Cryptographic Boolean Functions in Lean

5.1. Bentness🔗

Definition5.1.1
Group: Chapter 5: Bent functions (69)
Group member previews
Preview
Lemma 5.1.2
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 4
Statement dependency previews
Preview
Definition 1.4.3
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
Used by 21
Reverse dependency previews
Preview
Lemma 5.1.2
Loading preview
Reverse dependency preview content is loaded from the rendered-fragment cache.
L∃∀N

Definition 7 (Carlet, pp. 77--78). Let n be even. A Boolean function f:V_n\to\mathbb F_2 is bent when \operatorname{nl}(f)=2^{n-1}-2^{n/2-1}. Equivalently, |W_f(a)|=2^{n/2} for every a\in V_n, or the distance from f to every affine function is 2^{n-1}\pm2^{n/2-1}. Bentness is preserved by affine changes of variables and by addition of affine functions.

Lean code for Definition5.1.17 theorems
  • theoremdefined in CryptBoolean/Carlet/Chapter06/Bentness.lean
    complete
    theorem CryptBoolean.natAbs_walshTransform_eq_two_pow_half_of_isBent {n : }
      (f : CryptBoolean.BooleanFunction n) (hf : CryptBoolean.IsBent f)
      (a : FABL.F₂Cube n) :
      (CryptBoolean.walshTransform f a).natAbs = 2 ^ (n / 2)
    theorem CryptBoolean.natAbs_walshTransform_eq_two_pow_half_of_isBent
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hf : CryptBoolean.IsBent f)
      (a : FABL.F₂Cube n) :
      (CryptBoolean.walshTransform f
            a).natAbs =
        2 ^ (n / 2)
    Every raw Walsh coefficient of a bent Boolean function has magnitude `2^(n/2)`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter06/Bentness.lean
    complete
    theorem CryptBoolean.maxWalshMagnitude_eq_two_pow_half_of_isBent {n : }
      (f : CryptBoolean.BooleanFunction n) (hf : CryptBoolean.IsBent f) :
      CryptBoolean.maxWalshMagnitude f = 2 ^ (n / 2)
    theorem CryptBoolean.maxWalshMagnitude_eq_two_pow_half_of_isBent
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hf : CryptBoolean.IsBent f) :
      CryptBoolean.maxWalshMagnitude f =
        2 ^ (n / 2)
    The maximum raw Walsh magnitude of a bent function is `2^(n/2)`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter06/Bentness.lean
    complete
    theorem CryptBoolean.nonlinearity_eq_two_pow_sub_two_pow_half_of_isBent {n : }
      (f : CryptBoolean.BooleanFunction n) (hf : CryptBoolean.IsBent f)
      (hn : 2  n) :
      CryptBoolean.nonlinearity f = 2 ^ (n - 1) - 2 ^ (n / 2 - 1)
    theorem CryptBoolean.nonlinearity_eq_two_pow_sub_two_pow_half_of_isBent
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hf : CryptBoolean.IsBent f)
      (hn : 2  n) :
      CryptBoolean.nonlinearity f =
        2 ^ (n - 1) - 2 ^ (n / 2 - 1)
    In positive even dimension, a bent function attains Carlet's integral
    nonlinearity value `2^(n-1)-2^(n/2-1)`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter06/Bentness.lean
    complete
    theorem CryptBoolean.isBent_iff_forall_natAbs_walshTransform_eq_two_pow_half
      {n : } (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.IsBent f 
         (a : FABL.F₂Cube n),
          (CryptBoolean.walshTransform f a).natAbs = 2 ^ (n / 2)
    theorem CryptBoolean.isBent_iff_forall_natAbs_walshTransform_eq_two_pow_half
      {n : }
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.IsBent f 
         (a : FABL.F₂Cube n),
          (CryptBoolean.walshTransform f
                a).natAbs =
            2 ^ (n / 2)
    Bentness is equivalent to the exact raw Walsh magnitude at every frequency. 
  • theoremdefined in CryptBoolean/Carlet/Chapter06/Bentness.lean
    complete
    theorem CryptBoolean.isBent_add_affineFunction_iff {n : }
      (f : CryptBoolean.BooleanFunction n) (b : FABL.𝔽₂)
      (a : FABL.F₂Cube n) :
      CryptBoolean.IsBent (f + FABL.affineFunction b a) 
        CryptBoolean.IsBent f
    theorem CryptBoolean.isBent_add_affineFunction_iff
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (b : FABL.𝔽₂) (a : FABL.F₂Cube n) :
      CryptBoolean.IsBent
          (f + FABL.affineFunction b a) 
        CryptBoolean.IsBent f
    Adding an affine Boolean function preserves bentness. 
  • theoremdefined in CryptBoolean/Carlet/Chapter06/Bentness.lean
    complete
    theorem CryptBoolean.isBent_comp_affineEquiv_iff {n : }
      (f : CryptBoolean.BooleanFunction n)
      (L : FABL.F₂Cube n ≃ᵃ[FABL.𝔽₂] FABL.F₂Cube n) :
      CryptBoolean.IsBent (f  L)  CryptBoolean.IsBent f
    theorem CryptBoolean.isBent_comp_affineEquiv_iff
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (L :
        FABL.F₂Cube n ≃ᵃ[FABL.𝔽₂]
          FABL.F₂Cube n) :
      CryptBoolean.IsBent (f  L) 
        CryptBoolean.IsBent f
    Precomposition by an affine automorphism preserves bentness. 
  • theoremdefined in CryptBoolean/Carlet/Chapter06/Bentness.lean
    complete
    theorem CryptBoolean.abs_hammingDistance_affine_sub_half_of_isBent {n : }
      (f : CryptBoolean.BooleanFunction n) (hf : CryptBoolean.IsBent f)
      (b : FABL.𝔽₂) (a : FABL.F₂Cube n) :
      |(CryptBoolean.hammingDistance f (FABL.affineFunction b a)) -
            2 ^ n / 2| =
        2 ^ (n / 2) / 2
    theorem CryptBoolean.abs_hammingDistance_affine_sub_half_of_isBent
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hf : CryptBoolean.IsBent f)
      (b : FABL.𝔽₂) (a : FABL.F₂Cube n) :
      |(CryptBoolean.hammingDistance f
                (FABL.affineFunction b a)) -
            2 ^ n / 2| =
        2 ^ (n / 2) / 2
    Every affine distance from a bent function differs from half the cube size by
    `2^(n/2-1)`. 
Lemma5.1.2
Group: Chapter 5: Bent functions (69)
Group member previews
Preview
Definition 5.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 2
Statement dependency previews
Preview
Theorem 1.9.2
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
Used by 4
Reverse dependency previews
Preview
Proposition 5.2.5
Loading preview
Reverse dependency preview content is loaded from the rendered-fragment cache.
L∃∀N

