New Monomial Bent Functions over the
Finite Field of Odd Characteristic
Tor Helleseth and Alexander Kholosha
Coding Theory and Cryptography: 7 October 2005
www.ii.uib.no/publikasjoner/texrap/pdf/2005-310.pdf
Rothaus (1976) - Bent functions
f (x) : GF(2)n → GF(2)
X
1 X
f (x)+x·b
f (x)
(−1)
and (−1)
= n
Sf (b)(−1)x·b
Sf (b) =
2
n
n
x∈GF(2)
b∈GF(2)
Properties:
X
2
(Sf (b)) =
b∈GF(2)n
XXX
x
b
=
XX
x
y
= 2n
X
(−1)f (x)+f (y)+b·(x+y)
y
f (x)+f (y)
(−1)
X
(−1)b·(x+y)
b
(−1)0 = 22n
x
f (x) is a bent function iff Sf (b) = ±2n/2 for all b ∈ GF(2)n
Bent functions exist for n even only.
Maiorana-McFarland’s constructions
The best known construction of bent functions is the MaioranaMcFarland’s constructions.
For constructing bent functions :
Let π : GF (2)n/2 → GF (2)n/2 be a permutation and g any mapping
g : GF (2)n/2 → GF (2). Then
fπ,g (x, y) = x · π(y) + g(y),
is a bent function.
First order Reed-Muller code
Let x = (x1 , . . . , xn ) ∈ GF(2)n . Let vf be vector of length 2n ,
vf = (f (x))x∈GF(2)n
The first order Reed-MullerP
code of length 2n , is obtained using all binary
n
affine polynomials f (x) = i=1 bi xi + b0 , i.e.
RM (1, n) = {vf | deg(f ) ≤ 1}
Parameters of RM (1, n) : [2n , k = n + 1, d = 2n−1 ].
Example n = 3:
1
1
G=
1
1

1
1
1
0
1
1
0
1
1
1
0
0
1
0
1
1
1
0
1
0
1
0
0
1

1
0
0
0
For f (x) = x1 + x3 + 1 we obtain codeword vf = (10100101).
Covering radius of RM(1,n) (I)
The covering radius of a code is the smallest integer ρ such that the spheres
of radius ρ around the codewords cover the complete space.
Distance for arbitrary vector vf = (f (x))x∈GF(2)n to a codeword c = b·x+a ∈
RM (1, n), can be found via Walsh transform,
a
(−1) Sf (b) =
X
(−1)f (x)+b·x+a
x
m
= (2 − d(vf , c)) − d(vf , c)
= 2m − 2d(vf , c)
Hence, since average of |Sb (f )| is 2n/2 , it holds for the covering radius,
n
ρn ≤ 2n−1 − 2 2 −1
Bent functions exist for n even and give
n
ρn = 2n−1 − 2 2 −1 for even n
Covering radius of RM(1,n) (II)
Let ρn be the covering radius of RM (1, n).
n 3 4 5 6 7 8
9
10
ρn 2 6 12 28 56 120 240 − 244 496
Let v be a vector of distance ρn to the RM (1, n).
Consider code C by restricting RM (1, n) to the positions where v has a 1.
v 111...111 111...111 000...000 000...000
c 111...111
| {z } 000...000
| {z } 111...111
| {z } 000...000
w
ρn − w 2n−1 − w
Since d(v, c) = ρn − w + 2n−1 − w ≥ ρn we have w ≤ 2n−2 , and since
all-one vector belongs to C its parameters are
[ρn, n + 1, ρn − 2n−2]
and dual minimum distance d⊥ = 4.
Bounds on covering radius of RM(1,m)
n
ρn = 2n−1 − 2 2 −1 for even n
2n−1 − 2
n−1
2
n
≤ ρn ≤ 2n − 2 2 −1 for odd n
For n = 7 then ρn = 56. This was proved by Mykkeltveit (1979) by
showing that a [57, 8, 25] self-complementary code with d⊥ = 4 do not
exist.
To settle ρn for the next open question n = 9 one has do decide whether
a self-complementary code of one of the parameters [241, 10, 113],
[242, 8, 114], [243, 8, 115], [244, 8, 116] and d⊥ = 4 do exist.
For odd values of n ≥ 15 then ρn is strictly greater than the lower
bound.
