SOME NEW RESULTS ON THE CONJECTURE ON EXCEPTIONAL APN FUNCTIONS AND ABSOLUTELY IRREDUCIBLE POLYNOMIALS: THE GOLD CASE

. An almost perfect nonlinear (APN) function f : F 2 n → F 2 n (neces- sarily polynomial) is called exceptional APN if it is APN on inﬁnitely many extensions of F 2 n . Aubry, McGuire and Rodier conjectured that the only excep- tional APN functions are the Gold and the Kasami-Welch monomial functions. They established that a polynomial function of odd degree is not exceptional APN provided the degree is not a Gold number (2 k + 1) or a Kasami-Welch number (2 2 k − 2 k + 1). When the degree of the polynomial function is a Gold number or a Kasami-Welch number, several partial results have been obtained by several authors including us. In this article we address these exceptions. We almost prove the exceptional APN conjecture in the Gold degree case when deg ( h ( x )) is odd. We also show exactly when the corresponding multivariate polynomial φ ( x,y,z ) is absolutely irreducible. Also, there is only one result known when f ( x ) = x 2 k +1 + h ( x ), and deg( h ( x )) is even. Here, we extend this result as well, thus making progress in this case that seems more diﬃcult.


Introduction and background
In this section, we give the necessary background that we use in the article. For a deeper introduction to APN functions and exceptional APN functions, and their applications, we recommend the articles in the bibliography from [1] to [25] and the survey articles [4,24] and references therein. Definition 1. Let L = F q , with q = 2 n for some positive integer n. A function f : L → L is said to be almost perfect nonlinear (APN) on L if for all a, b ∈ L, a = 0, the equation (1) f has at most 2 solutions. It is called exceptional APN if it is APN on infinitely many extensions of L.
Nyberg [23] proved that APN functions have the property of being highly resistant against differential cryptanalytic attacks when they are used as substitution components of block ciphers (S-Boxes).
Much earlier, the motivation for APN functions came by way of research in communication systems in the theory of sequence design and in the design of cyclic codes. Consider the cyclic code of length 2 s − 1 generated by C (t) s = m ω (T )m ω t (T ) where m ω (T ) (resp. m ω t (T ) ) is the minimal polynomial of ω (resp. ω t ), where ω is a primitive element of F 2 s . These codes had arisen in the context of Preparata and Goethals codes, see [2], and in sequence design [22]. By a result of van Lint and Wilson, these cyclic codes have minimum distance at most 5 when s ≥ 4. When t = 2 k + 1 (a Gold exponent) or t = 2 2k − 2 k + 1 (a Kasami-Welch exponent), then there exist infinitely many values of s, for which the minimum distance of the code is 5 (see [21] for the references). Janwa and Wilson [21] studied this question for other families of exponents, and gave partial results. They formulated this problem as an algebraic geometric problem as follows. A word of weight 4 of C (t) s corresponds to ω i +ω j +ω k +ω l = 0 and ω it +ω jt +ω kt +ω lt = 0. The equations ω i +ω j +ω k +ω l = 0 and ω it + ω jt + ω kt + ω lt = 0 lead to the hyperplane section of the following Fermat variety x t + y t + z t + w t = 0 by the hyperplane z + y + z + w = 0 and the study of its nontrivial solutions. This led them [21] to study the number of rational points on the associated projective curve corresponding to the function (with j = t): If this curve has a non-trivial solution then the corresponing cyclic code has minimum distance at most 4. If this curve is absolutely irreducible (i.e. irreducible over the algebraic closure) or has an absolutely irreducible component, then they use the Weil estimate to show that only finitely many codes can have minimum distance 5 (see [21]). The authors, in [21], conjectured that the exceptional exponents are precisely the Gold or the Kasami-Welch exponents. A firm foundation for a resolution of this conjecture was laid in Janwa, McGuire and Wilson [20] (they gave an algorithmic approach involving multiplicity analysis introduced in [21] in Bezout's Theorem to prove absolute irreducibility, and settled most of the cases of the conjecture). After a series of results by several contributors, Hernando and McGuire [19] established that this conjecture is true. That conjecture corresponded to the monomial function f (x) = x t , and whether they are exceptional APN functions.
The check matrix of the cyclic code with roots ω and ω t can be replaced by those given by ω and f (ω), giving a code that is not necessarily cyclic. One can then ask, when the corresponding code has minimum distance 5. Rodier [25] then considered the functions f (x), and framed the question of APN functions in terms of the corresponding affine hypersurface in P 3 associate with the multivariate polynomial: He proved by using the theorem of Lang-Weil, or its improvement due to Ghorpade and Lachaud, that if the corresponding projective hypersurface is absolutely irreducible or has an absolutely irreducible component, then f (x) can not be an exceptional APN function. The best known examples of APN functions are the families of Gold functions f (x) = x 2 k +1 , and the family of Kasami-Welch functions f (x) = x 2 2k −2 k +1 ; which are APN on any field F 2 n where k, n are relatively prime.
As another example, the family of Welch functions f (x) = x 2 r +3 are APN on F 2 n , where n = 2r + 1.
Notice that, as shown in the above examples, the APN property may depends on the extension degree of the finite field. For any t = 2 r + 1 there exist infinitely many values n such that (r, n) = 1. That is, any fixed Gold function which is APN on L is also APN on infinitely many extensions of L. Functions with this property are called exceptional APN functions. The situation is different for our second example, a Welch function that is APN over L is not necessarily APN on an extension of L. One way to classify APN functions is to determine which of them has the property of being exceptional.
Aubry, McGuire and Rodier conjectured the following in [1]. CONJECTURE: Up to equivalence, the Gold and Kasami-Welch functions are the only exceptional APN functions.
After this conjecture was established, several researchers (including us) have obtained partial results in proving that any other polynomial function (not a Gold or a Kasami-Welch function) can not be an exceptional APN polynomial (see Section 2 for a summary). In this article (see Section 3 and 4), we contribute to these efforts with some results for Gold degree polynomials.

