A Construction of Bent Functions of n + 2 Variables from a Bent Function of n Variables and Its Cyclic Shifts

We present a method to iteratively construct new bent functions of n + 2 variables from a bent function of n variables and its cyclic shift permutations usingminterms of n variables andminterms of 2 variables. In addition, we provide the number of bent functions of n + 2 variables that we can obtain by applying the method here presented, and finally we compare this method with a previous one introduced by us in 2008 and with the Rothaus and Maiorana-McFarland constructions.


Introduction
Boolean functions are widely used in different types of cryptographic applications, such as block ciphers, stream ciphers, and hash functions [1][2][3], and in coding theory [4,5], among others.For example, the implementation of an S-box needs nonlinear Boolean functions to resist attacks such as the linear and differential cryptanalysis [6][7][8][9].For an even number of variables, Boolean functions bearing maximum nonlinearity are called bent functions [10,11].The construction of one-to-one S-boxes so that any linear combination of the output functions is balanced has already been explained [12,13] and also the issue of making such linear combination a bent function [14].However, no conclusive approaches have been presented yet for the construction of all S-boxes so that they satisfy the property that any linear combination of the outputs is also bent.It is precisely for this reason that a thorough study of the properties of bent functions as well as of the methods to construct them has occupied the minds of many authors in the last decades (see, e.g., [9,11, and the references therein).
Bent functions constitute a fascinating issue in cryptography but, unfortunately, there is a mist hovering over their properties, their classification, and their actual number.The origin of the concept of bent function takes us back to a theoretical article by McFarland [36] where he discussed difference sets in finite noncyclic groups.Dillon [24], a year later, systematized and further elaborated McFarland's insights and provided proofs for a great number of properties; Dillon's Ph.D. dissertation has been an excellent source in the field of bent functions up to the mid 1970s.But it was Rothaus [37] who came up with the name for the concept.These functions are called perfect nonlinear Boolean functions by Meier and Staffelbach [30].
There are different ways to obtain bent functions; most of them are based on the algebraic normal form of a Boolean function and the Walsh transform.However, there are very few constructions of bent functions based on the truth table of Boolean functions, for example, the partial spread class of bent functions introduced by Dillon [24]; moreover, from the truth tables of linear functions and bent functions, it is possible to construct bent functions with a greater number of 2 Algebra variables [38].But not all the bent functions in 6 variables can be obtained from bent functions and linear functions with a smaller number of variables, as proved by Chang [21].Hou and Langevin [28] described how, from a well-known bent function, new bent functions can be obtained with the same number of variables.
Charnes et al. [39,40] discovered a surprising relation with the classical invariant theory.Qu et al. [41] have found, by computer enumeration, an interesting class of bent functions with 6 variables.Carlet and Guillot [19], Dobbertin [25], Kumar et al. [29], and Langevin [42] have analyzed some bent function constructions, characterizations, properties, and generalizations.Tokareva [34] introduces lower bound on the number of bent functions that can be obtained by the iterative constructions proposed by Canteaut and Charpin [43].
A general method for generating all bent functions is not known to exist yet, except for some particular cases.For example, it is well known that, for  = 4, there are only 896 different bent functions, for  = 6, Preneel [32] (see also [21]) proved that the number of different bent functions is 5 425 430 528, and, for  = 8, Langevin and Leander [44] proved recently that the number of bent functions is 99 270 589 265 934 370 305 785 861 242 880.Nevertheless, the classification and counting for  > 8 is still an open problem.
We refer the reader to the two excellent surveys in [18] and [23,Chapter 5] about bent functions.
The mentioned literature so far makes an intensive use of the representation of Boolean functions either in polynomial form, in matrix form, or in sequential form.Nevertheless, the classical concept of minterm, which, by the way, is directly related to the implementation of logic circuits and its complexity, has not been frequently applied (see [22]).This paper purports to practically generate bent functions using the representation of Boolean functions as a sum of minterms.
The use of the algebraic normal form or the truth table or both has its advantages and disadvantages.For example, the algebraic normal form of a Boolean function (x) of  variables provides directly its degree, and, if it is greater than /2, we can ensure that (x) is not a bent function [37]; nevertheless, we do not know the cardinality of its support (i.e., the number of minterms).On the other hand, if we know the truth table of (x), then we know if its support has the necessary number of elements to be a bent function, although we do not know its degree.
The remainder of the paper is organized as follows.In Section 2, we present some basic definitions and notations used.In Section 3, we introduce a general method for the construction of bent functions of  + 2 variables using a bent function of  variables and some of its shifts; we also introduce some other important results required to prove the main theorems.In Section 4, we present the necessary results to count the number of bent functions we can construct based on the method dealt with in Section 3. Finally, in Section 5, we show that our construction generates bent functions which are not Rothaus or Maiorana-McFarland type (see, e.g., [29,37]); we also show that the construction introduced in this paper is basically different from the construction introduced in [22] and we compute the number of bent functions we can obtain using one construction but not by the other one.In addition, we summarize the number of bent functions obtained by the different methods here considered.