Norse bound
Definition A code C (possibly nonlinear) has strength s(C) = 2 if all pairs
occur equally often in each pair of coordinates.
(For a linear code d⊥ = s(c) + 1).
Theorem (Helleseth, Kløve and Mykkeltveit 1978) Let C be a code a strength
2, then covering radius ρ obeys,
√
n− n
ρ≤
2
Sketch of proof The result follows by considering the coset v + C where
d(v, C) = ρ and using expression for the sum of the squares of the weight
of the words of the coset.
The Norse bound can be improved for codes of strength > 2.
Trace functions
The trace function T rkn : GF (pn ) → GF (pk ), is defined by
n
T rkn(x) =
k −1
X
ki
xp .
i=0
For k = 1 we use notation T rn (x) =
Pn−1
i=0
i
xp instead of T r1n(x).
Properties of trace mapping:
(i) T rn (ax+by) = aT rn (x)+bT rn (y) for all x, y ∈ GF (pn ), a, b ∈ GF (p).
(ii) T rn (xp ) = T rn (x).
(iii) T rk (T rkn (x)) = T rn (x) for all x ∈ GF (pn ).
(iv) T rn (ax) takes on all elements in GF (p) equally often when a 6= 0.
m-sequences
An m-sequence is a sequence of period pn −1 generated by a linear recursion
with primitive characteristic polynomial f (x) of degree n and period pn − 1.
Let α be a primitive element, then
s(t) = T rn(αt).
The crosscorrelation between two m-sequences s(t) and s(dt) that differ by
a decimation d, where gcd(d, pn − 1) = 1 is defined by
pn −2
Cd(τ ) =
X
t=0
ω
s(t+τ )−s(dt)
=
X
d
ω T rn(cx−x ).
x∈GF (pn )
where ω is a primitive complex p-th root if unity.
For d = −1 this is called a Kloosterman sum.
Conjecture 1 For d = 1 (mod p − 1) then Cd (τ ) = −1 for some τ .
Kasami bent functions
Theorem (Kasami) Let n = 2k and a 6= 0, then
k
T rk (ax2 +1)
is bent.
Proof Any x ∈ GF (2n )∗ can be written uniquely as x = αβ where α has
order 2k − 1 and β has order 2k + 1. Then Walsh transform gives
Sb(f ) =
X
2k +1 +bx+b2k x2k )
(−1)T rk (ax
x
=
XX
β
2
2 2 +b2k+1 β −2 ))
(−1)T rk (α (a+b β
α
= (N (a, b) − 1)2k − 1
where N (a, b) is the number of solutions β of a + b2 β 2 + b2
N (a, b) = 0 or 2.
k+1
β −2 = 0, i.e
Some bent functions
In this case one consider functions of the type f (x) = α1 xd1 + xd2 where
di = 2t (mod 2k − 1) for some t.
Theorem (Dobbertin, Leander, Carlet, Canteaut,Felke,Gaborit) Let n = 2k
k
and α1 + α12 = 1, then the following functions are bent:
k
k−1
T rn(α1x2 +1 + x3·2 −1) k odd,
k
k
T rn(α1x2 +1 + x3·2 +3) k odd,
k
k
T rn(α1x2 +1 + x3·2 +5) k odd.
Sketch of proof In principle the same but much more tricky and complicated. Uses nice ideas in Dickson polynomials and many inventive tricks.
As in the Kasami case one need that d1 = 2t (mod 2k − 1) and reduces the
problem to an equation that one needs to show have either 0 or 2 roots.
Introduction - Nonbinary
f (x) : GF(pn) 7→ GF(p) – p-ary function
X
1 X
f (x)−Trn (bx)
f (x)
Sf (b) =
ω
and ω
= n
Sf (b)ω Trn(bx) ,
p
n
n
x∈GF(p )
b∈GF(p )
2πi
where Trn () : GF(pn ) → GF(p) is the absolute trace function, ω = e p is
the complex primitive pth root of unity and elements of GF(p) are considered as integers modulo p.
Sf (b)
the Walsh transform coefficient of f ;
|Sf (b)|2 = pn
p-ary bent function [KuSchWe85];
p−n/2Sf (b) = ω f
∗ (b)
up−n/2Sf (b) = ω f
f (x) = Trn (axd)
∗ (b)
regular bent function, f ∗ : GF(pn ) 7→ GF(p);
weakly regular bent function if |u| = 1;
p-ary monomial function.
