Cryptographic Boolean Functions in Lean

2.1. Reed--Muller codes🔗

Theorem2.1.1
Statement uses 2
Statement dependency previews
Preview
Theorem 1.1.5
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
used by 1L∃∀N

Weight of a nonconstant affine function (Carlet, p. 38). For a\in V_n, b\in\mathbb F_2, and x\in V_n, (A_{a,b})_\chi(x)=(-1)^b(-1)^{a\mathbin\cdot x}. If a\ne0, then A_{a,b} is balanced and w_H(A_{a,b})=2^{n-1}.

Lean code for Theorem2.1.13 theorems
  • theoremdefined in CryptBoolean/Carlet/Chapter02/Affine.lean
    complete
    theorem CryptBoolean.realSignView_affineFunction {n : } (b : FABL.𝔽₂)
      (a x : FABL.F₂Cube n) :
      CryptBoolean.realSignView (CryptBoolean.affineFunction b a) x =
        FABL.binarySign b * (FABL.vectorWalshCharacter a) x
    theorem CryptBoolean.realSignView_affineFunction
      {n : } (b : FABL.𝔽₂)
      (a x : FABL.F₂Cube n) :
      CryptBoolean.realSignView
          (CryptBoolean.affineFunction b a)
          x =
        FABL.binarySign b *
          (FABL.vectorWalshCharacter a) x
    The real sign view of an affine function is a constant sign times a Walsh character. 
  • theoremdefined in CryptBoolean/Carlet/Chapter02/Affine.lean
    complete
    theorem CryptBoolean.isBalanced_affineFunction_of_ne_zero {n : } (b : FABL.𝔽₂)
      (a : FABL.F₂Cube n) (ha : a  0) :
      CryptBoolean.IsBalanced (CryptBoolean.affineFunction b a)
    theorem CryptBoolean.isBalanced_affineFunction_of_ne_zero
      {n : } (b : FABL.𝔽₂)
      (a : FABL.F₂Cube n) (ha : a  0) :
      CryptBoolean.IsBalanced
        (CryptBoolean.affineFunction b a)
    A nonconstant affine Boolean function is balanced. 
  • theoremdefined in CryptBoolean/Carlet/Chapter02/Affine.lean
    complete
    theorem CryptBoolean.hammingWeight_affineFunction_of_ne_zero {n : }
      (b : FABL.𝔽₂) (a : FABL.F₂Cube n) (ha : a  0) :
      CryptBoolean.hammingWeight (CryptBoolean.affineFunction b a) =
        2 ^ (n - 1)
    theorem CryptBoolean.hammingWeight_affineFunction_of_ne_zero
      {n : } (b : FABL.𝔽₂)
      (a : FABL.F₂Cube n) (ha : a  0) :
      CryptBoolean.hammingWeight
          (CryptBoolean.affineFunction b a) =
        2 ^ (n - 1)
    A nonconstant affine Boolean function has weight `2^(n-1)`. 
Definition2.1.2
Statement uses 4
Statement dependency previews
Used by 4
Reverse dependency previews
L∃∀N

Reed--Muller code (Carlet, pp. 37--38). The Reed--Muller code of order r in n variables is R(r,n) =\{f:V_n\to\mathbb F_2:\deg_{\mathrm{alg}}(f)\le r\}. It is an \mathbb F_2-linear subspace of the space of Boolean functions. If r\le s, then R(r,n)\subseteq R(s,n), and every affine function belongs to R(1,n). Moreover, if f,g\in R(r,n) and f\ne g, then d_H(f,g)>0.

