 deggcdlx, x n x s, or equivalently see [9,.118] where deggcdax, x n 1 s, 6 Ax l a l i xl+i + a l i i x l i 7 is the associate of Lx. In some sense the simlest quadratic functions are quadratic monomials. It is well known that the monomial fx Tr n ax r +1 is bent for every a F n if and only if n/ gcdr, n is odd [3]. In [5] it was examined for which a F the function fx Tr nax n r +1 is bent covering also the case when n/ gcdr, n is even. In [1] it was shown that fx Tr n ax r +1 is never 1-lateaued. A full treatment of quadratic monomials is given in the following theorem. In articular we will see that quadratic monomials are never s-lateaued for any odd s. At some ositions in the roof we will use that for a divisor s of n we have s 1 n 1/ if and only if n/s is even, or equivalently νs < νn where ν denotes the -adic valuation on integers. Theorem 1: The quadratic monomial fx Tr n ax r +1 F n[x] is s-lateaued for some a F n if and only if n is even, s is an even divisor of n and νs νr + 1. Proof: The linearized olynomial Lx corresonding to fx Tr n ax r +1 F n[x] is given by Lx ax + a r x r. We want to find out under which conditions kerl has dimension s. For a rimitive element γ of F n, let a γ c for some c, 0 c n. Then Lγ t 0 for an exonent t, 0 t n, if and only if which is equivalent to n 1 γ n 1 c r 1 γ r 1t, c r 1 r 1t mod n 1. The kernel has dimension s if and only if this congruence has s 1 incongruent solutions, i.e. a gcd r 1, n 1 gcdr,n 1 s 1, or equivalently gcdr, n s, b s 1 n 1 c r 1. First, assume that n is odd. By a this imlies that s is also odd and hence gcdr, n s. Consequently s 1 divides r 1, thus b holds if and only if s 1 n 1, which contradicts that n is odd. Therefore for the rest of the roof we may assume that n is even and hence by condition a also s is even. We consider two cases. Case I: n s is even. Condition a then imlies that r s is odd, hence νs νr + 1. We remark that in this case and s 1 does

3 IEEE TRANSACTIONS ON INFORMATION THEORY 3 not divide r 1. Due to condition b we then have to find solutions c, y for the equation y s 1 + c r 1 n 1. 8 Equation 8 has solutions if and only if gcd s 1, r 1 gcdr,s 1 n 1, which is guaranteed since n/s is even. Case II: n s is odd. We consider two subcases: i Suose r s is odd. Then we have νs νr + 1 and hence s 1 r 1. Condition b is satisfied for some integer c if and only if equation 8 has solutions. This is guaranteed by νn νs νr+1. ii Suose r s is even, i.e. νs νr. Then s 1 r 1 and for condition b, we need s 1 n 1 which contradicts that n/s is odd. We remark that for n, r, s satisfying the conditions of the theorem, the elements a γ c for which fx Tr n ax r +1 is s-lateaued are obtained from the congruence 8. For the remaining elements a F the corresonding monomial is n bent. III. OBTAINING BENT FUNCTIONS FROM s-plateaued FUNCTIONS Let f be a function from F n to F, and f denote its Fourier transform. The suort of f is then defined to be the set su f {b F n fb 0}. In this section we describe a rocedure to construct -ary bent functions in dimension n+s from s-lateaued functions from F n to F. The s-lateaued functions must be chosen so that the suorts of their Fourier transforms are airwise disjoint. Our construction can be seen as a generalization of the