Lemma 2 (Carlet, p. 77). Let n\ge2 be even. A Boolean function f:V_n\to\mathbb F_2 is bent if and only if W_f(a)\equiv 2^{n/2}\pmod {2^{n/2+1}} \qquad(a\in V_n).

Lean code for Lemma5.1.21 theorem
  • theoremdefined in CryptBoolean/Carlet/Chapter06/WalshCongruence.lean
    complete
    theorem CryptBoolean.isBent_iff_forall_walshTransform_modeq {n : }
      (f : CryptBoolean.BooleanFunction n) (hn : Even n) (_hnTwo : 2  n) :
      CryptBoolean.IsBent f 
         (a : FABL.F₂Cube n),
          CryptBoolean.walshTransform f a  2 ^ (n / 2) [ZMOD
            2 ^ (n / 2 + 1)]
    theorem CryptBoolean.isBent_iff_forall_walshTransform_modeq
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hn : Even n) (_hnTwo : 2  n) :
      CryptBoolean.IsBent f 
         (a : FABL.F₂Cube n),
          CryptBoolean.walshTransform f a 
            2 ^ (n / 2) [ZMOD 2 ^ (n / 2 + 1)]
    Carlet Lemma 2: in even dimension at least two, bentness is equivalent
    to every raw Walsh coefficient being congruent to `2^(n/2)` modulo
    `2^(n/2+1)`. 
Theorem5.1.3
Group: Chapter 5: Bent functions (69)
Group member previews
Preview
Definition 5.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 3
Statement dependency previews
Preview
Theorem 1.10.3
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
Used by 6
Reverse dependency previews
Preview
Theorem 5.1.4
Loading preview
Reverse dependency preview content is loaded from the rendered-fragment cache.
L∃∀N

Theorem 8 (Carlet, p. 78). A Boolean function f:V_n\to\mathbb F_2 is bent if and only if every derivative in a nonzero direction is balanced: \forall a\in V_n\setminus\{0\},\qquad D_af\text{ is balanced}. Equivalently, f satisfies the propagation criterion of degree n.