Introduction - Nonbinary (2)
Walsh transform coefficients of a p-ary bent function f with odd p satisfy
p−n/2Sf (b) =
∗
± ω f (b), if n is even or n is odd and p ≡ 1 (mod 4) ,
∗
± i ω f (b), if n is odd and p ≡ 3 (mod 4) ,
where i is a complex primitive 4th root of unity.
Nb(j) := #{x ∈ GF(pn) | f (x) − Trn(bx) = j}
Sf (b) = Nb(0) + Nb(1)ω + . . . + Nb(p − 1)ω p−1
n is even (b fixed)
Nb(j) ≡ const for j 6= f ∗(b) and Nb(f ∗(b)) differs from the rest by ±pn/2
n is odd (b fixed)
Nb(j) − Nb(f ∗(b)) = pk for half of j 6= f ∗(b) and equal to −pk for the rest
Non-binary Dillon Bent Functions
χ – a nontrivial additive character of GF(pk ), a, b ∈ GF(pk )
X
−1
K(χ; a, b) =
χ ac + bc
– Kloosterman sum
c∈GF(pk )∗
G(ψ, χ) =
X
ψ(c)χ(c) – Gaussian sum,
c∈GF(pn )∗
where χ is an additive and ψ a multiplicative character of GF(pn ).
Theorem 1 Let n = 2k , a ∈ GF(pn ) is nonzero and prime p is odd. Then for
any nontrivial additive character χ of GF(pk )
pk
X
k
n
j(pk −1)
χ Trk (aξ
) = −K(χ; 1, ap +1) ,
j=0
where ξ is a primitive element of GF(pn ).
Non-binary Dillon Bent Functions (2)
Theorem 2 Let n = 2k and t be an arbitrary positive integer with gcd(t, pk +
1) = 1 and pk > 3 for an odd prime p. Then for any nonzero a ∈ GF(pn) the
p-ary function f (x) mapping GF(pn) to GF(p) and given by
k
f (x) = Trn(axt(p −1))
is bent if and only if the following Kloosterman sum over GF(pk ) satisfies
k
K(χ1; 1, ap +1) = −1 ,
(1)
where χ1 is the canonical additive character of GF(pk ). Moreover, if (1) holds
then f (x) is a regular bent function and for b ∈ GF(pn )∗ the corresponding
Walsh transform coefficient of f (x) is equal to
k
Sa(b) = p ω
and Sa (0) = pk .
k
−Trn ab−t(p −1)
Non-binary Dillon Bent Functions (3)
Corollary 3 In the ternary case there exists at least one a ∈ GF(pn ) such that
function f (x) is bent. Moreover, f (x) is bent if and only if the Hamming weight
k
of c(a) = Trn (aξ j(3 −1) ) | j = 0, . . . , 3k is equal to 2 · 3k−1 , where ξ is a
primitive element of GF(3n ). In this case f (x) is a regular bent function.
Conjecture 4 (He76) If d ≡ 1 (mod p − 1) then the periodic correlation of an
m-sequence and its d-decimation contains the value −1 (not true in the opposite
direction in general).
The set of Kloosterman sums is equal to the periodic correlation of an msequence and its reverse (so d = −1)
d = −1 ≡ 1 (mod p − 1) ⇐⇒ p ∈ {2, 3}
KS takes on the value −1 if p = 2 (LaWo90) and p = 3 (Katz89). If the
conjecture was true in the opposite direction for d = −1 then the KS would
never be equal to −1 in a non-binary and non-ternary case, which means
that there would be no Dillon bent for p > 3.
New Class of Ternary Monomial Bent Functions
Conjecture 5 Let n = 2k with k odd. Then the ternary function f (x) mapping
GF(3n) to GF(3) and given by
f (x) = Trn(ax
3n −1
k
4 +3 +1
) ,
3k +1
4
is a weakly regular bent function if a = ξ
and ξ is a primitive element of
n
n
GF(3 ). Moreover, for b ∈ GF(3 ) the corresponding Walsh transform coefficient
of f (x) is equal to
Sf (b) = −3k ω
±Trk
k
b3 +1
a(I+1)
,
where I is a primitive 4th root of unity over GF(3n ).
p – odd prime, ξ – a primitive element of GF(pn), n = 2k , i = 0, 1, 2, 3
n
p
−
1
Ci := ξ 4t+i | t = 0, . . . ,
− 1 cyclotomic cl. of order 4 in GF(pn)∗
4
New Class Ternary Monomial Bent Functions (2)
Tj :=
X
ω
k
Trk c(x+1)p +1 −c
for
(c ∈ GF(pk ), j = 0, 1, 2, 3)
x∈Cj
Lemma 6 Let p be an odd prime with p ≡ 3 (mod 8) and let n = 2k with k
odd. Then for any j
pk + 1 Trk (c)
(ω
−Tj = ω
Tj+2 +
+ 1) .
