On two-to-one mappings over finite fields

TL;DR

This paper systematically studies two-to-one mappings over finite fields, characterizing them via Walsh transforms, presenting various constructions, and exploring their applications in cryptography and related areas.

Contribution

It provides a comprehensive characterization, new constructions, and applications of two-to-one mappings over finite fields, advancing understanding in cryptographic function design.

Findings

Characterization of 2-to-1 mappings via Walsh transforms

New constructions including AGW-like criterion and polynomial forms

Applications to bent functions, semi-bent functions, and permutation polynomials

Abstract

Two-to-one ($2$-to-$1$) mappings over finite fields play an important role in symmetric cryptography. In particular they allow to design APN functions, bent functions and semi-bent functions. In this paper we provide a systematic study of two-to-one mappings that are defined over finite fields. We characterize such mappings by means of the Walsh transforms. We also present several constructions, including an AGW-like criterion, constructions with the form of $x^rh(x^{(q-1)/d})$, those from permutation polynomials, from linear translators and from APN functions. Then we present $2$-to-$1$ polynomial mappings in classical classes of polynomials: linearized polynomials and monomials, low degree polynomials, Dickson polynomials and Muller-Cohen-Matthews polynomials, etc. Lastly, we show applications of $2$-to-$1$ mappings over finite fields for constructions of bent Boolean and vectorial bent functions, semi-bent functions, planar functions and permutation polynomials. In all those respects, we shall review what is known and provide several new results.

Equations

$${\mathrm{Tr}}_{p^n/p}(x)=\sum _{i=0}^{n-1}{x}^{p^i}=x+x^p+x^{p^2}+\cdots +x^{p^{n-1}},$$

$${\mathrm{Tr}}_{q^n/q}(x)=\sum _{i=0}^{n-1}{x}^{q^i}=x+x^q+x^{q^2}+\cdots +x^{q^{n-1}}.$$

$$N_n=\frac{(2^n!{)}^2}{2^{2^{n-1}}(2^{n-1}!{)}^2}\approx \frac{2^{n\cdot 2^n+2^{n-1}+1}}{e^{2^n}}.$$

$$N_n=\left(\genfrac{}{}{0ex}{}{2^n}{2^{n-1}}\right)\cdot \left(\genfrac{}{}{0ex}{}{2^n}{2}\right)\cdot \left(\genfrac{}{}{0ex}{}{2^n-2}{2}\right)\cdots \left(\genfrac{}{}{0ex}{}{2}{2}\right)=\frac{(2^n!{)}^2}{2^{2^{n-1}}(2^{n-1}!{)}^2}.$$

$$\frac{N_n}{B_n}=\frac{2^n!}{2^{2^{n-1}}(2^{n-1}!{)}^2}\approx \frac{2^{2^{n-1}}}{\sqrt{\pi 2^{n-1}}}.$$

$$W_F(u,v):=\sum _{x\in {\mathbb{F}}_{2^n}}(-1{)}^{{\mathrm{Tr}}_{2^n/2}(vF(x))+{\mathrm{Tr}}_{2^n/2}(ux)}.$$

$$\sum _{j\ge 0}{A}_j(\#\{x\in {\mathbb{F}}_{2^n}:F(x)+b=0\}{)}^j\ge 0,$$

$$\sum _{j\ge 0}{A}_j\sum _{b\in {\mathbb{F}}_2^n}(\#\{x\in {\mathbb{F}}_{2^n}:F(x)+b=0\}{)}^j\ge 0,$$

$$\#\{x\in {\mathbb{F}}_{2^n}:F(x)+b=0\}=2^{-n}\sum _{x\in {\mathbb{F}}_{2^n},v\in {\mathbb{F}}_{2^n}}(-1{)}^{{\mathrm{Tr}}_{2^n/2}(v(F(x)+b))},$$

$$\sum _{b\in {\mathbb{F}}_{2^n}}{\left(\#\{x\in {\mathbb{F}}_{2^n}:F(x)+b=0\}\right)}^j$$

$$A_{0}+\sum_{j\geq 1}A_{j}2^{-(j-1)n}\sum_{\begin{array}[]{c}v_{1},\cdots,v_{j}\in{\mathbb{F}}_{2^{n}}\\ \sum_{i=1}^{j}v_{i}=0\end{array}}\prod_{i=1}^{j}W_{F}(0,v_{i})\geq 0,$$

$$2^{-2n}\sum _{v_1,v_2\in {\mathbb{F}}_{2^n}}{W}_F(0,v_1)W_F(0,v_2)W_F(0,v_1+v_2)-2^{2-n}\sum _{v\in {\mathbb{F}}_{2^n}}{W}_F(0,v{)}^2+2^{n+2}\ge 0,$$

$$A\text{ignorespaces}\text{ignorespaces}\text{ignorespaces}\text{ignorespaces}\text{ignorespaces}\text{ignorespaces}\text{ignorespaces}\text{ignorespaces}$$

$$\bar{s}=\bar{\lambda }(b)=\bar{\lambda }\circ f(a)=g\circ \lambda (a).$$

$$f(x)=h(\psi (x))\varphi (x)+g(\psi (x))$$

$$\bar{f}(x)=h(x)\varphi (x)+\bar{\psi }(g(x)).$$

$$\bar{\psi }\circ f(x)$$

$${\mathbb{F}}_{q^n}\text{ignorespaces}\text{ignorespaces}\text{ignorespaces}\text{ignorespaces}\text{ignorespaces}\text{ignorespaces}\text{ignorespaces}\text{ignorespaces}$$

$$f(x)=L_1(x)+L_2(x)g(L_3(x))$$

$$\bar{f}(x)=L_1(x)+L_2(x)g(x).$$

$${\mathbb{F}}_{q^n}\text{ignorespaces}\text{ignorespaces}\text{ignorespaces}\text{ignorespaces}\text{ignorespaces}\text{ignorespaces}\text{ignorespaces}\text{ignorespaces}$$

$$f(x)=h(\psi (x))\varphi (x)+g(\psi (x))$$

$$f(x)=aP(x)+(P(x)+b)H(L(x))$$

$$\bar{f}(x)=aP(x)+(P(x)+L(b))H(x).$$

$$L(b)\cdot H(x)=L(b\cdot H(x))=\psi (g(x)),$$

$$\bar{f}(x)=(a+H(x))P(x)+L(b)H(x)=h(x)\varphi (x)+\psi (g(x)),$$

$$f(x)=h({\mathrm{Tr}}_{q^n/q}(x))\varphi (x)+g({\mathrm{Tr}}_{q^n/q}(x))$$

$$\bar{f}(x)=h(x)\varphi (x)+{\mathrm{Tr}}_{q^n/q}(g(x)).$$

$$f(x)=h(x^q-x)\varphi (x)+g(x^q-x)$$

Full text

**Keywords: **Two-to-one mappings, permutation polynomials, AGW criterion, linear translators, symmetric cryptography.

1 Introduction

Permutation mappings (or $1$-to-$1$ mappings) over finite fields have been extensively studied for their applications in cryptography, coding theory, combinatorial design, etc. For recent advances on permutation polynomials over finite fields, we refer to the excellent survey [17] and the references therein. For a detailed study of involutions over finite fields (in characteristic 2), we send the reader to [9]. Two-to-one ($2$-to-$1$) mappings are involved in several criteria in particular to design special important primitives in symmetric cryptography such as APN functions, bent functions and more general plateaued functions. Despite their importance, they have never been studied in the literature. The objective of this paper is to provide a systematic study of two-to-one mappings over finite fields including characterizations, criteria and methods for handling and designing such functions as well as effective constructions.

The paper is organized as follows. Section 2 gives preliminaries and fixes the notation. In Section 3, we first present the definitions of $2$-to-$1$ mappings over finite fields as well as basic properties, and then provide a characterization of $2$-to-$1$ mappings by means of the Walsh transforms. Section 4 is devoted to the constructions of $2$-to-$1$ mappings. We shall present several constructions. First, an AGW-like criterion for $2$-to-$1$ mappings is given. Next, constructions of $2$-to-$1$ polynomial mappings with the form of $x^{r}h(x^{(q-1)/d})$ are provided. Furthermore, constructions of $2$-to-$1$ mappings from permutation polynomials, from linear translators and from APN functions respectively are given. In Section 5 we present $2$-to-$1$ polynomial mappings in classical classes of polynomials: linearized polynomials and monomials, low degree polynomials, Dickson polynomials and Muller-Cohen-Matthews polynomials, etc. In Section 6, we are interested in applications of $2$-to-$1$ mappings over finite fields for constructions of bent Boolean and vectorial bent functions, semi-bent functions, planar functions and permutation polynomials. It should be noted that this section is not only an application of the obtained results, but also a motivation to study 2-to-1 mappings. In all those sections, we shall review what is known and provide several new results.

2 Notation and Preliminaries

For a set $S$, $\#S$ will denote the cardinality of $S$. For any field $E$, $E^{\ast}=E\setminus\{0\}$. Let $\mathbb{N}$, $\mathbb{R}$ and $\mathbb{C}$ be respectively the set of all natural, real and complex numbers. Let $p$ be a prime number and $n$ be a positive integer. The finite field with $q:=p^{n}$ elements is denoted by ${\mathbb{F}}_{q}$ or ${\mathbb{F}}_{p^{n}}$, which can be viewed as an $n$-dimensional vector space over ${\mathbb{F}}_{p}$, and it is denoted by ${\mathbb{F}}_{p}^{n}$. Denote by $\overline{{\mathbb{F}}}_{q}$ the algebraic closure of ${\mathbb{F}}_{q}$. The trace function ${\rm Tr}_{p^{n}/p}:\mathbb{F}_{p^{n}}\rightarrow\mathbb{F}_{p}$ is defined as

[TABLE]

which is called the absolute trace of $x\in\mathbb{F}_{p^{n}}$. More general, the trace function ${\rm Tr}_{q^{n}/q}:\mathbb{F}_{q^{n}}\rightarrow\mathbb{F}_{q}$ is defined as

[TABLE]

A linearized polynomial (or additive polynomial), $L\in\mathbb{F}_{q}[x]$ is a polynomial of the shape $L(x)=\sum_{i=0}^{n}a_{i}x^{p^{i}}$. A polynomial $A\in\mathbb{F}_{q}[x]$ is called an affine polynomial if it equals to the summation of a linearized polynomial and a constant term.

