Cryptographic Boolean Functions in Lean

3.3. Higher-order nonlinearity🔗

Definition3.3.1
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 2
Statement dependency previews
Preview
Definition 1.4.3
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
Used by 10
Reverse dependency previews
Preview
Theorem 3.2.10
Loading preview
Reverse dependency preview content is loaded from the rendered-fragment cache.
L∃∀N

Higher-order nonlinearity (Carlet, pp. 53--54). For 0\le r<n, define \operatorname{nl}_r(f) =\min_{g\in R(r,n)}d_H(f,g). The sequence (\operatorname{nl}_r(f))_{0\le r<n} is the nonlinearity profile of f.

Lean code for Definition3.3.15 declarations
  • defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderNonlinearity.lean
    complete
    def CryptBoolean.higherOrderNonlinearity {n : } (r : )
      (f : CryptBoolean.BooleanFunction n) : 
    def CryptBoolean.higherOrderNonlinearity
      {n : } (r : )
      (f : CryptBoolean.BooleanFunction n) : 
    The order-`r` nonlinearity is the minimum raw Hamming distance to `R(r,n)`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderNonlinearity.lean
    complete
    theorem CryptBoolean.nonlinearity_eq_higherOrderNonlinearity_one {n : }
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.nonlinearity f = CryptBoolean.higherOrderNonlinearity 1 f
    theorem CryptBoolean.nonlinearity_eq_higherOrderNonlinearity_one
      {n : }
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.nonlinearity f =
        CryptBoolean.higherOrderNonlinearity 1
          f
    Ordinary nonlinearity is first-order Reed--Muller distance. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderNonlinearity.lean
    complete
    theorem CryptBoolean.higherOrderNonlinearity_le_hammingDistance {n : } (r : )
      (f g : CryptBoolean.BooleanFunction n)
      (hg : g  CryptBoolean.reedMuller r n) :
      CryptBoolean.higherOrderNonlinearity r f 
        CryptBoolean.hammingDistance f g
    theorem CryptBoolean.higherOrderNonlinearity_le_hammingDistance
      {n : } (r : )
      (f g : CryptBoolean.BooleanFunction n)
      (hg : g  CryptBoolean.reedMuller r n) :
      CryptBoolean.higherOrderNonlinearity r
          f 
        CryptBoolean.hammingDistance f g
    Distance to `R(r,n)` is bounded by the distance to each of its codewords. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderNonlinearity.lean
    complete
    theorem CryptBoolean.exists_reedMuller_hammingDistance_eq_higherOrderNonlinearity
      {n : } (r : ) (f : CryptBoolean.BooleanFunction n) :
       g  CryptBoolean.reedMuller r n,
        CryptBoolean.hammingDistance f g =
          CryptBoolean.higherOrderNonlinearity r f
    theorem CryptBoolean.exists_reedMuller_hammingDistance_eq_higherOrderNonlinearity
      {n : } (r : )
      (f : CryptBoolean.BooleanFunction n) :
       g  CryptBoolean.reedMuller r n,
        CryptBoolean.hammingDistance f g =
          CryptBoolean.higherOrderNonlinearity
            r f
    The finite Reed--Muller code contains a closest codeword. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderNonlinearity.lean
    complete
    theorem CryptBoolean.higherOrderNonlinearity_antitone {n r s : } (hrs : r  s)
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.higherOrderNonlinearity s f 
        CryptBoolean.higherOrderNonlinearity r f
    theorem CryptBoolean.higherOrderNonlinearity_antitone
      {n r s : } (hrs : r  s)
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.higherOrderNonlinearity s
          f 
        CryptBoolean.higherOrderNonlinearity r
          f
    Increasing the Reed--Muller order can only decrease the distance to the code. 
Theorem3.3.2
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 2
Statement dependency previews
Preview
Definition 1.4.1
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
used by 0L∃∀N

Distance to functions on a prescribed coordinate set (Carlet, p. 53). If I\subseteq\{1,\ldots,n\} and |I|=r, then \operatorname{nl}_r(f) \le \min_{g\text{ depending only on }I}d_H(f,g).

Lean code for Theorem3.3.24 theorems
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderJuntaDistance.lean
    complete
    theorem CryptBoolean.anfCoeff_eq_zero_of_coordinate_invariant {n : }
      (g : CryptBoolean.BooleanFunction n) (S : Finset (Fin n)) (i : Fin n)
      (hiS : i  S)
      (hinvariant :
         (x : FABL.F₂Cube n),
          g (Function.update x i 1) = g (Function.update x i 0)) :
      FABL.anfCoeff g S = 0
    theorem CryptBoolean.anfCoeff_eq_zero_of_coordinate_invariant
      {n : }
      (g : CryptBoolean.BooleanFunction n)
      (S : Finset (Fin n)) (i : Fin n)
      (hiS : i  S)
      (hinvariant :
         (x : FABL.F₂Cube n),
          g (Function.update x i 1) =
            g (Function.update x i 0)) :
      FABL.anfCoeff g S = 0
    Invariance under one binary coordinate forces every ANF coefficient
    containing that coordinate to vanish. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderJuntaDistance.lean
    complete
    theorem CryptBoolean.anfCoeff_eq_zero_of_dependsOn_of_not_subset {n : }
      (g : CryptBoolean.BooleanFunction n) {I S : Finset (Fin n)}
      (hdepends : DependsOn g I) (hS : ¬S  I) : FABL.anfCoeff g S = 0
    theorem CryptBoolean.anfCoeff_eq_zero_of_dependsOn_of_not_subset
      {n : }
      (g : CryptBoolean.BooleanFunction n)
      {I S : Finset (Fin n)}
      (hdepends : DependsOn g I)
      (hS : ¬S  I) : FABL.anfCoeff g S = 0
    A function depending only on `I` has no ANF coefficient supported
    outside `I`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderJuntaDistance.lean
    complete
    theorem CryptBoolean.functionAlgebraicDegree_le_card_of_dependsOn {n : }
      (g : CryptBoolean.BooleanFunction n) (I : Finset (Fin n))
      (hdepends : DependsOn g I) : FABL.functionAlgebraicDegree g  I.card
    theorem CryptBoolean.functionAlgebraicDegree_le_card_of_dependsOn
      {n : }
      (g : CryptBoolean.BooleanFunction n)
      (I : Finset (Fin n))
      (hdepends : DependsOn g I) :
      FABL.functionAlgebraicDegree g  I.card
    A Boolean function depending only on `I` has algebraic degree at most
    the cardinality of `I`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderJuntaDistance.lean
    complete
    theorem CryptBoolean.higherOrderNonlinearity_le_hammingDistance_of_dependsOn
      {n : } (r : ) (f g : CryptBoolean.BooleanFunction n)
      (I : Finset (Fin n)) (hI : I.card = r) (hdepends : DependsOn g I) :
      CryptBoolean.higherOrderNonlinearity r f 
        CryptBoolean.hammingDistance f g
    theorem CryptBoolean.higherOrderNonlinearity_le_hammingDistance_of_dependsOn
      {n : } (r : )
      (f g : CryptBoolean.BooleanFunction n)
      (I : Finset (Fin n)) (hI : I.card = r)
      (hdepends : DependsOn g I) :
      CryptBoolean.higherOrderNonlinearity r
          f 
        CryptBoolean.hammingDistance f g
    Carlet's coordinate-junta bound: every function depending on a set `I`
    of `r` coordinates is an admissible order-`r` approximant. 
Lemma3.3.3
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 2
Statement dependency previews
Preview
Theorem 2.1.6
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
used by 1L∃∀N