4
k
∈ GF(3k ), b = a(I + 1)β 3 6= 0 and β −1 ∈ Cj then
Trk (c)
k
Let c =
b3 +1
a(I+1)
Sf (b) = 1 + Tj + Tj+1 + Tj+2 + Tj+3
k
3
+
1
= (1 − ω Trk (c)) Tj + Tj+1 +
− 3k .
2
In particular, if Trk (c) = 0 then Sa (b) = −3k .
Quadratic Monomial Bent Functions
Theorem 7 Let a ∈ GF(pn ) be nonzero and a prime p be odd. Then for any
j ∈ {1, . . . , n} the quadratic p-ary function f (x) mapping GF(pn) to GF(p)
and given by
j
f (x) = Trn(axp +1)
is bent if and only if
n
p −1
gcd(2j,n)
p
− 1 /
− i0(pj − 1) ,
2
(2)
where a = ξ i0 and ξ is a primitive element of GF(pn ). Moreover, if (2) holds
then f (x) is a (weakly) regular bent function.
Corollary 8 (Kumar, Moreno 91) Let n = ek for an odd integer k and integer
r in the range 1 ≤ r ≤ k with gcd(r, k) = 1. Then the function f (x) =
er
Trn(axp +1) is a (weakly) regular bent function for any nonzero a ∈ GF(pn)
and odd prime p.
Sidelnikov and Kasami Cases
Corollary 9 (Sidelnikov) For any nonzero a ∈ GF(pn ) and odd prime p the
function f (x) = Trn (ax2 ) is a (weakly) regular bent function. Moreover, for
b ∈ GF(pn) the corresponding Walsh transform coefficient of f (x) is equal to
n−1 n/2
Sf (b) = η(a)(−1)
and
p
2
ω
b
−Trn ( 4a
)
if
p ≡ 1 (mod 4)
b2
Sf (b) = η(a)(−1)n−1inpn/2ω −Trn( 4a ) if p ≡ 3 (mod 4),
where i is the complex primitive 4th root of unity and η is the quadratic character
of GF(pn ).
Corollary 10 (p-ary Kasami, see LiuKomo92) Let n = 2k and a ∈ GF(pn )
k
for an odd prime p. Then the function f (x) = Trn (axp +1 ) is a weakly regular
k
bent function if a + ap 6= 0. Moreover, for b ∈ GF(pn ) the corresponding Walsh
transform coefficient of f (x) is equal to
Sf (b) = −pk ω
−Trk
k
bp +1
k
a+ap
.
Perfect Nonlinear (Planar) Functions
F (x) : GF(pn) 7→ GF(pn) is perfect nonlinear if for any c ∈ GF(pn)∗ the
mapping F (x + c) − F (x) is a bijection over GF(pn ).
If F (x) is perfect nonlinear, a ∈ GF(pn )∗ and f (x) = Trn (aF (x)) then
2
|Sf (b)| =
X
ω Trn(a(F (x)−F (y))+b(y−x))
x,y∈GF(pn )
=
X
ω
Trn (bz)
z∈GF(pn )
where z = y − x and since
3k +1
X
ω Trn(a(F (y−z)−F (y))) = pn ,
y∈GF(pn )
P
y∈GF(pn )
ω Trn(a(F (y−z)−F (y))) = 0 for a, z 6= 0.
F (x) = x 2 is perfect nonlinear over GF(3n) if and only if gcd(k, n) = 1
and k is odd (Coulter-Matthews 97). Consequently, with such n and k , for
3k +1
n ∗
any a ∈ GF(3 ) the function Trn (ax 2 ) over GF(3n ) is bent.
