On Some Properties of Quadratic APN Functions of a Special Form

TL;DR

This paper investigates specific quadratic functions formed by linear combinations of $x^3$ and $x^9$, providing necessary and sufficient conditions for these functions to be Almost Perfect Nonlinear (APN), which are valuable in cryptography.

Contribution

It offers a detailed characterization of when quadratic functions of a special form are APN, advancing understanding of their cryptographic properties.

Findings

Derived necessary and sufficient conditions for APN property

Identified new classes of APN functions of the given form

Enhanced methods for constructing APN functions

Abstract

In a recent paper, it is shown that functions of the form $L_1(x^3)+L_2(x^9)$, where $L_1$ and $L_2$ are linear, are a good source for construction of new infinite families of APN functions. In the present work we study necessary and sufficient conditions for such functions to be APN.

Tables

Table 1. Table I: Known APN power functions x d superscript 𝑥 𝑑 x^{d} over 𝔽 2 n subscript 𝔽 superscript 2 𝑛 \mathbb{F}_{2^{n}}

Functions	Exponents $d$	Conditions	Degree	Proven
Golden	$2^i+1$	gcd($i,n$)=1	2	[2, 3]
Kasami	$2^{2i}-2^i+1$	gcd($i,n$)=1	$i$+1	[4, 5]
Welch	$2^t+3$	$n=2t+1$	3	[6]
Niho	$2^t+2^{\frac{t}{2}}-1$, $t$ even	$n=2t+1$	$\frac{t+2}{2}$	[7]
	$2^t+2^{\frac{3t+1}{2}}-1$, $t$ odd		$t$+1
Inverse	$2^{2t}-1$	$n=2t+1$	$n-1$	[8, 3]
Dobbertin	$2^{4i}+2^{3i}+2^{2i}+2^i-1$	$n=5i$	$i+3$	[9]

Table 2. Table II: Known classes of quadratic APN polynomial over 𝔽 2 n subscript 𝔽 superscript 2 𝑛 \mathbb{F}_{2^{n}} CCZ-inequivalent to power functions

Functions	Conditions	Proven
	$n=pk$, gcd$(k,3)$=gcd($s,3k$)=1,
$x^{2^s+1}+{\alpha }^{2^k-1}{x}^{2^{ik}+2^{mk+s}}$	$p\in \{3,4\}$, $i=sk$ mod $p$, $m=p-i$,	[13]
	$n\ge 12$, $\alpha$ primitive in ${𝔽}_{2^n}^{\ast }$
	$q=2^m$, $n=2m$, gcd($i,m$)=1,
$x^{2^{2i}+2^i}+b{x}^{q+1}+c{x}^{q\left(2^{2i}+2^i\right)}$	gcd($2^i+1,q+1)\ne 1$, $c{b}^q+b\ne 0$,	[14]
	$c\notin \left\{{\lambda }^{\left(2^i+1\right)\left(q-1\right)},\lambda \in {𝔽}_{2^n}\right\}$, $c^{q+1}=1$
	$q=2^m$, $n=2m$, gcd($i,m$)=1,
$x\left(x^{2^i}+x^q+c{x}^{2^{i}q}\right)$	$c\in {𝔽}_{2^n}$, $s\in {𝔽}_{2^n}\setminus {𝔽}_q$,	[14]
$+x^{2^i}\left(c^q{x}^q+s{x}^{2^{i}q}\right)+x^{\left(2^i+1\right)q}$	$X^{2^i+1}+c{X}^{2^i}+c^{q}X+1$
	is irreducible over ${𝔽}_{2^n}\}$
$x^3+a^{-1}{\text{Tr}}_n\left(a^3{x}^9\right)$	$a\ne 0$	[15]
$x^3+a^{-1}{\text{Tr}}_n^3\left(a^3{x}^9+a^6{x}^{18}\right)$	$3|n$, $a\ne 0$	[1]
$x^3+a^{-1}{\text{Tr}}_n^3\left(a^6{x}^{18}+a^{1}2x^{3}6\right)$	$3|n$, $a\ne 0$	[1]
	$n=3k$, gcd$(k,3)$=gcd($s,3k$)=1,
$u{x}^{2^s+1}+u^{2^k}{x}^{2^{-k}+2^{k+s}}+$	$v,w\in {𝔽}_{2^k}$, $vw\ne 1$,	[16]
$v{x}^{2^{-k}+1}+w{u}^{2^k+1}{x}^{2^s+2^{k+s}}$	$3|\left(k+s\right)$ $u$ primitive in ${𝔽}_{2^n}^{\ast }$
	$n=2k$, gcd$(s,k)$=1, $s,k$ odd,
$\alpha x^{2^s+1}+{\alpha }^{2^k}{x}^{2^{k+s}+2^k}+$	$\beta \notin {𝔽}_{2^k}$, ${\gamma }_i\in {𝔽}_{2^k}$,	[17, 16]
$\beta x^{2^k+1}+{\sum }_{i+1}^{k-1}{\gamma }_i{x}^{2^{k+i}+2^i}$	$\alpha$ not a cube

Table 3. Table III: APN functions of the form x 9 + L ​ ( x 3 ) superscript 𝑥 9 𝐿 superscript 𝑥 3 x^{9}+L(x^{3}) over 𝔽 2 n subscript 𝔽 superscript 2 𝑛 \mathbb{F}_{2^{n}}

