# New Perfect Nonlinear Functions over Finite Fields

In this paper we present a new class of perfect nonlinear polynomials over F_p^2k for any odd prime p. In addition, we show that the new perfect nonlinear functions are CCZ-inequivalent to all the previously known perfect nonlinear functions in general.

## Authors

• 23 publications
• 5 publications
• 1 publication
• ### New Perfect Nonlinear Functions and Their Semifields

In this paper, two new classes of perfect nonlinear functions over F_p^2...
05/03/2019 ∙ by Jinquan Luo, et al. ∙ 0

• ### Multidimensional Padé approximation of binomial functions: Equalities

Let ω_0,…,ω_M be complex numbers. If H_0,…,H_M are polynomials of degree...
08/01/2021 ∙ by Michael A. Bennett, et al. ∙ 0

• ### Correlation in scattered perfect optical vortices

We study correlations in the speckle patterns generated by the scatterin...
11/16/2021 ∙ by Bikash Kumar Das, et al. ∙ 0

• ### The number of almost perfect nonlinear functions grows exponentially

Almost perfect nonlinear (APN) functions play an important role in the d...
04/23/2020 ∙ by Christian Kaspers, et al. ∙ 0

• ### Equivalences of biprojective almost perfect nonlinear functions

Two important problems on almost perfect nonlinear (APN) functions are t...
11/07/2021 ∙ by Faruk Göloğlu, et al. ∙ 0

• ### Perfect Sampling of Multivariate Hawkes Process

As an extension of self-exciting Hawkes process, the multivariate Hawkes...
07/12/2020 ∙ by Xinyun Chen, et al. ∙ 0

This short article presents a class of projection-based solution algorit...
03/08/2011 ∙ by Xin Li, et al. ∙ 0

##### This week in AI

Get the week's most popular data science and artificial intelligence research sent straight to your inbox every Saturday.

## 1 Introduction

Block ciphers use substitution boxes(S-boxes) whose aim is to create confusion into the cryptosystems. Functions used as S-boxes are required to have low differential uniformity [4], high nonlinearity [28] and high algebraic degree [22]. It is well known that the lowest differential uniformity of a function defined on with odd prime can achieve is and such functions are called perfect nonlinear(PN) functions. It is interesting to observe that PN functions have also been studied under the name of planar functions, which are functions such that is a permutation polynomials for all nonzero . Planar functions were introduced in [15] to describe projective planes with certain properties. It was shown in [19, 34]

that a PN function yields either a skew Hadamard difference set or a Paley type partial difference set depending on

. In [11, 12], PN functions were used to describe new finite commutative semifields of odd order. Furthermore, PN functions is one of the most important cryptographic functions and has extensive applications in cryptography and communication[33, 39].

It is an interesting research problem to find new PN functions, which is CCZ-inequivalent to the known ones.

Before this paper, there are several constructions of PN functions or in its equivalent form of commutative semifields. In [2], Bierbrauer introduced a general projection method to construct commutative semifields and generalized the known PN functions. In [31, 32], Pott and Zhou presented a switching construction of PN function and introduced a character theoretic approach to prove the planarity of a function. In [37] Zhou and Pott also presented new commutative semifields with two parameters and then get new PN functions. [23] constructed some new PN functions by the products of two linearized polynomials. Even through some new methods were used to construct new PN functions, but it is still difficult to find more new PN functions[3, 7, 25, 36, 38]. In this paper, we construct a new family of perfect nonlinear Dembowski-Ostrom polynomials over for odd prime . Furthermore, we claim that these functions are CCZ-inequivalent to all the previously known PN functions in general.

The remainder of this paper is organized as follows. In Sec. , we introduce some preliminary knowledge and lemmas. A new family of PN functions will be constructed in Sec. . In Sec. , we shall analyze the CCZ-equivalence of the new PN functions.

## 2 Preliminaries

For a prime number and a positive integer , let be the finite field with elements and its multiplicative group. One denotes by the largest power of dividing , i.e., with odd. The trace function from to its subfield is defined by

 Trnk(x)=n/k−1∑i=0xpki=x+xpk+⋯+xpk(n/k−1).

Any function from the finite field to itelf can be represented as a polynomial of degree less than . The graph of the function is defined as the set

 GF={(x,F(x))∣∣x∈Fpn}⊂F2pn.

A polynomial is called a linearized polynomial or -polynomial if can be written as

 L(x)=n−1∑i=0aixpi,ai∈Fpn.

A polynomial from to itself is affine, if it is defined by the sum of a linearized and a constant polynomial over . A polynomial is a Dembowski-strom polynomial (DO-polynomial) if it can be expressed as

 F(x)=∑0≤i,j≤n−1ai,jxpi+pj,ai,j∈Fpn.
###### Definition 1.