Known results in the Gold degree case
For known results in the non-Gold degree case, we refer to [1,10,16,25]. Aubry, McGuire and Rodier [1] also found results for Gold degree polynomials.
a j x j . Suppose that there exists a nonzero coefficient a j of h such that φ j (x, y, z) is absolutely irreducible. Then φ(x, y, z) is absolutely irreducible and so f is not exceptional APN.
In the case when deg(h) is even, they were able to obtain the following partial result.
and deg(h) = 2 k −1 + 2. Let k be odd and relatively prime to n. If h(x) does not have the form ax 2 k −1 +2 + a 2 x 3 then φ is absolutely irreducible, while if h(x) does have this form, then either φ is absolutely irreducible or φ splits into two absolutely irreducible factors that are both defined over L.
In [11,13], we extended these results for the Gold degree case and found new families of polynomials which are not exceptional APN. 3 (mod 4). Then, φ(x, y, z) is absolutely irreducible.
The following result was conjectured in [13], and then proved in [14].
Theorem 5. If d is an odd integer, then φ 2 k +1 and φ d are relatively prime for all k ≥ 1 except when d = 2 l + 1 and (l, k) > 1.
Using this result, in [14], we generalized theorem 3 and 4 as follows: is an odd integer that is not a Gold number or that is a Gold number of the form 2 l + 1 with (l, k) = 1. Then φ(x, y, z) is absolutely irreducible, and f (x) can not be exceptional APN.
Also, we will need an observation of [1] that if f = Σf j t j , then φ(x, y, z) = Σf j φ j (x, y, z).