Lean code for Theorem5.1.32 theorems
  • theoremdefined in CryptBoolean/Carlet/Chapter06/Bentness.lean
    complete
    theorem CryptBoolean.isBent_iff_forall_nonzero_derivative_isBalanced {n : }
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.IsBent f 
         (a : FABL.F₂Cube n),
          a  0  CryptBoolean.IsBalanced (FABL.booleanDerivative f a)
    theorem CryptBoolean.isBent_iff_forall_nonzero_derivative_isBalanced
      {n : }
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.IsBent f 
         (a : FABL.F₂Cube n),
          a  0 
            CryptBoolean.IsBalanced
              (FABL.booleanDerivative f a)
    Carlet Theorem 8: a Boolean function is bent exactly when every nonzero
    directional derivative is balanced. 
  • theoremdefined in CryptBoolean/Carlet/Chapter06/Bentness.lean
    complete
    theorem CryptBoolean.isBent_iff_satisfiesPropagationCriterion_dimension {n : }
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.IsBent f  CryptBoolean.SatisfiesPropagationCriterion n f
    theorem CryptBoolean.isBent_iff_satisfiesPropagationCriterion_dimension
      {n : }
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.IsBent f 
        CryptBoolean.SatisfiesPropagationCriterion
          n f
    Carlet's `PC(n)` formulation of Theorem 8. 
Theorem5.1.4
Group: Chapter 5: Bent functions (69)
Group member previews
Preview
Definition 5.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 3
Statement dependency previews
Preview
Definition 1.1.2
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
used by 1L∃∀N

Hadamard-matrix and difference-set characterizations (Carlet, p. 78). Let n\ge2 be even and let f:V_n\to\mathbb F_2. The matrix H_f(x,y)=(-1)^{f(x+y)} is Hadamard if and only if f is bent. If S_f is the support of f and N_{S_f}(a)=\bigl|\{x\in S_f:x+a\in S_f\}\bigr|, then f is bent if and only if |S_f|\ge 2^{n-2} \quad\text{and}\quad N_{S_f}(a)=|S_f|-2^{n-2} \quad(a\ne0). Thus S_f is a Hadamard difference set in the additive group V_n.