Two functions : are called :
extended affine equivalent (EA-equivalent) if

 F′=A1∘F∘A2+A

for some affine permutations , and affine function .
Carlet-Charpin-Zinoview equivalent (CCZ-equivalent) if there exists some affine permutation

 L:F2pn→F2pn

such that .

Note that CCZ-equivalent functions have equal differential uniformity and EA-equivalent is a particular case of CCZ-equivalence[9]. However, CCZ-equivalence coincides with EA-equivalence for PN functions[24].

In the following, we list all the known families of PN functions and corresponding commutative semifields. For any odd prime , there are:

 x2

over , which corresponds to the finite field ;

 xps+1

over , and , which corresponds to the Albert’s commutative twisted fields [14, 15];

 xps+1−upk+1xp2k+pk+s

over , where , , and , is a primitive element of , which corresponds to Zha-Kyureghyan-Wang (ZKW) semifields [3, 36];

 xps+1−upk+1xp3k+pk+s

over , where , , is a primitive element of , which corresponds to Bierbrauer semifields [3];

 ωβxps+1+ωβpkxpk(ps+1)+xpk+1

over , where

 ω+ωpk=0,βp2kgcd(pk+1,ps+1)≠1

and . It corresponds to Budaghyan-Helleeth-Bierbrauer (BHB) semifields [2, 8];

 x2+x2qm+G(xq2+1)

over , where is a power of odd prime , and with

 h(x)=k∑i=0(−1)ixqi+k−1∑j=0(−1)k+jxq2j+1.

It corresponds to Lunardon-Marino-Polverino-Trombetti-Bierbrauer (LMPTB) semifields [2, 27];

over , where is a power of odd prime and is a nonsquare element in . The semifields corresponds to Dickson semifields [16];

over , where , , is a nonsquare element in and . The semifields corresponds to Zhou-Pott (ZP) semifields [37].

For , there are :

The Coulter-Matthews-Ding-Yuan semifields with odd [14, 19];

The Cohen-Ganley semifields with odd [10];

The Ganley’s semifields with odd [31];

, over [1, 13, 35].

Up till now, all the known PN functions are DO polynomials, except for the family

 x3k+12

over , is odd and . It corresponds to Coulter-Matthews (CM) planes [14, 21].

The purpose of this paper is to construct new PN functions, which are CCZ-inequivalent to all the known PN functions in general. Note that two DO PN functions are CCZ-inequivalent if and only if the corresponding presemifeilds are not strongly isotopic [6]. In what follows, we propose the notation of isotopism and strongly isotopism.

A ring with left and right distributive laws and cancelation laws is called a presemifield. It can be shown that a planar DO polynomials is equivalent to a commutative presemifield in odd characteristic, see [11] for details. Indeed, if is the multiplication in the presemifield, then the corresponding DO-planar function is . Conversely, the planar DO polynomial is given, then the corresponding presemifield can be defined as

 x∗y=12[f(x+y)−f(x)−f(y)].

A presemifield with a multiplicative identity is called a semifield. Any finite presemifield can be represented by , where is the additive group of , but may have different multiplication in , see [11] for more details.

###### Definition 2.

Let and be two presemifields. If there exist three -linear permutations over such that

 L(x∘y)=M(x)⋆N(y),

for any , then and are called isotopic. The triple is called the isotopism between and . If , then and are called strongly isotopic.

In the following, we shall define the dual and transpose of a presemifield, which yields the definition of symplectic presemifield.

For a given presemifield , the presemifield is called the dual of , where

 x∙∗y=y∙x.

Particularly, for , we define

 x∙y=F(x,y)=n−1∑i,j=0aijxpiypj,aij∈Fpn.

Then the sets

 S={φy:x∈Fpn↦F(x,y)∈Fpn|y∈Fpn}⊆V=EndFp(Fpn)

and

 S∗={φx:y∈Fpn↦F(x,y)∈Fpn|x∈Fpn}⊆V=EndFp(Fpn)

are the spread set associated with and , respectively.
For any with , the conjugate of is defined by

 ¯¯¯¯φ(x)=n−1∑i=0θpn−iixpn−i.

The presemifield , where with , is the transpose of . The presemifield is called the symplectic presemifield of , where with . Moreover, the set and are the spread set associated with and , respectively.

The following lemma characterizes a consistency of isotopism between two presemifields and their symplectic presemifields.

###### Lemma 1.

([29]) Let and be two presemifields. Then   is an isotopism between and if and only if is an isotopism between and .

Next, some criteria commonly used to prove the CCZ-inequivalence among the new PN functions and the functions and is recalled from [29] in the following.

###### Lemma 2.

([29]) Let be an odd prime power, and be odd and even integers, respectively, such that and . Then the corresponding symplectic presemifield of the functions is

 ¯¯¯¯B(q,l,d,β)t∗=(Fq2l,+,⋆′),

whose multiplication is given by

 x⋆′y=2Axql+2σq2l−dβq2l−dBq2l−dxq2l−d+2σβBxqd

where is a nonsquare in and with , is a nonsquare in and .