Preliminaries
Consider the binary field Z 2 with the addition modulo 2 (denoted by ⊕) and the multiplication modulo 2. For any positive integer , it is well known that Z  2 is a linear space over Z 2 with the addition ⊕ given by for a = ( 1 ,  2 , . . .,   ) and b = ( 1 ,  2 , . . .,   ) in Z  2 .Also, we consider the inner product of a and b.Furthermore, we say that a < b if there exists  (with 1 ≤  ≤ ) such that So, we can order the elements e 0 , e 1 , . . ., Furthermore, if e  = ( () 1 ,  () 2 , . . .,  ()  ) ∈ Z  2 , then (5) and we call the vector e  the binary expansion of the integer .With this representation, we can identify the vector e  with the integer  and, consequently, we can identify the set Z  2 with the set Z 2  .
A Boolean function of  variables is a map  : Z  2 → Z 2 .The set B  of all Boolean functions of  variables is a linear space over Z 2 with the addition ⊕ given by for ,  ∈ B  .For a function  of B  , the (0, 1)-sequence of length 2  ,   = ( (e 0 ) ,  (e 1 ) , . . .,  (e 2  −1 )) , where ( 1 ,  2 , . . .,   ) ∈ Z  2 .For  = 0, 1, 2, . . ., 2  − 1, it is evident that  e  (x) = 1 if and only if x = e  .We will write   (x) instead of  e  (x).So, the truth table, (  (e 0 ) ,   (e 1 ) , . . .,   (e 2  −1 )) , of   (x) has 1 in the th position and 0 elsewhere.Consequently, Also, since   (x) =   (x) if and only if  = , we can identify the minterm   (x) with the integer  (or with the vector e  as best suited).Now, for all  ∈ B  , it is well known that and since the identity implies   = 0 for  = 0, 1, 2, . . ., 2  − 1, we can state that the set { 0 ,  1 , . . .,  2  −1 } is a basis of B  .For all  ∈ B  , we call the support of  the set according to expression (11) and the identification of Z  2 with Z 2  .So, we can identify  as the set of minterms of (x).Therefore, we can rewrite expression (11) as where  ⊆ Z  2 or  ⊆ Z 2  as best suited.The Hamming weight of a (0, 1)-sequence , denoted by (), is the number of 1s in .The Hamming weight of a Boolean function (x), denoted by (), is the Hamming weight of its truth table   ; that is, () = (  ), and consequently, () is the number of minterms in the expression of (x) taken as a sum of minterms.A (0, 1)sequence is balanced if it contains an equal number of 0s and 1s, so a function  in B  is balanced if its truth table is balanced.
We say that  ∈ B  is an affine function if it takes the form where The nonlinearity of a function  ∈ B  is defined as where A  ⊆ B  is the set of all affine functions and the distance (, ), for ,  ∈ B  , is defined as (, ) = ( ⊕ ).The nonlinearity of  ∈ B  is upper bounded (see, e.g., [11,18,23,30]) by The Boolean functions achieving the maximum nonlinearity are called bent functions (see, e.g., [11,18,23,30]).As a consequence, bent functions only exist for  even.
It is well know that the above upper bound on the nonlinearity of a Boolean function of  variables coincides with the covering radius of the first order binary Reed-Muller code of length 2  (see, e.g., [30,45]).
The following result (see, e.g., [11,46]) that we quote for further references gives us a characterization of a bent function.
Theorem 1.Let (x) be a function of  variables.The following statements are equivalent.
(2) The Boolean function Taking into account that, and as a consequence of the previous theorem, if (x) is a bent function of  variables, then the number of 1s in its truth table is Finally, it is well known that for any bent function (x), the functions 1 ⊕ (x) and (x ⊕ u), for all u ∈ Z  2 , are also bent functions.
Before moving onto the next section, remember that two Boolean functions (x) and (x) are called affine equivalent if there exist an  ×  invertible matrix , two vectors a, b ∈ Z  2 , and a bit  ∈ Z 2 such that It is known (see, e.g., [47]) that affine equivalent functions are both bent or both not bent.So, many authors work on the problem of finding the number and representatives of affine equivalent classes of bent functions.Nevertheless, we are interested in the problem of finding how many different bent functions there exist or we can construct, because not all affine equivalent bent functions are different as we can see in the following example.