Finite sphere-covering criterion for Carlet's p. 54 lower bound. Put V(N,t)=\sum_{j=0}^{t}\binom Nj, \qquad D=\sum_{j=0}^{r}\binom nj. If 2^D V(2^n,t)<2^{2^n}, then some f:V_n\to\mathbb F_2 satisfies t<\operatorname{nl}_r(f). Equivalently, it suffices that V(2^n,t)<2^{2^n-D}.

Lean code for Lemma3.3.33 declarations
  • defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderGeneralBounds.lean
    complete
    def CryptBoolean.hammingBallVolume (N t : ) : 
    def CryptBoolean.hammingBallVolume (N t : ) :
      
    The cardinality of a binary Hamming ball of radius `t` in dimension `N`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderGeneralBounds.lean
    complete
    theorem CryptBoolean.exists_higherOrderNonlinearity_gt_of_counting (r n t : )
      (hcount :
        (2 ^  j  Finset.range (r + 1), n.choose j) *
            CryptBoolean.hammingBallVolume (2 ^ n) t <
          2 ^ 2 ^ n) :
       f, t < CryptBoolean.higherOrderNonlinearity r f
    theorem CryptBoolean.exists_higherOrderNonlinearity_gt_of_counting
      (r n t : )
      (hcount :
        (2 ^
               j  Finset.range (r + 1),
                n.choose j) *
            CryptBoolean.hammingBallVolume
              (2 ^ n) t <
          2 ^ 2 ^ n) :
       f,
        t <
          CryptBoolean.higherOrderNonlinearity
            r f
    If the Reed--Muller Hamming balls of radius `t` have total cardinality
    strictly below the Boolean-function space, some function has order-`r`
    nonlinearity greater than `t`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderGeneralBounds.lean
    complete
    theorem CryptBoolean.exists_higherOrderNonlinearity_gt_of_hammingBallVolume_lt
      (r n t : )
      (hdimension :  j  Finset.range (r + 1), n.choose j  2 ^ n)
      (hvolume :
        CryptBoolean.hammingBallVolume (2 ^ n) t <
          2 ^ (2 ^ n -  j  Finset.range (r + 1), n.choose j)) :
       f, t < CryptBoolean.higherOrderNonlinearity r f
    theorem CryptBoolean.exists_higherOrderNonlinearity_gt_of_hammingBallVolume_lt
      (r n t : )
      (hdimension :
         j  Finset.range (r + 1),
            n.choose j 
          2 ^ n)
      (hvolume :
        CryptBoolean.hammingBallVolume (2 ^ n)
            t <
          2 ^
            (2 ^ n -
               j  Finset.range (r + 1),
                n.choose j)) :
       f,
        t <
          CryptBoolean.higherOrderNonlinearity
            r f
    Power-of-two form of the exact finite sphere-covering criterion. 
Theorem3.3.4
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
uses 1used by 0L∃∀N

Asymptotic lower existence bound for higher-order nonlinearity (Carlet, pp. 53--54). For each fixed r and all sufficiently large n, there is a function f:V_n\to\mathbb F_2 such that \operatorname{nl}_r(f)> 2^{n-1}-\sqrt{2^{n-1}\sum_{i=0}^{r}\binom ni}.

Lean code for Theorem3.3.43 theorems
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderGeneralBounds.lean
    complete
    theorem CryptBoolean.exists_higherOrderNonlinearity_gt_lower_bound_of_dimension
      (r n : )
      (hdimension : 2 *  j  Finset.range (r + 1), n.choose j  2 ^ n) :
       f,
        2 ^ n / 2 -
            (2 ^ n / 2 * (∑ j  Finset.range (r + 1), n.choose j)) <
          (CryptBoolean.higherOrderNonlinearity r f)
    theorem CryptBoolean.exists_higherOrderNonlinearity_gt_lower_bound_of_dimension
      (r n : )
      (hdimension :
        2 *
             j  Finset.range (r + 1),
              n.choose j 
          2 ^ n) :
       f,
        2 ^ n / 2 -
            (2 ^ n / 2 *
                (∑ j  Finset.range (r + 1),
                    n.choose j)) <
          (CryptBoolean.higherOrderNonlinearity
              r f)
    Finite-dimensional form of Carlet's probabilistic lower bound. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderGeneralBounds.lean
    complete
    theorem CryptBoolean.eventually_twice_sum_choose_le_two_pow (r : ) :
      ∀ᶠ (n : ) in Filter.atTop,
        2 *  j  Finset.range (r + 1), n.choose j  2 ^ n
    theorem CryptBoolean.eventually_twice_sum_choose_le_two_pow
      (r : ) :
      ∀ᶠ (n : ) in Filter.atTop,
        2 *
             j  Finset.range (r + 1),
              n.choose j 
          2 ^ n
    For fixed order `r`, the Reed--Muller dimension is eventually at most
    half of the ambient Boolean cube dimension. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderGeneralBounds.lean
    complete
    theorem CryptBoolean.eventually_exists_higherOrderNonlinearity_gt_carlet_lower_bound
      (r : ) :
      ∀ᶠ (n : ) in Filter.atTop,
         f,
          2 ^ (n - 1) -
              (2 ^ (n - 1) * (∑ j  Finset.range (r + 1), n.choose j)) <
            (CryptBoolean.higherOrderNonlinearity r f)
    theorem CryptBoolean.eventually_exists_higherOrderNonlinearity_gt_carlet_lower_bound
      (r : ) :
      ∀ᶠ (n : ) in Filter.atTop,
         f,
          2 ^ (n - 1) -
              (2 ^ (n - 1) *
                  (∑
                      j 
                        Finset.range (r + 1),
                      n.choose j)) <
            (CryptBoolean.higherOrderNonlinearity
                r f)
    Carlet's fixed-order asymptotic lower bound for higher-order nonlinearity. 
Lemma3.3.5
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
uses 1used by 1L∃∀N