###### Lemma 3.

([29]) Let be an odd prime power, and be odd and even integers, respectively, such that and . Then the corresponding symplectic presemifield of the functions is

 P(q,l)t∗=(Fq2l,+,∙),

whose multiplication is given by

 x∙y=Ax+Bq2ηxq2+Bηxq2l−2,

where with and , .

###### Lemma 4.

([29]) Let be an odd prime power, and be odd and even integers, respectively, such that and . Then is isotopic to a presemifield , whose multiplication is given by

 x⋆′′y=2Ax+2σBωβξqlxqd+2σBq2l−dωβq2l−dξqlxq2l−d, (2)

where with , with and is an element of such that and . Furthermore, the commutative presemifields and are strong isotopic if and not strong isotopic if .

## 3 New Class of PN Functions

A new class of PN functions over with is proposed as follows.

###### Theorem 1.

Let be an odd prime, , and be positive integers such that

 v2(s)>v2(k).

If and , then the function

 f(x)=bxps+1−bxpk(ps+1)+Trnk(x2)

is PN over .

###### Proof.

Since is a DO polynomial, to prove that is PN, it is sufficient to show that for any , the equation

 Δf,a(x):=f(x+a)−f(x)−f(a)=0

has exactly one solution . It can be verified that

 Δf,a(x)=b(axps+apsx)−b(apkxpk+s+apk+sxpk)+2Trnk(ax).

By taking and , this equation is equivalent to

 Δf,a(x)=bA−bApk+2B.

If is a solution of , then

 bA−bApk+2B=0. (3)

Raising both sides of (3) to the power , one obtains

 bpkApk−bpkA+2B=0, (4)

since .
It follows from (3) and (4) that

 (bpk−1+1)B=0.

The fact implies

 B=0, (5)

which indicates

 xpk=−a1−pkx. (6)

Combining (3) and (5), one has

 A−Apk=0, (7)

that is,

 (axps+apsx)−(apkxpk+s+apk+sxpk)=0. (8)

Substituting (6) into (8), one yields

 (aps+apk+s−pk+1)x+(a+aps+pk−pk+s)xps=0,

which is equivalent to

 aps−1(1+a(ps−1)(pk−1))x+(1+a(ps−1)(1−pk))xps=0. (9)

If , then for any ,

 xps−1=−1+a(ps−1)(pk−1)1+a(ps−1)(1−pk)aps−1=−a(ps−1)pk. (10)

We claim that for any . Otherwise, there exists such that

 1+a(ps−1)(1−pk)=0.

That is to say,

 a(ps−1)(pk−1)=−1.

Denoting by with be a primitive element of , then one has

 (ps−1)(pk−1)i≡pn−12(mod pn−1). (11)

Dividing on both sides of (11), one obtains

 (ps−1)i≡pk+12(mod pk+1). (12)

This shows that

 (pk+1,ps−1)∣∣pk+12,

which is impossible. In fact, due to , it follows that

 pk+1(pk+1,ps−1)

 1+a(ps−1)(pk−1)≠0

for any .
Similarly, (10) derives the equation

 (xapk)ps−1=−1,

which has no solution in . Indeed, suppose that there exists some positive integer such that

 (gj)ps−1=−1,

then one has

 (ps−1)j≡pn−12(mod pn−1).

This indicates

 2∣∣∣pn−1p(s,n)−1,

Consequently, has exactly one solution . It follows that is a PN funtion. ∎

## 4 CCZ-inequivalence of New PN Functions

In the following, we will analyze the CCZ-inequivalence among the new PN functions in Theorem 1 and all the known PN functions mentioned in Section in general. Note that the new PN functions are DO polynomials and exist for general odd prime , it suffices to consider the equivalence of the functions -.

The main result in this section is given by the following theorem.

###### Theorem 2.

Let be an odd prime. The new PN functions in Theorem 1 are CCZ-inequivalent to any of the known PN functions - listed in Section .

###### Proof.

Note that the functions - cannot cover all the new PN functions, it follows that the new PN functions are CCZ-inequivalent to the functions -. The detailed proof for the CCZ-inequivalence of the functions - and - is available in Subsection 4.1 and 4.2, see Proposition 1 and Proposition 2, respectively.