$n$	CCZ-eq	Representatives
4	1	$L\left(x\right)=0$
5	2	$L\left(x\right)=0$, $L\left(x\right)=\text{Tr}\left(x\right)$
6	2	$L\left(x\right)={\alpha }^{44}x+\alpha x^2$,
		$L\left(x\right)={\alpha }^{23}x+x^{2^2}$
7	1	$L\left(x\right)=0$
8	6	$L\left(x\right)=0$, $L\left(x\right)=x^2+x^{2^4}$,
		$L\left(x\right)=x^{2^3}+x^{2^7}$, $L\left(x\right)=\text{Tr}\left(x\right)$,
		$L\left(x\right)=x^{2^2}+{\alpha }^{85}{x}^{2^3}+x^{2^4}$,
		$L\left(x\right)={\alpha }^{60}x+{\alpha }^{200}{x}^2+{\alpha }^{242}{x}^4+{\alpha }^{190}{x}^8+\alpha x^{16}$
9	0	-
10	2	$L\left(x\right)=0$,
		$L\left(x\right)={\alpha }^{1021}x+{\alpha }^{1022}{x}^2+\alpha x^{2^2}$

Equations

$$F(x)=\sum _{j=0}^{2^n-1}{\delta }_j{x}^j,\text{mbox}with{\delta }_j\in {\mathbb{F}}_{2^n}.$$

$${\hat{f}}_{\chi }(u)=\sum _{x\in {\mathbb{F}}_{2^n}}(-1{)}^{f(x)+\text{Tr}(ux)},$$

$$\mathcal{F}(f)=\sum _{x\in {\mathbb{F}}_{2^n}}(-1{)}^{f(x)}=2^n-2\cdot \text{mbox}wt(f),$$

$$F^{\prime }(x)=F(x^3)=L_1(x^3)+L_2(x^9),$$

$$L_1(x)=\sum _{i=0}^{n-1}{b}_i{x}^{2^i}\text{mbox}and{L}_2(x)=\sum _{i=0}^{n-1}{c}_i{x}^{2^i},$$

$$a{x}^3+L(a^3{x}^9+a^{2}b{x}^6+a{b}^2{x}^3)$$

$$\textit{Tr}_{n}\bigg{(}\frac{u}{(L(u))^{3}}\bigg{)}=\begin{cases}0&\mbox{ if $n$ is odd}\\ 1&\mbox{ if $n$ is even}\end{cases}$$

$$L_1(a^3(x^2+x))+L_2(a^9(x^8+x))\ne 0;$$

$$L_1(a^{3}y)+L_2(a^9(y^4+y^2+y))\ne 0.$$

$$F^{\prime }(ax+a)+F^{\prime }(ax)+F^{\prime }(a)=0\text{mbox}ifandonlyifx\in \{0,1\}.$$

$$L_1(a^3(x^2+x))+L_2(a^9(x^8+x))\ne 0\text{mbox}ifandonlyifx\ne 0,1.$$

$$d_0=b_0+b_{n-1}+c_0+c_{n-3}$$

$$d_1=b_1+b_0+c_1+c_{n-2}$$

$$d_2=b_2+b_1+c_2+c_{n-1}$$

$$d_i=b_i+b_{i-1}+c_i+c_{i-3},\text{mbox}for3\le i\le n-1.$$

$$L_1(a^3)+L_2(a^9)=F(a^3)=F^{\prime }(a)\ne 0.$$

$$L_1(1)+L_2(1)=\sum _{i=0}^{n-1}{b}_i+\sum _{i=0}^{n-1}{c}_i=\sum _{i=0}^{n-1}(b_i+c_i)\ne 0.$$

$$L_1(a^3\beta )+L_2(a^9({\beta }^4+{\beta }^2+\beta ))=L_1(a^3\beta )\ne 0\forall a\ne 0.$$

$$L_1(a^{3}y)=L_2(a^9{y}^{3}t)$$

$$\text{mbox}foranya,y\in {\mathbb{F}}_{2^n}^{\ast },\text{Tr}(y)=0L_1(a^{3}y)+L_2(a^9(y^4+y^2+y))\ne 0.$$

$$L_2(a^9(y^4+t{y}^3+y^2+y))\ne 0.$$

$$L_1(a^{3}y)=L_2(a^9{y}^{3}t)$$

$$\text{Tr}(a^3(x^2+x))+a^9(x^8+x)\ne 0.$$

$$\text{Tr}(a^3(x^2+x))+a^9(x^8+x)=0.$$

$$\sum _{\lambda \in {\mathbb{F}}_{2^n}}{\mathcal{F}}^2(D_a{f}_{\lambda })\ge 2^{2n+1}.$$

$$\sum _{\lambda \in {\mathbb{F}}_{2^n}}{\mathcal{F}}^2(D_a{f}_{\lambda })=2^{2n+1}.$$

$${\Delta }_a=\{\lambda \in {\mathbb{F}}_{2^n}:D_a{f}_{\lambda }^{\prime }\text{mbox}isconstant\},$$

$$\sum _{\lambda \in {\mathbb{F}}_{2^n}}{\mathcal{F}}^2(D_a{f}_{\lambda }^{\prime })=2^{2n}\cdot |{\Delta }_a|.$$

$${\Delta }_a^{\ast }={\Delta }_a\setminus \{0\}.$$

$$V_{\lambda }=\{a\in {\mathbb{F}}_{2^n}:D_a{f}_{\lambda }^{\prime }\text{mbox}isconstant\};$$