Lean code for Theorem5.1.411 declarations
  • defdefined in CryptBoolean/Carlet/Chapter02/Foundations.lean
    complete
    def CryptBoolean.f₂BitWeight (b : FABL.𝔽₂) : 
    def CryptBoolean.f₂BitWeight (b : FABL.𝔽₂) : 
    The natural-valued Hamming weight of a binary scalar. 
  • theoremdefined in CryptBoolean/Carlet/Chapter02/Foundations.lean
    complete
    theorem CryptBoolean.hammingNorm_eq_sum_f₂BitWeight.{u_1} {ι : Type u_1}
      [Fintype ι] (x : ι  FABL.𝔽₂) :
      hammingNorm x =  i, CryptBoolean.f₂BitWeight (x i)
    theorem CryptBoolean.hammingNorm_eq_sum_f₂BitWeight.{u_1}
      {ι : Type u_1} [Fintype ι]
      (x : ι  FABL.𝔽₂) :
      hammingNorm x =
         i, CryptBoolean.f₂BitWeight (x i)
    Hamming norm is the sum of the scalar binary weights. 
  • theoremdefined in CryptBoolean/Carlet/Chapter02/Foundations.lean
    complete
    theorem CryptBoolean.hammingNorm_add_restrictSupport_identity.{u_1}
      {ι : Type u_1} [Fintype ι] (x y : ι  FABL.𝔽₂) :
      (hammingNorm (x + y) + 2 * hammingNorm fun j => y j) =
        hammingNorm x + hammingNorm y
    theorem CryptBoolean.hammingNorm_add_restrictSupport_identity.{u_1}
      {ι : Type u_1} [Fintype ι]
      (x y : ι  FABL.𝔽₂) :
      (hammingNorm (x + y) +
          2 * hammingNorm fun j => y j) =
        hammingNorm x + hammingNorm y
    Hamming weight decomposes into the symmetric-difference weight and twice
    the common-support weight. 
  • defdefined in CryptBoolean/Carlet/Chapter06/HadamardDifferenceSet.lean
    complete
    def CryptBoolean.bentSignMatrix {n : }
      (f : CryptBoolean.BooleanFunction n) :
      Matrix (FABL.F₂Cube n) (FABL.F₂Cube n) 
    def CryptBoolean.bentSignMatrix {n : }
      (f : CryptBoolean.BooleanFunction n) :
      Matrix (FABL.F₂Cube n) (FABL.F₂Cube n) 
    The translation sign matrix `H[x,y] = (-1)^(f(x+y))`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter06/HadamardDifferenceSet.lean
    complete
    theorem CryptBoolean.bentSignMatrix_mul_conjTranspose_apply {n : }
      (f : CryptBoolean.BooleanFunction n) (x z : FABL.F₂Cube n) :
      (CryptBoolean.bentSignMatrix f *
            (CryptBoolean.bentSignMatrix f).conjTranspose)
          x z =
        CryptBoolean.autocorrelation f (x + z)
    theorem CryptBoolean.bentSignMatrix_mul_conjTranspose_apply
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (x z : FABL.F₂Cube n) :
      (CryptBoolean.bentSignMatrix f *
            (CryptBoolean.bentSignMatrix
                f).conjTranspose)
          x z =
        CryptBoolean.autocorrelation f (x + z)
    A Gram-matrix entry of the translation sign matrix is the corresponding
    autocorrelation coefficient. 
  • theoremdefined in CryptBoolean/Carlet/Chapter06/HadamardDifferenceSet.lean
    complete
    theorem CryptBoolean.isBent_iff_bentSignMatrix_isHadamard {n : }
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.IsBent f  (CryptBoolean.bentSignMatrix f).IsHadamard
    theorem CryptBoolean.isBent_iff_bentSignMatrix_isHadamard
      {n : }
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.IsBent f 
        (CryptBoolean.bentSignMatrix
            f).IsHadamard
    Bentness is equivalent to the Hadamard property of the translation sign
    matrix. 
  • defdefined in CryptBoolean/Carlet/Chapter06/HadamardDifferenceSet.lean
    complete
    def CryptBoolean.differenceMultiplicity {n : } (D : Finset (FABL.F₂Cube n))
      (a : FABL.F₂Cube n) : 
    def CryptBoolean.differenceMultiplicity
      {n : } (D : Finset (FABL.F₂Cube n))
      (a : FABL.F₂Cube n) : 
    The multiplicity of a nonzero group difference inside a finite subset of
    the binary cube. 
  • defdefined in CryptBoolean/Carlet/Chapter06/HadamardDifferenceSet.lean
    complete
    def CryptBoolean.IsHadamardDifferenceSet {n : }
      (D : Finset (FABL.F₂Cube n)) : Prop
    def CryptBoolean.IsHadamardDifferenceSet
      {n : } (D : Finset (FABL.F₂Cube n)) :
      Prop
    The Hadamard difference-set parameters appropriate to a subset of the
    binary cube. 
  • theoremdefined in CryptBoolean/Carlet/Chapter06/HadamardDifferenceSet.lean
    complete
    theorem CryptBoolean.differenceMultiplicity_support_eq_hammingNorm_restriction
      {n : } (f : CryptBoolean.BooleanFunction n) (a : FABL.F₂Cube n) :
      CryptBoolean.differenceMultiplicity (CryptBoolean.support f) a =
        hammingNorm fun x => f (x + a)
    theorem CryptBoolean.differenceMultiplicity_support_eq_hammingNorm_restriction
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (a : FABL.F₂Cube n) :
      CryptBoolean.differenceMultiplicity
          (CryptBoolean.support f) a =
        hammingNorm fun x => f (x + a)
    On a Boolean support, difference multiplicity is the Hamming weight of
    the translated function restricted to the original support. 
  • theoremdefined in CryptBoolean/Carlet/Chapter06/HadamardDifferenceSet.lean
    complete
    theorem CryptBoolean.hammingWeight_booleanDerivative_add_two_mul_differenceMultiplicity
      {n : } (f : CryptBoolean.BooleanFunction n) (a : FABL.F₂Cube n) :
      CryptBoolean.hammingWeight (FABL.booleanDerivative f a) +
          2 *
            CryptBoolean.differenceMultiplicity (CryptBoolean.support f) a =
        2 * CryptBoolean.hammingWeight f
    theorem CryptBoolean.hammingWeight_booleanDerivative_add_two_mul_differenceMultiplicity
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (a : FABL.F₂Cube n) :
      CryptBoolean.hammingWeight
            (FABL.booleanDerivative f a) +
          2 *
            CryptBoolean.differenceMultiplicity
              (CryptBoolean.support f) a =
        2 * CryptBoolean.hammingWeight f
    Derivative weight plus twice the support difference multiplicity equals
    twice the support size. 
  • theoremdefined in CryptBoolean/Carlet/Chapter06/HadamardDifferenceSet.lean
    complete
    theorem CryptBoolean.isBent_iff_support_isHadamardDifferenceSet {n : }
      (f : CryptBoolean.BooleanFunction n) (_hnEven : Even n) (hn : 2  n) :
      CryptBoolean.IsBent f 
        CryptBoolean.IsHadamardDifferenceSet (CryptBoolean.support f)
    theorem CryptBoolean.isBent_iff_support_isHadamardDifferenceSet
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (_hnEven : Even n) (hn : 2  n) :
      CryptBoolean.IsBent f 
        CryptBoolean.IsHadamardDifferenceSet
          (CryptBoolean.support f)
    In positive even dimension, bentness is equivalent to the support being
    a Hadamard difference set in the additive binary cube. 
Theorem5.1.5
Group: Chapter 5: Bent functions (69)
Group member previews
Preview
Definition 5.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
uses 1used by 0L∃∀N