Perfect Nonlinear (Planar) Functions (2)
F (x) perfect nonlinear ⇐⇒ Trn(aF (x)) bent ∀a ∈ GF(pn)∗ (see CaDu01)
PN Functions
p
Sidelnikov (r, wr)
Kumar-Moreno (r, wr)
Coulter-Matthews
Coulter-Matthews
Ding-Yuan
d or F (x)
n
2
pj + 1,
3k +1
2 ,
3
n
gcd(n,j) -odd
gcd(k, n) = 1, k -odd
3
2 or 2k + 1
x10 + x6 − x2
3
2k + 1
x10 − ux6 − u2 x2 , u ∈ GF(3n )∗
Proven in
Cor. 9
KuMo91, Cor. 8
CoMa97
CoMa97
DiYu05
Bent functions from difference sets
Theorem (Helleseth-Gong) Let α be a primitive element of GF (pn ).
Let n = (2m + 1)k , gcd(s, 2m + 1) = 1 where 1 ≤ s ≤ 2m.
Define b0 = 1, bis = (−1)i , and bi = b2m+1−i for i = 1, 2, . . . , m.
Let u0 = b0 /2 = (p + 1)/2 and ui = b2i for i = 1, 2 . . . , m.
Then the sequences of period pn − 1 given by
s(t) = T rn(
m
X
ul α
p2kl +1
2
)
l=0
has an ideal autocorrelation, where indices of bi ’s are mod 2m + 1.
Theorem Conditions as above, then
f (x) = T rn(
m
X
l=0
is a bent function.
ul x p
2kl +1
)
Example
Example Let p = 3, m = 2, k = 2 and n = (2m + 1)k = 10. Let s = 2 such
that gcd(s, 2m + 1) = 1. Then the parameters bi and ui can be chosen as
follows;
b0 = 1, b1 = b6 = (−1)3 = −1, b2 = (−1)1 = −1
b3 = b8 = (−1)4 = 1, b4 = (−1)2 = 1
u0 =
b0
, u1 = b2 = 2, u2 = b4 = 1
2
f (x) = T rn(x2 + x82 − x6562)
is a bent function.
Classes of p-ary Monomial Bent Functions
Fact 11 The ternary function f (x) mapping GF(36 ) to GF(3) and given by
f (x) = Tr6 ξ 7x98
,
where ξ is a primitive element of GF(36 ), is bent and not weakly regular bent.
Bent Functions
n
Sidelnikov (r, wr)
p-ary Kasami (wr)
2k
Kumar-Moreno (r, wr)
Coulter-Matthews
p-ary Gold (r, wr)
p-ary Dillon (r)
2k
Conjectured (wr)
2k
Fact (not wr)
6
d
2
k
p +1
pj + 1,
n
gcd(n,j) -odd
3k +1
2 ,
gcd(k, n) = 1, k -odd
pj + 1
t(3k − 1), gcd(t, 3k + 1) = 1
3n −1
4
+ 3k + 1
98
ξ
primitive element of GF(pn );
r
regular bent functions;
wr
weakly regular bent functions.
a
a 6= 0
k
a + ap 6= 0
a 6= 0
a 6= 0
(2)
(1)
ξ
3k +1
4
ξ7
Proven in
Cor. 9
LiuKomo92, Cor. 10
KuMo91, Cor. 8
CoMa97
Th. 7
Th. 2
Con. 5
Fact 11
References
[1] P. V. Kumar, R. A. Scholtz, and L. R. Welch, “Generalized bent functions
and their properties,” Journal of Combinatorial Theory, Series A, vol. 40,
no. 1, pp. 90–107, September 1985.
[2] X.-D. Hou, “p-Ary and q -ary versions of certain results about bent functions and resilient functions,” Finite Fields and Their Applications, vol. 10,
no. 4, pp. 566–582, October 2004.
[3] P. V. Kumar and O. Moreno, “Prime-phase sequences with periodic correlation properties better than binary sequences,” IEEE Transactions on
Information Theory, vol. 37, no. 3, pp. 603–616, May 1991.
[4] S.-C. Liu and J. J. Komo, “Nonbinary Kasami sequences over GF(p),”
IEEE Transactions on Information Theory, vol. 38, no. 4, pp. 1409–1412,
July 1992.
[5] R. S. Coulter and R. W. Matthews, “Planar functions and planes of LenzBarlotti class II,” Designs, Codes and Cryptography, vol. 10, no. 2, pp.
167–184, February 1997.