Finite Plotkin induction for the cited upper bound. Define \rho(r,n)=\max_f\operatorname{nl}_r(f). For 1\le r\le n, \rho(r,n)\le\sum_{j=r}^{n-1}\rho(r-1,j). More generally, if throughout this range \rho(r-1,j)\le 2^{j-1}-A(\sqrt2)^j+e(j), then \rho(r,n)\le \frac{2^n-2^r}{2} -A(1+\sqrt2)\big((\sqrt2)^n-(\sqrt2)^r\big) +\sum_{j=r}^{n-1}e(j).

Lean code for Lemma3.3.58 declarations
  • defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderGeneralBounds.lean
    complete
    def CryptBoolean.maximumHigherOrderNonlinearity (r n : ) : 
    def CryptBoolean.maximumHigherOrderNonlinearity
      (r n : ) : 
    The covering radius `ρ(r,n)`: the largest order-`r` nonlinearity in
    dimension `n`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderGeneralBounds.lean
    complete
    theorem CryptBoolean.higherOrderNonlinearity_le_maximum {n : } (r : )
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.higherOrderNonlinearity r f 
        CryptBoolean.maximumHigherOrderNonlinearity r n
    theorem CryptBoolean.higherOrderNonlinearity_le_maximum
      {n : } (r : )
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.higherOrderNonlinearity r
          f 
        CryptBoolean.maximumHigherOrderNonlinearity
          r n
    Every order-`r` nonlinearity is bounded by the Reed--Muller covering radius. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderGeneralBounds.lean
    complete
    theorem CryptBoolean.exists_higherOrderNonlinearity_eq_maximum (r n : ) :
       f,
        CryptBoolean.higherOrderNonlinearity r f =
          CryptBoolean.maximumHigherOrderNonlinearity r n
    theorem CryptBoolean.exists_higherOrderNonlinearity_eq_maximum
      (r n : ) :
       f,
        CryptBoolean.higherOrderNonlinearity r
            f =
          CryptBoolean.maximumHigherOrderNonlinearity
            r n
    The finite Boolean-function space contains a word attaining the
    order-`r` Reed--Muller covering radius. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderGeneralBounds.lean
    complete
    theorem CryptBoolean.maximumHigherOrderNonlinearity_succ_le (r n : )
      (hr : 1  r) :
      CryptBoolean.maximumHigherOrderNonlinearity r (n + 1) 
        CryptBoolean.maximumHigherOrderNonlinearity r n +
          CryptBoolean.maximumHigherOrderNonlinearity (r - 1) n
    theorem CryptBoolean.maximumHigherOrderNonlinearity_succ_le
      (r n : ) (hr : 1  r) :
      CryptBoolean.maximumHigherOrderNonlinearity
          r (n + 1) 
        CryptBoolean.maximumHigherOrderNonlinearity
            r n +
          CryptBoolean.maximumHigherOrderNonlinearity
            (r - 1) n
    The Reed--Muller covering radii satisfy the Plotkin recurrence
    `ρ(r,n+1) ≤ ρ(r,n) + ρ(r-1,n)`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderGeneralBounds.lean
    complete
    theorem CryptBoolean.maximumHigherOrderNonlinearity_self (n : ) :
      CryptBoolean.maximumHigherOrderNonlinearity n n = 0
    theorem CryptBoolean.maximumHigherOrderNonlinearity_self
      (n : ) :
      CryptBoolean.maximumHigherOrderNonlinearity
          n n =
        0
    The order-`n` Reed--Muller code has covering radius zero in dimension `n`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderGeneralBounds.lean
    complete
    theorem CryptBoolean.maximumHigherOrderNonlinearity_le_sum_Ico (r n : )
      (hr : 1  r) (hrn : r  n) :
      CryptBoolean.maximumHigherOrderNonlinearity r n 
         j  Finset.Ico r n,
          CryptBoolean.maximumHigherOrderNonlinearity (r - 1) j
    theorem CryptBoolean.maximumHigherOrderNonlinearity_le_sum_Ico
      (r n : ) (hr : 1  r) (hrn : r  n) :
      CryptBoolean.maximumHigherOrderNonlinearity
          r n 
         j  Finset.Ico r n,
          CryptBoolean.maximumHigherOrderNonlinearity
            (r - 1) j
    Iterating the Plotkin recurrence bounds `ρ(r,n)` by the sum of the
    order-`r-1` covering radii in dimensions `r,…,n-1`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderGeneralBounds.lean
    complete
    theorem CryptBoolean.maximumHigherOrderNonlinearity_cast_le_sum_Ico_of_le
      (r n : ) (hr : 1  r) (hrn : r  n) (bound :   )
      (hbound :
         j  Finset.Ico r n,
          (CryptBoolean.maximumHigherOrderNonlinearity (r - 1) j) 
            bound j) :
      (CryptBoolean.maximumHigherOrderNonlinearity r n) 
         j  Finset.Ico r n, bound j
    theorem CryptBoolean.maximumHigherOrderNonlinearity_cast_le_sum_Ico_of_le
      (r n : ) (hr : 1  r) (hrn : r  n)
      (bound :   )
      (hbound :
         j  Finset.Ico r n,
          (CryptBoolean.maximumHigherOrderNonlinearity
                (r - 1) j) 
            bound j) :
      (CryptBoolean.maximumHigherOrderNonlinearity
            r n) 
         j  Finset.Ico r n, bound j
    A pointwise real-valued bound for the order-`r-1` covering radii can be
    summed through the Plotkin recurrence to bound the order-`r` covering radius. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderGeneralBounds.lean
    complete
    theorem CryptBoolean.maximumHigherOrderNonlinearity_cast_le_carlet_step
      (r n : ) (hr : 1  r) (hrn : r  n) (A : ) (error :   )
      (hlower :
         j  Finset.Ico r n,
          (CryptBoolean.maximumHigherOrderNonlinearity (r - 1) j) 
            2 ^ j / 2 - A * 2 ^ j + error j) :
      (CryptBoolean.maximumHigherOrderNonlinearity r n) 
        (2 ^ n - 2 ^ r) / 2 - A * (1 + 2) * (2 ^ n - 2 ^ r) +
           j  Finset.Ico r n, error j
    theorem CryptBoolean.maximumHigherOrderNonlinearity_cast_le_carlet_step
      (r n : ) (hr : 1  r) (hrn : r  n)
      (A : ) (error :   )
      (hlower :
         j  Finset.Ico r n,
          (CryptBoolean.maximumHigherOrderNonlinearity
                (r - 1) j) 
            2 ^ j / 2 - A * 2 ^ j +
              error j) :
      (CryptBoolean.maximumHigherOrderNonlinearity
            r n) 
        (2 ^ n - 2 ^ r) / 2 -
            A * (1 + 2) * (2 ^ n - 2 ^ r) +
           j  Finset.Ico r n, error j
    Carlet's finite higher-order induction step: a bound with leading
    coefficient `A` at order `r-1` yields coefficient `A * (1 + √2)` at order
    `r`, with the finite error terms summed over dimensions `r,…,n-1`. 