Let $f$ be a function from $\mathbb{F}_{p}^{n}$ to $\mathbb{F}_{p}$. We can give a corresponding complex-valued function $\chi_{f}$ from ${\mathbb{F}}_{p}^{n}$ to ${\mathbb{C}}$ defined as $\chi_{f}(x)=\xi_{p}^{f(x)}$ for all $x\in{\mathbb{F}}_{p}^{n}$ where $\xi_{p}=e^{(2\pi\sqrt{-1})/p}$ is a complex primitive $p$-th root of unity. The Walsh transform of $f$ is the Fourier transform $\widehat{\chi}_{f}$ from ${\mathbb{F}}_{p}^{n}$ to ${\mathbb{C}}$ of $\chi_{f}$ defined as $\widehat{\chi}_{f}(\omega)=\sum_{x\in\mathbb{F}_{p}^{n}}{\xi_{p}}^{{f(x)}-\omega\cdot x}$ for all $\omega\in{\mathbb{F}}_{p}^{n}$, where $``\cdot"$ denotes an inner product (for instance, the usual inner product) in ${\mathbb{F}}_{p}^{n}$. We can take $\omega\cdot x={\rm Tr}_{p^{n}/p}(\omega x)$ if ${\mathbb{F}}_{p}^{n}$ is identified with ${\mathbb{F}}_{p^{n}}$. Note that if $p=2$ then $\xi_{p}=-1$ and a function from $\mathbb{F}_{2^{n}}$ to $\mathbb{F}_{2}$ is said to be a Boolean function.

3 Definitions and a characterization of $2$-to-$1$ mappings over finite fields

3.1 Definitions of $2$-to-$1$ mappings

Firstly, we give the definition of $2$-to-$1$ mappings over any finite set.

Definition 1**.**

Let $A$ and $B$ be two finite sets, and let $f$ be a mapping from $A$ to $B$. Then $f$ is called a $2$-to-$1$ mapping if one of the following two cases hold:

$\sharp A$ is even, and for any $b\in B$, it has either $2$ or [math] preimages of $f$; 2. 2.

$\sharp A$ is odd, and for all but one $b\in B$, it has either $2$ or [math] preimages of $f$, and the exception element has exactly one preimage.

Throughout this paper, we mainly focus on the mappings over finite fields. Let ${\mathbb{F}}_{p^{n}}$ and ${\mathbb{F}}_{p^{m}}$ be two finite fields of order $p^{n}$ and $p^{m}$, respectively. Let $F$ be a mapping from ${\mathbb{F}}_{p^{n}}$ to ${\mathbb{F}}_{p^{m}}$. Then according to the above definition, if $p=2$, then $F$ is a $2$-to-$1$ mapping if and only if the equation $F(x)=a$ has either zero or two solutions in ${\mathbb{F}}_{2^{n}}$ for any $a\in{\mathbb{F}}_{2^{m}}$, or equivalently, $\#\{x\in{\mathbb{F}}_{2^{n}}|F(x)=F(y)\}=2$ for all $y\in{\mathbb{F}}_{2^{n}}$. While for an odd prime $p$, a mapping $F:{\mathbb{F}}_{p^{n}}\rightarrow{\mathbb{F}}_{p^{m}}$ is $2$-to-$1$ if and only if all but one elements in the image set of $F$ have two preimages and the exceptional element has one preimage, or equivalently, there exists a unique $b\in{\mathbb{F}}_{p^{m}}$ such that $\#F^{-1}(b)=1$ and $\#F^{-1}(a)\in\{0,2\}$, for all $a\in{\mathbb{F}}_{p^{m}}\setminus\{b\}$. Without loss of generality, we can assume that the exceptional element of $b$ is [math]. Moreover, if its unique preimage is also the zero element, then we have the following remark.

Remark 2**.**

Let $F:{\mathbb{F}}_{p^{n}}\rightarrow{\mathbb{F}}_{p^{m}}$ with $F(x)=0$ if and only if $x=0$, where $p$ is odd. Then $F$ is a $2$-to-$1$ mapping if and only if, $F(x)=a$ has either zero or two solutions in ${\mathbb{F}}_{p^{n}}$ for any $a\in{\mathbb{F}}_{p^{m}}^{\ast}$.

In the end of this subsection, we calculate the number of all $2$-to-$1$ mappings over ${\mathbb{F}}_{2^{n}}$. It seems to be a huge number.

Proposition 3**.**

Denote by $N_{n}$ the number of all $2$-to-$1$ mappings $F:{\mathbb{F}}_{2^{n}}\rightarrow{\mathbb{F}}_{2^{n}}$. Then

[TABLE]

Proof.

Let $F$ be a $2$-to-$1$ mapping over ${\mathbb{F}}_{2^{n}}$. Then the size of its image set is $2^{n-1}$. For the first element of the image set, its preimage have $\binom{2^{n}}{2}$ choices, while for the second element, it has $\binom{2^{n}-2}{2}$ choices, so on and so forth, the last element has $\binom{2}{2}$ choices. Hence we have

[TABLE]

Then the result follows from the well-known String formula. ∎

It is well known that the number of all mappings (resp. bijective mappings) from ${\mathbb{F}}_{2^{n}}$ to itself is $2^{n\cdot 2^{n}}$ (resp. $(2^{n})!$) . Denote the latter number by $B_{n}$. Then we have

[TABLE]

We list the ratio of these two numbers for $1\leq n\leq 8$ in the following table. The values are rounded to three significant figures.

[TABLE]

It seems from the above table that the number of all $2$-to-$1$ mappings over ${\mathbb{F}}_{2^{n}}$ is much greater than that of all bijective mappings over ${\mathbb{F}}_{2^{n}}$.

3.2 A characterization of $2$-to-$1$ mappings over ${\mathbb{F}}_{2^{n}}$ by means of the Walsh transforms

In this subsection we present a characterization of $2$-to-$1$ mappings over ${\mathbb{F}}_{2^{n}}$ by means of the Walsh transforms. The main idea goes back to Carlet [4] who has characterized the differential uniformity of vectorial functions by the Walsh transform. Let $F(x)$ be a polynomial over ${\mathbb{F}}_{2^{n}}$. Recall that $F(x)$ is $2$-to-$1$ if and only if, for every $b$ in ${\mathbb{F}}_{2^{n}}$, the equation $F(x)=b$ has 0 or 2 solutions. Let $F:{\mathbb{F}}_{2^{n}}\rightarrow{\mathbb{F}}_{2^{n}}$ be a vectorial Boolean function. The Walsh transform of $F$ at $(u,v)\in{\mathbb{F}}_{2^{n}}\times{\mathbb{F}}_{2^{n}}$ equals by definition the Walsh transform of the so-called component function ${\rm Tr}_{2^{n}/2}(vF(x))$ at $u$, that is:

[TABLE]

Let $\phi(x)=\sum_{j\geq 0}A_{j}x^{j}$ be any polynomial over $\mathbb{R}$ such that $\phi(x)=0$ for $x=0,2$ and $\phi(x)>0$ for every $x\in\mathbb{N}\setminus\{0,2\}$. Hence for any $F$ and $b\in{\mathbb{F}}_{2^{n}}$, we have

[TABLE]

and $F$ is a two-to-one function if and only if this inequality is an equality for any $b\in{\mathbb{F}}_{2^{n}}$. Furthermore, for any $F$, we have

[TABLE]

and $F$ is $2$-to-$1$ if and only if this inequality is an equality.

We shall now characterize this condition by means of the Walsh transform. We have:

[TABLE]

and therefore, for $j\geq 1$:

[TABLE]

Hence we have the following characterization of $2$-to-$1$ mappings over ${\mathbb{F}}_{2^{n}}$ by the Walsh transform.

Theorem 4**.**

Let $F:{\mathbb{F}}_{2^{n}}\rightarrow{\mathbb{F}}_{2^{n}}$ be a vectorial Boolean function. Then

[TABLE]

and $F$ is $2$-to-$1$ if and only if this inequality is an equality.

Now, let us consider the polynomial over $\mathbb{R}$ equal to $X(X-2)^{2}=X^{3}-4X^{2}+4X$. It takes value 0 when $X$ equals 0 or 2 and takes strictly positive value when $X$ is in $\mathbb{N}\setminus\{0,2\}$. We have then the following corollary.

Corollary 5**.**

Let $F:{\mathbb{F}}_{2^{n}}\rightarrow{\mathbb{F}}_{2^{n}}$ be a vectorial Boolean function. Then

[TABLE]

and this inequality is an equality if and only if $F$ is $2$-to-$1$.

4 Constructions of $2$-to-$1$ mappings

In this section, we present different methods to construct $2$-to-$1$ mappings over finite fields.

4.1 AGW-like criterion for $2$-to-$1$ mappings

The criterion, discovered by Akbary, Ghioca and Wang [1], is a simple and effective method that establishes the permutation property of a mapping ${\mathbb{F}}_{q}\rightarrow{\mathbb{F}}_{q}$ through a commutative diagram. The significance of the AGW criterion resides in the fact that it not only provides a unified interpretation for many previous constructions of permutations polynomials but also facilitates numerous new discoveries. In this subsection we will generalize AGW criterion to construct $2$-to-$1$ mappings over finite fields.

We give a brief description of this subsection for the readers’ convenience. First, the AGW criterion is generalized to construct $2$-to-$1$ mappings over finite sets (Proposition 6). Second, three general constructions (Theorem 8, Theorem 9, and Proposition 10) are given by applying this generalized AGW criterion. Then several explicit $2$-to-$1$ polynomials over finite fields are constructed from Proposition 10, and most of the constructions are divided into two cases.

Proposition 6**.**

Let $A$ be a finite set, $S,\bar{S}$ be two finite sets such that $\sharp S=\sharp\bar{S}$. Let $f,g,\lambda,\bar{\lambda}$ be four mappings defined as the following diagram such that $\bar{\lambda}\circ f=g\circ\lambda$. If $g$ is bijective from $S$ to $\bar{S}$, $f|_{\lambda^{-1}(s)}$ is $2$-to-$1$ for any $s\in S$, and there is at most one $s\in S$ such that $\sharp{\lambda^{-1}(s)}$ is odd, then $f$ is a $2$-to-$1$ mapping over $A$.

[TABLE]

Proof.