Full text

I Introduction

For given positive integers $n$ and $m$, a function $F$ from the finite field with $2^{n}$ elements to the finite field with $2^{m}$ elements is called a vectorial Boolean function or an ($n,m$)-function, and in the case when $m$=1 it is simply called a Boolean function. Boolean functions are among the most fundamental objects investigated in pure and applied mathematics and computer science. Boolean function theory is an important tool for solving problems of analysis and synthesis of discrete devices which transform and process information. The primary motivation for studying Boolean functions comes from cryptography. In modern society, exchange and storage of information in an efficient, reliable and secure manner is of fundamental importance. Cryptographic primitives are used to protect information against eavesdropping, unauthorized changes and other misuse. In the case of symmetric cryptography ciphers are designed by appropriate composition of nonlinear Boolean functions. For example, the security of block ciphers depends on S-boxes which are ($n,m$)-functions. For most of cryptographic attacks on block ciphers there are certain properties of functions which measure the resistance of the S-box to these attacks. The differential attack introduced by Biham and Shamir is one of the most efficient cryptanalysis tools for block ciphers. It is based on the study of how differences in an input can affect the resulting difference at the output. When $n=m$ the functions that contribute an optimal resistance against differential attack are called Almost Perfect Nonlinear (APN). Such APN function $F(x)$ are characterized by having at most two solution for every equation $F(x+a)-F(x)=b$, where $a$ and $b$ are general elements of the field and $a$ is not null.

The role of APN functions is not just related to cryptography. In coding theory APN functions define binary error correcting codes optimal in a certain sense. In projective geometry quadratic APN functions define dual hyperovals. Recent advances in APN functions have made a prominent impact on the theory of commutative semifields.

For these reasons many works were focused on the studying and the construction of such optimal functions.

Let assume $n$ be a positive integer and $\mathbb{F}_{2^{n}}$ the finite field with $2^{n}$ elements. If $n$ is an even number, then we have that $3|(2^{n}-1)$ and we denote with $k$ the integer value $\frac{2^{n}-1}{3}$.

A function $F$ from $\mathbb{F}_{2^{n}}$ to $\mathbb{F}_{2^{n}}$ admits a unique representation, called Univariate Polynomial Representation, over $\mathbb{F}_{2^{n}}$ of degree at most $2^{n}-1$:

[TABLE]

For every integer $j$ consider its binary expansion $\sum_{s=0}^{n-1}j_{s}2^{s}$ and denote with $w_{2}(j)$ the number of nonzero coefficients (i.e. $\sum_{s=0}^{n-1}j_{s}$). The algebraic degree of the function $F$ is the $\max_{j=0,\ldots,2^{n}-1/\delta_{j}\neq 0}w_{2}(j)$. Functions of algebraic degree 1 are called affine and of degree 2 quadratic. Linear functions are affine functions without the constant term and they can be represented as $L(x)=\sum_{j=0}^{n-1}\gamma_{j}x^{2^{j}}$. A known example of a linear function defined over any dimension $n$ is the Trace function $\textit{Tr}(x)=\textit{Tr}_{n}(x)=\sum_{i=0}^{n-1}x^{2^{i}},$ In particular the trace is a Boolean function, i.e. $\textit{Tr}:\mathbb{F}_{2^{n}}\rightarrow\mathbb{F}_{2}$. For $m$ positive divisor of $n$ we use the notation $\textit{Tr}^{m}(x)=\sum_{i=0}^{n/m-1}x^{2^{im}}$.

Given a function $F$ we define its $\lambda$-component as the Boolean function $f_{\lambda}:\mathbb{F}_{2^{n}}\rightarrow\mathbb{F}_{2}$ with $f_{\lambda}(x)=\textit{Tr}(\lambda\cdot F(x))$, for $\lambda\in\mathbb{F}_{2^{n}}$. For a Boolean function $f$ we define the Walsh transformation as

[TABLE]

with $u\in\mathbb{F}_{2^{n}}$. With Walsh Spectrum we refer to the set of all possible values of the Walsh transformation. With the symbol $\mathcal{F}(f)$ we indicate the Walsh transformation valued in 0,

[TABLE]

where wt$(f)$ is the Hamming weight of $f$ (i.e. the cardinality of the set $\{x\in\mathbb{F}_{2^{n}}:f(x)=1\}$). Therefore we have that a Boolean function $f$ is balanced (wt$(f)=2^{n-1}$) if and only if $\mathcal{F}(f)=0$. A Boolean function $f$ is called bent if its Walsh spectrum corresponds to the set $\{\pm 2^{n/2}\}$. Therefore such function can exist only for even values of $n$. Moreover, we have that $f$ is bent if and only if, for every $a\in\mathbb{F}_{2^{n}}^{*}$, the function $D_{a}f(x)=f(x+a)+f(x)$ is balanced.

For every nonzero element $a\in\mathbb{F}_{2^{n}}^{*}$ the derivative of $F$ in the direction of $a$ is the function $D_{a}F(x)=F(x+a)+F(x)$. The function $F$ is called almost perfect nonlinear (APN) if for every $a\neq 0$ and every $b$ in $\mathbb{F}_{2^{n}}$, the equation $D_{a}F(x)=b$ admits at most 2 solutions. Used as S-Boxes in block ciphers, APN functions are useful since they oppose an optimal resistance against differential cryptanalysis.

The APN property is invariant under the action of some transformations of functions.

• •

Given $A_{1},A_{2}$ affine permutations and $A$ an affine function, if $F$ is APN then also $G=A_{1}\circ F\circ A_{2}+A$ is APN; in this case the functions are called extended affine equivalent (EA-equivalent).