The proof constructs the Plotkin approximant from the two coordinate slices and then evaluates the two finite geometric sums exactly. Thus the cited sharp constant reduces to the order-two covering-radius theorem.

Outline of the sharp upper bound.

The sharp upper bound follows from a chain of lemmas. The correlation-moment ratio turns a lower bound for two consecutive even moments into an upper bound for the order-two covering radius. Character orthogonality then rewrites those moments as signed counts of words in the dual Reed--Muller code, and finite Fourier inversion groups the counts by Hamming weight. The difference of the seventh and eighth moments is supported only at weights 0,8,12,14,16; separate geometric or classification arguments bound the character sum at each weight. The resulting moment inequality gives the sharp \sqrt{15}/2 order-two coefficient, and the Plotkin recurrence propagates it to every fixed order r\ge2, multiplying it by 1+\sqrt2 at each step.

The weight-sixteen branch is the only exceptional part of this spine. Its rank-seven words are normalized through an augmented self-dual [16,8,\ge4] code, classified into the three affine orbits 2E_8, D_{16}^{+}, and F_{16}, and controlled by an orbit-wise sum-of-squares identity. Words of affine-span rank at most six are handled by a separate rank-deficient affine-mask cover. Adding these two estimates supplies the single weight-sixteen character bound used by the moment argument; no later analytic step depends on the details of the finite classification.

More explicitly, the exceptional branch uses the following six steps.

  1. Orthogonality to R(2,n) bounds the affine-span dimension of a weight-sixteen support by seven and, in dimension seven, produces an augmented self-dual [16,8,\ge4] code.

  2. Choosing a support point and seven genuine support differences identifies the full-rank support with a systematic sixteen-point subset of V_7; its quadratic parity constraints are precisely those inherited from the dual Reed--Muller condition.

  3. The systematic constraints classify the normalized support into one of the three canonical patterns. Affine composition transports that classification back to V_n, and pairwise orbit disjointness makes the three alternatives unique.

  4. For each canonical pattern, a nonnegative complete affine-map sum is split into injective and rank-deficient maps. Counting the latter and then dividing by the common positive fiber size gives the lower bound for the corresponding set of distinct image words.

  5. If the affine-span dimension is at most six, a padded basis realizes the support as the image of a mask on V_7 under a rank-deficient affine map. Counting maps and masks bounds both the residual family and its character loss.

  6. The exact rank-seven/residual partition adds the three orbit estimates and the residual estimate. This is the sole weight-sixteen ingredient in the seventh/eighth moment inequality.

Lemma3.3.6
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 3
Statement dependency previews
Preview
Theorem 1.9.2
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
Used by 2
Reverse dependency previews
Preview
Lemma 3.3.7
Loading preview
Reverse dependency preview content is loaded from the rendered-fragment cache.
L∃∀N

Second-order correlation moment ratio. For f:V_n\to\mathbb F_2 and g\in R(2,n), put C_f(g)=2^n-2d_H(f,g), \qquad S_k(f)=\sum_{g\in R(2,n)} C_f(g)^{2k}. Then S_k(f)>0 and \sqrt{\frac{S_{k+1}(f)}{S_k(f)}} \le 2^n-2\operatorname{nl}_2(f). Consequently, if \rho(2,n)=\max_f\operatorname{nl}_2(f) and \mu_{k,n}=\min_f\sqrt{S_{k+1}(f)/S_k(f)}, then \rho(2,n)\le 2^{n-1}-\frac{\mu_{k,n}}2.