Let $b\in A$. Assume that there exists an element $a$ in $A$ such that $f(a)=b$. Let $\bar{s}=\bar{\lambda}(b)$. Then

[TABLE]

Since $g$ is bijective from $S$ to $\bar{S}$, there exists a unique element $s\in S$ such that $g(s)=\bar{s}$. Hence $\lambda(a)=s$. If $\sharp{\lambda^{-1}(s)}$ is even, then $f(x)=b$ has exactly two solutions in $A$ (one is $a$) since $f|_{\lambda^{-1}(s)}$ is $2$-to-$1$ for any $s\in S$. If $\sharp{\lambda^{-1}(s)}$ is odd, then with one exception, $b$ has exactly two preimages of $f$ in $A$. Further, since at most one of $\sharp{\lambda^{-1}(s)}$ is odd for all $s\in S$, we know that $f$ is a $2$-to-$1$ mapping over $A$. ∎

Remark 7**.**

If $g$ is $2$-to-$1$ from $S$ to $\bar{S}$, and $f|_{\lambda^{-1}(s)}$ is injective for any $s\in S$, then one can only deduce that for any $b\in A$, it has at most two preimages. Similarly, let $b\in A$ and assume that there exists an element $a$ in $A$ such that $f(a)=b$. Let $\bar{s}=\bar{\lambda}(b)$. Then

[TABLE]

Since $g$ is $2$-to-$1$, there exist exactly two elements $s_{1},s_{2}$ in $S$ such that $g(s_{1})=g(s_{2})=\bar{s}$ with at most one exception. Hence $\lambda(a)=s_{1}$ or $\lambda(a)=s_{2}$. Then it follows from the assumptions that $f|_{\lambda^{-1}(s)}$ is $1$-to-$1$ for any $s\in S$ that there exist at most two elements $a_{1}(=a),a_{2}$ in $A$ such that $f(a_{1})=f(a_{2})=b$. It seems not easy to add a condition such that $f$ is a $2$-to-$1$ mapping over $A$. We leave this problem to interested readers.

By applying Proposition 6, we can give the following two general constructions.

Theorem 8**.**

Consider any polynomial $g\in{\mathbb{F}}_{q^{n}}[x]$, any additive polynomials $\phi,\psi\in{\mathbb{F}}_{q^{n}}[x]$, any ${\mathbb{F}}_{q}$-linear polynomial $\bar{\psi}\in{\mathbb{F}}_{q^{n}}[x]$ satisfying $\phi\circ\psi=\bar{\psi}\circ\phi$, and any polynomial $h\in{\mathbb{F}}_{q^{n}}[x]$ such that $h(\psi({\mathbb{F}}_{q^{n}}))\subseteq{\mathbb{F}}_{q}^{\ast}$. Let

[TABLE]

and

[TABLE]

If $\bar{f}$ is bijective from $\psi({\mathbb{F}}_{q^{n}})$ to $\bar{\psi}({\mathbb{F}}_{q^{n}})$, $f|_{\psi^{-1}(s)}$ is $2$-to-$1$ for any $s\in\psi({\mathbb{F}}_{q^{n}})$, and there is at most one $s\in\psi({\mathbb{F}}_{q^{n}})$ such that $\sharp{\psi^{-1}(s)}$ is odd, then $f$ is a $2$-to-$1$ mapping over ${\mathbb{F}}_{q^{n}}$.

Proof.

We have

[TABLE]

the second equality holds since $h(\psi({\mathbb{F}}_{q^{n}}))\subseteq{\mathbb{F}}_{q}^{\ast}$, $\bar{\psi}$ is ${\mathbb{F}}_{q}$-linear and $\phi\circ\psi=\bar{\psi}\circ\phi$. Hence we get the following commutative diagram:

[TABLE]

Then the result follows directly from Proposition 6. ∎

Theorem 9**.**

Let $q$ be an even prime power, let $n$ be a positive integer, and let $L_{1},L_{2},L_{3}$ be ${\mathbb{F}}_{q}$-linear polynomials over ${\mathbb{F}}_{q}$ seen as endomorphisms of the ${\mathbb{F}}_{q}$-module ${\mathbb{F}}_{q^{n}}$. Let $g(x)\in{\mathbb{F}}_{q^{n}}[x]$ be such that $g(L_{3}({\mathbb{F}}_{q^{n}}))\subseteq{\mathbb{F}}_{q}$. Assume

[TABLE]

and

[TABLE]

For any $y\in L_{3}({\mathbb{F}}_{q^{n}})$, let $F_{y}(x):=L_{1}(x)+L_{2}(x)g(y)$. If $\ker(F_{y})\cap\ker(L_{3})=\{0,c_{y}\}$, for any $y\in L_{3}({\mathbb{F}}_{q^{n}})$, where $c_{y}$ is a nonzero element of ${\mathbb{F}}_{q^{n}}$, and $\bar{f}$ is a permutation over $L_{3}({\mathbb{F}}_{q^{n}})$, then $f$ is $2$-to-$1$ over ${\mathbb{F}}_{q^{n}}$.

[TABLE]

Proof.

We apply Proposition 6 with $A={\mathbb{F}}_{q^{n}}$, $f(x)=L_{1}(x)+L_{2}(x)g(L_{3}(x))$, $S=\bar{S}=L_{3}({\mathbb{F}}_{q^{n}})$, $\lambda=\bar{\lambda}=L_{3}$ and $\bar{f}(x):=L_{1}(x)+L_{2}(x)g(x)$. Since $g(L_{3}({\mathbb{F}}_{q^{n}}))\subseteq{\mathbb{F}}_{q}$, and $L_{1},L_{2}$ and $L_{3}$ are ${\mathbb{F}}_{q}$-linear polynomials over ${\mathbb{F}}_{q}$, one can easily verified that $\lambda\circ f=\bar{f}\circ\lambda$. For any $y\in L_{3}({\mathbb{F}}_{q^{n}})$, $f|_{\lambda^{-1}(y)}=L_{1}(x)+L_{2}(x)g(y)=F_{y}$ is linearized. It is $2$-to-$1$ over $L_{3}^{-1}(y)$ if and only if $\dim(\ker(F_{y})\cap\ker(L_{3}))=1$. Hence the result follows from Proposition 6. ∎

The above two constructions are quite general and can be used to construct more explicit $2$-to-$1$ polynomials. Due to the space limit, we will only take the first one as an example and give several explicit constructions. The interested readers are cordially invited to apply the second one to construct more $2$-to-$1$ polynomials.

The following proposition follows from Theorem 8, and is the foundation of later constructions in this subsection.

Proposition 10**.**

Let $q=2^{m}$, $\phi(x)$ and $\psi(x)$ be two ${\mathbb{F}}_{q}$-linear polynomials over ${\mathbb{F}}_{q}$ seen as endomorphisms of the ${\mathbb{F}}_{q}$-module ${\mathbb{F}}_{q^{n}}$, and let $g,h\in{\mathbb{F}}_{q^{n}}[x]$ such that $h(\psi({\mathbb{F}}_{q^{n}}))\subseteq{\mathbb{F}}_{q}^{\ast}.$ If $\ker(\phi)\cap\ker(\psi)=\{0,c\}$ for some $c\in{\mathbb{F}}_{q^{n}}^{\ast}$, and $\bar{f}(x)=h(x)\phi(x)+\psi(g(x))$ permutes $\psi({\mathbb{F}}_{q^{n}})$, then

[TABLE]

is $2$-to-$1$ over ${\mathbb{F}}_{q^{n}}$.

Proof.

In Theorem 8, let $\bar{\psi}=\psi$, then $\phi\circ\psi={\psi}\circ\phi$ since both $\psi$ and $\phi$ are ${\mathbb{F}}_{q}$-linear polynomials over ${\mathbb{F}}_{q}$. Further, $f|_{\psi^{-1}(s)}$ is $2$-to-$1$ for any $s\in\psi({\mathbb{F}}_{q^{n}})$ since $\dim_{{\mathbb{F}}_{2}}(\ker(\phi)\cap\ker(\psi))=1$. The result then follows from Theorem 8. ∎

By applying Proposition 10, we have the following theorem.

Theorem 11**.**

Let $q=2^{m}$, $a\in{\mathbb{F}}_{q}$, and let $b\in{\mathbb{F}}_{q^{n}}$. Let $P(x)$ and $L(x)$ be ${\mathbb{F}}_{q}$-linear polynomials over ${\mathbb{F}}_{q}$. Let $H(x)\in{\mathbb{F}}_{q^{n}}[x]$ be such that $H(L({\mathbb{F}}_{q^{n}}))\subseteq{\mathbb{F}}_{q}\setminus\{-a\}$. Let

[TABLE]

and

[TABLE]

If $\ker(P)\cap\ker(L)=\{0,c\}$ for some $c\in{\mathbb{F}}_{q^{n}}^{\ast}$, and $\bar{f}$ permutes $L({\mathbb{F}}_{q^{n}})$, then $f$ is $2$-to-$1$ over ${\mathbb{F}}_{q^{n}}$.

**Proof. ** In Proposition 10, we let $h(x)=a+H(x)$, $\phi(x)=P(x)$, $\psi(x)=L(x)$ and $g(x)=b\cdot H(x)$. For any $x\in L({\mathbb{F}}_{q^{n}})$, since $H(x)\in{\mathbb{F}}_{q}$ and $L$ is a ${\mathbb{F}}_{q}$-linear polynomial, we obtain

[TABLE]

and thus

[TABLE]

as in Proposition 10. $\hfill\Box$

Next we study in detail some of the consequences of Proposition 10 (or alternatively of Theorem 8 when $\psi=\bar{\psi}$ ) for two specific choices of ${\mathbb{F}}_{q}$-linear polynomials. First we consider the case $\psi(x)={\rm Tr}_{q^{n}/q}(x)$ and next we study the case $\psi(x)=x^{q}-x$.

Case 1. $\psi(x)=\bar{\psi}(x)={\rm Tr}_{q^{n}/q}(x)=x+x^{q}+\cdots+x^{q^{n-1}}.$

The first result in this case follows directly from Proposition 10.

Proposition 12**.**

Let $q=2^{m}$, $\phi(x)$ be a ${\mathbb{F}}_{q}$-linear polynomial over ${\mathbb{F}}_{q}$ seen as an endomorphism of the ${\mathbb{F}}_{q}$-module ${\mathbb{F}}_{q^{n}}$ and ${\rm Tr}_{q^{n}/q}(x)$ be the trace function from ${\mathbb{F}}_{q^{n}}$ to ${\mathbb{F}}_{q}$. Let $g,h\in{\mathbb{F}}_{q^{n}}[x]$ be such that $h({\mathbb{F}}_{q})\subseteq{\mathbb{F}}_{q}^{\ast}.$ Assume

[TABLE]

and

[TABLE]

If $\ker(\phi)\cap\ker({\rm Tr}_{q^{n}/q}(x))=\{0,c\}$ for some $c\in{\mathbb{F}}_{q^{n}}^{\ast}$, and $\bar{f}$ permutes ${\mathbb{F}}_{q}$, then $f$ is $2$-to-$1$ over ${\mathbb{F}}_{q^{n}}$.

By applying Proposition 12, we get the following construction.