• •

Two functions $F$ and $G$ are CCZ-equivalent if there exists an affine permutation $\mathcal{L}$ of $\mathbb{F}_{2^{n}}^{2}$ such that $\mathcal{L}(\Gamma_{F})=\Gamma_{G}$, where $\Gamma_{F}$ is the graph of the function $F$, $\{(x,F(x)):x\in\mathbb{F}_{2^{n}}\}$. Also CCZ-equivalence preserve the APN property. Moreover, we have that EA-equivalence is a particular case of CCZ-equivalence.

Many different works have been focused on finding and constructing new families of APN functions. Table I gives us all known values for exponents $d$ such that the function $x^{d}$, defined over $\mathbb{F}_{2^{n}}$, is APN.

Since EA-equivalence preserves the algebraic degree of a function and, in general, the functions listed in Table I have different algebraic degrees, it is easy to verify that these APN functions are EA-inequivalent. Instead the algebraic degree is not an invariant for CCZ-equivalence. But also for this case it was possible to prove some inequalities. In [10] it is shown that two different Gold functions $x^{2^{i}+1}$ and $x^{2^{j}+1}$, where $1\leq i<j\leq n/2$, are CCZ-inequivalent and that in general the Gold functions are CCZ-inequivalent to the Welch and to any Kasami functions. Moreover, the inverse and Dobbertin functions are not CCZ-equivalent to each other and to all other known APN power functions, [10]. For all the other cases the problem is still open.

Before the work in [11] the only known APN functions were EA-equivalent to power functions and it was supposed that all APN functions are EA-equivalent to power functions. In [11] it is showed the existence of classes of APN mappings EA-inequivalent to power functions. Such functions were constructed by applying CCZ-equivalence to the Gold APN mappings. In [12] we can find the first examples of APN function CCZ-inequivalent to power functions. The first infinite families of such APN polynomial can be found in [11]. In Table II these functions are listed. They are all quadratic functions.

In this work we focus on functions of the form

[TABLE]

where $L_{1}$ and $L_{2}$ are linear functions. From now on, we will refer to $L_{1}$ and $L_{2}$ as to the linear functions

[TABLE]

with $b_{i},c_{i}\in\mathbb{F}_{2^{n}}$. In particular we want to study conditions on $L_{1}$ and $L_{2}$ such that $F^{\prime}$ is APN.

Some results are already been given in different papers. In [15] the function $x^{3}+\textit{Tr}(x^{9})$ is proved to be APN for any dimension $n$. Moreover, for $n\geq 7$ it is proved to be CCZ-inequivalent to the Gold functions, to the inverse and Dobbertin functions and EA-inequivalent to power functions. For a quadratic APN function $F:\mathbb{F}_{2^{n}}\rightarrow\mathbb{F}_{2^{n}}$ and a quadratic boolean function $f:\mathbb{F}_{2^{n}}\rightarrow\mathbb{F}_{2}$, under some conditions it is proved that the function $F(x)+f(x)$ is APN. In particular these conditions are that for every nonzero $a\in\mathbb{F}_{2^{n}}$ there must exist a linear Boolean function $l_{a}$ satisfying:

$\varphi_{f}(x,a)=l_{a}(\varphi_{F}(x,a))$, 2. 2.

if $\varphi_{F}(x,a)=1$ for some $x\in\mathbb{F}_{2^{n}}$ then $l_{a}(1)=0$,

where $\varphi_{\chi}(x,a)=\chi(x)+\chi(x+a)+\chi(a)+\chi(0)$.

A similar theorem is proved when $f:\mathbb{F}_{2^{n}}\rightarrow\mathbb{F}_{2^{m}}$, where $m$ is a divisor of $n$. Due to this result the following functions, defined over $\mathbb{F}_{2^{2m}}$ where $m$ is an even positive integer, are APN:

• •

$x^{3}+\textit{Tr}_{n/m}(x^{2^{m}+2})=x^{3}+x^{2^{m}+2}+x^{2^{m+1}+1}$,

• •

$x^{3}+(\textit{Tr}_{n/m}(x^{2^{m}+2}))^{3}$.

When $F$ is a Gold function, all possible APN mappings $F(x)+f(x)$, where $f$ is a Boolean function, are computed until dimension 15. The only possibilities, different from $x^{3}+\textit{Tr}(x^{9})$, are for $n=5$ the function $x^{5}+\textit{Tr}(x^{3})$ (CCZ-equivalent to Gold functions) and for $n=8$ the function $x^{9}+\textit{Tr}(x^{3})$ (CCZ-inequivalent to power functions and to $x^{3}+\textit{Tr}(x^{9})$).

In [1] the function $x^{3}+\textit{Tr}(x^{9})$ has been generalized to form (1). It has been proved that for $n$ even a sufficient condition is $L_{1}(x)+L_{2}(x^{3})$ being a permutation over $\mathbb{F}_{2^{n}}$. In the odd dimension a weaker conditions lead to an APN mapping.

Moreover from the fact that by applying a linear function $l(x)=ax+b$, with $a\in\mathbb{F}_{2^{n}}^{*}$ and $b\in\mathbb{F}_{2^{n}}$, to a permutation we obtain another one, a simply but useful statement has been proved. In particular it is stated that for $n$ even, $L$ a linear function over $\mathbb{F}_{2^{n}}$, $a\in\mathbb{F}_{2^{n}}^{*}$ and $b\in\mathbb{F}_{2^{n}}$ if $x+L(x^{3})$ is a permutation over $\mathbb{F}_{2^{n}}$, then the function

[TABLE]

is APN over $\mathbb{F}_{2^{n}}$.