Example 2. Consider the bent function
of 4 variables; the invertible matrix the vectors a = (0, 0, 0, 1), b = (0, 0, 0, 0), and the bit  = 0.It is easy to check that the Boolean functions (x ⊕ a) ⊕  b (x) ⊕  and (x) have both the same truth table and, consequently, are the same Boolean function.

Main Results
In the rest of the paper, we consider that x = ( 1 ,  2 , . . .,   ) is a vector of Z  2 and that y Algebra Firstly, we introduce two important properties of the minterms which allow us to construct functions of  + 2 variables from functions of  variables.In the first one, for each minterm of  variables, we obtain four different minterms of  + 2 variables.Lemma 3 (see Lemma 1 of [22]).Suppose that  ∈ Z 2  and  ∈ Z 2 2 .If   (x) is a minterm of  variables and   (y) is a minterm of 2 variables, then   (y, x) =   (y)  (x) is a minterm of  + 2 variables, where The previous lemma tells us that the four minterms of  + 2 variables, which can be obtained from the minterm   (x) of  variables, are Note that if we use the vector representation for the indices of the minterms, the four minterms of  + 2 variables obtained from the minterm  a (x) of  variables are Furthermore, minterms have the following property that makes them operative from the algebraic point of view.

Lemma 4. One has 𝑚
Proof.Assume that then The following theorem is the main result of this paper.Here, we present a construction of bent functions of  + 2 variables from a bent function (x) of  variables and some cyclic shifts of (x).
is a bent function of  + 2 variables.
Proof.According to Theorem 1 we must prove that the Boolean function, is balanced for all (b, a) ∈ Z 2 2 × Z  2 with (b, a) ̸ = (0 2 , 0  ).In the following, we use the vector b = ( 1 ,  2 ) ∈ Z 2 2 as the argument of the functions and its integer representation  =  1 2 +  2 ∈ Z 2 2 as subindex of a minterm.So, by Lemma 4, Now, for each  ∈ Z 2 2 , if we denote by   the permutation of {0, 1, 2, 3} given by   () =  () ⊕  for  = 0, 1, 2, 3, then it is not difficult to prove that the 4!⋅4 cases, corresponding to the different values of  and , are reduced to one of the following four cases for some permutation  of {0, 1, 2, 3}.
(1) Consider (3) Consider  (b,a) (y, x) Observe that each one of the factors which multiply to  () (y) for  = 0, 1, 2, 3 can be written as Now, by Theorem 1, since (z) ⊕ (z ⊕ a) is balanced for all nonzero a, we have that  (b,a) (y, x) is balanced, unless a = b = 0.
Note that, as a consequence of Lemma 4, if  is the support of (x), then is the support of (x ⊕ w) for all w ∈ Z  2 .Furthermore, as a consequence of Lemma 3, if we use the decimal notation for the indices of the minterms and consider the permutation ), then the support of the bent function (y, x) constructed in Theorem 5 is the set Nevertheless, if we use the vector notation for the indices of the minterms and consider the permutation ( (0,0) (0,1) (1,0) (1,1) b 0 b 1 b 2 b 3 ), then the support of (y, x) is the set Note that the sets of expression (35) (resp., (36)) are pairwise disjoints by Lemma 3.