constructions in [], [1], [8] where s 1. Theorem : For each a a 1, a,, a s F s, let f a x be an s-lateaued function from F n to F. If su f a su f b for a, b F s, a b, then the function F x, y 1, y,, y s from F n F s to F defined by F x, y 1, y,, y s 1 s s i1 y iy i 1 y i 1 f a x y 1 a 1 y s a s a F s is bent. Proof: For α, a, x, y F n F s the inner roduct we use is Tr n αx+a y Tr n αx+a 1 y 1 +a y + +a s y s, where a a 1,, a s, y y 1,, y s. The Fourier transform F of F at α, a is F α, a ɛ F x,y1,,ys Trnαx x F n,y 1,,y s F ɛ y 1,,y s F ɛ y 1,,y s F ɛ y 1,,y s F x F n x F n f y α. ɛ F x,y1,,ys Trnαx ɛ fyx Trnαx As each α F n belongs to the suort of exactly one f y, y F s, for this y we have F α, a ɛ f y α n+s. Theorem 3: For each a F s, let g a be a quadratic s- lateaued function from F n to F with the corresonding linearized olynomial L a such that for all a F s, L a has the same kernel {c 1 β c s β s, 0 c 1,, c s 1} in F n. For each a a 1,, a s F s, let γ a F n be such that g a β j + Tr n γ a β j g 0 β j + a j, 9 for all j 1,, s. Then for each a F s, the s-lateaued function f a defined by f a x g a x + Tr n γ a x satisfies su f a su f b for b F s, a b. Proof: We have to show that α su f b imlies α su f a for a b. Suose α su f b, i.e. g b β j +Tr n γ b β j +Tr n αβ j g 0 β j +b j +Tr n αβ j 0, for each j 1,, s. Let a b and suose that a j b j for some 1 j s. Then f a β j + Tr n αβ j g a β j + Tr n γ a β j + Tr n αβ j g 0 β j + a j + Tr n αβ j 0. Observe that the existence of γ a that satisfies equation 9 for all j 1,..., s, is guaranteed by the linear indeendence of β 1,..., β s, the elements of the basis of the kernel for the linearized olynomial L a. To oint to a deterministic way of obtaining γ a we give a detailed argument for this observation: Let {δ 1, δ,..., δ n } and {ρ 1, ρ,..., ρ n } be dual bases of F n over F, and let β j b j1 δ 1 + b j δ + + b jn δ n. Put γ a x 1 ρ 1 + x ρ + + x n ρ n, then Tr n γ a β j b j1 x 1 + b j x + + b jn x n. A value for γ a is then a solution of the linear system Bx c over F for the s n-matrix B b jk and c c 1,, c s T with c j g 0 β j + a j g a β j, j 1,,..., s. Examle 1: To obtain a -lateaued monomial function Tr 4 ax 3r +1 from F 3 4 to F 3, by Theorem 1 we can choose r 1 or r 3. In fact the monomials g 0 x Tr 4 x 4, g 1 x Tr 4 x 8 have the same corresonding linearized olynomial Lx x + x 3 with a kernel of dimension in F 3 4. A basis for this kernel is {β, β 3 } where β is a root of the olynomial x 4 + x +. Since we have g 0 β g 0 β 3 g 1 β g 1 β 3 0 for each a a 1, a F 3 F 3, we choose γ a F 3 4 such that Tr 4 γ a β a 1, Tr 4 γ a β 3 a. For instance we can choose γ 0,0 1, γ 0,1 β 3 + 1, γ 0, β 3 +, γ 1,0 β, γ 1,1 β 3 + β, γ 1, β 3 + β + 1, γ,0 β + 1, γ,1 β 3 + β, γ, β 3 + β, and for the nine required -lateaued functions with airwise disjoint suorts of their Fourier transforms we then can