Lean code for Lemma3.3.615 declarations
  • defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.lean
    complete
    def CryptBoolean.orderTwoCorrelation {n : }
      (f g : CryptBoolean.BooleanFunction n) : 
    def CryptBoolean.orderTwoCorrelation {n : }
      (f g : CryptBoolean.BooleanFunction n) :
      
    The raw correlation of `f` with a Reed--Muller approximant `g`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.lean
    complete
    theorem CryptBoolean.orderTwoCorrelation_eq_two_pow_sub_two_hammingDistance
      {n : } (f g : CryptBoolean.BooleanFunction n) :
      CryptBoolean.orderTwoCorrelation f g =
        2 ^ n - 2 * (CryptBoolean.hammingDistance f g)
    theorem CryptBoolean.orderTwoCorrelation_eq_two_pow_sub_two_hammingDistance
      {n : }
      (f g : CryptBoolean.BooleanFunction n) :
      CryptBoolean.orderTwoCorrelation f g =
        2 ^ n -
          2 *
            (CryptBoolean.hammingDistance f
                g)
    Raw correlation is cube size minus twice Hamming distance. 
  • defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.lean
    complete
    def CryptBoolean.maximumOrderTwoCorrelation {n : }
      (f : CryptBoolean.BooleanFunction n) : 
    def CryptBoolean.maximumOrderTwoCorrelation
      {n : }
      (f : CryptBoolean.BooleanFunction n) : 
    Carlet--Mesnager's `A₂(f)`, expressed through the exact distance--
    correlation relation. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.lean
    complete
    theorem CryptBoolean.maximumOrderTwoCorrelation_eq {n : }
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.maximumOrderTwoCorrelation f =
        2 ^ n - 2 * (CryptBoolean.higherOrderNonlinearity 2 f)
    theorem CryptBoolean.maximumOrderTwoCorrelation_eq
      {n : }
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.maximumOrderTwoCorrelation
          f =
        2 ^ n -
          2 *
            (CryptBoolean.higherOrderNonlinearity
                2 f)
    The definition of `A₂(f)` is the complement of twice the second-order
    nonlinearity. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.lean
    complete
    theorem CryptBoolean.orderTwoCorrelation_le_maximum {n : }
      (f g : CryptBoolean.BooleanFunction n)
      (hg : g  CryptBoolean.reedMuller 2 n) :
      CryptBoolean.orderTwoCorrelation f g 
        CryptBoolean.maximumOrderTwoCorrelation f
    theorem CryptBoolean.orderTwoCorrelation_le_maximum
      {n : }
      (f g : CryptBoolean.BooleanFunction n)
      (hg : g  CryptBoolean.reedMuller 2 n) :
      CryptBoolean.orderTwoCorrelation f g 
        CryptBoolean.maximumOrderTwoCorrelation
          f
    Every second-order Reed--Muller correlation is at most `A₂(f)`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.lean
    complete
    theorem CryptBoolean.exists_orderTwoCorrelation_eq_maximum {n : }
      (f : CryptBoolean.BooleanFunction n) :
       g  CryptBoolean.reedMuller 2 n,
        CryptBoolean.orderTwoCorrelation f g =
          CryptBoolean.maximumOrderTwoCorrelation f
    theorem CryptBoolean.exists_orderTwoCorrelation_eq_maximum
      {n : }
      (f : CryptBoolean.BooleanFunction n) :
       g  CryptBoolean.reedMuller 2 n,
        CryptBoolean.orderTwoCorrelation f g =
          CryptBoolean.maximumOrderTwoCorrelation
            f
    A closest second-order Reed--Muller word attains `A₂(f)`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.lean
    complete
    theorem CryptBoolean.maximumOrderTwoCorrelation_nonneg {n : }
      (f : CryptBoolean.BooleanFunction n) :
      0  CryptBoolean.maximumOrderTwoCorrelation f
    theorem CryptBoolean.maximumOrderTwoCorrelation_nonneg
      {n : }
      (f : CryptBoolean.BooleanFunction n) :
      0 
        CryptBoolean.maximumOrderTwoCorrelation
          f
    The maximum second-order correlation is nonnegative. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.lean
    complete
    theorem CryptBoolean.abs_orderTwoCorrelation_le_maximum {n : }
      (f g : CryptBoolean.BooleanFunction n)
      (hg : g  CryptBoolean.reedMuller 2 n) :
      |CryptBoolean.orderTwoCorrelation f g| 
        CryptBoolean.maximumOrderTwoCorrelation f
    theorem CryptBoolean.abs_orderTwoCorrelation_le_maximum
      {n : }
      (f g : CryptBoolean.BooleanFunction n)
      (hg : g  CryptBoolean.reedMuller 2 n) :
      |CryptBoolean.orderTwoCorrelation f g| 
        CryptBoolean.maximumOrderTwoCorrelation
          f
    Every second-order correlation has absolute value at most `A₂(f)`. 
  • defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.lean
    complete
    def CryptBoolean.orderTwoCorrelationPowerSum {n : } (k : )
      (f : CryptBoolean.BooleanFunction n) : 
    def CryptBoolean.orderTwoCorrelationPowerSum
      {n : } (k : )
      (f : CryptBoolean.BooleanFunction n) : 
    The even `2k`-th correlation power sum over `RM(2,n)`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.lean
    complete
    theorem CryptBoolean.orderTwoCorrelationPowerSum_nonneg {n : } (k : )
      (f : CryptBoolean.BooleanFunction n) :
      0  CryptBoolean.orderTwoCorrelationPowerSum k f
    theorem CryptBoolean.orderTwoCorrelationPowerSum_nonneg
      {n : } (k : )
      (f : CryptBoolean.BooleanFunction n) :
      0 
        CryptBoolean.orderTwoCorrelationPowerSum
          k f
    Correlation power sums are nonnegative. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.lean
    complete
    theorem CryptBoolean.orderTwoCorrelationPowerSum_pos {n : } (k : )
      (f : CryptBoolean.BooleanFunction n) :
      0 < CryptBoolean.orderTwoCorrelationPowerSum k f
    theorem CryptBoolean.orderTwoCorrelationPowerSum_pos
      {n : } (k : )
      (f : CryptBoolean.BooleanFunction n) :
      0 <
        CryptBoolean.orderTwoCorrelationPowerSum
          k f
    Every correlation power sum has a nonzero affine-correlation summand. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.lean
    complete
    theorem CryptBoolean.orderTwoCorrelationPowerSum_succ_le {n : } (k : )
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.orderTwoCorrelationPowerSum (k + 1) f 
        CryptBoolean.maximumOrderTwoCorrelation f ^ 2 *
          CryptBoolean.orderTwoCorrelationPowerSum k f
    theorem CryptBoolean.orderTwoCorrelationPowerSum_succ_le
      {n : } (k : )
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.orderTwoCorrelationPowerSum
          (k + 1) f 
        CryptBoolean.maximumOrderTwoCorrelation
              f ^
            2 *
          CryptBoolean.orderTwoCorrelationPowerSum
            k f
    The consecutive power sums satisfy the finite maximum-moment inequality
    used in Carlet--Mesnager Relation (9.9). 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.lean
    complete
    theorem CryptBoolean.sqrt_orderTwoCorrelationPowerSum_ratio_le {n : } (k : )
      (f : CryptBoolean.BooleanFunction n) :
      (CryptBoolean.orderTwoCorrelationPowerSum (k + 1) f /
            CryptBoolean.orderTwoCorrelationPowerSum k f) 
        CryptBoolean.maximumOrderTwoCorrelation f
    theorem CryptBoolean.sqrt_orderTwoCorrelationPowerSum_ratio_le
      {n : } (k : )
      (f : CryptBoolean.BooleanFunction n) :
      (CryptBoolean.orderTwoCorrelationPowerSum
              (k + 1) f /
            CryptBoolean.orderTwoCorrelationPowerSum
              k f) 
        CryptBoolean.maximumOrderTwoCorrelation
          f
    Carlet--Mesnager Relation (9.9): the square root of a consecutive
    power-sum ratio is bounded by the maximum second-order correlation. 
  • defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.lean
    complete
    def CryptBoolean.minimumOrderTwoMomentRatio (k n : ) : 
    def CryptBoolean.minimumOrderTwoMomentRatio
      (k n : ) : 
    The minimum consecutive moment ratio appearing in Relation (9.10). 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.lean
    complete
    theorem CryptBoolean.maximumHigherOrderNonlinearity_two_cast_le_momentRatio
      (k n : ) :
      (CryptBoolean.maximumHigherOrderNonlinearity 2 n) 
        2 ^ n / 2 - CryptBoolean.minimumOrderTwoMomentRatio k n / 2
    theorem CryptBoolean.maximumHigherOrderNonlinearity_two_cast_le_momentRatio
      (k n : ) :
      (CryptBoolean.maximumHigherOrderNonlinearity
            2 n) 
        2 ^ n / 2 -
          CryptBoolean.minimumOrderTwoMomentRatio
              k n /
            2
    Carlet--Mesnager Relation (9.10), before inserting the low-weight
    dual-code character-sum estimate. 