Lean code for Definition2.1.25 declarations
  • defdefined in CryptBoolean/Carlet/Chapter03/ReedMuller.lean
    complete
    def CryptBoolean.reedMuller (r n : ) :
      Submodule FABL.𝔽₂ (CryptBoolean.BooleanFunction n)
    def CryptBoolean.reedMuller (r n : ) :
      Submodule FABL.𝔽₂
        (CryptBoolean.BooleanFunction n)
    Carlet's Reed--Muller code `R(r,n)`, represented without a redundant
    general coding-theory wrapper. 
  • theoremdefined in CryptBoolean/Carlet/Chapter03/ReedMuller.lean
    complete
    theorem CryptBoolean.mem_reedMuller_iff {n r : }
      (f : CryptBoolean.BooleanFunction n) :
      f  CryptBoolean.reedMuller r n 
        CryptBoolean.functionAlgebraicDegree f  r
    theorem CryptBoolean.mem_reedMuller_iff {n r : }
      (f : CryptBoolean.BooleanFunction n) :
      f  CryptBoolean.reedMuller r n 
        CryptBoolean.functionAlgebraicDegree
            f 
          r
    Membership in `R(r,n)` is exactly the algebraic-degree bound. 
  • theoremdefined in CryptBoolean/Carlet/Chapter03/ReedMuller.lean
    complete
    theorem CryptBoolean.reedMuller_mono {n r s : } (hrs : r  s) :
      CryptBoolean.reedMuller r n  CryptBoolean.reedMuller s n
    theorem CryptBoolean.reedMuller_mono {n r s : }
      (hrs : r  s) :
      CryptBoolean.reedMuller r n 
        CryptBoolean.reedMuller s n
    Reed--Muller codes are nested in their order. 
  • theoremdefined in CryptBoolean/Carlet/Chapter03/ReedMuller.lean
    complete
    theorem CryptBoolean.affineFunction_mem_reedMuller_one {n : } (b : FABL.𝔽₂)
      (a : FABL.F₂Cube n) :
      CryptBoolean.affineFunction b a  CryptBoolean.reedMuller 1 n
    theorem CryptBoolean.affineFunction_mem_reedMuller_one
      {n : } (b : FABL.𝔽₂)
      (a : FABL.F₂Cube n) :
      CryptBoolean.affineFunction b a 
        CryptBoolean.reedMuller 1 n
    Every affine function belongs to the first-order Reed--Muller code. 
  • theoremdefined in CryptBoolean/Carlet/Chapter03/ReedMuller.lean
    complete
    theorem CryptBoolean.reedMuller_distance_pos {n r : }
      {f g : CryptBoolean.BooleanFunction n}
      (_hf : f  CryptBoolean.reedMuller r n)
      (_hg : g  CryptBoolean.reedMuller r n) (hfg : f  g) :
      0 < CryptBoolean.hammingDistance f g
    theorem CryptBoolean.reedMuller_distance_pos
      {n r : }
      {f g : CryptBoolean.BooleanFunction n}
      (_hf : f  CryptBoolean.reedMuller r n)
      (_hg : g  CryptBoolean.reedMuller r n)
      (hfg : f  g) :
      0 < CryptBoolean.hammingDistance f g
    Distinct Reed--Muller codewords always have positive raw Hamming distance. 
Theorem2.1.3
used by 0L∃∀N

Derived order-one specialization of Carlet's Theorem 1. Let n\ge1. If f:V_n\to\mathbb F_2 is nonzero and \deg_{\mathrm{alg}}(f)\le1, then w_H(f)\ge2^{n-1}. Equivalently, for all distinct f,g\in R(1,n), d_H(f,g)\ge2^{n-1}.

Lean code for Theorem2.1.33 theorems
  • theoremdefined in CryptBoolean/Carlet/Chapter03/ReedMuller.lean
    complete
    theorem CryptBoolean.hammingWeight_affineFunction_one_zero {n : } :
      CryptBoolean.hammingWeight (CryptBoolean.affineFunction 1 0) = 2 ^ n
    theorem CryptBoolean.hammingWeight_affineFunction_one_zero
      {n : } :
      CryptBoolean.hammingWeight
          (CryptBoolean.affineFunction 1 0) =
        2 ^ n
    The weight of the constant-one Boolean function is the cube cardinality. 
  • theoremdefined in CryptBoolean/Carlet/Chapter03/ReedMuller.lean
    complete
    theorem CryptBoolean.two_pow_sub_one_le_hammingWeight_of_degree_le_one {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hdegree : CryptBoolean.functionAlgebraicDegree f  1) (hf : f  0) :
      2 ^ (n - 1)  CryptBoolean.hammingWeight f
    theorem CryptBoolean.two_pow_sub_one_le_hammingWeight_of_degree_le_one
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hdegree :
        CryptBoolean.functionAlgebraicDegree
            f 
          1)
      (hf : f  0) :
      2 ^ (n - 1) 
        CryptBoolean.hammingWeight f
    A nonzero Boolean function of degree at most one has weight at least
    `2^(n-1)`.  This is Carlet Theorem 1 for first-order Reed--Muller codes. 
  • theoremdefined in CryptBoolean/Carlet/Chapter03/ReedMuller.lean
    complete
    theorem CryptBoolean.reedMuller_one_distance_lower_bound {n : }
      {f g : CryptBoolean.BooleanFunction n}
      (hf : f  CryptBoolean.reedMuller 1 n)
      (hg : g  CryptBoolean.reedMuller 1 n) (hfg : f  g) :
      2 ^ (n - 1)  CryptBoolean.hammingDistance f g
    theorem CryptBoolean.reedMuller_one_distance_lower_bound
      {n : }
      {f g : CryptBoolean.BooleanFunction n}
      (hf : f  CryptBoolean.reedMuller 1 n)
      (hg : g  CryptBoolean.reedMuller 1 n)
      (hfg : f  g) :
      2 ^ (n - 1) 
        CryptBoolean.hammingDistance f g
    Distinct first-order Reed--Muller codewords have distance at least
    `2^(n-1)`. 
Theorem2.1.4
Statement uses 3
Statement dependency previews
Preview
Theorem 1.6.1
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
used by 1L∃∀N