4 IEEE TRANSACTIONS ON INFORMATION THEORY 4 choose The function F x, y, z is then bent. f 0,0 x Tr 4 x 4 + x, f 0,1 x Tr 4 x 4 + β 3 + 1x, f 0, x Tr 4 x 4 + β 3 + x, f 1,0 x Tr 4 x 4 + βx, f 1,1 x Tr 4 x 4 + β 3 + βx, f 1, x Tr 4 x 8 + β 3 + β + 1x, f,0 x Tr 4 x 8 + β + 1x, f,1 x Tr 4 x 8 + β 3 + βx, f, x Tr 4 x 8 + β 3 + βx. aa 1,a F 3 F 3 yzy 1z 1y z f a x y a 1 z a IV. BENT FUNCTIONS WITH HIGH ALGEBRAIC DEGREE In this section we construct 3-ary bent functions attaining the bound, and 3-ary and 5-ary bent functions attaining the bound 3 also for odd dimension. This can be seen as the main result of this aer. We start with a roosition on the degree of the bent functions constructed in Theorem with quadratic s-lateaued functions. Proosition 1: Let {f a a F s } be a set of quadratic s- lateaued functions satisfying the conditions of Theorem. If a F f s a is quadratic affine then the bent function F in Theorem has degree degf 1s + degf 1s + 1. Proof: If the quadratic terms in a F f s a do not cancel, then in F given as in Theorem the summand 1 s y 1 1 y 1 ys 1 a F f ax having degree s 1s + does not vanish. Similarly, if a F f s a Tr n cx for some c F n, then the bent function F in Theorem has the summand 1 s y 1 1 y 1 ys 1 Tr n cx of degree degf 1s + 1 as term of largest degree. In order to obtain bent functions of highest ossible degree we have to choose s as large as ossible. Naturally we have s n and the set of n-lateaued functions recisely coincides with the set of affine and constant functions. Thus s n 1 is the maximal value for s for s-lateaued quadratic functions. The following roosition shows that this maximal value can be obtained. Proosition : For n even, the quadratic function chx, c F, from F n to F with hx Tr n + 1 n/ x x + n/ 1 i1 x i is n 1-lateaued. If n is odd, then the quadratic function chx, c F, from F n to F with hx Tr n + 1 n 1/ x + x i i1 is n 1-lateaued. Proof: We only show the statement for n even, the case where n is odd is shown in the same way. Straightforward one sees that the associate Ax 7 of the linearized olynomial 5 that corresonds to chx is given by Ax c c + 1 xn xn/ + x n/+i + x n/ i n/ 1 i1 + 1 xn c + 1 xn 1 + c n 1 x i n 1 x i. Evidently we have gcdax, x n 1 n 1 xi, thus hx is n 1-lateaued by equation 6. For the subsequent theorem we fix the following notation: 1 h is the function 10 and 11 when n is even and odd, resectively, for each a a 1, a,..., a n 1 F n 1 let c a be a nonzero element of F, γ a be an element of F n, such that c a hβ j +Tr n γ a β j c 0 hβ j +a j, j 1,..., n 1, 1 for a fixed basis {β 1, β,..., β n 1 } for the kernel of the linearized olynomial L corresonding to h, h a x c a hx + Tr n γ a x. Theorem 4: The function F defined by F x, y 1, y,, y n 1 a F n 1 1 n 1 n 1 i1 y iy i 1 y i 1 h a x y 1 a 1 y n 1 a n 1 from F n F n 1 to F is bent, and has degree 1n 1 + if a F n 1 c a 0, and degree 1n if a F n 1 c a 0 and a F n 1 γ a 0. Proof: For all a F n 1 the linearized olynomials L a corresonding to c a h have the same kernel, and the definition 1 for γ a guarantees that the Fourier transforms of the n 1-lateaued functions h a, a F n 1, have airwise disjoint suort. By Theorem the function F is bent. Since a F n 1 h a a F n 1 c a h + Tr n a F n 1 γ a x has degree if a F n 1 c a 0 and degree 1 if a F n 1 c a 0 and a F n 1 γ a 0, the bent function F has degree 1n 1 + and 1n 1 + 1, resectively, by Proosition 1. Of course it is always ossible to choose a F n 1 c a 0. We emhasize that for any choice of the set {c a a F n 1 } we can choose {γ a a F n 1 } such that a F n 1 γ a 0, since for every a F n 1 the linear system from which we obtain γ a does not have a unique solution.