Theorem 13**.**

Let $q=2^{m}$, $\phi$ be a ${\mathbb{F}}_{q}$-linear polynomial over ${\mathbb{F}}_{q}$, let $g(x)\in{\mathbb{F}}_{q^{n}}[x]$, and let $h(x)\in{\mathbb{F}}_{q^{n}}[x]$ such that $h({\mathbb{F}}_{q})\subseteq{\mathbb{F}}_{q}^{\ast}$. Assume $f(x)=h({\rm Tr}_{q^{n}/q}(x))\phi(x)+g({\rm Tr}_{q^{n}/q}(x))^{q}-g({\rm Tr}_{q^{n}/q}(x))$. If $\ker(\phi)\cap\ker({\rm Tr}_{q^{n}/q}(x))=\{0,c\}$ for some $c\in{\mathbb{F}}_{q^{n}}^{\ast}$, and $h(x)\phi(x)$ permutes ${\mathbb{F}}_{q}$, then $f$ is $2$-to-$1$ over ${\mathbb{F}}_{q^{n}}$.

**Case 2. ** $\psi(x)=\bar{\psi}(x)=x^{q}-x.$

Similarly, we have the following two results.

Proposition 14**.**

Let $q=2^{m}$, $\phi(x)$ be a ${\mathbb{F}}_{q}$-linear polynomials over ${\mathbb{F}}_{q}$ seen as an endomorphism of the ${\mathbb{F}}_{q}$-module ${\mathbb{F}}_{q^{n}}$. Let $g,h\in{\mathbb{F}}_{q^{n}}[x]$ be such that $h(x^{q}-x)\subseteq{\mathbb{F}}_{q}^{\ast}$ for all $x\in{\mathbb{F}}_{q^{n}}$. Assume

[TABLE]

and

[TABLE]

If $\phi(x)$ is $2$-to-$1$ over ${\mathbb{F}}_{q}$ and $\bar{f}$ permutes over $S=\{a^{q}-a|a\in{\mathbb{F}}_{q^{n}}\}$, then $f$ is $2$-to-$1$ over ${\mathbb{F}}_{q^{n}}$.

Proof.

In Theorem 8, let $\psi=\bar{\psi}=x^{q}-x$. For any $s\in\psi({\mathbb{F}}_{q^{n}})$, $f|_{\psi^{-1}(s)}=h(s)\phi(x)+g(s)$ is $2$-to-$1$ if and only if $\phi$ is $2$-to-$1$ over ${\mathbb{F}}_{q}$ since $h(s)\neq 0$. Hence the result follows. ∎

Theorem 15**.**

Let $q=2^{m}$, $\phi(x)$ be a ${\mathbb{F}}_{q}$-linear polynomials over ${\mathbb{F}}_{q}$ seen as an endomorphism of the ${\mathbb{F}}_{q}$-module ${\mathbb{F}}_{q^{n}}$. Let $u,h\in{\mathbb{F}}_{q^{n}}[x]$ be such that $h(x^{q}-x)\subseteq{\mathbb{F}}_{q}^{\ast}$ for all $x\in{\mathbb{F}}_{q^{n}}$. Assume

[TABLE]

and

[TABLE]

If $\phi(x)$ is $2$-to-$1$ over ${\mathbb{F}}_{q}$ and $h(x)\phi(x)$ permutes over $S=\{a^{q}-a|a\in{\mathbb{F}}_{q^{n}}\}$, then both $f_{1}$ and $f_{2}$ are $2$-to-$1$ over ${\mathbb{F}}_{q^{n}}$.

Proof.

We only prove for $f_{1}$ as the other case can be proved similarly. In Proposition 14, let $g(x)={\rm Tr}_{q^{n}/q}(u(x))$. Then

[TABLE]

since $\psi(g(x))\equiv 0$. Hence the result follows. ∎

4.2 $2$-to-$1$ polynomial mappings with the form of $x^{r}h(x^{(q-1)/d})$

In this subsection, we construct two-to-one polynomial mappings with the form of $x^{r}h(x^{(q-1)/d})$. We need $q-1$ to be even. Hence it is assumed that $q$ is odd throughout this subsection.

Proposition 16**.**

*Let $q$ be an odd prime power, $r,d$ be positive integers such that $d|q-1$. Let $f(x)=x^{r}h(x^{(q-1)/d})$, where $h\in{\mathbb{F}}_{q}[x]$ such that $h(x)\neq 0$ if $x\neq 0$, and let $\lambda(x)=x^{(q-1)/d}$ and $\mu_{d}=\{x\in{{\mathbb{F}}_{q}}:x^{d}=1\}$. Let $g(x)=x^{r}h(x)^{(q-1)/d}$. If $g$ is $1$-to-$1$ from $\mu_{d}$ to $\mu_{d}$ and $\gcd(r,\frac{q-1}{d})=2$, then $f$ is a $2$-to-$1$ mapping over ${\mathbb{F}}_{q}$. *

[TABLE]

Proof.

Since $\gcd(r,\frac{q-1}{d})=2$, we know that $f|_{\lambda^{-1}(s)}=x^{r}h(s)$ is $2$-to-$1$ for any $s\in\mu_{d}$. Then the result follows directly from the fact that $\lambda\circ f=g\circ\lambda$ and Proposition 6. ∎

Then we have the following result.

Corollary 17**.**

Suppose that there exists $n\geq 0$ such that $h(x)^{(q-1)/d}=x^{n}$ for all $x\in\mu_{d}$. If $\gcd(r+n,d)=1$ and $\gcd(r,\frac{q-1}{d})=2$, then $x^{r}h(x^{(q-1)/d})$ is $2$-to-$1$ over ${\mathbb{F}}_{q}$.

Theorem 18**.**

Suppose that $q=q_{0}^{m}$, where $q_{0}\equiv 1(\mod d)$ and $d|m$, $h\in{\mathbb{F}}_{q_{0}}[X]$ has no roots in $\mu_{d}$, $\gcd(r,d)=1$ and $\gcd(r,(q-1)/d)=2$. Then $x^{r}h(x^{(q-1)/d})$ is $2$-to-$1$ over ${\mathbb{F}}_{q}$.

Proof.

For any $x\in\mu_{d}\subseteq{\mathbb{F}}_{q_{0}}^{\ast}$, we have

[TABLE]

Hence it is the case $n=0$ in Corollary 17. Then the result follows. ∎

4.3 Constructions of $2$-to-$1$ mapping from permutation polynomials

Proposition 19**.**

Let $G:{\mathbb{F}}_{2^{n}}\rightarrow{\mathbb{F}}_{2^{n}}$ be a permutation polynomial, and let ${\mathbb{F}}_{2^{n}}=S_{1}\cup S_{2}$ be a disjoint decomposition of ${\mathbb{F}}_{2^{n}}$, where $\#S_{1}=\#S_{2}=2^{n-1}$. Define $\phi$ be a bijective mapping from $S_{2}$ to $S_{1}$. Let

[TABLE]

Then $F$ is a $2$-to-$1$ mapping over ${\mathbb{F}}_{2^{n}}$.

Conversely, any $2$-to-$1$ mapping can be constructed by this method.

The following corollary follows directly from the above proposition.

Corollary 20**.**

Let $G:{\mathbb{F}}_{2^{n}}\rightarrow{\mathbb{F}}_{2^{n}}$ be a permutation polynomial, and let $S$ be a ${\mathbb{F}}_{2}$-linear subspace of ${\mathbb{F}}_{2^{n}}$ with dimension $n-1$, $\gamma\in{\mathbb{F}}_{2^{n}}\setminus S$. Define

[TABLE]

and

[TABLE]

Then both $F_{1}$ and $F_{2}$ are $2$-to-$1$ mappings over ${\mathbb{F}}_{2^{n}}$.

In the above corollary, let $S=\{x\in{\mathbb{F}}_{q}:{\rm Tr}_{2^{n}/2}(x)=0\}$, we have

Proposition 21**.**

Let $G:{\mathbb{F}}_{2^{n}}\rightarrow{\mathbb{F}}_{2^{n}}$ be a permutation polynomial, and let $\gamma\in{\mathbb{F}}_{2^{n}}$ such that ${\rm Tr}_{2^{n}/2}(\gamma)=1$. Define

[TABLE]

and

[TABLE]

Then both $F_{1}$ and $F_{2}$ are $2$-to-$1$ mappings over ${\mathbb{F}}_{2^{n}}$.

New $2$-to-$1$ mappings can also be constructed from the composition of permutation polynomials and known $2$-to-$1$ mappings.

Proposition 22**.**

Let $G:{\mathbb{F}}_{2^{n}}\rightarrow{\mathbb{F}}_{2^{n}}$ be a permutation polynomial, and let $H:{\mathbb{F}}_{2^{n}}\rightarrow{\mathbb{F}}_{2^{n}}$ be a $2$-to-$1$ mapping. Then both $F_{1}(x)=H(G(x))$ and $F_{2}(x)=G(H(x))$ are $2$-to-$1$ mappings over ${\mathbb{F}}_{2^{n}}$.

Hence one can use any $2$-to-$1$ polynomial and any permutation polynomial to produce new $2$-to-$1$ polynomials. It should be noted that in the above proposition we can composize many permutation polynomials with one $2$-to-$1$ mapping with any order. Particularly, we have the following corollary.

Corollary 23**.**

Let $G:{\mathbb{F}}_{2^{n}}\rightarrow{\mathbb{F}}_{2^{n}}$ be a permutation polynomial, and let $L(x):{\mathbb{F}}_{2^{n}}\rightarrow{\mathbb{F}}_{2^{n}}$ be a linearized polynomial with $\dim\ker L=1$. Then both $F_{1}(x)=L(G(x))$ and $F_{2}(x)=G(L(x))$ are $2$-to-$1$ mappings over ${\mathbb{F}}_{2^{n}}$.

4.4 Constructions of $2$-to-$1$ mappings from linear translators

We recall the definitions of linear translator and linear structure.

Definition 24**.**

Let $n=rk$, $1\leq k\leq n$. Let $f$ be a function from $\mathbb{F}_{p^{n}}$ to $\mathbb{F}_{p^{k}}$, $\gamma\in\mathbb{F}_{p^{n}}^{*}$ and $b$ be fixed in $\mathbb{F}_{p^{k}}$. Then $\gamma$ is a $b$-linear translator of $f$ if $f(x+u\gamma)-f(x)=ub$ for all $x\in\mathbb{F}_{p^{n}}$ and $u\in\mathbb{F}_{p^{k}}$. In particular, if $k=1$ then $\gamma$ is usually called a $b$-linear structure of the function $f$ (where $b\in\mathbb{F}_{p}$), that is $f(x+\gamma)-f(x)=b$ for all $x\in\mathbb{F}_{p^{n}}$.

Proposition 25**.**

[7]** Let $G$ be a polynomial in $\mathbb{F}_{2^{n}}[x]$, $F$ be a permutation on $\mathbb{F}_{2^{n}}$ and $\gamma\in\mathbb{F}_{2^{n}}$ be a $1$-linear structure of ${\rm Tr}_{2^{n}/2}(G(x))$. Then $F(x)+\gamma{\rm Tr}_{2^{n}/2}(G(F(x)))$ is a $2$-to-$1$ mapping over $\mathbb{F}_{2^{n}}$.