Strong regularity of the Boolean Cayley graph (Carlet, p. 78). Let n\ge2 be even, let f:V_n\to\mathbb F_2 be bent with f(0)=0, and join distinct x,y\in V_n exactly when f(x+y)=1. If S_f is the support of f, the resulting graph is strongly regular with parameters \left(2^n,\ |S_f|,\ |S_f|-2^{n-2},\ |S_f|-2^{n-2}\right).

Lean code for Theorem5.1.55 declarations
  • defdefined in CryptBoolean/Carlet/Chapter06/CayleyGraph.lean
    complete
    def CryptBoolean.booleanCayleyGraph {n : }
      (f : CryptBoolean.BooleanFunction n) : SimpleGraph (FABL.F₂Cube n)
    def CryptBoolean.booleanCayleyGraph {n : }
      (f : CryptBoolean.BooleanFunction n) :
      SimpleGraph (FABL.F₂Cube n)
    The additive Cayley graph generated by the support of a Boolean function. 
  • theoremdefined in CryptBoolean/Carlet/Chapter06/CayleyGraph.lean
    complete
    theorem CryptBoolean.booleanCayleyGraph_adj {n : }
      (f : CryptBoolean.BooleanFunction n) (x y : FABL.F₂Cube n) :
      (CryptBoolean.booleanCayleyGraph f).Adj x y  x  y  f (x + y) = 1
    theorem CryptBoolean.booleanCayleyGraph_adj
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (x y : FABL.F₂Cube n) :
      (CryptBoolean.booleanCayleyGraph f).Adj
          x y 
        x  y  f (x + y) = 1
    Two distinct vertices are adjacent exactly when their sum lies in the
    Boolean support. 
  • theoremdefined in CryptBoolean/Carlet/Chapter06/CayleyGraph.lean
    complete
    theorem CryptBoolean.card_commonNeighbors_booleanCayleyGraph {n : }
      (f : CryptBoolean.BooleanFunction n) (hfZero : f 0 = 0)
      (v w : FABL.F₂Cube n) :
      Nat.card ((CryptBoolean.booleanCayleyGraph f).commonNeighbors v w) =
        CryptBoolean.differenceMultiplicity (CryptBoolean.support f) (v + w)
    theorem CryptBoolean.card_commonNeighbors_booleanCayleyGraph
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hfZero : f 0 = 0)
      (v w : FABL.F₂Cube n) :
      Nat.card
          ((CryptBoolean.booleanCayleyGraph
                  f).commonNeighbors
              v w) =
        CryptBoolean.differenceMultiplicity
          (CryptBoolean.support f) (v + w)
    Common neighbors in the Boolean Cayley graph are counted by the
    corresponding support difference multiplicity. 
  • theoremdefined in CryptBoolean/Carlet/Chapter06/CayleyGraph.lean
    complete
    theorem CryptBoolean.degree_booleanCayleyGraph {n : }
      (f : CryptBoolean.BooleanFunction n) (hfZero : f 0 = 0)
      (v : FABL.F₂Cube n) :
      (CryptBoolean.booleanCayleyGraph f).degree v =
        (CryptBoolean.support f).card
    theorem CryptBoolean.degree_booleanCayleyGraph
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hfZero : f 0 = 0) (v : FABL.F₂Cube n) :
      (CryptBoolean.booleanCayleyGraph
              f).degree
          v =
        (CryptBoolean.support f).card
    The Boolean Cayley graph has degree equal to the support size when the
    origin is outside the support. 
  • theoremdefined in CryptBoolean/Carlet/Chapter06/CayleyGraph.lean
    complete
    theorem CryptBoolean.isSRGWith_booleanCayleyGraph_of_isBent {n : }
      (f : CryptBoolean.BooleanFunction n) (hnEven : Even n) (hn : 2  n)
      (hfZero : f 0 = 0) (hf : CryptBoolean.IsBent f) :
      (CryptBoolean.booleanCayleyGraph f).IsSRGWith (2 ^ n)
        (CryptBoolean.support f).card
        ((CryptBoolean.support f).card - 2 ^ (n - 2))
        ((CryptBoolean.support f).card - 2 ^ (n - 2))
    theorem CryptBoolean.isSRGWith_booleanCayleyGraph_of_isBent
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hnEven : Even n) (hn : 2  n)
      (hfZero : f 0 = 0)
      (hf : CryptBoolean.IsBent f) :
      (CryptBoolean.booleanCayleyGraph
            f).IsSRGWith
        (2 ^ n) (CryptBoolean.support f).card
        ((CryptBoolean.support f).card -
          2 ^ (n - 2))
        ((CryptBoolean.support f).card -
          2 ^ (n - 2))
    A bent function normalized by `f(0)=0` has a strongly regular Boolean
    Cayley graph with its exact Hadamard difference-set parameters. 
Proposition5.1.6
Group: Chapter 5: Bent functions (69)
Group member previews
Preview
Definition 5.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 4
Statement dependency previews
Preview
Theorem 1.7.3
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
used by 1L∃∀N