Theorem 1 (Carlet, p. 36). Let 0\le r\le n. If f,g:V_n\to\mathbb F_2 are distinct and \deg_{\mathrm{alg}}(f)\le r, \qquad \deg_{\mathrm{alg}}(g)\le r, then d_H(f,g)\ge2^{n-r}. Equivalently, every nonzero Boolean function h of algebraic degree at most r satisfies w_H(h)\ge2^{n-r}.

Lean code for Theorem2.1.42 theorems
  • theoremdefined in CryptBoolean/Carlet/Chapter03/ReedMuller.lean
    complete
    theorem CryptBoolean.two_pow_sub_le_hammingWeight_of_degree_le {n r : }
      (f : CryptBoolean.BooleanFunction n)
      (hdegree : CryptBoolean.functionAlgebraicDegree f  r) (hf : f  0) :
      2 ^ (n - r)  CryptBoolean.hammingWeight f
    theorem CryptBoolean.two_pow_sub_le_hammingWeight_of_degree_le
      {n r : }
      (f : CryptBoolean.BooleanFunction n)
      (hdegree :
        CryptBoolean.functionAlgebraicDegree
            f 
          r)
      (hf : f  0) :
      2 ^ (n - r) 
        CryptBoolean.hammingWeight f
    Carlet Theorem 1: a nonzero Boolean function of algebraic degree at most `r`
    has Hamming weight at least `2^(n-r)`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter03/ReedMuller.lean
    complete
    theorem CryptBoolean.reedMuller_distance_lower_bound {n r : }
      {f g : CryptBoolean.BooleanFunction n}
      (hf : f  CryptBoolean.reedMuller r n)
      (hg : g  CryptBoolean.reedMuller r n) (hfg : f  g) :
      2 ^ (n - r)  CryptBoolean.hammingDistance f g
    theorem CryptBoolean.reedMuller_distance_lower_bound
      {n r : }
      {f g : CryptBoolean.BooleanFunction n}
      (hf : f  CryptBoolean.reedMuller r n)
      (hg : g  CryptBoolean.reedMuller r n)
      (hfg : f  g) :
      2 ^ (n - r) 
        CryptBoolean.hammingDistance f g
    Carlet Theorem 1 in coding form: distinct words of `R(r,n)` have raw
    Hamming distance at least `2^(n-r)`. 
Proposition2.1.5
uses 1used by 0XL∃∀N

Proposition 12 (Carlet, pp. 36--37). Let 0\le r\le n. A Boolean function f:V_n\to\mathbb F_2 satisfies \deg_{\mathrm{alg}}(f)=r \qquad\text{and}\qquad w_H(f)=2^{n-r} if and only if f is the indicator of an (n-r)-dimensional affine subspace of V_n.

Theorem2.1.6
Statement uses 2
Statement dependency previews
Preview
Theorem 1.6.1
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
used by 1L∃∀N

Dimension of the Reed--Muller code (Carlet, p. 38). For 0\le r\le n, \dim_{\mathbb F_2}R(r,n)=\sum_{i=0}^{r}\binom ni. Consequently, |R(r,n)|=2^{\sum_{i=0}^{r}\binom ni}.