The statement just mentioned gives new examples of APN functions in even dimensions. The following infinite families of function are proved to be APN also in odd dimensions:

$x^{3}+a^{-1}\textit{Tr}(a^{3}x^{9})$, with $a\in\mathbb{F}_{2^{n}}^{*}$ and any positive $n$; 2. 2.

$x^{3}+a^{-1}\textit{Tr}^{3}(a^{6}x^{18}+a^{12}x^{36})$, with $a\in\mathbb{F}_{2^{n}}^{*}$ and $n$ divisible by 3; 3. 3.

$x^{3}+a^{-1}\textit{Tr}^{3}(a^{3}x^{9}+a^{6}x^{18})$, with $a\in\mathbb{F}_{2^{n}}^{*}$ and $n$ divisible by 3.

In [1] some conditions for constructing permutations, and consequentially for constructing APN functions, are given.

• •

For a general positive $n$ and a linear function $L$ over $\mathbb{F}_{2^{n}}$ if for every $u\in\mathbb{F}_{2^{n}}$ such that $L(u)\neq 0$, the condition

[TABLE]

is satisfied, then the function $x+L(x^{3})$ is a permutation.

• •

For $n$ even integer and $L$ linear function over $\mathbb{F}_{2^{n}}$ the function $x+L(x^{3})$ is a permutation of $\mathbb{F}_{2^{n}}$ if and only if for every $b\in\mathbb{F}_{2^{n}}^{*}$ such that $L^{*}(b)\neq 0$ there exists an element $\gamma\in\mathbb{F}_{2^{n}}$ such that $L^{*}(b)=\gamma^{3}$ and $\textit{Tr}_{n}^{2}(\gamma^{-1}b)\neq 0$, where $L^{*}$ denotes the adjoint linear mapping of $L$.

• •

For $n$ odd integer and $L$ linear function over $\mathbb{F}_{2^{n}}$ the function $x+L(x^{3})$ is a permutation of $\mathbb{F}_{2^{n}}$ if and only if for every $b\in\mathbb{F}_{2^{n}}$ either $L^{*}(b)=0$ or $\textit{Tr}_{n}(\gamma^{-1}b)=0$, where $L^{*}(b)=\gamma^{3}$ and $L^{*}$ denotes the adjoint linear mapping of $L$.

The above mentioned function $x^{9}+\textit{Tr}(x^{3})$, for $n=8$, is a clear example of the fact that there are other possible conditions for function of the form (1) to be APN. Therefore with this work we try to find new conditions and new relations for the APN property.

II APN Conditions

II-A Necessary and sufficient conditions

Let $F(x)=L_{1}(x)+L_{2}(x^{3})$, with $L_{1}$ and $L_{2}$ as in (2), be a function defined over $\mathbb{F}_{2^{n}}$ for a positive integer $n$ and $F^{\prime}(x)=F(x^{3})=L_{1}(x^{3})+L_{2}(x^{9})$.

Just analysing the APN property for a quadratic function we can state the following lemma.

Lemma 1**.**

For any positive integer $n$ and any linear functions $L_{1}$ and $L_{2}$ of $\mathbb{F}_{2^{n}}$, a function $F^{\prime}$ defined by (1) is APN if and only if for every $a\in\mathbb{F}_{2^{n}}^{*}$ one of the following conditions is satisfied:

if $x\neq 0,1$

[TABLE] 2. 2.

if $y\neq 0\mbox{ and }\textit{Tr}(y)=0$

[TABLE]

Proof.

Since $F^{\prime}$ is a quadratic function satisfying $F^{\prime}(0)=0$, APN condition can be reformulated as the following:

for any $a\in\mathbb{F}_{2^{n}}^{*}$

[TABLE]

The equation above is equivalent to $L_{1}(a^{3}(x^{2}+x))+L_{2}(a^{9}(x^{8}+x))=0$, therefore we have that

[TABLE]

Lets denote now $y=x^{2}+x$. Since $x\neq 0,1$ we have that $y\neq 0$ and Tr$(y)=0$. The second condition follows easily. ∎

Proposition 1**.**

Let $F^{\prime}$ be APN and, referring to (2), construct the linear function $L_{3}(x)=\sum_{i+0}^{n-1}d_{i}x^{2^{i}}$ with coefficients

[TABLE]

[TABLE]

[TABLE]

[TABLE]

Then $L_{3}$ is a 2-to-1 map satisfying $L_{3}(x)=0$ if and only if $x=0,1$.

Proof.

Using equation (4) with $a=1$, consider the following map: $L_{1}(x^{2}+x)+L_{2}(x^{8}+x)$. Analysing the two linear functions we have: $L_{1}(x^{2}+x)=(b_{0}+b_{n-1})x+\sum_{i=1}^{n-1}(b_{i}+b_{i-1})x^{2^{i}}$, $L_{2}(x^{8}+x)=(c_{0}+c_{n-3})x+(c_{1}+c_{n-2})x^{2}+(c_{2}+c_{n-1})x^{2^{2}}+\sum_{i=3}^{n-1}(c_{i}+c_{i-3})x^{2^{i}}$.

Therefore $L_{1}(x^{2}+x)+L_{2}(x^{8}+x)$ corresponds to the linear function $L_{3}(x)$ described above. From Lemma 1 we have that $L_{3}(x)=0$ if and only if $x=0,1$. ∎

The following lemma gives a quite fast way to verify if a function $F^{\prime}$ can be APN, since you have to evaluate it over a third of the elements of the space.