Proposition 16 (Carlet, pp. 78--79; corrected dimension range). Let n\ge4 be even, let S_f=\{u_1,\ldots,u_w\} be the support of f:V_n\to\mathbb F_2, and let C_f=\{(v\mathbin\cdot u_1,\ldots,v\mathbin\cdot u_w):v\in V_n\}. Then f is bent if and only if \dim C_f=n and the nonzero words of C_f have exactly the two weights 2^{n-2}\quad\text{and}\quad w_H(f)-2^{n-2}, with both weights occurring.

Lean code for Proposition5.1.69 declarations
  • defdefined in CryptBoolean/Carlet/Chapter06/SupportCode.lean
    complete
    def CryptBoolean.supportCodeMap {n : }
      (f : CryptBoolean.BooleanFunction n) :
      FABL.F₂Cube n →ₗ[FABL.𝔽₂] (CryptBoolean.support f)  FABL.𝔽₂
    def CryptBoolean.supportCodeMap {n : }
      (f : CryptBoolean.BooleanFunction n) :
      FABL.F₂Cube n →ₗ[FABL.𝔽₂]
        (CryptBoolean.support f)  FABL.𝔽₂
    The codeword obtained by evaluating the linear form `x ↦ v · x` on the
    support of `f`. 
  • defdefined in CryptBoolean/Carlet/Chapter06/SupportCode.lean
    complete
    def CryptBoolean.supportCode {n : } (f : CryptBoolean.BooleanFunction n) :
      Submodule FABL.𝔽₂ ((CryptBoolean.support f)  FABL.𝔽₂)
    def CryptBoolean.supportCode {n : }
      (f : CryptBoolean.BooleanFunction n) :
      Submodule FABL.𝔽₂
        ((CryptBoolean.support f)  FABL.𝔽₂)
    The support-column linear code generated by the coordinate rows of the
    support matrix. 
  • defdefined in CryptBoolean/Carlet/Chapter06/SupportCode.lean
    complete
    def CryptBoolean.supportCodewordWeight {n : }
      (f : CryptBoolean.BooleanFunction n) (v : FABL.F₂Cube n) : 
    def CryptBoolean.supportCodewordWeight {n : }
      (f : CryptBoolean.BooleanFunction n)
      (v : FABL.F₂Cube n) : 
    The Hamming weight of the support-code word indexed by `v`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter06/SupportCode.lean
    complete
    theorem CryptBoolean.supportCodewordWeight_zero {n : }
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.supportCodewordWeight f 0 = 0
    theorem CryptBoolean.supportCodewordWeight_zero
      {n : }
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.supportCodewordWeight f 0 =
        0
    The support-code word indexed by zero has weight zero. 
  • theoremdefined in CryptBoolean/Carlet/Chapter06/SupportCode.lean
    complete
    theorem CryptBoolean.supportCodewordWeight_eq_card_filter {n : }
      (f : CryptBoolean.BooleanFunction n) (v : FABL.F₂Cube n) :
      CryptBoolean.supportCodewordWeight f v =
        {x  CryptBoolean.support f | FABL.f₂DotProduct v x = 1}.card
    theorem CryptBoolean.supportCodewordWeight_eq_card_filter
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (v : FABL.F₂Cube n) :
      CryptBoolean.supportCodewordWeight f v =
        {x  CryptBoolean.support f |
            FABL.f₂DotProduct v x = 1}.card
    A support-code word counts support points on which its defining linear
    form is one. 
  • theoremdefined in CryptBoolean/Carlet/Chapter06/SupportCode.lean
    complete
    theorem CryptBoolean.codeCharacterSum_support_eq_card_sub_two_weight {n : }
      (f : CryptBoolean.BooleanFunction n) (v : FABL.F₂Cube n) :
      CryptBoolean.codeCharacterSum (CryptBoolean.support f) v =
        (CryptBoolean.support f).card -
          2 * (CryptBoolean.supportCodewordWeight f v)
    theorem CryptBoolean.codeCharacterSum_support_eq_card_sub_two_weight
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (v : FABL.F₂Cube n) :
