A new construction of rotation symmetric bent functions with maximal algebraic degree

In this paper, for any even integer \begin{document}$ n = 2m\ge4 $\end{document} , a new construction of \begin{document}$ n $\end{document} -variable rotation symmetric bent function with maximal algebraic degree \begin{document}$ m $\end{document} is given as \begin{document}$ f(x_0,x_1\cdots,x_{n-1}) = \bigoplus\limits_{i = 0}^{m-1}(x_ix_{m+i})\oplus \bigoplus\limits_{i = 0}^{n-1}(x_ix_{i+1}\cdots x_{i+m-2} \overline{x_{i+m}} ), $\end{document} whose dual function is \begin{document}$ \widetilde{f}(x_0,x_1\cdots,x_{n-1}) = \bigoplus\limits_{i = 0}^{m-1}(x_ix_{m+i})\oplus \bigoplus\limits_{i = 0}^{n-1}(x_ix_{i+1}\cdots x_{i+m-2} \overline{x_{i+n-2}} ), $\end{document} where \begin{document}$ \overline{x_{i}} = x_{i}\oplus 1 $\end{document} and the subscript of \begin{document}$ x $\end{document} is modulo \begin{document}$ n $\end{document} .


(Communicated by Zhengchun Zhou)
Abstract. In this paper, for any even integer n = 2m ≥ 4, a new construction of n-variable rotation symmetric bent function with maximal algebraic degree m is given as whose dual function is where x i = x i ⊕ 1 and the subscript of x is modulo n.

Introduction
The subject of Boolean functions is well established and constitutes a cornerstone of cryptography and coding theory. Bent functions were introduced by Rothaus in 1976 [17]. A Boolean function is bent if it has maximal Hamming distance to the set of all the affine Boolean functions. Bent functions have been attracted much attention due to their important applications in cryptography, coding theory and sequence design [1,5,11,12,14,15]. Bent functions always occur in pairs, that is, given a bent function one can always define its dual function which is again a bent function. Yet, computing the dual function of a given bent function is not an easy task in general [13].
It has been found recently that the class of rotation symmetric Boolean functions is extremely rich in terms of cryptographically significant Boolean functions. An n-variable Boolean function over the vector space F n 2 which is invariant under the action of the cyclic group C n is called rotation symmetric Boolean function. Rotation symmetric Boolean functions were introduced (with a different name, idempotents) in Papers [6,7] and were studied under their now standard name in Paper [16]. In fact, such class of Boolean functions is of great interest since they need less space to be stored and allow faster computation of their Walsh-Hadamard transform [8,10]. In recent years, the construction of rotation symmetric bent functions has become a hot topic. Any theoretic advancement in this direction can be used to find cryptographically significant functions on higher number of variables. Before 2015, only few constructions of rotation symmetric bent functions were known [3,4,9]. Further, the algebraic degrees of these rotation symmetric bent functions are not more than 4. For instance, in 2012, Gao et al. proved that the cubic rotation symmetric [9], where n = 2m, 1 ≤ t ≤ m − 1, x i+m = x i+m ⊕ 1, and the subscript of x is modulo n. In 2017, a systematic constructions of n-variable rotation symmetric bent functions with any possible algebraic degree ranging from 2 to n/2 were proposed in Paper [18]. In Paper [19], the authors proposed a large group of bent functions with optimal algebraic degree and studied their dual bent functions.
In this paper, for any even integer n ≥ 4, a new construction of n-variable rotation symmetric bent function with maximal algebraic degree n/2 is presented, whose dual function is also given.
The rest of this paper is organized as follows. In Section 2, some basic notations and definitions of Boolean functions and rotation symmetric bent functions are reviewed. In Section 3, the construction of n-variable rotation symmetric bent function with maximal algebraic degree n/2 is given. In Section 4, the dual function of the proposed rotation symmetric bent function is proposed, which also has maximal algebraic degree. Section 5 concludes this paper.