Lemma 2**.**

For $n$ even assume $F^{\prime}$ is APN. Let $\alpha\in\mathbb{F}_{2^{n}}^{*}$ be a primitive element and $k=\frac{2^{n}-1}{3}$. Then $F^{\prime}(a)\neq 0$ for any $a\neq 0$ or equivalently $F(\alpha^{3j})=F^{\prime}(\alpha^{j})\neq 0$ for $0\leq j\leq k-1$.

Proof.

For $n$ even we have Tr$(1)=0$. Therefore using equation (5) with $y=1$ we get for any $a\neq 0$

[TABLE]

For $a\neq 0$ we have that $a=\alpha^{j}$ with $0\leq j\leq 2^{n}-2$. Since we consider just cubic power of $a$, we can restrict the possibilities to $0\leq j\leq k-1$. This concludes the proof. ∎

Remark 1*.*

If we consider $j=0$ in Lemma 2 then

[TABLE]

Moreover, if we just consider linear functions defined over $\mathbb{F}_{2}$ (i.e. $b_{i},c_{i}\in\mathbb{F}_{2}$) then a fast way to check if $F^{\prime}$ is not APN is by verifying that $L_{1}$ and $L_{2}$ have the same parity number of monomials.

Lemma 3**.**

Let $n$ be an even number multiple of 3 and $F^{\prime}$ be APN. Then for any $a\neq 0$ $L_{1}(a^{3}\beta)\neq 0$, with $\beta\in\mathbb{F}_{2^{3}}^{*}$ such that $\textit{Tr}_{3}(\beta)=0$.

Proof.

Consider such an element $\beta$ and call $m$ the integer $\frac{n}{3}$. We have that $\textit{Tr}_{n}(\beta)$ is equal to $\sum_{j=1}^{m}\sum_{i=0}^{2}\beta^{2^{i}}=\sum_{j=1}^{m}\textit{Tr}_{3}(\beta)=0$. Therefore we can apply (5) with $y=\beta$ and obtain

[TABLE]

∎

Lemma 4**.**

Consider a function $F^{\prime}$ from $\mathbb{F}_{2^{n}}$ to itself defined as in (1). $F^{\prime}$ is APN if and only if it satisfies the following condition:

for every $a,y\neq 0$ with Tr($y$)=0 if an element $t\in\mathbb{F}_{2^{n}}$ satisfies $\textit{Tr}(t$)=0 and

[TABLE]

then $L_{2}(a^{9}(y^{4}+ty^{3}+y^{2}+y))\neq 0$.

Proof.

By Lemma 1 we have that APN property for $F^{\prime}$ is equivalent to

[TABLE]

Assume that there exists an element $t$ that satisfies the conditions in the statement. Let us re-write the formula above as

\begin{array}[]{cl}0\neq&L_{1}(a^{3}y)+L_{2}(a^{9}(y^{4}+y^{2}+y))=\\ &L_{1}(a^{3}y)+L_{2}(a^{9}y^{3}t)+L_{2}(a^{9}(y^{4}+ty^{3}+y^{2}+y))=\\ &L_{2}(a^{9}(y^{4}+ty^{3}+y^{2}+y)).\end{array}

Therefore the APN condition is equivalent to

[TABLE]

On the other hand assume that for any $t$ of null trace we have $L_{1}(a^{3}y)\neq L_{2}(a^{9}y^{3}t)$. Therefore

$L_{1}(a^{3}y)\not\in\Omega=\{L_{2}(a^{9}y^{3}t):\textit{Tr}(t)=0\}$.

Let us consider the second term of the formula,

$L_{2}(a^{9}(y^{4}+y^{2}+y))=L_{2}(a^{9}y^{3}(y+1/y+1/y^{2}))$.

Since $\textit{Tr}(y+1/y+1/y^{2})$=0, the term belongs to the set $\Omega$. Therefore the relation is again respected. ∎

Corollary 1**.**

For general $a\neq 0$ and $y\neq 0$ with Tr($y$)=0, if the equation

[TABLE]

is satisfied only for $t$ with Tr($t$)=1, then the function $F^{\prime}(x)=F(x^{3})=L_{1}(x^{3})+L_{2}(x^{9})$ is APN.

Proof.

In this case the hypothesis of the previous lemma is always satisfied, since there is no element $t$ such that $L_{1}(a^{3}y)=L_{2}(a^{9}y^{3}t)$ and $\textit{Tr}(t)=0$. Therefore the function $F^{\prime}$ is APN. ∎

II-B On APN functions of the form $x^{9}+L(x^{3})$

From [15] we know that in $\mathbb{F}_{2^{8}}$ the function $F^{\prime}(x)=x^{9}+\textit{Tr}(x^{3})$ is APN.

Lemma 5**.**

If $3|n$ then the function $x^{9}+\textit{Tr}(x^{3})$ is not APN over $\mathbb{F}_{2^{n}}$.

Proof.

From Lemma 1 we have that $x^{9}+\textit{Tr}(x^{3})$ is APN if and only if for any $a\neq 0$ and any $x\neq 0,1$

[TABLE]

If we now consider $n$ multiple of 3, $x\in\mathbb{F}_{2^{3}}\setminus\mathbb{F}_{2}$ and $a=1$ we obtain

[TABLE]

∎

Using Lemma 4 it was possible to implement, using the software MAGMA, a fast algorithm that checks if $x^{9}+\textit{Tr}(x^{3})$ is APN over $\mathbb{F}_{2^{n}}$. Running the code for $n$ up to 200 the only APN functions are for dimensions 4, 5 and 8.