Relations (9.7)--(9.10) of the cited Carlet--Mesnager argument reduce the sharp order-two bound to a uniform lower estimate for consecutive even correlation moments. The low-weight dual Reed--Muller classification supplies that estimate through the subsequent weight-by-weight decomposition.

Lemma3.3.7
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 2
Statement dependency previews
Preview
Theorem 2.1.7
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
used by 1L∃∀N

Dual-code decomposition of second-order correlation moments. For an ordered 2k-tuple x=(x_i) of points of V_n, let p_x be the Boolean function recording the parity of the multiplicity of each point, and let U_{k,n}=\{x:p_x\in R(n-3,n)\}. If n\ge3, then S_k(f)=|R(2,n)| \sum_{x\in U_{k,n}}(-1)^{\langle f,p_x\rangle}.

Lean code for Lemma3.3.77 declarations
  • defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.lean
    complete
    def CryptBoolean.tuplePointParity {n m : } (x : Fin m  FABL.F₂Cube n) :
      CryptBoolean.BooleanFunction n
    def CryptBoolean.tuplePointParity {n m : }
      (x : Fin m  FABL.F₂Cube n) :
      CryptBoolean.BooleanFunction n
    The parity of the multiset of points in an ordered tuple, viewed as a
    Boolean function. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.lean
    complete
    theorem CryptBoolean.booleanFunctionPairing_tuplePointParity {n m : }
      (f : CryptBoolean.BooleanFunction n) (x : Fin m  FABL.F₂Cube n) :
      ((CryptBoolean.booleanFunctionPairing n) f)
          (CryptBoolean.tuplePointParity x) =
         i, f (x i)
    theorem CryptBoolean.booleanFunctionPairing_tuplePointParity
      {n m : }
      (f : CryptBoolean.BooleanFunction n)
      (x : Fin m  FABL.F₂Cube n) :
      ((CryptBoolean.booleanFunctionPairing n)
            f)
          (CryptBoolean.tuplePointParity x) =
         i, f (x i)
    Pairing with the tuple point-parity function evaluates a Boolean function
    on every entry of the tuple and adds the results. 
  • defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.lean
    complete
    def CryptBoolean.orderTwoAdmissibleTuples (k n : ) :
      Finset (Fin (2 * k)  FABL.F₂Cube n)
    def CryptBoolean.orderTwoAdmissibleTuples
      (k n : ) :
      Finset (Fin (2 * k)  FABL.F₂Cube n)
    The ordered `2k`-tuples whose point-parity function belongs to the dual
    Reed--Muller code occurring in Carlet--Mesnager Lemma 9.2.2. 
  • defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.lean
    complete
    def CryptBoolean.reedMullerTwoPairingCharacterSum {n : }
      (h : CryptBoolean.BooleanFunction n) : 
    def CryptBoolean.reedMullerTwoPairingCharacterSum
      {n : }
      (h : CryptBoolean.BooleanFunction n) : 
    The character sum over `RM(2,n)` induced by pairing with `h`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.lean
    complete
    theorem CryptBoolean.reedMullerTwoPairingCharacterSum_eq_card_of_mem_dual
      {n : } (h : CryptBoolean.BooleanFunction n)
      (hdual : h  CryptBoolean.reedMullerDual 2 n) :
      CryptBoolean.reedMullerTwoPairingCharacterSum h =
        (Nat.card (CryptBoolean.reedMuller 2 n))
    theorem CryptBoolean.reedMullerTwoPairingCharacterSum_eq_card_of_mem_dual
      {n : }
      (h : CryptBoolean.BooleanFunction n)
      (hdual :
        h  CryptBoolean.reedMullerDual 2 n) :
      CryptBoolean.reedMullerTwoPairingCharacterSum
          h =
        (Nat.card
            (CryptBoolean.reedMuller 2 n))
    Character orthogonality on `RM(2,n)` at a word in the dual code. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.lean
    complete
    theorem CryptBoolean.reedMullerTwoPairingCharacterSum_eq_zero_of_not_mem_dual
      {n : } (h : CryptBoolean.BooleanFunction n)
      (hdual : h  CryptBoolean.reedMullerDual 2 n) :
      CryptBoolean.reedMullerTwoPairingCharacterSum h = 0
    theorem CryptBoolean.reedMullerTwoPairingCharacterSum_eq_zero_of_not_mem_dual
      {n : }
      (h : CryptBoolean.BooleanFunction n)
      (hdual :
        h  CryptBoolean.reedMullerDual 2 n) :
      CryptBoolean.reedMullerTwoPairingCharacterSum
          h =
        0
    Character orthogonality on `RM(2,n)` away from the dual code. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.lean
    complete
    theorem CryptBoolean.orderTwoCorrelationPowerSum_eq_admissibleTupleCharacterSum
      {n : } (k : ) (f : CryptBoolean.BooleanFunction n) (hn : 3  n) :
      CryptBoolean.orderTwoCorrelationPowerSum k f =
        (Nat.card (CryptBoolean.reedMuller 2 n)) *
           x  CryptBoolean.orderTwoAdmissibleTuples k n,
            FABL.binarySign
              (((CryptBoolean.booleanFunctionPairing n) f)
                (CryptBoolean.tuplePointParity x))
    theorem CryptBoolean.orderTwoCorrelationPowerSum_eq_admissibleTupleCharacterSum
      {n : } (k : )
      (f : CryptBoolean.BooleanFunction n)
      (hn : 3  n) :
      CryptBoolean.orderTwoCorrelationPowerSum
          k f =
        (Nat.card
              (CryptBoolean.reedMuller 2
                  n)) *
          