      CryptBoolean.codeCharacterSum
          (CryptBoolean.support f) v =
        (CryptBoolean.support f).card -
          2 *
            (CryptBoolean.supportCodewordWeight
                f v)
    The character sum over the support is its cardinality minus twice the
    support-code word weight. 
  • theoremdefined in CryptBoolean/Carlet/Chapter06/SupportCode.lean
    complete
    theorem CryptBoolean.four_mul_supportCodewordWeight_eq {n : }
      (f : CryptBoolean.BooleanFunction n) (v : FABL.F₂Cube n)
      (hv : v  0) :
      4 * (CryptBoolean.supportCodewordWeight f v) =
        2 ^ n + CryptBoolean.walshTransform f v -
          CryptBoolean.walshTransform f 0
    theorem CryptBoolean.four_mul_supportCodewordWeight_eq
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (v : FABL.F₂Cube n) (hv : v  0) :
      4 *
          (CryptBoolean.supportCodewordWeight
              f v) =
        2 ^ n +
            CryptBoolean.walshTransform f v -
          CryptBoolean.walshTransform f 0
    For a nonzero frequency, four times the support-code word weight is the
    difference between the corresponding and zero-frequency Walsh coefficients,
    shifted by the cube cardinality. 
  • defdefined in CryptBoolean/Carlet/Chapter06/SupportCode.lean
    complete
    def CryptBoolean.SupportCodeHasExactlyTwoNonzeroWeights {n : }
      (f : CryptBoolean.BooleanFunction n) : Prop
    def CryptBoolean.SupportCodeHasExactlyTwoNonzeroWeights
      {n : }
      (f : CryptBoolean.BooleanFunction n) :
      Prop
    The exact two-nonzero-weight condition for the support-column code. 
  • theoremdefined in CryptBoolean/Carlet/Chapter06/SupportCode.lean
    complete
    theorem CryptBoolean.isBent_iff_supportCode_finrank_and_two_nonzero_weights
      {n : } (f : CryptBoolean.BooleanFunction n) (hnEven : Even n)
      (hn : 4  n) :
      CryptBoolean.IsBent f 
        Module.finrank FABL.𝔽₂ (CryptBoolean.supportCode f) = n 
          CryptBoolean.SupportCodeHasExactlyTwoNonzeroWeights f
    theorem CryptBoolean.isBent_iff_supportCode_finrank_and_two_nonzero_weights
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hnEven : Even n) (hn : 4  n) :
      CryptBoolean.IsBent f 
        Module.finrank FABL.𝔽₂
              (CryptBoolean.supportCode f) =
            n 
          CryptBoolean.SupportCodeHasExactlyTwoNonzeroWeights
            f
    Carlet Proposition 16, with the necessary correction `n ≥ 4`: a
    Boolean function in positive even dimension is bent exactly when its
    support-column code has dimension `n` and exactly the two stated nonzero
    weights. 

For n=2, every bent function has odd support size, so the second displayed quantity can coincide with zero; the printed positive-even formulation is therefore false in that dimension.

Theorem5.1.7
Group: Chapter 5: Bent functions (69)
Group member previews
Preview
Definition 5.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
uses 1used by 0L∃∀N

Alternate support-code characterizations (Carlet, p. 79; correction). The two reported converses require additional hypotheses. Indeed, define f_1:V_4\to\mathbb F_2 to vanish at (1,0,0,0) and to equal one elsewhere. Then \dim C_{f_1}=4, the two nonzero weights of C_{f_1} are 7 and 8, and 7+8=w_H(f_1)=15, but f_1 is not bent. Also let f_2(x)=x_2+x_3 on V_4. Then w_H(f_2)=8 is even, the two nonzero weights of C_{f_2} are 4 and 8, and 4=2^{4-2}, but f_2 is not bent.