When is odd, without loss of generality, there exists such that . It allows us to choose as an -basis of . Then for any , it can be uniquely represented as with . Similarly, for any with , it can be uniquely expressed as with . It can be verified that

 f(u)=bups+1−bupk(ps+1)+Trnk(u2)=(b1+b2ω)(x+yω)ps+1−(b1+b2ω)(x+yω)pk(ps+1)+Trnk((x+yω)2)=2x2+2ω2(y2+b2(xpsy+xyps))+2b1(xpsy+xyps)ω

Recall that , then the new PN functions in Theorem 1 can be transformed into

 (x,y)↦(2x2+2ω2(y2+b2x∘sy),2b1x∘sy),

which is equivalent to

 (x,y)↦(x2+ω2(y2+b2x∘sy),b1x∘sy). (13)

In the sequel, the equation (1) mentioned in Section implies that the PN function is equivalent to

 (x,y)↦(x2+αy2q,2xy).

It follows that for any in Theorem 1, the new PN functions in Theorem 1 are CCZ-inequivalent to the PN functions . In fact, the parameter in Theorem 1 is a positive integer, which induces that there exists no in equation (13).

On the other hand, the proof of Theorem in [37] shows that:
i) if is non-trivial, then the PN function is equivalent to

 (x,y)↦(cxpt+1+αcσ(ypt+1)σ,2cxy); (14)

ii) if is trivial, then the PN function is equivalent to

 (x,y)↦(cxpt+1+αcypt+1,2cxy) (15)

or

 (x,y)↦(2c(xpt+1+αcypt+1)+2αx∘ty,2cxy+x2+αy2). (16)

Similarly, it can be verified that for any in Theorem 1

, there exists no linear transformation by which the equation (

13) can be transformed to the equations (14) and (15) as in Theorem 1. More specifically, if , then the equation (13) cannot be equivalent to the equation (16). Therefore, it follows that for any , the new PN functions in Theorem 1 are CCZ-inequivalent to the PN functions . This proves the desired conclusion. ∎

### 4.1 CCZ-inequivalent of Functions I-II

The equivalence between the new PN functions and the functions - is described as follows.

###### Proposition 1.

Let be an odd prime, , , , be positive integers such that

 v2(s)>v2(k),v2(r)>v2(k).

If and , then the function

 f(x)=bxps+1−bxpk(ps+1)+x2+x2pk

is CCZ-inequivalent to

 g(x)=xpr+1.

Furthermore, for , is also CCZ-inequivalent to over .

###### Proof.

Since CCZ-equivalence coincides with EA-equivalence for PN functions, it is sufficient to show that and is EA-inequivalent. Suppose that is EA-equivalent to . Precisely, there exist linear permutations

 L1(x)=n−1∑j=0djxpj

and

 L2(x)=n−1∑j=0ejxpj

such that

 L1(f(x))=g(L2(x)). (17)

In the following, all the subscripts of and are regarded as module . For instance,

 d−i=dn−i,e−i=en−i.

If , then (17) can be simplified as

 n−1∑j=0dj(bxps+1−bxpk(ps+1)+x2+x2pk)pj=n−1∑i,j=0eiejxpi+pj. (18)

Comparing the coefficients of and with on both sides of (18), respectively, we have

 di+di+k=e2i (19)

and

 di+di+k=e2i+k. (20)

For any , comparing the coefficient of with , one obtains

 0=ei+lei. (21)

Assume that there exists some with such that . Then (21) indicates that if . Since , one has

 ej+k=0.

Combining (19) and (20), we can deduce

 ej=0,

a contradiction. It follows that holds for any , which yields

 L2(x)=0.

This is impossible since cannot be a permutation.

When , we distinguish now the cases and .

Case I : If , then (17) can be written as

 n−1∑j=0dj(bxps+1−bxpk(ps+1)+x2+x2pk)pj=n−1∑i,j=0eiepsjxpi+pj+s. (22)

Comparing the coefficients of , , , and with on both sides of (22), respectively, we have

 0=eiepsi+k−s+ei+kepsi−s (23)
 0=ei+kepsi+ei+sepsi+k−s (24)
 dibpi−di+kbpi+k=eps+1i+ei+sepsi−s (25)
 di+kbpi+k−dibpi=eps+1i+k+ei+k+sepsi+k−s (26)

and

 di+k+di=ei+kepsi+k−s. (27)

For any , comparing the coefficient of with , we obtain

 0=eiepsi+l−s+ei+lepsi−s. (28)

For any , assume that there exists some such that . Then, according to (28),

 −epsj+l−sej+l=epsj−sej=−epsj+l′−sej+l′=epsj+l′+l−l′−sej+l′+l−l′=epsj+l−sej+l, (29)

which implies

 ej+l−s=ej−s=0.

By (23) and (24), one has

 ej+k−s=ei+k=0.

Combining (25) and (26), we deduce , a contradiction. Thus, for any , one has

 eiei+lei+l′=0.

Now we claim that for any . Indeed, if , it follows that

 ei+lei+l′=0.

Then (28) implies . By taking or , one has

 ei+k=ei+k−s=0.

Due to , it follows from (26) and (27) that for any ,

 di=di+k=0.

If all , then , a contradiction.

If not all , then we denote