Preliminaries
Let F 2 be the finite field with two elements, n be a positive integer, and F n 2 be the n-dimensional vectorspace over F 2 . To avoid confusion, we denote the sum over Z by + or , and the sum over F 2 by ⊕ or . Given a vector x = (x 0 , x 1 , · · · , x n−1 ) ∈ F n 2 , define its support as the set supp(x) = {0 ≤ i < n | x i = 1}, and its Hamming weight wt(x) as the cardinality of its support, i.e., wt(x) = |supp(x)|.
An n-variable Boolean function is a mapping from F n 2 into F 2 . We denote by B n the set of all the n-variable Boolean functions. Given a subset T ⊆ F n 2 , the characteristic function of T is defined as Hence, supp(χ T ) = T . In usual, a Boolean function f ∈ B n is expressed as where c α is the coefficient of the term x α = x α0 0 x α1 1 · · · x αn−1 n−1 for the vectors x = (x 0 , x 1 , · · · , x n−1 ) ∈ F n 2 and α = (α 0 , α 1 , · · · , α n−1 ). The expression of the Boolean function f in (1) is called the algebraic normal form (ANF) of f . Further, the algebraic degree of the Boolean function f in (1) is defined as deg(f ) = max{wt(α) | c α = 1, α ∈ F n 2 }. Especially, the Boolean functions of algebraic degree at most 1 are called affine functions.
Given a vector x = (x 0 , x 1 , · · · , x n−1 ) ∈ F n 2 , define the left l-cyclic shift of x as ρ l n (x) = (x l , x 1+l , · · · , x n−1+l ), where the integers l ≥ 0 and 0 ≤ i < n. Herein and hereafter, the subscript of x is modulo n. The orbit generated by a vector x ∈ F n 2 is defined as  n (x)) = f (x) holds for all inputs x ∈ F n 2 , then f is called an n-variable rotation symmetric Boolean function. That is, rotation symmetric Boolean functions are invariant under the left cyclic shift of their inputs. As a consequence, given a vector α ∈ F n 2 , the coefficients of the terms x β , β ∈ O n (α), in the ANF of an n-variable rotation symmetric Boolean function are all the same. Hence, when the ANF of an n-variable rotation symmetric Boolean function is given, we denote x β in this paper for simplicity. For example, when n = 4, then The Walsh-Hadamard transform of a Boolean function f ∈ B n at the point ω ∈ F n 2 is defined as For any Boolean function f ∈ B n , according to the well-known Parseval's relation [12], we know Indeed, bent function reaches the lower bound as follows.
2 , then f is called a bent function. Obviously, an n-variable Boolean function is bent only if n is even. In addition, the algebraic degree of an n-variable bent function is at most n/2 for n ≥ 4 [2]. It is known that bent functions occur in pair. In fact, given an n-variable bent function f , we define its dual function, denoted by f , when considering the signs of the values of the Walsh-Hadamard transform of f , as Note that the dual function of a bent function is bent as well [2].
From now on, for convenience, the following assumption and notations will be fixed all through this paper.
(2) Given a vector x ∈ F n 2 , we always denote The all-zero (resp. all-one) vector of length n is denoted by 0 n (resp. 1 n ). (4) We always denote a = a ⊕ 1 for an entry a ∈ F 2 and x = x ⊕ 1 n for a vector x ∈ F n 2 .

Construction of rotation symmetric bent function with maximal algebraic degree
In this section, the method of constructing new n-variable rotation symmetric bent function is to choose a proper subset of F n 2 which is used to modify the support of a well-known quadratic Boolean function as which is the first kind of rotation symmetric bent function. And then, the ANF of the newly constructed n-variable rotation symmetric bent function will be given, which has the maximal algebraic degree m.
3.1. Construction of rotation symmetric Boolean function. Firstly, let's define a subset of F n 2 , which is used to construct new n-variable rotation symmetric bent function by modifying the support of the quadratic rotation symmetric bent function given in (3), as For convenience, the subset T in (4) can be written as T = T 1 ∪ T 2 , where Note that T 1 ∩ T 2 = ∅. Further, it is easy to see that the number of the vectors in T defined in (4) is equal to 2 m−1 and the length of the orbit generated by each vector in T is equal to n.
Using the subset T of F n 2 in (4), we define an n-variable Boolean function as where f 0 is the n-variable rotation symmetric bent function defined in (3). In fact, by definition 2.1, we know the Boolean function f in (6) is rotation symmetric since f 0 is rotation symmetric. So, we need to verify that the rotation symmetric Boolean function f in (6) is bent, which will be done in the next subsection.
3.2. The bentness of the rotation symmetric Boolean function f defined in (6). In this subsection, we will verify the bentness of the rotation symmetric Boolean function f defined in (6).
Firstly, the following two conclusions will be used to compute the values of the Walsh-Hadamard transform of the rotation symmetric bent function f defined in (6).
Lemma 3.2. Given a vector ω ∈ F n 2 , we have where f 0 is given in (3), T is given in (4), and Proof. Recall that the subset T in (4) can be written as T = T 1 ∪T 2 with T 1 ∩T 2 = ∅, where T 1 and T 2 are defined in (5). Hence, we have which will be discussed in the following two cases.
(2) If x ∈ T 2 , then f 0 (ρ l n (x)) = 1 for all 0 ≤ l < n since f 0 is a rotation symmetric Boolean function and f 0 (x) = 1. Hence, similarly we have x∈T2 0≤l<n Combining (10) and (11), we have where the third identity holds by (7), and in the fourth identity we denote ∆ = {0 ≤ l < n | (ρ −l n (ω)) = 0 m−2 , ω m−2−l = ω n−1−l }. Note that, in the equation (8), if ∆ = ∅ then we get In order to calculate the values of the Walsh-Hadamard transform of the rotation symmetric Boolean function f defined in (6), for any vector ω ∈ F n 2 we should firstly determine the value of where ∆ is given in (9).
Note that the values of δ ω defined in (12), ω ∈ F n 2 , are very useful not only to calculate the values of the Walsh-Hadamard transform of the rotation symmetric Boolean function f defined in (6), but also to compute the dual function of the rotation symmetric bent function f defined in (6). Using the conclusions in Lemma 3.2 and Lemma 3.3, we can easily verify that the rotation symmetric bent function f defined in (6) is bent.
The proof is finished by Definition 2.2 and Lemma 3.3.