The following result can be derived from [19]. For making the paper self-contained, we include its proof.

Proposition 26**.**

Let $\gamma,\delta$ be two distinct elements in $\mathbb{F}_{2^{m}}^{\ast}$, and let $f,g$ be two Boolean functions defined over $\mathbb{F}_{2^{m}}$. The mapping $y\mapsto y+\gamma f(y)+\delta g(y)$ is $2$-to-$1$ on ${\mathbb{F}}_{2^{m}}$ if one of the following conditions holds:

$\gamma$, $\delta$ are $1$-linear structures of $f$ and $\gamma$ is a [math]-linear structure of $g$, 2. 2.

$\gamma$* is a $1$-linear structure of $f$ and $\gamma$, $\delta$ are [math]-linear structures of $g$,* 3. 3.

$\gamma$, $\delta$ are [math]-linear structures of $f$ and $\delta$ is a $1$-linear structure of $g$, 4. 4.

$\delta$* is a [math]-linear structure of $f$ and $\gamma$, $\delta$ are $1$-linear structures of $g$,* 5. 5.

$\gamma$* is a [math]-linear structure of $f$, $\delta$ is a $1$-linear structure of $f$ and $\gamma+\delta$ is a $1$-linear structure of $g$,* 6. 6.

$\gamma$* is a $1$-linear structure of $g$, $\delta$ is a [math]-linear structure of $g$ and $\gamma+\delta$ is a $1$-linear structure of $f$.*

Proof.

We give the proof for Case 1 only since the proofs for other cases are similar. Now, we need to show that $\rho(y):y\mapsto y+\gamma f(y)+\delta g(y)$ is $2$-to-$1$. Let $\rho(y)=a$ for some $a\in{\mathbb{F}}_{2^{m}}$. Then, $y\in\left\{a,a+\gamma,a+\delta,a+\gamma+\delta\right\}$. As $\gamma$ is a $1$-linear structure of $f$ and [math]-linear structure of $g$, we have $\rho(a)=\rho(a+\gamma)$ and $\rho(a+\delta)=\rho(a+\gamma+\delta)$. Moreover, $\rho(a+\delta)=a+\delta+\gamma f(a+\delta)+\delta g(a+\delta)=a+\delta+\gamma+\gamma f(a)+\delta g(a+\delta)$ where we use that $\delta$ is a $1$-linear structure of $f$. We observe that $\rho(a)=a+\gamma f(a)+\delta g(a)\neq\rho(a+\delta)$. Indeed, if the equality holds, then \gamma+\delta+\delta\big{(}g(a)+g(a+\delta)\big{)}=0. This is a contradiction as $\gamma\neq\delta$ and $\gamma\neq 0$. This implies that $\rho^{-1}(a)=\left\{a,a+\gamma\right\}$ or $\rho^{-1}(a)=\left\{a+\delta,a+\gamma+\delta\right\}$ which shows that $\rho$ is $2$-to-$1$. ∎

Proposition 27**.**

Let $L:\mathbb{F}_{2^{n}}\rightarrow\mathbb{F}_{2^{n}}$ be a ${\mathbb{F}}_{2}$-linear permutation of ${\mathbb{F}}_{2^{n}}$. Let $f$ be a Boolean function over ${\mathbb{F}}_{2^{n}}$ and $\alpha$ be a non-zero $1$-linear structure of $f$.Then $F(y)=L(y)+L(\alpha)f(y)$ is $2$-to-$1$ on ${\mathbb{F}}_{2^{n}}$.

Proof.

For any $b\in{\mathbb{F}}_{2^{n}}$, let $F(y)=L(y)+L(\alpha)f(y)=b$. Then we have

[TABLE]

or

[TABLE]

It follows from Eq. (5) and $L$ is a linear permutation that $y=\alpha+L^{-1}(b)$. Then $f(y)=f(\alpha+L^{-1}(b))=f(L^{-1}(b))+1$ since $\alpha$ is a non-zero $1$-linear structure of $f$. Hence $F(y)=b$ has either zero or two solutions in ${\mathbb{F}}_{2^{n}}$, which completes the proof. ∎

4.5 APN functions

Almost perfect nonlinear (APN) functions are important research objects in cryptography and coding theory. Let us recall their definition.

Definition 28**.**

Let $F$ be a mapping from ${\mathbb{F}}_{2^{n}}$ to itself ($n$ a positive integer). The function $F$ is said to be APN if

[TABLE]

It is clear that a function $F$ over ${\mathbb{F}}_{2^{n}}$ is APN if and only if $D_{a}F(x)=F(x+a)+F(x)$ is $2$-to-$1$ over ${\mathbb{F}}_{2^{n}}$ for every $a\in{\mathbb{F}}_{2^{n}}^{\ast}$. Hence one can construct a big family of $2$-to-$1$ mappings from an APN function. For the known list of APN functions over ${\mathbb{F}}_{2^{n}}$, please refer to [27][31] and the references therein. From these APN functions, we can construct plenties of $2$-to-$1$ mappings over ${\mathbb{F}}_{2^{n}}$.

Conversely, two-to-one mappings over finite fields in characteristic $2$ can also allow to construct APN functions as follows: let $G:{\mathbb{F}}_{2^{n}}\rightarrow{\mathbb{F}}_{2^{n}}$ be a mapping such that $F_{a}(x):=G(x+a)+G(x)$ is $2$-to-$1$ over ${\mathbb{F}}_{2^{n}}$ for every $a\in{\mathbb{F}}_{2^{n}}^{\ast}$. Then $G$ is an APN function.

5 $2$-to-$1$ polynomial mappings in classical classes of polynomials

5.1 Linearized polynomials and Monomials

Firstly, we have the following general proposition characterizing $2$-to-$1$ linear mappings over finite fields in even characteristic.

Proposition 29**.**

Let $L$ be an ${\mathbb{F}}_{2}$-linear mapping from ${\mathbb{F}}_{2^{n}}$ to ${\mathbb{F}}_{2^{m}}$. Then $L$ is a $2$-to-$1$ mapping if and only if $\dim\ker L=1$.

We have to mention that the simplest example of $2^{m}$-to-$1$ mapping is the trace function ${\rm Tr}_{2^{2m}/2^{m}}$ from $\mathbb{F}_{2^{2m}}$ to $\mathbb{F}_{2^{m}}$.

On the other hand, there are other explicit constructions of $2$-to-$1$ mapping.

Proposition 30**.**

[7, Theorem9]** Let $n$ be an odd prime number satisfying one of the two following conditions (where $ord_{n}(2)$ denotes the order of 2 modulo $n$, that is the smallest positive integer $k$ such that $n$ divides $2^{k}-1$)

• •

$ord_{n}(2)=n-1$;

• •

$n=2r+1$, $r$ odd and $ord_{n}(2)=r$.

Let I be a nonempty set of integers in the range [1, $\frac{n-1}{2}$]. Then, for any such I the mapping $L_{I}(x)=\sum_{i\in I}(x^{2^{i}}+x^{2^{n-i}})$ is $2$-to-$1$ with kernel $\{0,1\}$.

Proposition 31**.**

Let $F_{k}$ be the mapping from $\mathbb{F}_{2^{n}}$ to $\mathbb{F}_{2^{n}}$ given by $F_{k}(x)=x^{2^{k}+1}+x^{2^{k}+2^{m}}$ where $n=2m$ and $0<k<m$. Let $G_{k,a}(x)=F_{k}(x+a)+F_{k}(x)$. If $a\in\mathbb{F}_{2^{n}}\setminus\mathbb{F}_{2^{m}}$ and $\gcd(k,m)=1$, then $x\mapsto G_{k,a}(x)$ is $2$-to-$1$.

Proof.

We have $G_{k,a}(x)=F_{k}(a)+L_{a}(x)$, where

[TABLE]

is a linearized polynomial. Then it suffices to prove that $L_{a}(x)=0$ has exactly two zeros in ${\mathbb{F}}_{2^{n}}$ if $a\in\mathbb{F}_{2^{n}}\setminus\mathbb{F}_{2^{m}}$ and $\gcd(k,m)=1$. Clearly, if $x\in{\mathbb{F}}_{2^{m}}$, then $L_{a}(x)=0$ reduces to $x=0$. Now we assume that $x\notin{\mathbb{F}}_{2^{m}}$. Then

[TABLE]

Adding the above two equations leads to

[TABLE]

Hence $(x^{2^{m}}+x)^{2^{k}-1}=(a^{2^{m}}+a)^{2^{k}-1}$, which further leads to $x^{2^{m}}+x=a^{2^{m}}+a$ since $\gcd(k,m)=1$. Let $x=a+y$. Then $y\in{\mathbb{F}}_{2^{m}}$. Plugging it into $L_{a}(x)=0$, we get $y=0$, which means $x=a$. Thus $L_{a}(x)=0$ has exactly two zeros $x=0$ and $x=a$ in ${\mathbb{F}}_{2^{n}}$. ∎

Now we recall the following trivial characterization of $2$-to-$1$ monomial mapping over ${\mathbb{F}}_{q}$.

Proposition 32**.**

Let $f(x)=ax^{d}$ be a monomial polynomial over ${\mathbb{F}}_{q}$, where $a\neq 0$. Then $f$ is $2$-to-$1$ over ${\mathbb{F}}_{q}$ if and only if $\gcd(d,q-1)=2$.

Then we recall a result which is closely related to the monomial mapping. In 1998 Maschietti discovered a class of cyclic difference sets with Singer parameters which was called the hyperoval sets [25]. Let $m$ be odd. Maschietti showed that

[TABLE]

is a difference set if and only if $x\rightarrow x^{k}$ is a permutation on ${\mathbb{F}}_{2^{m}}$ and the mapping $x\rightarrow x^{k}+x$ is two-to-one. The following $k$ yields difference sets, hence they also yields $2$-to-$1$ mappings.

Proposition 33**.**

Let $m$ be odd. Then $f(x)=x^{k}+x$ is $2$-to-$1$ over ${\mathbb{F}}_{2^{m}}$ if one of the following case holds.

$k=2$* (the Singer case);* 2. 2.

$k=6$* (the Segre case);* 3. 3.

$k=2^{\sigma}+2^{\pi}$* with $\sigma=(m+1)/2$ and $4\pi\equiv 1\mod m$ (the Glynn I case);* 4. 4.