Counting Bent Functions
In this section we introduce some results in order to compute the number of bent functions we can construct using Theorem 5. Firstly, we consider three particular cases (see Corollaries 6, 7, and 8) which we can derive directly from Theorem 5.The first one corresponds to the case u = k = 0; the second one to the case u = k ̸ = 0, and the third one to the case 0 ̸ = u ̸ = k ̸ = 0. Corollary 6.If (x) is a bent function of  variables and  is any permutation of {0, 1, 2, 3}, then , and  is any permutation of {0, 1, 2, 3}, then  ,u,k (y, x) =  (0) (y)  (x) ⊕  (1) (y)  (x ⊕ u) is a bent function of  + 2 variables.
The following result establishes that the bent functions constructed in Corollary 6 are all different from one another.Lemma 9. Let (x) and (x) be bent functions of  variables.Assume that   (y, x) is the bent function constructed in Corollary 6 using (x) and the permutation  of {0, 1, 2, 3}.Assume also that   (y, x) is the bent function constructed in Corollary 6 using (x) and the permutation  of {0, 1, 2, 3}.If (x) ̸ = (x), then   (y, x) ̸ =   (y, x).
Proof.If  and  are the truth tables of (x) and (x), respectively, then the truth tables of   (y, x) and   (y, x) have four blocks (not necessarily in that order and not the same order for all): If   (y, x) =   (y, x), then the four blocks of the second row are a permutation of the four blocks of the first row.But if we consider the 4! cases corresponding to these permutations, we obtain that (x) = (x), or that (x) Algebra and (x) both have the same number of minterms and the complementary number of minterms.So, in all cases, we obtain a contradiction and, therefore,   (y, x) ̸ =   (y, x).
Our next result, whose proof is similar to the previous one, establishes that the bent functions constructed in Corollary 7 are all different from one another.Lemma 10.Let (x) and (x) be bent functions of  variables.Assume that  ,u (y, x) is the bent function constructed in Corollary 7 using (x), the vector u ∈ Z  2 \ {0}, and the permutation  of {0, 1, 2, 3}.Assume also that  ,a (y, x) is the bent function constructed in Corollary 7 using (x), the vector a ∈ Z  2 \{0}, and the permutation  of {0, 1, 2, 3}.
The same result is not true for the bent functions constructed using Corollary 8 as we can see in the following example.
Note that, in the previous example, (x) = (x ⊕ 1) and that {1, 2} and {1, 3} are bases of the same linear subspace {0, 1, 2, 3} of Z 2  2 .With the aim to avoid this situation which provides equal bent functions, we will consider only vectors u, k ∈ Z  2 such that {u, k} is a Gauss-Jordan basis of cardinality 2. Remember that a set {u 1 , u 2 , . . ., u  } ⊆ Z  2 is a Gauss-Jordan basis of cardinality  if the matrix whose rows are u 1 , u 2 , . . ., u  is in reduced row echelon form (see also [48,49]).
So, our next result establishes that the bent functions constructed in Corollary 8 are all different if {u, k} is a Gauss-Jordan basis of cardinality 2 of Z  2 .
Lemma 12. Let (x) and (x) be bent functions of  variables.Assume that  ,u,k (y, x) is the bent function constructed in Corollary 8 using (x), the Gauss-Jordan basis {u, k} of cardinality 2 of Z  2 , and the permutation  of {0, 1, 2, 3}.Assume also that  ,a,b (y, x) is the bent function constructed in Corollary 8 using (x), the Gauss-Jordan basis {a, b} of cardinality 2 of Z  2 , and the permutation  of {0, 1, 2, 3}.
Proof.If  and  are the truth tables of (x) and (x), respectively, then the truth tables of  ,u,k (y, x) and  ,a,b (y, x) have four blocks (not necessarily in that order and not the same order for all): where  u ,  k ,  u⊕k ,  a ,  b , and  a⊕b are the truth tables of (x⊕ u), (x ⊕ k), (x ⊕ u ⊕ k), (x ⊕ a), (x ⊕ b), and (x ⊕ a ⊕ b), respectively.
If  ,u,k (y, x) =  ,a,b (y, x), then the four blocks of the second row are a permutation of the four blocks of the first row.But if we consider the 4! cases corresponding to these permutations, we obtain that (x) = (x) or that (x) and (x) both have the same number of minterms and the complementary number of minterms, or that (44) note that if {u, k} is a Gauss-Jordan basis of cardinality 2, then {a, b} cannot be a Gauss-Jordan basis of cardinality 2. So, in all cases we obtain a contradiction and, therefore,  ,u,k (y, x) ̸ =  ,a,b (y, x).
Proof.If , , and  are the truth tables of (x), (x), and ℎ(x), respectively, then the truth tables of   (y, x),  ,u (y, x), Algebra 7 and  ℎ,u,k (y, x) have four blocks (not necessarily in that order and not the same order for all): where  u ,  a ,  b , and  a⊕b are the truth tables of (x ⊕ u), ℎ(x ⊕ a), ℎ(x ⊕ b), and ℎ(x ⊕ a ⊕ b), respectively.
The result is now evident because   (y, x) has three identical blocks,  ,u (y, x) has only two identical blocks, and all the blocks of  ℎ,a,b (y, x) are different.Now, as a consequence of the previous lemmas, we can obtain the number of bent functions of  + 2 variables that we can construct using Corollaries 6, 7, and 8.