Lean code for Theorem5.1.78 declarations
  • theoremdefined in CryptBoolean/Carlet/Chapter06/SupportCode.lean
    complete
    theorem CryptBoolean.finrank_supportCode_eq_n_iff_injective {n : }
      (f : CryptBoolean.BooleanFunction n) :
      Module.finrank FABL.𝔽₂ (CryptBoolean.supportCode f) = n 
        Function.Injective (CryptBoolean.supportCodeMap f)
    theorem CryptBoolean.finrank_supportCode_eq_n_iff_injective
      {n : }
      (f : CryptBoolean.BooleanFunction n) :
      Module.finrank FABL.𝔽₂
            (CryptBoolean.supportCode f) =
          n 
        Function.Injective
          (CryptBoolean.supportCodeMap f)
    The support code has full ambient dimension exactly when its defining
    linear map is injective. 
  • defdefined in CryptBoolean/Carlet/Chapter06/SupportCodeAlternatives.lean
    complete
    def CryptBoolean.SupportCodeHasExactlyTwoNonzeroWeightValues {n : }
      (f : CryptBoolean.BooleanFunction n) (r s : ) : Prop
    def CryptBoolean.SupportCodeHasExactlyTwoNonzeroWeightValues
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (r s : ) : Prop
    The nonzero words of the support code have exactly the two distinct
    weights `r` and `s`. 
  • defdefined in CryptBoolean/Carlet/Chapter06/SupportCodeAlternatives.lean
    complete
    def CryptBoolean.HasSupportCodeWeightSumAlternative {n : }
      (f : CryptBoolean.BooleanFunction n) : Prop
    def CryptBoolean.HasSupportCodeWeightSumAlternative
      {n : }
      (f : CryptBoolean.BooleanFunction n) :
      Prop
    The first reported alternative: full dimension and two nonzero weights
    whose sum is the code length. 
  • defdefined in CryptBoolean/Carlet/Chapter06/SupportCodeAlternatives.lean
    complete
    def CryptBoolean.HasSupportCodeEvenLengthQuarterWeightAlternative {n : }
      (f : CryptBoolean.BooleanFunction n) : Prop
    def CryptBoolean.HasSupportCodeEvenLengthQuarterWeightAlternative
      {n : }
      (f : CryptBoolean.BooleanFunction n) :
      Prop
    The second reported alternative: even length and two nonzero weights, one
    of which is `2^(n-2)`. 
  • defdefined in CryptBoolean/Carlet/Chapter06/SupportCodeAlternatives.lean
    complete
    def CryptBoolean.supportCodeWeightSumCounterexample :
      CryptBoolean.BooleanFunction 4
    def CryptBoolean.supportCodeWeightSumCounterexample :
      CryptBoolean.BooleanFunction 4
    The complement of one nonzero point in the four-dimensional cube. 
  • defdefined in CryptBoolean/Carlet/Chapter06/SupportCodeAlternatives.lean
    complete
    def CryptBoolean.supportCodeQuarterWeightCounterexample :
      CryptBoolean.BooleanFunction 4
    def CryptBoolean.supportCodeQuarterWeightCounterexample :
      CryptBoolean.BooleanFunction 4
    A nonconstant linear function in the four-dimensional cube. 
  • theoremdefined in CryptBoolean/Carlet/Chapter06/SupportCodeAlternatives.lean
    complete
    theorem CryptBoolean.supportCodeWeightSumAlternative_not_characterize_bent :
      CryptBoolean.HasSupportCodeWeightSumAlternative
          CryptBoolean.supportCodeWeightSumCounterexample 
        ¬CryptBoolean.IsBent CryptBoolean.supportCodeWeightSumCounterexample
    theorem CryptBoolean.supportCodeWeightSumAlternative_not_characterize_bent :
      CryptBoolean.HasSupportCodeWeightSumAlternative
          CryptBoolean.supportCodeWeightSumCounterexample 
        ¬CryptBoolean.IsBent
            CryptBoolean.supportCodeWeightSumCounterexample
    Full dimension and two distinct nonzero weights summing to the support
    size do not characterize bentness without an additional hypothesis. 
  • theoremdefined in CryptBoolean/Carlet/Chapter06/SupportCodeAlternatives.lean
    complete
    theorem CryptBoolean.supportCodeEvenLengthQuarterWeightAlternative_not_characterize_bent :
      CryptBoolean.HasSupportCodeEvenLengthQuarterWeightAlternative
          CryptBoolean.supportCodeQuarterWeightCounterexample 
        ¬CryptBoolean.IsBent
            CryptBoolean.supportCodeQuarterWeightCounterexample
    theorem CryptBoolean.supportCodeEvenLengthQuarterWeightAlternative_not_characterize_bent :
      CryptBoolean.HasSupportCodeEvenLengthQuarterWeightAlternative
          CryptBoolean.supportCodeQuarterWeightCounterexample 
        ¬CryptBoolean.IsBent
            CryptBoolean.supportCodeQuarterWeightCounterexample
    Even length and two distinct nonzero weights including `2^(n-2)` do not
    characterize bentness without an additional hypothesis.