            x 
              CryptBoolean.orderTwoAdmissibleTuples
                k n,
            FABL.binarySign
              (((CryptBoolean.booleanFunctionPairing
                    n)
                  f)
                (CryptBoolean.tuplePointParity
                  x))
    Carlet--Mesnager Lemma 9.2.2: the `2k`-th correlation power sum is the
    cardinality of `RM(2,n)` times the character sum over the ordered tuples whose
    point-parity function belongs to `RM(n-3,n)`. 

Expanding the even power gives ordered tuples. Character orthogonality over R(2,n) leaves exactly its dual, and Chapter 3 duality identifies that code with R(n-3,n). This is Carlet--Mesnager Lemma 9.2.2; the subsequent grouping by low dual weights remains separate.

Lemma3.3.8
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
uses 1used by 1L∃∀N

Weight grouping and finite inversion of tuple multiplicities. Let N_k(w) be the number of ordered 2k-tuples whose point-parity word is a prescribed Boolean function of Hamming weight w. This number depends only on w, and N_k(w)=2^{-2^n}\sum_{j=0}^{2^n} K_j^{(2^n)}(w)(2^n-2j)^{2k}, where K_j^{(2^n)} is the binary Krawtchouk polynomial. Consequently the dual-code moment decomposition can be grouped by dual words and then by their Hamming weights using these exact multiplicities.