3.3.
The ANF of the rotation symmetric bent function f defined in (6).
In this subsection, we will compute the ANF of the n-variable rotation symmetric bent function f defined in (6).
Next conclusion tells us that we can interchange and when we compute the ANF of the n-variable rotation symmetric bent function f defined in (6).
Proof. In fact, by a direct calculation, we have Repeat the above steps, the proof is finished.
and the right hand side of the equation in (15) is equal to Now, we begin to compute the ANF of the n-variable rotation symmetric bent function f defined in (6).
Theorem 3.6. The ANF of the n-variable rotation symmetric bent function f defined in (6) is where f 0 is given in (3).
Proof. In order to calculate the ANF of the n-variable rotation symmetric bent function f defined in (6), we only need to calculate the characteristic function of O n (T ) with T given in (4) In fact, given a vector α = (α 0 , α 1 , · · · , α n−1 ) ∈ T in (4), we know α i ∈ F 2 for 0 ≤ i ≤ m − 3, α m−2 = α n−1 ∈ F 2 , α i = 0 for m − 1 ≤ i ≤ n − 3, and α n−2 = 1. Hence, where the second identity holds by Lemma 3.5 and since and the third identity holds since Since O n n−2 i=m−2 The proof is finished.
In fact, there is another rotation symmetric bent function which has the similar ANF as the rotation symmetric bent function given in Theorem 3.6. Corollary 1. The n-variable rotation symmetric Boolean function is also bent, and the support of O n x 0 x 1 · · · x m−2 x m is {x | x ∈ O n (T )}, where f 0 is given in (3) and T is given in (4).
Proof. From Theorem 3.6 we know the n-variable rotation symmetric Boolean function In this section, we study the dual function of the rotation symmetric bent function f defined in (6).
Define a subset of F n 2 as Similarly, the subset T in (16) can be written as T = T 1 ∪ T 2 , where Then, by a direct verification it is easy to know the following conclusion holds.
Corollary 2. Given a vector ω ∈ F n 2 , then δ ω = 2 if and only if ω ∈ O n T , where δ ω is given in (12) and T is defined in (16).
where f 0 is given in (3) and T is defined in (16).
The proof is finished by Corollary 2.
Theorem 4.2. The ANF of the n-variable rotation symmetric bent function f in (17) is where f 0 is given in (3).
Proof. We only need to verity that the characteristic function of O n ( T ) is where T is given in (16).
Similarly to the proof of Theorem 3.6, by Lemma 3.5 and by the definition of T , we have By a direct calculation, we have the following conclusion.
Corollary 3. The dual function of the n-variable rotation symmetric bent function in Corollary 1 is where f 0 is given in (3).

Conclusion
In this paper, for any even integer n = 2m ≥ 4, we give a new construction of n-variable rotation symmetric bent function with maximal algebraic degree and very simple ANF. Further, its dual function is also given.