5 IEEE TRANSACTIONS ON INFORMATION THEORY 5 Considering that the bent function F in Theorem 4 is in dimension n + s n 1 the bounds and 3 become degf 1n 1 + 1/ + 1 and degf 1n 1 + 1/, resectively. As we can see the function F in Theorem 4 attains the first bound when 3 and a F n 1 c a 0, and the second bound for arbitrary odd dimensions when 3, a F n 1 c a 0, a F n 1 γ a 0, and when 5, a F n 1 c a 0. We obtained the following corollaries artially solving oen roblems I and II. Corollary 1: The bounds and 3 can be attained for 3 in arbitrary odd dimension. Corollary : The bound 3 can be attained for 5 in arbitrary odd dimension. Remark 1: As the bound can only be attained by nonweakly regular bent functions, the function F in Theorem 4 must be non-weakly regular for 3 and a F n 1 c a 0. In fact this can be seen by a generalization of the arguments in [1] where infinite classes of non-weakly regular bent functions have been constructed. The reason behind F being non-weakly regular is that we cannot choose all c a with the same quadratic character under the condition 3 and a F n 1 c a 0. This is not a roblem for 5 where non-weakly regular as well as weakly regular F attaining the bound 3 can be found. We recall that for weakly regular bent functions the bound 3 is best ossible. V. CONCLUSIONS In [1], [], [8] a construction of bent functions from nearbent functions has been resented. In this article we generalize the this construction and resent a technique to construct bent functions from lateaued functions. As quadratic functions are always lateaued we investigate some classes of quadratic functions. We comletely describe the Fourier sectrum of quadratic monomials, and resent classes of quadratic functions with maximal ossible absolute values in their Fourier sectrum. We aly our construction to the latter classes of quadratic functions and thereby obtain the first construction of bent functions in characteristic 3 and 5 attaining uer bounds on the algebraic degree of bent functions resented by Hou in [6]. This artly solves oen roblems on the degree of bent functions and we can reformulate the oen roblems as follows: i Can the bound be attained for 5; ii Can the bound be attained in even dimension; iii Can the bound 3 be attained for 7 and odd dimension. REFERENCES [1] A. Çeşmelioğlu, G. McGuire, W. Meidl, A construction of weakly and non-weakly regular bent functions, rerint 010. [] P. Charin, E. Pasalic, C. Tavernier, On bent and semi-bent quadratic Boolean functions. IEEE Trans. Inform. Theory , [3] P. Dembowski, T. Ostrom, Planes of order n with collineation grous of order n. Math. Z , [4] H. Dobbertin, Construction of bent functions and balanced boolean functions with high nonlinearity, in: Fast Software Encrytion B. Preneel, Eds., Second International Worksho, Proceedings, Lecture Notes in Comuter Science 1008, Sringer-Verlag, Berlin, 1995, [5] T. Helleseth, A. Kholosha, Monomial and quadratic bent functions over the finite field of odd characteristic. IEEE Trans. Inform. Theory 5 006, [6] X.D. Hou, -ary and q-ary versions of certain results about bent functions and resilient functions. Finite Fields Al , [7] P.V. Kumar, R.A. Scholtz, L.R. Welch, Generalized bent functions and their roerties. Journal of Combinatorial Theory, Series A , [8] G. Leander, G. McGuire, Construction of bent functions from near-bent functions. Journal of Combinatorial Theory, Series A , [9] R. Lidl, H. Niederreiter, Finite Fields, nd ed., Encycloedia Math. Al., vol. 0, Cambridge Univ. Press, Cambridge, [10] O.S. Rothaus, On bent functions. Journal of Combinatorial Theory, Series A , [11] Y. Tan, J. Yang, X. Zhang, A recursive aroach to construct - ary bent functions which are not weakly regular. In: Proceedings of IEEE International Conference on Information Theory and Information Security, Beijing, 010, to aear. Ayça Çeşmelioğlu received the Ph.D. degree in mathematics from Sabancı University, İstanbul, Turkey, in June 008. Currently, she is a ostdoc researcher at Sabanci University. Her research interests include ermutation olynomials, crytograhically significant functions and seudorandom sequences. Meidl Wilfried received the M.Sc and Ph.D degrees from Klagenfurt University, Austria, in 1994 and 1998, resectively. From 000 to 00, ha was with the Institute of Discrete Mathematics, OEAW, Vienna, Austria. From 00 to 004, ha was with Temasek Labs, National University of Singaore and from 004 to 005 with RICAM, Linz, Austria. He is now with Sabancı University, MDBF, İstanbul, Turkey. His research interests include sequences, ermutation olynomials, seudorandom number generation, finite fields and their alications, APN-functions, bentfunctions. ACKNOWLEDGMENTS The first author would like to thank the hositality of INRIA Paris-Rocquencourt and she also wishes to thank Prof. Pascale Charin who made the research visit ossible. Parts of the article were written during a short visit of the second author at INRIA Paris-Rocquencourt. He would like to thank the institute for the hositality.