Let be a power of a prime. Let be a finite field with elements and denote its multiplicative group. A polynomial is called a permutation polynomial if its associated polynomial mapping from to itself is a bijection. Moreover, is called an involution if the compositional inverse of is itself. Permutation polynomials over finite fields have been extensively studied due to their wide applications in cryptography, coding theory and combinatorial design theory. So, finding new classes of permutations with desired properties is of great interest in both theoretical and applied aspects, and also a challenging task. In many situations, both the permutation polynomials and their compositional inverses are required. For example, in many block ciphers, a permutation has been used as an S-box for providing confusion during the encryption process. While decrypting the cipher, the compositional inverse of the S-box comes into the picture. Thus, it is advantageous for the designer if both the permutation and its compositional inverse have efficient implementations. This motivates the use of involutions in the S-box of block ciphers. One practical advantage of involutions is that the implementation of the inverse does not require additional resources, which is particularly useful (as part of a block cipher) in devices with limited resources.
Involutions have been used widely in block cipher designs, such as in AES , Khazad, Anubis  and PRINCE . For instance, the inverse function over used in the S-box of AES is an involution. In PRINCE, a linear involution (denoted by ) was used to ensure -reflection property. More typically, in Midori  and iSCREAM , non-linear involutions were used to provide both encryption and decryption functionalities with minimal tweaks in the circuit. Recently, Canteaut and Roué have shown that involutions were the best candidates against several cryptanalytic attacks by analysing the behaviors of the permutations of an affine equivalent class with respect to these attacks . Involutions have been also used to construct Bent functions over finite fields  and to design codes. For instance, Gallager used an involution (called Gallager’s involution transform) to update check nodes to obtain low-complexity hardware implementation of the sum product algorithm which was used for decoding .
To the best of our knowledge, there are not many known involutions over finite fields. Recently, Charpin, Mesnager and Sarkar  firstly discussed Dickson involutions over finite fields of even characteristic. Then, they  investigated monomial involutions and linear involutions, and proposed an approach to constructing involutions from known involutions over the finite field . Rubio et. al.  further discussed monomial involutions and their fixed points. Very recently, Fu and Feng  investigated involutory behavior of all known differentially 4-uniform permutations over finite fields of even characteristic, and most of them were not involutions. To date, primary constructions of involutions over finite fields seems far from enough.
It is known that every polynomial over can be written as for some , , and [3, 27]. Due to the importance of the polynomials of the form , Wan and Lidl  first gave a criterion for permutation polynomials of this type. Then, Park and Lee, Wang and Zieve proposed a more concise criterion for permutation behavior of polynomials of the form [22, 26, 31], respectively. By using this criterion, many classes of permutation polynomials of the form have been constructed [2, 11, 15, 16, 17, 18, 19, 20, 21, 24, 26, 29, 31, 32]. But the previous woks were not involved involutory behavior of the polynomials of this type. This paper proposes a criterion for involutions of polynomials of the form by the piecewise representation of functions, and a general method to construct involutions of this form over from given involutions over the corresponding subgroup of . Then, many classes of involutions over are obtained.
The remainder of this paper is organized as follows. In Section 2, we give a necessary and sufficient condition for being an involution over and propose a general method to construct involutions of the form over from a given involution over the corresponding subgroup of . Section 3 presents explicit involutions of the form over from the inverse involution over the subgroup of . In Section 4 we construct involutions of the form over from some special over . Section 5 discusses the constructions of involutions over finite fields from those on their subfields. Finally, we conclude this paper in Section 6.
2 A general construction of involutions over finite fields
Throughout this paper let be a power of a prime, and be divisors of such that . Let be a finite field with elements and denote the set of th roots of unity in , i.e.,
which is also the unique cyclic subgroup of of order . This subgroup can also be represented as . It is easy to verify that
where for . The following well-known lemma gives a necessary and sufficient condition for being a permutation over .
Next we give a criterion for involutions of the form for , and . From above discussions we can express in the form of piecewise functions as
where , . From the piecewise functional representation we obtain a necessary and sufficient condition for being an involution over .