Let us consider now a more general form for $F^{\prime}$, $G(x)=x^{9}+L(x^{3})$ with $L$ linear function in $\mathbb{F}_{2^{n}}[x]$.

With some computational work, done with MAGMA, we tried to find more APN functions of this form in other dimensions. In Table III we summarize the results we obtained. With $\alpha$ we indicate a primitive element of $\mathbb{F}_{2^{n}}^{*}$. We searched for APN functions in $\mathbb{F}_{2^{n}}$, up to $n=10$, of the form $x^{9}+L(x^{3})$. We studied their CCZ-equivalence relation and obtained the representatives for each dimension. Obviously for every $n$ not multiple of 3, the Gold function $x^{9}$ (corresponding to the case $L(x)=0$) is APN.

For greater dimensions we just checked the possible APN function of the form $x^{9}+L(x^{3})$ with $L\in\mathbb{F}_{2}[x]$, up to CCZ-equivalence.

• •

for $n=11$ there are no APN except $F(x)=x^{9}$;

• •

for $n=12$ there are no APN;

• •

for $n=13$ there are no APN except $F(x)=x^{9}$.

• •

for $n=14$ there are no APN except $F(x)=x^{9}$;

• •

for $n=15$ there are no APN;

• •

for $n=16$ there are no APN except $F(x)=x^{9}$.

For $n=4$ the function $x^{9}+\textit{Tr}(x^{3})$ is CCZ-equivalent to the Gold function $x^{9}$.

For $n=6$ the found APN functions are not CCZ-equivalent to functions $x^{9}+L(x^{3})$ defined over $\mathbb{F}_{2}$. Moreover we get:

• •

for $L(x)=\alpha^{44}x+\alpha x^{2}$ the function $x^{9}+L(x^{3})$ is CCZ-equivalent to $x^{3}+\alpha^{-1}\textit{Tr}_{n}(\alpha^{3}x^{9})$;

• •

for $L(x)=\alpha^{23}x+x^{2^{2}}$ the function $x^{9}+L(x^{3})$ is CCZ-equivalent to $x^{3}=x^{3}+\textit{Tr}_{n}(x^{9})$.

Both of these functions belong to the class of APN functions studied in [1]

For $n=8$ we compared the found APN mappings with the list of known APN function in dimension 8 in [18]. We get the following:

• •

for $L(x)=x^{2}+x^{2^{4}}$ the function $x^{9}+L(x^{3})$ is CCZ-equivalent to $x^{3}+\textit{Tr}(x^{9})$;

• •

for $L(x)=x^{2^{3}}+x^{2^{7}}$ the function $x^{9}+L(x^{3})$ is CCZ-equivalent to $x^{3}$;

• •

for $L(x)=x^{2^{2}}+\alpha^{85}x^{2^{3}}+x^{2^{4}}$ the function $x^{9}+L(x^{3})$ is not CCZ-equivalent to any function of the form $x^{3}+a^{-1}\textit{Tr}(a^{3}x^{9})$ but it is CCZ-equivalent to function $\alpha^{135}x^{144}+\alpha^{120}x^{66}+\alpha^{65}x^{18}+x^{3}$, no. 6 in the list of APN mapping of $\mathbb{F}_{2^{8}}$ in [18];

• •

for $L(x)=\alpha^{60}x+\alpha^{200}x^{2}+\alpha^{242}x^{4}+\alpha^{190}x^{8}+\alpha x^{16}$ the function $x^{9}+L(x^{3})$ is not CCZ-equivalent to any function of the form $x^{3}+a^{-1}\textit{Tr}(a^{3}x^{9})$ but it is CCZ-equivalent to function $\alpha^{242}x^{192}+\alpha^{100}x^{144}+\alpha^{66}x^{132}+\alpha^{230}x^{129}+\alpha^{202}x^{96}+\alpha^{156}x^{72}+\alpha^{254}x^{66}+\alpha^{18}x^{48}+\alpha^{44}x^{36}+\alpha^{95}x^{33}+\alpha^{100}x^{24}+\alpha^{245}x^{18}+\alpha^{174}x^{12}+\alpha^{175}x^{9}+\alpha^{247}x^{6}+\alpha^{166}x^{3}$, no. 9 in the list of APN mapping of $\mathbb{F}_{2^{8}}$ in [18]

II-C On the number of bent components

From [19] we get the following theorem.

Theorem 1**.**

Let $F$ be a function from $\mathbb{F}_{2^{n}}$ to $\mathbb{F}_{2^{n}}$. Then for any non-zero $a\in\mathbb{F}_{2^{n}}$

[TABLE]

Moreover, $F$ is APN if and only if for every non-zero $a\in\mathbb{F}_{2^{n}}$

[TABLE]

Lemma 6**.**

$F^{\prime}(x)=L_{1}(x^{3})+L_{2}(x^{9})$* is an APN function if and only if for any $a\in\mathbb{F}_{2^{n}}^{*}$ there exists one and only one $\lambda\in\mathbb{F}_{2^{n}}^{*}$ such that $\textit{Tr}(\lambda L_{1}(ax^{2}+a^{2}x)+\lambda L_{2}(ax^{8}+a^{8}x))$ is constantly 0.*

Proof.