Completion of the exceptional APN conjecture in the Gold degree case when deg (h) is odd
From Theorem 6, the conjecture is completely finished for Gold degree polynomials of the form f (x) = x 2 k +1 + h(x), where d = deg(h) is any odd integer that is not a Gold number or a Gold number with d = 2 l + 1 and (l, k) = 1.
For non relatively prime numbers k, l: Let us suppose that φ (related to f in Theorem 6) is not absolutely irreducible. Then, φ(x, y, z) = (P s + P s−1 + . . .
where P i , Q i are zero or forms of degree i, s + t = 2 k − 2. Assuming that s ≥ t, 2 k − 2 > s ≥ 2 k −2 2 ≥ t > 0. Let e = 2 k + 1 − d. From the last equation: since φ 2 k +1 is equal to the product of different linear factors [21], P s and Q t are relatively prime. By the assumed degree of h(x), the homogeneous terms of degree r, for d − 3 < r < 2 k − 2, are equal to zero. Equating the homogeneous terms of degree s + t − 1, s + t − 2, ..., d − 2, as in the proof of Theorem 3 ; we get Since for k > l, 2 k−1 > 2 l − 1; then s > d. Therefore, as in the proof of theorem 4 (First case) we obtain that: Q t−1 = Q t−2 = ... = Q 0 = 0. (Observe in the proof of Theorem 4 that t < e, where e = 2 k + 1 − d).
Then, the surface φ factor as: Therefore Q t divides each φ j (x, y, z). This implies that φ(x, y, z) would be absolutely irreducible if h contains a non zero term a m x m such that φ 2 k +1 and φ m are relatively primes.
We can summarize the above discussion in the following theorem.
The following theorem almost completes the classification of absolute irreducibility of Gold degree polynomials when h(x) has odd degree. However, if the Aubry, McGuire and Rodier conjecture is true, then if f (x) has Gold degree and is not a monomial then, φ(x, y, z) does have an absolutely irreducible factor defined over an extension of L, and therefore, f (x) is not exceptional APN in that case as well. The proof of this theorem and further results will appear in a subsequent article.
Theorem 8 leave out the case of the exceptional APN conjecture when f (x) is a sum of Gold degree terms when (k 1 , · · · , k t ) = q > 1. Because then φ is divisible by φ 2 q +1 , and therefore it is not absolutely irreducible. However, Berguer, Canteaut, Charpin, and Laigle-Chapuy [3] proved that a polynomial of the form where J is a finite set of integers of size at least two is not APN on L (and therefore not an APN on any extension of L). And therefore, f (x) is not an exceptional APN polynomial. This result was proved in the context of permutation polynomials (see the discussions in [3] and [7], where it is also discussed that this result was proven earlier by Payne in the context of the classification of hyperovals.) Therefore using Theorem 7 and Theorem 8, combined with the result just stated, we have almost established that the exceptional APN conjecture in the Gold degree case when deg (h) is odd is true. In the next section we will discuss the case when deg(h(x)) is an even number.

The complement case of Theorem 2
Next we will discuss the case when deg(h) is an even number (the hardly discussed case, see the Remark at the end). The following theorem is the version of Theorem 2 when k is an even number.
a j x j . If there is a nonzero coefficient a j such that (φ 2 2k +1 , φ j ) = 1. Then φ is absolutely irreducible, and f (x) is not an exceptional APN function.
Proof. Suppose by way of contradiction that φ is not absolutely irreducible. Then, φ(x, y, z) = P (x, y, z)Q(x, y, z). Writing P, Q as a sum of homogeneous terms: (2) 2 2k +1 j=0 a j φ j (x, y, z) = (P s + P s−1 + . . . where P i , Q i are zero or homogeneous of degree i and s + t = 2 2k − 2. Assuming that s ≥ t, then 2 2k − 2 > s ≥ 2 2k −2 2 ≥ t > 0. From the equation (2) we have that: Since φ 2 2k +1 is equal to the product of different linear factors [21], then P s and Q t are relatively primes. Since h(x) is assumed to have degree 2 2k−1 + 2, the homogeneous terms of degree r, for 2 2k−1 − 1 < r < 2 2k − 2, are equal to zero. Then equating the terms of degree s + t − 1 gives P s Q t−1 + P s−1 Q t = 0. Hence we have that P s divides P s−1 Q t and this implies that P s divides P s−1 , since P s and Q t are relatively primes. We conclude that P s−1 = 0 since the degree of P s−1 is less than the degree of P s . Then we also have that Q t−1 = 0 as P s = 0. Similarly, equating the terms of degree s + t − 2, s + t − 3, ..., s + 1 we get: The equation of degree s is: Lets consider two cases to prove the absolute irreducibility of φ(x, y, z).
Case s > t. Then s > 2 2k−1 − 1 and φ s+3 = 0. Then the equation (4) becomes: Then, using the previous argument, P s−t = Q 0 = 0. It means that Q = Q t is homogeneous. By the equation (3) and the factorization of φ 2 2k +1 in linear factors (see [7] for this factorization) we have that for all j, φ j (x, y, z) is divisible by x + αy + (α + 1)z for some α ∈ F 2 k − F 2 , which is a contradiction by the hypothesis of the theorem.
Remark. In Theorem 7 , if the conditions are not satisfied, then f is reducible. In theorem 9, in the case when deg(h) is even, becomes difficult because for this case, there is an example where f is reducible (see subsection 5.5.2 in [11] for such an example).