Proposition 23 Let f (x) =P
I∈P(N )λIxI be the NNF of a Boolean func-tion f on Fn2. Then f is bent if and only if:
1. for every I such that n/2 < |I| < n, the coefficient λI is divisible by 2|I|−n/2;
2. λN (with N = {1, · · · , n}) is congruent with 2n/2−1 modulo 2n/2.
Proof. According to Lemma 2, f is bent if and only if, for every a ∈ Fn2, f (a) ≡ 2b n/2−1 mod 2n/2. We deduce that, according to Relation (30) ap-plied with ϕ = f , Conditions 1. and 2. imply that f is bent.
Conversely, Condition 1. is necessary, according to Proposition 17. Condi-tion 2. is also necessary since bf (1, · · · , 1) = (−1)nλN (from Relation (30)).
2
Proposition 23 and Relation (9) imply some restrictions on the coefficients of the ANFs of bent functions, observed and used in [90] (and also partially observed by Hou and Langevin in [196]).
Proposition 23 can be seen as a (much) stronger version of Rothaus’ bound, since the algebraic degree of a Boolean function whose NNF is f (x) = P
I∈P(N )λIxI equals the maximum size of I, such that λI is odd.
6.6.2 Geometric characterization
Proposition 23 also allows proving the following characterization:
Theorem 12 [85] Let f be a Boolean function on Fn2. Then f is bent if and only if there exist n/2-dimensional subspaces E1, . . . , Ek of Fn2 (there is no constraint on the number k) and integers m1, . . . , mk (positive or negative) such that, for any element x of Fn2:
f (x) ≡
k
X
i=1
mi1Ei(x) − 2n/2−1δ0(x) h
mod 2n/2i
. (51)
If we have f (x) = Pk
i=1mi1Ei(x) − 2n/2−1δ0(x) then the dual of f equals f (x) =e Pk
i=1mi1E⊥
i (x) − 2n/2−1δ0(x).
Proof (sketch of). Relation (51) is a sufficient condition for f being bent, according to Lemma 2 (at the beginning of Section 6) and to Relation (16).
This same Relation (16) also implies the last sentence of Theorem 12. Con-versely, if f is bent, then Proposition 23 allows to deduce Relation (51), by expressing all the monomials xI by means of the indicators of subspaces of dimension at least n − |I| (indeed, the NNF of the indicator of the subspace {x ∈ Fn2/ xi = 0, ∀i ∈ I} being equal toQ
i∈I(1 − xi) =P
J ⊆I(−1)|J|xJ, the monomial xIcan be expressed by means of this indicator and of the monomi-als xJ, where J is strictly included in I) and by using Lemma 3 below (note that d ≥ n − |I| implies |I| − n/2 ≥ n/2 − d and thatQ
i∈N(1 − xi) = δ0(x)).
2
Lemma 3 Let F be any d-dimensional subspace of Fn2. There exist n/2-dimensional subspaces E1, · · · , Ek of Fn2 and integers m, m1, · · · , mk such
that, for any element x of Fn2:
2n/2−d1F(x) ≡ m +
k
X
i=1
mi1Ei(x)h
mod 2n/2i
if d < n/2, and
1F(x) ≡
k
X
i=1
mi1Ei(x)h
mod 2n/2i
if d > n/2.
The class of those functions f which satisfy the relation obtained from (51) by withdrawing “[mod 2n/2]” is called Generalized Partial Spread class and denoted by GPS (it includes PS), see [55]. The dual ef of such function f of GPS equaling ef (x) = Pk
i=1mi1E⊥
i (x) − 2n/2−1δ0(x), it belongs to GPS too.
There is no uniqueness of the representation of a given bent function in the form (51). There exists another characterization, shown in [86], in the form f (x) =Pk
i=1mi1Ei(x) ± 2n/2−1δ0(x), where E1, . . . , Ek are vector subspaces of Fn2 of dimensions n/2 or n/2 + 1 and where m1, . . . , mk are integers (positive or negative). There is not a unique way, either, to choose these spaces Ei. But it is possible to define some subclass of n/2-dimensional and (n/2 + 1)-dimensional spaces such that there is uniqueness, if the spaces Ei are chosen in this subclass.
P. Guillot has proved subsequently in [171] that, up to composition by a translation x 7→ x + a, every bent function belongs to GPS.
6.6.3 characterization by second-order covering sequences
Proposition 24 [93] A Boolean function f defined on Fn2 is bent if and only if:
∀x ∈ Fn2, X
a,b∈Fn2
(−1)DaDbf (x)= 2n. (52)
Proof. If we multiply both terms of Relation (52) by fχ(x) = (−1)f (x), we obtain the (equivalent) relation:
∀x ∈ Fn2, fχ⊗ fχ⊗ fχ(x) = 2nfχ(x);
indeed, we have fχ⊗ fχ⊗ fχ(x) =P
b∈Fn2
P
a∈Fn2(−1)f (a)⊕f (a+b)
(−1)f (b+x)= P
a,b∈Fn2(−1)f (a+x)⊕f (a+b+x)⊕f (b+x). According to the bijectivity of the Fourier transform and to Relation (20), this is equivalent to :
∀u ∈ Fn2, bfχ3(u) = 2nfbχ(u) . Thus, we have P
a,b∈Fn2(−1)DaDbf (x) = 2n if and only if, for every u ∈ Fn2, fbχ(u) equals ±√
2n or 0. According to Parseval’s relation, the value 0 can-not be achieved by bfχand this is therefore equivalent to the bentness of f . 2
Relation (52) is equivalent to the relationP
a,b∈Fn2(1 − 2DaDbf (x)) = 2n, that isP
a,b∈Fn2 DaDbf (x) = 22n−1− 2n−1, and hence to the fact that f ad-mits the second order covering sequence with all-1 coefficients and with level 22n−1− 2n−1.