Theorem 14.
If ]  is the number of bent functions of  variables, then using Corollaries 6, 7, and 8 one can construct 2 2+2 ]  different bent functions of  + 2 variables.
Proof.According to Lemma 9, using Corollary 6, we can construct bent functions of  + 2 variables.Similarly, according to Lemma 10, using Corollary 7, we can construct

4! 2!
]  (2  − 1) , bent functions of  + 2 variables.Finally, according to Lemma 12, using Corollary 8, we can construct bent functions of  + 2 variables where (, 2) is the number of Gauss-Jordan basis of cardinality 2 in Z  2 .Now, taking into account that each linear subspace of dimension 2 has a unique Gauss-Jordan basis of cardinality 2, we have that (, 2) is the number of linear subspaces of dimension 2 in Z  2 ; so (see [50, page 46]) The result follows now by replacing expression (49) in expression (48) and by adding expressions (46), (47), and (48) because Lemma 13 guarantees that bent functions constructed according to Corollaries 6, 7, and 8 are all different from one another.

Comparison with Other Methods
Our examples now show some bent functions constructed according to Corollaries 7 and 8 that are not Maiorana-McFarland functions or Rothaus functions.
In [22] we introduced the following construction of bent functions of +2 variables using bent functions of  variables and the minterms of two variables.

Algebra
In addition, we also establish [22,Theorem 3] that the number of different bent functions of  + 2 variables we can construct using the previous theorem is that is, 4]  from Theorem 17(1) and 6] 2  − 12]  from Theorem 17 (2).
According to expression (10) it is evident that Corollary 6 and Theorem 17(1) provide the same bent functions.It is also evident that the bent functions constructed by Corollary 7 can be obtained by Theorem 17(2) if we take In fact, for  = 2, both constructions provide the same bent functions of  + 2 = 4 variables.The following result establishes that this is the only case when both constructions provide the same bent functions.
Proof.If  0 ,  1 , , and  u are the truth tables of the functions  0 (x),  1 (x), (x), and (x ⊕ u), respectively, then, according to Theorem 17(2) and Corollary 7, the truth tables of the functions   0 , 1 (y, x) and  ,u (y, x) have four blocks (not necessarily in that order and not the same order for all): If   0 , 1 (y, x) =  ,u (y, x), then the four blocks of the second row are a permutation of the four blocks of the first row.But if we consider the 4! cases corresponding to these permutations, we obtain that u = 0, ( 0 (x),  1 So, in all cases, we obtain a contradiction and, therefore,   0 , 1 (y, x) ̸ =  ,u (y, x).
Although, for  = 2, both constructions provide the same bent functions of  + 2 = 4 variables, for  ≥ 4, Theorems 18 and 14 ensure that Theorem 17(2) provides (see expression (47) and the comment explaining expression (55)) bent functions of  + 2 variables which cannot be obtained by Corollary 7. Now, the following result, whose proof is similar to the previous one, establishes that none of the bent functions obtained by Corollary 8 can be obtained by Theorem 17 (2) and vice versa.Theorem 19.Let  0 (x),  1 (x), and (x) be bent functions of  variables and assume that {u, k} is a Gauss-Jordan basis of cardinality 2 of Z  2 ; then   0 , 1 (y, x) ̸ =  ,u,k (y, x).
So, Theorem 19 and expressions (48) and (49) ensure that the number of different bent functions of  + 2 variables constructed by Corollary 8, which cannot be obtained by Theorem 17 (2), is Finally, adding expressions (55) and (60), we have the following result which establishes the number of different bent functions we can construct using Theorems 5 and 17.Table 1 summarizes the number of bent functions we can construct using Theorems 5 and 17 compared with the number of bent functions of the classes of Rothaus and Maiorana-McFarland and the iterative construction.The number of Rothaus functions for more than 6 variables is unknown.Also, the number of bent functions of more than 10 variables is unknown.Note that for 4 variables the number of bent functions provided by Theorem 5 or by Theorem 17 (see comments after Theorem 18) is the same as the number of bent functions provided by Rothaus construction; nevertheless, both constructions provide different bent functions as we can see in Example 16.Using the iterative construction of Canteaut and Charpin [43], Tokareva [34] obtain the same number of bent functions for 4 variables and more functions for a greater number of variables, but for 8 and 10 variables, she only provides a lower bound on the number of bent functions that can be obtained.Finally, an exhaustive computer search shows that the 512 bent functions of 4 variables obtained by iterative construction and Theorem 17 are the same.