$k=3\cdot 2^{\sigma}+4$* with $\sigma=(m+1)/2$ (the Glynn II case).*

5.2 Low degree polynomials

Let $f(x)=\sum_{i=0}^{n}a_{i}x^{i}\in{\mathbb{F}}_{q}[x]$, where $q=p^{m}$. In this subsection, we consider $2$-to-$1$ mappings of degree $\leq 4$ over ${\mathbb{F}}_{q}$. It is clear that $f(x)\in{\mathbb{F}}_{q}[x]$ is a $2$-to-$1$ mapping over ${\mathbb{F}}_{q}$ if and only if so is $f_{1}(x)=bf(x+c)+d$, where $b,c,d\in{\mathbb{F}}_{q}$ with $b\neq 0$. Hence, W.L.O.G, we consider $f(x)\in{\mathbb{F}}_{q}[x]$ with normalized form, i.e., $f(x)$ is monic ($a_{n}=1$), $f(0)=0$ ($a_{0}=0$), and when $\gcd(p,n)=1$, the coefficient of $x^{n-1}$ is [math] ($a_{n-1}=0$).

(A) $n\leq 3$.

When $n=1$, $f(x)=x$ can not be a $2$-to-$1$ mapping.

When $n=2$, let $f(x)=x^{2}+ax\in{\mathbb{F}}_{q}[x]$, where $q=p^{m}$. If $p=2$, then $f(x)$ is a $2$-to-$1$ mapping if and only if $a\neq 0$. If $p\neq 2$, then $f(x)$ is always a $2$-to-$1$ mapping.

When $n=3$, consider $f(x)=x^{3}+a_{2}x^{2}+a_{1}x\in{\mathbb{F}}_{q}[x]$, where $q\geq 5$. Let $b\in{\mathbb{F}}_{q}$. Since $f$ is a cubic polynomial, $f(x)=b$ has generally either [math] or $1$ or $3$ solutions in ${\mathbb{F}}_{q}$. And $f(x)=b$ has two solutions in ${\mathbb{F}}_{q}$ if and only if one of its solutions has multiplicity $2$, while this case only occurs for at most two values of $b$ when $a_{2}$ and $a_{1}$ are fixed. Hence $f$ can not be $2$-to-$1$ if $q\geq 7$. It is shown by an exhaustive search that there exists ten $2$-to-$1$ polynomials with such form over ${\mathbb{F}}_{5}$ : $f(x)=x^{3}\pm 2x$, $f(x)=x^{3}\pm x^{2}+4x$, $f(x)=x^{3}\pm 2x^{2}+x$, and $f(x)=x^{3}+cx^{2}$, $c\in{\mathbb{F}}_{5}^{\ast}$.

(B) $n=4$.

We divide the discussion into three cases according to the characteristic of the field. In more details, for the cases of $p=2$, $p=3$ and $p>3$. The following lemma will be needed.

Lemma 34**.**

[2]**[29]** Let $a,b\in{\mathbb{F}}_{q}$, where $q=p^{m}$ and $b\neq 0$. Then the cubic equation $x^{3}+ax+b=0$ has a unique solution in ${\mathbb{F}}_{q}$ if and only if one of the following holds

$p=2$* and ${\rm Tr}_{p^{m}/p}\left(\frac{a^{3}}{b^{2}}\right)\neq{\rm Tr}_{p^{m}/p}(1)$;* 2. 2.

$p=3$, $a=0$ or $-a$ is a non-square in ${\mathbb{F}}_{q}$; 3. 3.

$p>3$, $-4a^{3}-27b^{2}$ is a non-square in ${\mathbb{F}}_{q}$.

(B.1) $p=2$.

Theorem 35**.**

Let $q=2^{m}$ and $f(x)=x^{4}+a_{3}x^{3}+a_{2}x^{2}+a_{1}x\in{\mathbb{F}}_{q}[x]$. Then $f(x)$ is $2$-to-$1$ if and only if one of the following holds:

$a_{3}=a_{1}=0$, $a_{2}\neq 0$; 2. 2.

$a_{3}=0,a_{1}\neq 0$* and ${\rm Tr}_{2^{m}/2}\left(\frac{a_{2}^{3}}{a_{1}^{2}}\right)\neq{\rm Tr}_{2^{m}/2}(1)$;* 3. 3.

$m$* is odd, $a_{3}\neq 0$ and $a_{2}^{2}=a_{1}a_{3}$.*

Proof.

First assume that $a_{3}=0$. Then $f(x)=x^{4}+a_{2}x^{2}+a_{1}x$ is linearized. Hence $f(x)$ is $2$-to-$1$ if and only if $f(x)=x\left(x^{3}+a_{2}x+a_{1}\right)=0$ has exactly two solutions, which means that $x^{3}+a_{2}x+a_{1}=0$ has exactly one solution in ${\mathbb{F}}_{q}^{*}$.

If $a_{1}=0$, then $x^{3}+a_{2}x=0$, $x=0$ or $x^{2}=a_{2}$. Hence, $a_{2}\neq 0$.

If $a_{1}\neq 0$, then according to Lemma 34, we know that $x^{3}+a_{2}x+a_{1}=0$ has exactly one solution in ${\mathbb{F}}_{q}^{*}$ if and only if ${\rm Tr}_{2^{m}/2}\left(\frac{a_{2}^{3}}{a_{1}^{2}}\right)\neq{\rm Tr}_{2^{m}/2}(1)$.

Now assume that $a_{3}\neq 0$. Then $f$ is $2$-to-$1$ if and only if for any $b\in{\mathbb{F}}_{q}$, we have

[TABLE]

has exactly two solutions $x=0$ and $x=x_{0}\in{\mathbb{F}}_{q}^{*}$, or equivalently,

[TABLE]

has exactly one solution in ${\mathbb{F}}_{q}^{*}$ for any $b\in{\mathbb{F}}_{q}$.

If $b^{2}a_{3}+a_{1}=0$, i.e., $b=a_{1}^{1/2}a_{3}^{-1/2}$, then Eq. (7) reduces to

[TABLE]

Since Eq. (8) has exactly one solution in ${\mathbb{F}}_{q}^{*}$, we have $ba_{3}+a_{2}=0$. Then with $b^{2}a_{3}+a_{1}=0$, we know that $a_{2}^{2}=a_{1}a_{3}.$ Plugging it into Eq. (7), and letting $x=a_{3}+z$, we get

[TABLE]

where $u=a_{3}^{2}+ba_{3}+a_{2}$ and $v=b^{2}a_{3}+ba_{3}^{2}+a_{2}a_{3}+a_{1}.$

If $v=0$, i.e., $\left(ba_{3}^{1/2}+a_{1}^{1/2}\right)\left(ba_{3}^{1/2}+a_{1}^{1/2}+a_{3}^{3/2}\right)=0$, then $b=a_{1}^{1/2}a_{3}^{-1/2}$ or $b=a_{1}^{1/2}a_{3}^{-1/2}+a_{3}$. When $b=a_{1}^{1/2}a_{3}^{-1/2}$, Eq. (7) has exactly one nonzero solution $x=a_{3}$. When $b=a_{1}^{1/2}a_{3}^{-1/2}+a_{3}$, we have $u=0$. Therefore, $z=0$ is the unique solution of Eq. (9). Moreover, Eq. (7) also has exactly one solution $x=a_{3}$.

Now we assume that $v\neq 0$. According to Lemma 34, it suffices to prove

[TABLE]

Claim 1: ${\rm Tr}_{2^{m}/2}\left(u^{3}/v^{2}\right)=0$, where $u=a_{3}^{2}+ba_{3}+a_{2}$, $v=b^{2}a_{3}+ba_{3}^{2}+a_{2}a_{3}+a_{1}\neq 0$ and $a_{2}^{2}=a_{1}a_{3}$.

We have

[TABLE]

where

[TABLE]

and

[TABLE]

Let $U=b^{2}a_{3}^{4}+a_{3}^{6}+a_{1}a_{3}^{3}$. Then $A=UB+U^{2}.$ Thus,

[TABLE]

From Claim 1, we know that ${\rm Tr}_{2^{m}/2}\left(u^{3}/v^{2}\right)\neq{\rm Tr}_{2^{m}/2}(1)$ if and only if $m$ is odd. The proof is completed. ∎

(B.2) $p=3$.

Theorem 36**.**

Let $f(x)=x^{4}+a_{2}x^{2}+a_{1}x\in{\mathbb{F}}_{3^{m}}[x]$, where $m>1$. Then $f(x)$ is $2$-to-$1$ over ${\mathbb{F}}_{3^{m}}$ if and only if $a_{2}=a_{1}=0$ and $m$ is odd.

Before proving this theorem, we give two lemmas.

Lemma 37**.**

*([26, Theorem 6.2.2])

Let $f\in{\mathbb{F}}_{q}[x]$ be a polynomial of degree $d>0$ and $\chi:{\mathbb{F}}_{q}^{*}\to\mathbb{C}^{*}$ a non-trivial multiplicative character of order $m$ (extended by zero to ${\mathbb{F}}_{q}$). If $f$ is not an $m$-th power in $\overline{{\mathbb{F}}}_{q}[x]$, then*

[TABLE]

Lemma 38**.**

Let $h(x)=x^{6}+2a_{2}x^{4}+a_{1}x^{3}+a_{2}^{3}\in{\mathbb{F}}_{q}[x]$, where $q=3^{m}$. Then $h(x)$ is a square in $\overline{{\mathbb{F}}}_{q}[x]$ if and only if $a_{1}=a_{2}=0.$

Proof.

Let $h(x)=g(x)^{2}$, where $g(x)\in\overline{{\mathbb{F}}}_{q}[x]$. Hence, $h^{\prime}(x)=2g(x)g^{\prime}(x)$, it follows that $g(x)\mid\gcd\left(h(x),h^{\prime}(x)\right)$. On the other hand, $h^{\prime}(x)=2a_{2}x^{3}$. Therefore, if $a_{2}\neq 0$, then $\gcd\left(h(x),h^{\prime}(x)\right)=\gcd\left(x^{6}+2a_{2}x^{4}+a_{1}x^{3}+a_{2}^{3},2a_{2}x^{3}\right)=1$, which is impossible. Thus $a_{2}=0$ and $h(x)=x^{3}(x^{3}+a_{1})$. Then it follows that $a_{1}=0$, $g(x)=x^{3}$ and $h(x)=x^{6}$. We are done. ∎

Proof of Theorem 36. Assume that $f$ is $2$-to-$1$. If $a_{2}=a_{1}=0$, then $f(x)=x^{4}$ is $2$-to-$1$ over ${\mathbb{F}}_{q}$ if and only if $\gcd(4,3^{m}-1)=2$, or equivalently, if and only if $m$ is odd.

Now we assume that $(a_{1},a_{2})\neq(0,0)$.