Lean code for Theorem2.1.62 theorems
  • theoremdefined in CryptBoolean/Carlet/Chapter03/ReedMuller.lean
    complete
    theorem CryptBoolean.reedMuller_card {n r : } :
      Nat.card (CryptBoolean.reedMuller r n) =
        2 ^  j  Finset.range (r + 1), n.choose j
    theorem CryptBoolean.reedMuller_card {n r : } :
      Nat.card
          (CryptBoolean.reedMuller r n) =
        2 ^
           j  Finset.range (r + 1),
            n.choose j
    The number of Reed--Muller codewords is `2` raised to the number of
    square-free monomials of degree at most `r`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter03/ReedMuller.lean
    complete
    theorem CryptBoolean.reedMuller_finrank {n r : } :
      Module.finrank FABL.𝔽₂ (CryptBoolean.reedMuller r n) =
         j  Finset.range (r + 1), n.choose j
    theorem CryptBoolean.reedMuller_finrank
      {n r : } :
      Module.finrank FABL.𝔽₂
          (CryptBoolean.reedMuller r n) =
         j  Finset.range (r + 1), n.choose j
    Carlet's dimension formula for the Reed--Muller code `R(r,n)`. 
Theorem2.1.7
Statement uses 2
Statement dependency previews
Preview
Definition 2.1.2
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
used by 0L∃∀N

Theorem 2 (Carlet, pp. 38--39). Let 0\le r<n. Equip Boolean functions with the \mathbb F_2-valued inner product \langle f,g\rangle =\bigoplus_{x\in V_n}f(x)g(x). Then R(r,n)^\perp=R(n-r-1,n).

Lean code for Theorem2.1.76 declarations
  • defdefined in CryptBoolean/Carlet/Chapter03/ReedMullerDuality.lean
    complete
    def CryptBoolean.booleanFunctionPairing (n : ) :
      LinearMap.BilinForm FABL.𝔽₂ (CryptBoolean.BooleanFunction n)
    def CryptBoolean.booleanFunctionPairing
      (n : ) :
      LinearMap.BilinForm FABL.𝔽₂
        (CryptBoolean.BooleanFunction n)
    The standard binary pairing on scalar Boolean functions. 
  • theoremdefined in CryptBoolean/Carlet/Chapter03/ReedMullerDuality.lean
    complete
    theorem CryptBoolean.booleanFunctionPairing_apply {n : }
      (f g : CryptBoolean.BooleanFunction n) :
      ((CryptBoolean.booleanFunctionPairing n) f) g =  x, f x * g x
    theorem CryptBoolean.booleanFunctionPairing_apply
      {n : }
      (f g : CryptBoolean.BooleanFunction n) :
      ((CryptBoolean.booleanFunctionPairing n)
            f)
          g =
         x, f x * g x
  • theoremdefined in CryptBoolean/Carlet/Chapter03/ReedMullerDuality.lean
    complete
    theorem CryptBoolean.booleanFunctionPairing_nondegenerate {n : } :
      (CryptBoolean.booleanFunctionPairing n).Nondegenerate
    theorem CryptBoolean.booleanFunctionPairing_nondegenerate
      {n : } :
      (CryptBoolean.booleanFunctionPairing
          n).Nondegenerate
    The standard binary pairing on Boolean functions is nondegenerate. 
  • defdefined in CryptBoolean/Carlet/Chapter03/ReedMullerDuality.lean
    complete
    def CryptBoolean.reedMullerDual (r n : ) :
      Submodule FABL.𝔽₂ (CryptBoolean.BooleanFunction n)
    def CryptBoolean.reedMullerDual (r n : ) :
      Submodule FABL.𝔽₂
        (CryptBoolean.BooleanFunction n)
    The orthogonal complement of `R(r,n)` under Carlet's binary pairing. 
  • theoremdefined in CryptBoolean/Carlet/Chapter03/ReedMullerDuality.lean
    complete
    theorem CryptBoolean.reedMuller_complement_le_dual {n r : } (h : r < n) :
      CryptBoolean.reedMuller (n - r - 1) n 
        CryptBoolean.reedMullerDual r n
    theorem CryptBoolean.reedMuller_complement_le_dual
      {n r : } (h : r < n) :
      CryptBoolean.reedMuller (n - r - 1) n 
        CryptBoolean.reedMullerDual r n
    Functions of complementary Reed--Muller orders are orthogonal. 
  • theoremdefined in CryptBoolean/Carlet/Chapter03/ReedMullerDuality.lean
    complete
    theorem CryptBoolean.reedMullerDual_eq {n r : } (h : r < n) :
      CryptBoolean.reedMullerDual r n =
        CryptBoolean.reedMuller (n - r - 1) n
    theorem CryptBoolean.reedMullerDual_eq {n r : }
      (h : r < n) :
      CryptBoolean.reedMullerDual r n =
        CryptBoolean.reedMuller (n - r - 1) n
    Carlet, Chapter 3, Theorem 2: `R(r,n)ᗮ = R(n-r-1,n)` for `r < n`.