Let be positive integers with . Let for some polynomial . The polynomial is an involution over if and only if
for all .
Proof. Following notation introduced above, we know that , where . If , i.e., , then
So, . From (1) we obtain that
If and for all , then from (2) we have for ,
This shows that is an involution over .
Conversely, if is an involution over , then for each and any , from (2) we have
Let be another element of , then
Let and for some positive integer and . If is an involution over , then is an involution over the subgroup .
Proof. It is easy to verify that for any . If is an involution over , then for any , one has
This shows that is an identity over , i.e., is an involution on this subgroup of order .
To obtain involutions of the form over , it is crucial to find a suitable . From Corollary 2.3, is necessary to be an involution on the subgroup of for being an involution on . Next, we give a general method to determine the coefficients of from a given involution over .
Let be a primitive element of and be a generator of the subgroup . Let be an involution over , which is represented by
where is a rearrangement of . Assume that the polynomial as a mapping on is the same as on it, i.e, for ,
Since , from (5) there are some and with such that
where . This is equivalent to
since is equivalent to due to . It is verified that there exist integers satisfying (7) for . Let be a reduced polynomial modulo . Denote by
Since is a Vandermonde matrix, from (6) the coefficients of can be uniquely derived from the following linear equations
In summary, we have the following theorem.
3 Involutions from the inverse over the subgroup of
In this section we will give an explicit construction of involutions over from the inverse involution over the subgroup of . To this end, we first discuss a special case that having at most two elements. In this case, and is viewed as the inverse of modulo if is even. Then, in (1) is rewritten as
where , and .
If , then is a monomial over . Theorem 2.2 implies that is an involution over if and only if
By Theorem 2.2, we have the following proposition.
In Proposition 3.1, let and and for some non-square element in . It is easy to check that conditions (1) and (2) hold. Then the polynomial is an involution over .
Next, we discuss the case that the subgroup of has at least elements. It is clear that the inverse over is an involution, which can be represented as
Assume that the polynomial as a mapping over is the same as on it. Then the equalities in (5) are as follows,
From (11) we obtain that
where . Similarly to that in Theorem 2.5, the polynomial is an involution over if and only if the following equalities hold:
This is equivalent to
where . Let be a reduced polynomial modulo . The linear system (8) becomes
In summary, we have the following theorem.
Assume that and the subgroup of has exact elements, i.e, . Then the condition (13) is reduced to
By solving the corresponding linear system (14) we get
Let for a positive integer and be a primitive element of . Let be the cubic root of unity in . Set . From (15) we get that
Let for . Substituting these into (16) we get
From Proposition 3.4 we have
With notation introduced above, is an involution on .
Let , be a primitive element of and be the cubic root of unity in . Set , where and
Magma verifies that is an involution on for any . This experimental result coincides with that of Corollary 3.5.
where . From Proposition 3.4 we obtain
With notation introduced above, is an involution on .
Let and be a primitive element of . Set
where . Magma verifies that is an involution over for any . This experimental result coincides with that of Corollary 3.7.
4 Involutions from monomial mappings over the subgroup of
In this section, we will construct more explicit involutions over from some special , which as a mapping over the subgroup of is the same as a monomial mapping on it.
Let be a power of a prime and be an integer with . Let satisfy that for any ,
If for any , then is an involution over .
This completes the proof.
Let be a power of an odd prime, and , where . Then
is an involution on if one of the following condition hold:
and is an square element in ;
and is a non-square element in .
Lemma 2.1 shows that permutes if and only if and permutes the subgroup of , where . So, it is interesting to find the collections of polynomials which permute for certain values of . Zieve [31, 32] proposed a method to construct permutations of the form over . Thus, several classes of permutations of the form over were obtained. Following this technique proposed by Zieve in [31, 32] we obtain many classes of involutions of the form over by careful choices of .
Let be a prime power. Let and be integers with . Let and be an integer with , and with . Let be a polynomial with
If has no root in , then is an involution over