Since $f$ is $2$-to-$1$, then for all but one $b$ in ${\mathbb{F}}_{q}$,

[TABLE]

has exactly two solutions $x=0$ or $x=x_{0}\in{\mathbb{F}}_{q}^{*}$, which means

[TABLE]

has exactly a unique solution in ${\mathbb{F}}_{q}^{*}$ for all but one $b$ in ${\mathbb{F}}_{q}$. For convenience, we denote by $b_{0}$ this exceptional element.

Now let $b\neq 0$ and $b\neq b_{0}$. Let $g(x)=x^{3}+bx^{2}+a_{2}x+\left(b^{3}+2a_{2}b+a_{1}\right)$, and let

[TABLE]

where $A_{3}=\frac{a_{2}^{3}}{b^{3}}+b^{3}+2a_{2}b+a_{1}.$ It is clear that $g(x)$ has exactly one solution in ${\mathbb{F}}_{q}^{*}$ if and only if $\tilde{g}(x)$ has exactly one solution. Since $\tilde{g}(x)$ is affine over ${\mathbb{F}}_{3^{m}}$, it has exactly one solution in ${\mathbb{F}}_{q}^{\ast}$ if and only if $A_{3}=0$ or $\eta\left(-\frac{b}{A_{3}}\right)=-1$ if $A_{3}\neq 0$. Therefore, when $A_{3}\neq 0$, $\eta\left(-\frac{b}{A_{3}}\right)=-1.$ Furthermore,

[TABLE]

Let $h(b)=b^{6}+2a_{2}b^{4}+a_{1}b^{3}+a_{2}^{3}$. Then the above discussion leads to

[TABLE]

On the other hand, according to Lemmas 37 and 38, we have $h(b)$ is not a square and

[TABLE]

Thus, $q-10\leq 5\sqrt{q}$, where $q=3^{m}$. Hence we have $m\leq 3$. An exhaustive search over ${\mathbb{F}}_{3^{2}}$ and ${\mathbb{F}}_{3^{3}}$ found that there is no $2$-to-$1$ function with the form of $f(x)=x^{4}+a_{2}x^{2}+a_{1}x$, where $\left(a_{2},a_{1}\right)\neq(0,0)$. The proof is completed.$\hfill\Box$

**(B.3) $p\geq 5$. **

Theorem 39**.**

Let $q=p^{m}$, where $p\geq 5$ and $f(x)=x^{4}+a_{2}x^{2}+a_{1}x\in{\mathbb{F}}_{q}[x]$. Then $f(x)$ is $2$-to-$1$ if and only if one of the following holds:

$a_{1}=a_{2}=0$, $\gcd(4,q-1)=2$, i.e., $q\equiv 3\pmod{4}$; 2. 2.

$q=5$, $f(x)=x^{4}+x^{2}\pm 2x$, or $f(x)=x^{4}-x^{2}\pm x$ or $f(x)=x^{4}\pm 2x^{2}$; 3. 3.

$q=7$, $f(x)=x^{4}\pm 2x$.

Proof.

Assume that $f$ is $2$-to-$1$. If $a_{2}=a_{1}=0$, then $f(x)=x^{4}$ is $2$-to-$1$ over ${\mathbb{F}}_{q}$ if and only if $\gcd(4,q-1)=2$, or equivalently, if and only if $q\equiv 3\pmod{4}$.

Now we assume that $(a_{1},a_{2})\neq(0,0)$. Then for all but one $b\in{\mathbb{F}}_{q}$, $f(x+b)-f(b)=x^{4}+4bx^{3}+6b^{2}x^{2}+4b^{3}x+a_{2}\left(2bx+x^{2}\right)+a_{1}x=0$ has exactly two solutions in ${\mathbb{F}}_{q}$, i.e.,

[TABLE]

has exactly one solution in ${\mathbb{F}}_{q}^{*}$ for all but one $b\in{\mathbb{F}}_{q}$.

Let $x=y-\frac{4}{3}b$. Plugging it into Eq. (11), we get

[TABLE]

where

[TABLE]

and

[TABLE]

Since Eq. (12) has exactly one solution in ${\mathbb{F}}_{q}^{*}$ for all but one $b\in{\mathbb{F}}_{q}$, $\Delta=-4A_{1}^{3}-27A_{0}^{2}$ is a nonsquare. In addition, after computing, we obtain

[TABLE]

where $h(b)=b^{6}+2a_{2}b^{4}+\frac{5}{2}a_{1}b^{3}+\frac{5}{4}a_{2}^{2}b^{2}+\frac{9}{4}a_{1}a_{2}b+\frac{1}{4}a_{2}^{3}+\frac{27}{16}a_{1}^{2}.$ Assume $h(b)=g(b)^{2}$, where $g(b)=b^{3}+g_{2}b^{2}+g_{1}b+g_{0}\in\bar{{\mathbb{F}}}_{q}[b]$. Then $g_{2}=0$, $2a_{2}=2g_{1}$, i.e., $g_{1}=a_{2}$. Moreover,

[TABLE]

After matching the coefficients of the above equation, we know that $a_{2}=0$ and $a_{1}=0$. Hence, $h(b)$ is not a square since $(a_{1},a_{2})\neq(0,0).$

Similarly, on one hand, since $\Delta=-16h(b)$ is a non-square for all but at most one $b\in{\mathbb{F}}_{q}^{\ast}$ such that $A_{0}\neq 0$, we have

[TABLE]

On the other hand, since $h(b)$ is not a square, it follows from Lemma 37 that

[TABLE]

Thus $q=p^{m}<49$. An exhaustive search finishs the proof. ∎

5.3 Dickson polynomials

The Dickson polynomials have been extensively investigated in recent years under different contexts.

Definition 40**.**

The Dickson polynomial of the first kind of degree $n$ in indeterminate $x$ and with parameter $a\in\mathbb{F}_{q}^{*}$ is defined by Waring’s formula

[TABLE]

Proposition 41**.**

[15]** Let $D_{n}(x,a)$ be the Dickson polynomial of the first kind. Then $D_{n}(x,a)$ is $e$-to-$1$ over ${\mathbb{F}}_{q}$ if and only if $\gcd(n,q^{2}-1)=e$.

Remark 42**.**

The previous proposition can only provide $2$-to-$1$ mappings if $q$ is odd.

In 2009 Hou et al. considered a different perspective of the Dickson polynomial [18]. They fixed $a\in{\mathbb{F}}_{q}$, and studied the polynomial $D_{n}(a,x)\in{\mathbb{F}}_{q}[x]$, which they called reversed Dickson polynomial. The following result characterizes the reversed Dickson polynomial which are permutation in even characteristic in terms of $2$-to-$1$ mappings.

Proposition 43**.**

[18, Proposition 4.2]** $D_{n}(1,x)$ is permutation polynomials over $\mathbb{F}_{2^{m}}$ if and only if the function $y\mapsto y^{n}-(1-y)^{n}$ is a $2$-to-$1$ mapping on $\mathbb{F}_{2^{m}}\cup V$ where $V:=\{x\in\mathbb{F}_{2^{2m}}\mid x^{2^{m}}=1-x\}$.

5.4 Muller-Cohen-Matthews polynomials

Definition 44**.**

Let $q=2^{m}$ where $m>1$ is a positive integer. Let $T_{k}(x):=\sum_{i=0}^{k-1}x^{2^{i}}$. Then $f_{k,d}(x):=\frac{T_{k}^{d}(x^{c})}{x^{2^{k}}}$ (where $cd=2^{k}+1$) is the so-called Muller-Cohen-Matthews polynomial in $\mathbb{F}_{2^{n}}[x]$.

For every odd $k$, all $f_{k,d}$ are exceptional polynomials which induce a permutation on $\mathbb{F}_{2^{m}}$ when $m$ is relatively prime to $k$. We shall apply Muller-Cohen-Matthews polynomials for the choice $c=1$ and $d=2^{k}+1$. Then we have:

Proposition 45**.**

[16]** Suppose that $\gcd(k,m)=1$ and $k$ is even. Then $f_{k,2^{k}+1}$ is a $2$-to-$1$ mapping on $\mathbb{F}_{2^{m}}$.

5.5 Other Polynomials

We recall results on construction of $2$-to-$1$ mappings related with the trace functions.

Proposition 46**.**

[8]** Let $0\leq i\leq n-1$, $i\not\in\{0,\frac{n}{2}\}$ and $\delta$, $\gamma\in{\mathbb{F}}_{2^{n}}$ be such that $\delta^{2^{i}-1}=\gamma^{1-2^{2i}}$. If ${\rm Tr}_{2^{n}/2}(\delta\gamma^{2^{i}+1})=1$, then $F:\mathbb{F}_{2^{n}}\rightarrow\mathbb{F}_{2^{n}}$ defined by $F(y)=y+\gamma{\rm Tr}_{2^{n}/2}(\delta y^{2^{i}+1})$ is $2$-to-$1$.

Proposition 47**.**

[8]** Let $\gamma\in\mathbb{F}_{2^{n}}^{\ast}$ such that ${\rm Tr}_{2^{n}/2}(\gamma)=1$. Then the mapping $x\mapsto x^{s}+\gamma{\rm Tr}_{2^{n}/2}(x^{t})$ is $2$-to-$1$ over ${\mathbb{F}}_{2^{n}}$, where $s$ and $t$ are two positive integers.

6 Applications of $2$-to-$1$ mappings over finite fields

6.1 Bent functions

Bent functions introduced in 1974 ([14],[28]) are extremal objects in combinatorics and Boolean function theory. They are maximally nonlinear Boolean functions. Recall that the nonlinearity of a Boolean function $f$, denoted by $nl(f)$, is defined as the minimum Hamming distance between $f$ and all affine functions (that is, of degree at most $1$). It can be expressed by means of the Walsh transform as follows:

[TABLE]

Because of the well-known Parseval’s relation $\sum_{b\in{\mathbb{F}}_{2^{n}}}{\widehat{\chi}_{f}(b)}^{2}=2^{2n}$, $nl(f)$ is upper bounded by $2^{n-1}-2^{n/2-1}$. This bound is tight for $n$ even.

Definition 48**.**

Let $n$ be an even integer. A Boolean function on ${\mathbb{F}}_{2^{n}}$ is said to be bent if the upper bound $2^{n-1}-2^{n/2-1}$ on its nonlinearity $nl(f)$ is achieved with equality.

Bent functions on ${\mathbb{F}}_{2^{n}}$ exist then only when $n$ is even. We have the following main characterization of the bentness for Boolean functions in terms of the Walsh transform.

Proposition 49**.**

Let $n$ be an even integer. A Boolean function $f$ is bent if and only if its Walsh transform satisfies $\displaystyle\widehat{\chi}_{f}(a)=\pm 2^{\frac{n}{2}}$ for all $a\in{\mathbb{F}}_{2^{n}}$.