It is shown similarly in [93] that the relation similar to (52) but with any integer in the place of 2n characterizes the class of plateaued functions (see Subsection 6.8).
A characterization of bent functions through Cayley graphs also exists, see [18].
6.7 Subclasses: hyper-bent functions
In [356], A. Youssef and G. Gong study the Boolean functions f on the field F2n (n even) such that f (xi) is bent for every i co-prime with 2n− 1. These functions are called hyper-bent functions. The condition seems difficult to satisfy. However, A. Youssef and G. Gong show in [356] that hyper-bent functions exist. Their result is equivalent to the following (see [82]):
Proposition 25 All the functions of class PS#ap are hyper-bent.
Let us give here a direct proof of this fact.
Proof. We can restrict ourselves without loss of generality to the functions of class PSap. Let ω be any element in F2n \ F2n/2. The pair (1, ω) is a basis of the F2n/2-vectorspace F2n. Hence, we have F2n = F2n/2 + ωF2n/2. Moreover, every element y of F2n/2 satisfies y2n/2 = y and therefore trn(y) = y + y2 + · · · + y2n/2−1 + y + y2 + · · · + y2n/2−1 = 0. Consider the inner product in F2n defined by: y · y0 = trn(y y0); the subspace F2n/2 is then its own orthogonal; hence, according to Relation (16), any sum of the form P
y∈F2n/2(−1)trn(λy) is null if λ 6∈ F2n/2 and equals 2n/2 if λ ∈ F2n/2.
Let us consider any element of the class PSap, choosing a balanced Boolean function g on Fn/22 , vanishing at 0, and defining f (y0+ ω y) = g
y0 y
, with
y0 equal-ity being due to the fact that the mapping x → xi is one-to-one) equals 2n/2 if a ∈ F2n/2 and is null otherwise.
z∈F2n/2(−1)g(z) is null since g is balanced.
The sum P
z∈F2n/2(−1)g(z)P
y∈F2n/2(−1)trn(a(z+ω)iy) equals ±2n/2 if a 6∈
F2n/2, since we prove in the next Lemma that there exists then exactly one z ∈ F2n/2 such that a(z + ω)i ∈ F2n/2; and this sum is null if a ∈ F2n/2 (this can be checked, if a = 0 thanks to the balancedness of g, and if a 6= 0 because y ranges over F2n/2 and a(z + ω)i 6∈ F2n/2). This completes the
proof. 2
Lemma 4 Let n be any positive integer. Let a and ω be two elements of the set F2n\ F2n/2 and let i be co-prime with 2n− 1. There exists a unique element z ∈ Fn/22 such that a(z + ω)i∈ Fn/22 .
Proof. Let j be the inverse of i modulo 2n− 1. We have a(z + ω)i∈ Fn/22 if and only if z ∈ ω + a−j × Fn/22 . The sets ω + a−j × Fn/22 and Fn/22 are two flats whose directions a−j× Fn/22 and Fn/22 are subspaces whose sum is direct and equals F2n. Hence, they have a unique vector in their intersection. 2
Relationships between the notion of hyper-bent function and cyclic codes are studied in [82]. It is proved that every hyper-bent function f : F2n → F2, can be represented as: f (x) =Pr
i=1trn(aixti) ⊕ , where ai ∈ F2n, ∈ F2
and w2(ti) = n/2. Consequently, all hyper-bent functions have algebraic degree n/2.
In [102] is proved that, for every even n, every λ ∈ F∗2n/2 and every r ∈ ]0;n2[ such that the cyclotomic cosets of 2 modulo 2n/2+ 1 containing respec-tively 2r− 1 and 2r+ 1 have size n and such that the function trn
2 λx2r+1 is balanced on F2n/2, the function trn
λ
x(2r−1)(2n/2−1)+ x(2r+1)(2n/2−1)
is bent (i.e. hyper-bent) if and only if the function trn
2 x−1+ λx2r+1 is also balanced on F2n/2.
Remark. In [56] have been determined those Boolean functions on Fn2 such that, for a given even integer k (2 ≤ k ≤ n − 2), any of the Boolean functions on Fn−k2 , obtained by keeping constant k coordinates among x1, · · · , xn, is bent (i.e. those functions which satisfy the propagation criterion of degree n − k and order k, see Section 8). These are the four symmetric bent functions (see Section 10). They were called hyper-bent in [56] but we keep this term for the notion introduced by Youssef and Gong.
6.8 Superclasses: partially-bent functions, partial bent