Since $F^{\prime}$ is a quadratic function, every component has at most algebraic degree 2 and, consequently, the Boolean function $D_{a}f^{\prime}_{\lambda}$ can be either affine or constant. If $D_{a}f^{\prime}_{\lambda}$ is affine then $\mathcal{F}(D_{a}f^{\prime}_{\lambda})=0$. In the other case we have $\mathcal{F}(D_{a}f^{\prime}_{\lambda})=\pm 2^{n}$ and $\mathcal{F}^{2}(D_{a}f_{\lambda})=2^{2n}$. Let consider the set

[TABLE]

then

[TABLE]

From the previous theorem we have that $F^{\prime}$ is APN if and only if the sum is equal to $2^{2n+1}$, hence if and only if $|\Delta_{a}|=2$. Since $f^{\prime}_{0}$, and consequently $D_{a}f^{\prime}_{0}$, is the constantly null function, we have that 0 belongs to the set $\Delta_{a}$ for every $a\neq 0$. Therefore, $F^{\prime}$ is APN if and only if $|\Delta^{*}_{a}|=1$, with

[TABLE]

This is true for every generic quadratic APN function $F^{\prime}(x)$.

In our specific case we have

\begin{array}[]{ll}D_{a}f^{\prime}_{\lambda}(x)&=\textit{Tr}(\lambda[F^{\prime}(x)+F^{\prime}(x+a)])=\\ &\textit{Tr}(\lambda[L_{1}(ax^{2}+a^{2}x+a^{3})+\\ &\qquad+L_{2}(ax^{8}+a^{8}x+a^{9})])=\\ &\textit{Tr}(\lambda[L_{1}(ax^{2}+a^{2}x)+L_{2}(ax^{8}+a^{8}x)])+\\ &\qquad+\textit{Tr}(\lambda[L_{1}(a^{3})+L_{2}(a^{9})]).\end{array}

In order to study its constant conditions it is sufficient to study the function $g(x)=\textit{Tr}(\lambda[L_{1}(ax^{2}+a^{2}x)+L_{2}(ax^{8}+a^{8}x)])$. Since $g(0)=0$, we have that if $g$ is constant then it is the constant zero function and this concludes the proof. ∎

Remark 2*.*

Equivalently, we can study the conditions for $\textit{Tr}(\lambda L_{1}(a^{3}[x^{2}+x])+\lambda L_{2}(a^{9}[x^{8}+x]))$ to be the constant null function. Due to the property of the Trace function we can study the conditions for $\lambda L_{1}(a^{3}[x^{2}+x])+\lambda L_{2}(a^{9}[x^{8}+x])$ to be equal to $\eta+\eta^{2}$, with $\eta=\eta(a,\lambda,x)$.

Recalling the notation used in the proof we defined:

$\Delta_{a}$ as in (6) and $\Delta_{a}^{*}$ as in (7);

[TABLE]

[TABLE]

From Proposition 1 in [20] we get that the dimension of the kernel of $f_{\lambda}$ and $n$ have the same parity, where the kernel of a quadratic form $f$ is the subspace of $\mathbb{F}_{2^{n}}$

$\{u\in\mathbb{F}_{2^{n}}:f(u+v)+f(u)+f(v)=0\ \mbox{for any }v\in\mathbb{F}_{2^{n}}\}$. From Lemma 1 in [20] we get that, since $f_{\lambda}$ is a quadratic Boolean function, its kernel corresponds to the subspace $V_{\lambda}$. Therefore we have dim${}_{\mathbb{F}_{2}}(V_{\lambda})\equiv$ $n$ mod 2.

Moreover let’s consider the set

[TABLE]

If $\Gamma_{i}$ not empty then $i$ has the same parity as $n$. It can be easily proved by considering a not null element $\lambda$ in the set, i.e. such that dim$V_{\lambda}=i$. Since the dimension of $V_{\lambda}$ has the same parity as $n$, the same can be state on $i$.

The set $\Gamma_{0}$ correspond to the set of all bent components.

Corollary 2**.**

From Lemma 6 it is straightforward to prove that APN property for a quadratic function is equivalent to the following statement: $\mbox{for\ any}\ \lambda_{1}\neq\lambda_{2}\in\mathbb{F}^{*}_{2^{n}},$

[TABLE]

II-C1 Computational Results

Using the software MAGMA we tried to verify for functions $F^{\prime}$ of form (1) defined over small dimensions the relation between the APN property and the number of bent components. From the results obtained taking random linear functions $L_{1},L_{2}$ and constructing $F^{\prime}$ for $n\in\{4,6,8\}$ the relation seems the following one:

Conjecture 1**.**

For an even $n$, a function $F^{\prime}$ of the form (1) is APN if and only if it has exactly $\frac{2}{3}(2^{n}-1)$ bent components.

We know that this is not true for general quadratic functions. Indeed consider the quadratic APN function presented by Dillon in 2006 [21]

[TABLE]

defined over $\mathbb{F}_{2^{6}}$ where $u$ is a primitive element, root of the polynomial $x^{6}+x^{4}+x^{3}+x+1$. This function has 46 bent components and $46>\frac{2}{3}(2^{6}-1)=42$.

III Conclusion

In this work we continued the study of quadratic functions of the form $L_{1}(x^{3})+L_{2}(x^{9})$ and related APN conditions. New necessary and sufficient conditions are presented in this paper. Such conditions allow us to compute a faster algorithm that checks the existence of other APN functions of such form. New results are given considering functions of the form $x^{9}+L(x^{3})$. Up to CCZ-equivalence new APN functions are found in different low dimensions.