A recent survey on bent functions can be found in [6]. A book devoted especially to bent functions and containing a complete survey on bent functions (including its variations and generalizations) is [24].

One of the important classes of bent functions is the so-called class $\mathcal{H}$ whose elements $g$ are defined in bivariate representation over ${\mathbb{F}}_{2^{m}}\times{\mathbb{F}}_{2^{m}}$ by

[TABLE]

where $\psi:{\mathbb{F}}_{2^{m}}\rightarrow{\mathbb{F}}_{2^{m}}$ and $\mu\in{\mathbb{F}}_{2^{m}}$.

Two-to-one mappings over finite fields in characteristic $2$ allow to construct bent Boolean functions in bivariate representation from the class $\mathcal{H}$ as follows:

Proposition 50**.**

([5]) Let $g$ be a function defined on ${\mathbb{F}}_{2^{m}}\times{\mathbb{F}}_{2^{m}}$ by (14). Then $g$ is bent if and only if

[TABLE]

[TABLE]

The following result shows that one can construct vectorial bent functions from certain two-to-one mappings.

Theorem 51**.**

Let $m$ and $k$ be two positive integers such that $\gcd(k,2^{m}-1)=1$. Assume that $z\mapsto z^{k}+bz$ is 2-to-1 on ${\mathbb{F}}_{2^{m}}$, where $b\in\mathbb{F}_{2^{m}}^{\ast}$. Then the vectorial function $F$ defined from $\mathbb{F}_{2^{m}}\times\mathbb{F}_{2^{m}}$ to $\mathbb{F}_{2^{m}}$ by $F(x,y)=y^{k}x^{k(2^{m}-2)+1}$ is bent.

Proof.

Recall that $F$ is bent if and only if all its components (Boolean) functions $F_{v}:x\mapsto{\rm Tr}_{2^{m}/2}(vF(x,y))$ ($v\in\mathbb{F}_{2^{m}}^{\ast}$) are bent on ${\mathbb{F}}_{2^{m}}$. Let us compute the Walsh transform of $F_{v}$ at each element $(a,b)\in\mathbb{F}_{2^{m}}\times\mathbb{F}_{2^{m}}$.

We have:

[TABLE]

where $\delta_{0}(b)$ denotes $1$ if $b=0$ and [math] if $b\neq 0$.

Set $z:=x^{(2^{m}-2)}y$, that is, $y=zx$. Therefore,

[TABLE]

Now, if $b\not=0$ then the equation $vz^{k}+bz+a=0$ has [math] or $2$ solutions in ${\mathbb{F}}_{2^{m}}$ since the mapping $z\mapsto z^{k}+bz$ is 2-to-1 on ${\mathbb{F}}_{2^{m}}$. Thus, $\widehat{\chi}_{F_{v}}(a,b)=2^{m}(\#\{z\in{\mathbb{F}}_{2^{m}}\mid vz^{k}+bz+a=0\}-1)=\pm 2^{m}$.

If $b=0$ then the equation $vz^{k}+a=0$ has only one solution in ${\mathbb{F}}_{2^{m}}$ since $\gcd(k,2^{m}-1)=1$. Hence, $\widehat{\chi}_{F_{v}}(a,b)=2^{m}\#\{z\in{\mathbb{F}}_{2^{m}}\mid vz^{k}+a=0\}=2^{m}$. This completes the proof. ∎

6.2 Semi-bent functions

Semi-bent functions (or $2$-plateaued functions) on ${\mathbb{F}}_{2^{n}}$ exist only when $n$ is even. Semi-bent functions are defined as follows.

Definition 52**.**

Let $n$ be an even integer. A Boolean function on ${\mathbb{F}}_{2^{n}}$ is said to be semi-bent if its Walsh transform satisfies $\displaystyle\widehat{\chi}_{f}(a)\in\{0,\pm 2^{\frac{n+2}{2}}\}$ for all $a\in{\mathbb{F}}_{2^{n}}$.

Recall that the Maiorana-McFarland’s constructions are the best known primary constructions of bent functions ([23, 14]). The Maiorana-McFarland class is the set of all the Boolean functions on ${\mathbb{F}}_{2^{m}}\times{\mathbb{F}}_{2^{m}}$ of the form : $f(x,y)={\rm Tr}_{2^{m}/2}(x\pi(y))+g(y),$ where $x,y\in{\mathbb{F}}_{2^{m}},\pi$ is any permutation on ${\mathbb{F}}_{2^{m}}$ and $g$ is any Boolean function on ${\mathbb{F}}_{2^{m}}$. Any such function is bent (the bijectivity of $\pi$ is a necessary and sufficient condition for $f$ being bent). By computing the Walsh transform, we see that $f$ is semi-bent on ${\mathbb{F}}_{2^{m}}\times{\mathbb{F}}_{2^{m}}$ if $\pi$ is a 2-to-1 mapping from ${\mathbb{F}}_{2^{m}}$ to ${\mathbb{F}}_{2^{m}}$. Therefore two-to-one mappings over finite fields in characteristic $2$ allow to construct semi-bent Boolean functions in bivariate representation from the Maiorana-McFarland class as follows:

Theorem 53**.**

Let $\pi$ be a mapping from ${\mathbb{F}}_{2^{m}}$ to ${\mathbb{F}}_{2^{m}}$ and $g$ be a Boolean function on ${\mathbb{F}}_{2^{m}}$. Let $f$ be a Boolean function defined over ${\mathbb{F}}_{2^{m}}\times{\mathbb{F}}_{2^{m}}$ by $f(x,y)={\rm Tr}_{2^{m}/2}(x\pi(y))+g(y)$. If $\pi$ is $2$-to-$1$ on ${\mathbb{F}}_{2^{m}}$, then $f$ is semi-bent.

Proof.

For every $(a,b)\in{\mathbb{F}}_{2^{m}}\times{\mathbb{F}}_{2^{m}}$, we have:

[TABLE]

Since the mapping $y\in{\mathbb{F}}_{2^{m}}\mapsto\pi(y)$ is 2-to-1 for every $a\in{\mathbb{F}}_{2^{m}}$, we have $\widehat{\chi}_{f}(a,b)\in\{0,\pm 2^{m+1}\}$, which completes the proof. ∎

The following statement illustrates an example of constructions of semi-bent functions via $2$-to-$1$ mappings in the line of the Maiorana-McFarland’s method.

Proposition 54**.**

Let $r$ be a positive integer. Set $m=2r-1$. Let $g$ be any Boolean function over ${\mathbb{F}}_{2^{m}}$. Define over ${\mathbb{F}}_{2^{m}}\times{\mathbb{F}}_{2^{m}}$ a Boolean function by $f(x,y)={\rm Tr}_{2^{m}/2}(xy^{2^{r}+2}+xy)+g(y)$, $\forall(x,y)\in{\mathbb{F}}_{2^{m}}\times{\mathbb{F}}_{2^{m}}$. Then $f$ is semi-bent.

Proof.

The construction comes from Theorem 53 and the fact that the mapping $y\in{\mathbb{F}}_{2^{m}}\mapsto y^{2^{r}+2}+y$ is 2-to-1. ([12]). ∎

Note that given an APN function, one can derive a construction of semi-bent function in the sprit of Maiorana-McFarland’s method.

6.3 Planar functions

Let $q=p^{n}$ where $p$ is prime and $n$ is a positive integer. A planar function is a function $f:\mathbb{F}_{q}\rightarrow\mathbb{F}_{q}$ such that, for every $a\in\mathbb{F}_{q}^{*}$, the function $c\mapsto f(c+a)-f(c)$ is a bijection on $\mathbb{F}_{q}$. Planar functions can be used to construct finite projective planes, and they have been studied by finite geometers since 1968.

The following result highlights the importance of $2$-to-$1$ mappings for the constructions of planar functions of minimal size of their image set. .

Theorem 55**.**

[22]** Let $F:\mathbb{F}_{q}\rightarrow\mathbb{F}_{q}$ be a mapping and $\textup{Im}(F)$ be its image set. Assume that $F$ is planar (which implies $\#\textup{Im}(F)\geq\frac{q+1}{2}$). Then $F$ is $2$-to-$1$ if and only if $\#\textup{Im}(F)=\frac{q+1}{2}$.

A class of polynomials was described by Dembowski and Ostrom in [13]: the so-called Dembowski-Ostrom polynomials. For those polynomials, the property of being planar is equivalent to the property of being $2$-to-$1$. We first recall their definition.

Definition 56**.**

The polynomial $P\in\mathbb{F}_{q}[x]$ is called a Dembowski-Ostrom polynomial if $P$ has the shape $P(x)=\sum_{i,j=0}^{n-1}a_{ij}x^{p^{i}+p^{j}}$.

Proposition 57**.**

[10]** Let $P:\mathbb{F}_{q}\rightarrow\mathbb{F}_{q}$ be given by a Dembowski-Ostrom polynomial. Then $P$ is planar if and only if $P$ is $2$-to-$1$.

6.4 Permutation polynomials

Permutation polynomials can also be constructed from $2$-to-$1$ mappings.

Proposition 58**.**

Let $F:{\mathbb{F}}_{2^{n}}\rightarrow{\mathbb{F}}_{2^{n}}$ be a two-to-one mapping. Denote by $\textup{Im}(F)$ the image set of $F$. Let $\phi:\textup{Im}(F)\rightarrow{\mathbb{F}}_{2^{n}}\setminus\textup{Im}(F)$ be a bijection, and ${\mathbb{F}}_{2^{n}}=S_{1}\cup S_{2}$ be a disjoint decomposition of ${\mathbb{F}}_{2^{n}}$ such that $F(S_{1})=F(S_{2})=\textup{Im}(F)$. Define

[TABLE]

Then $G$ is a permutation polynomial over ${\mathbb{F}}_{2^{n}}$.

7 Concluding remarks

Many results presented in the literature highlight the importance of two-to-one mappings for designing cryptographic functions. Despite their importance, they have never been studied in detail in a general framework. Because of the gap between the interest of the notion of two-to-one mappings and the knowledge we have on it, our motivation was to bring a systematic study on those mappings by providing several results including new tools, constructions and applications. From our criteria, we expected new constructions of cryptographic functions from two-to-one mappings.

At last, we would like to note that most of the results of this paper can be easily generalized to $q$-to-$1$ mappings. $q$-to-$1$ mappings may also be useful in design theory, error-correcting codes, cryptography and others. We leave this generalization and the adventure to $q$-to-$1$ polynomials to interested readers.

Acknowledgement. The authors deeply thank the Assoc. Edit. Prof. Xiaohu Tang and the anonymous reviewers for their valuable comments and suggestions which have highly improved the manuscript.