Lean code for Lemma3.3.813 declarations
  • defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.lean
    complete
    def CryptBoolean.orderTwoDualWords (n : ) :
      Finset (CryptBoolean.BooleanFunction n)
    def CryptBoolean.orderTwoDualWords (n : ) :
      Finset (CryptBoolean.BooleanFunction n)
    The dual Reed--Muller words used to group the admissible tuples. 
  • defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.lean
    complete
    def CryptBoolean.tuplePointParityFiber {n : } (k : )
      (h : CryptBoolean.BooleanFunction n) :
      Finset (Fin (2 * k)  FABL.F₂Cube n)
    def CryptBoolean.tuplePointParityFiber {n : }
      (k : )
      (h : CryptBoolean.BooleanFunction n) :
      Finset (Fin (2 * k)  FABL.F₂Cube n)
    The fiber of ordered tuples having a prescribed point-parity word. 
  • defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.lean
    complete
    def CryptBoolean.tuplePointParityMultiplicity {n : } (k : )
      (h : CryptBoolean.BooleanFunction n) : 
    def CryptBoolean.tuplePointParityMultiplicity
      {n : } (k : )
      (h : CryptBoolean.BooleanFunction n) : 
    The number of ordered tuples having a prescribed point-parity word. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.lean
    complete
    theorem CryptBoolean.tuplePointParityMultiplicity_comp_perm {n : } (k : )
      (h : CryptBoolean.BooleanFunction n)
      (σ : Equiv.Perm (FABL.F₂Cube n)) :
      CryptBoolean.tuplePointParityMultiplicity k h =
        CryptBoolean.tuplePointParityMultiplicity k (h  (Equiv.symm σ))
    theorem CryptBoolean.tuplePointParityMultiplicity_comp_perm
      {n : } (k : )
      (h : CryptBoolean.BooleanFunction n)
      (σ : Equiv.Perm (FABL.F₂Cube n)) :
      CryptBoolean.tuplePointParityMultiplicity
          k h =
        CryptBoolean.tuplePointParityMultiplicity
          k (h  (Equiv.symm σ))
    Relabeling all cube points by a permutation preserves point-parity fiber
    cardinality. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.lean
    complete
    theorem CryptBoolean.tuplePointParityMultiplicity_eq_of_hammingWeight_eq {n : }
      (k : ) (h₁ h₂ : CryptBoolean.BooleanFunction n)
      (hweight :
        CryptBoolean.hammingWeight h₁ = CryptBoolean.hammingWeight h₂) :
      CryptBoolean.tuplePointParityMultiplicity k h₁ =
        CryptBoolean.tuplePointParityMultiplicity k h₂
    theorem CryptBoolean.tuplePointParityMultiplicity_eq_of_hammingWeight_eq
      {n : } (k : )
      (h₁ h₂ : CryptBoolean.BooleanFunction n)
      (hweight :
        CryptBoolean.hammingWeight h₁ =
          CryptBoolean.hammingWeight h₂) :
      CryptBoolean.tuplePointParityMultiplicity
          k h₁ =
        CryptBoolean.tuplePointParityMultiplicity
          k h₂
    Point-parity fiber cardinality depends only on the Hamming weight of the
    prescribed word. 
  • defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.lean
    complete
    def CryptBoolean.tuplePointParityMultiplicityByWeight (k n w : ) : 
    def CryptBoolean.tuplePointParityMultiplicityByWeight
      (k n w : ) : 
    The common point-parity multiplicity of words of Hamming weight `w`, or
    zero when no such word exists. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.lean
    complete
    theorem CryptBoolean.tuplePointParityMultiplicity_eq_byWeight {n : } (k : )
      (h : CryptBoolean.BooleanFunction n) :
      CryptBoolean.tuplePointParityMultiplicity k h =
        CryptBoolean.tuplePointParityMultiplicityByWeight k n
          (CryptBoolean.hammingWeight h)
    theorem CryptBoolean.tuplePointParityMultiplicity_eq_byWeight
      {n : } (k : )
      (h : CryptBoolean.BooleanFunction n) :
      CryptBoolean.tuplePointParityMultiplicity
          k h =
        CryptBoolean.tuplePointParityMultiplicityByWeight
          k n (CryptBoolean.hammingWeight h)
    A point-parity fiber multiplicity is its weight-indexed multiplicity. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.lean
    complete
    theorem CryptBoolean.tuplePointParityMultiplicityByWeight_eq_fourierSum {n : }
      (k : ) (h : CryptBoolean.BooleanFunction n) :
      (CryptBoolean.tuplePointParityMultiplicityByWeight k n
            (CryptBoolean.hammingWeight h)) =
        (∑ g,
            FABL.binarySign
                (((CryptBoolean.booleanFunctionPairing n) g) h) *
              (2 ^ n - 2 * (CryptBoolean.hammingWeight g)) ^ (2 * k)) /
          2 ^ 2 ^ n
    theorem CryptBoolean.tuplePointParityMultiplicityByWeight_eq_fourierSum
      {n : } (k : )
      (h : CryptBoolean.BooleanFunction n) :
      (CryptBoolean.tuplePointParityMultiplicityByWeight
            k n
            (CryptBoolean.hammingWeight h)) =
        (∑ g,
            FABL.binarySign
                (((CryptBoolean.booleanFunctionPairing
                      n)
                    g)
                  h) *
              (2 ^ n -
                  2 *
                    (CryptBoolean.hammingWeight
                        g)) ^
                (2 * k)) /
          2 ^ 2 ^ n
    Mesnager HDR Lemma 9.2.7 in finite Fourier form: the ordered-tuple
    multiplicity at a realizable weight is the inverse Fourier transform of the
    `2k`-th powers of the one-point character sums. 
  • defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.lean
    complete
    def CryptBoolean.tuplePointParityKrawtchoukMultiplicity (k n w : ) : 
    def CryptBoolean.tuplePointParityKrawtchoukMultiplicity
      (k n w : ) : 
    The finite Krawtchouk sum equal to Mesnager's exponential-generating
    coefficient `[z^(2k)] sinh(z)^w cosh(z)^(2^n-w)`. Here `w` is the full
    Hamming weight; Mesnager's parameter is half this value. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.lean
    complete
    theorem CryptBoolean.tuplePointParityMultiplicityByWeight_eq_krawtchoukSum
      {n : } (k : ) (h : CryptBoolean.BooleanFunction n) :
      (CryptBoolean.tuplePointParityMultiplicityByWeight k n
            (CryptBoolean.hammingWeight h)) =
        CryptBoolean.tuplePointParityKrawtchoukMultiplicity k n
          (CryptBoolean.hammingWeight h)
    theorem CryptBoolean.tuplePointParityMultiplicityByWeight_eq_krawtchoukSum
      {n : } (k : )
      (h : CryptBoolean.BooleanFunction n) :
      (CryptBoolean.tuplePointParityMultiplicityByWeight
            k n
            (CryptBoolean.hammingWeight h)) =
        CryptBoolean.tuplePointParityKrawtchoukMultiplicity
          k n (CryptBoolean.hammingWeight h)
    Mesnager HDR Lemma 9.2.7 in explicit finite Krawtchouk form. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.lean
    complete
    theorem CryptBoolean.orderTwoCorrelationPowerSum_eq_dualWeightGroupedCharacterSum
      {n : } (k : ) (f : CryptBoolean.BooleanFunction n) (hn : 3  n) :
      CryptBoolean.orderTwoCorrelationPowerSum k f =
        (Nat.card (CryptBoolean.reedMuller 2 n)) *
           h  CryptBoolean.orderTwoDualWords n,
            (CryptBoolean.tuplePointParityMultiplicityByWeight k n
                  (CryptBoolean.hammingWeight h)) *
              FABL.binarySign
                (((CryptBoolean.booleanFunctionPairing n) f) h)
    theorem CryptBoolean.orderTwoCorrelationPowerSum_eq_dualWeightGroupedCharacterSum
      {n : } (k : )
      (f : CryptBoolean.BooleanFunction n)
      (hn : 3  n) :
      CryptBoolean.orderTwoCorrelationPowerSum
          k f =
        (Nat.card
              (CryptBoolean.reedMuller 2
                  n)) *
          
            h 
              CryptBoolean.orderTwoDualWords
                n,
            (CryptBoolean.tuplePointParityMultiplicityByWeight
                  k n
                  (CryptBoolean.hammingWeight
                    h)) *
              FABL.binarySign
                (((CryptBoolean.booleanFunctionPairing
                      n)
                    f)
                  h)
    Carlet--Mesnager Proposition 9.2.5, first grouping layer: the correlation
    power sum is grouped by dual Reed--Muller words, with a tuple multiplicity that
    depends only on the word's Hamming weight. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.lean
    complete
    theorem CryptBoolean.orderTwoCorrelationPowerSum_eq_dualFourierMultiplicityCharacterSum
      {n : } (k : ) (f : CryptBoolean.BooleanFunction n) (hn : 3  n) :
      CryptBoolean.orderTwoCorrelationPowerSum k f =
        (Nat.card (CryptBoolean.reedMuller 2 n)) *
           h  CryptBoolean.orderTwoDualWords n,
            (∑ g,
                  FABL.binarySign
                      (((CryptBoolean.booleanFunctionPairing n) g) h) *
                    (2 ^ n - 2 * (CryptBoolean.hammingWeight g)) ^
                      (2 * k)) /
                2 ^ 2 ^ n *
              FABL.binarySign
                (((CryptBoolean.booleanFunctionPairing n) f) h)
    theorem CryptBoolean.orderTwoCorrelationPowerSum_eq_dualFourierMultiplicityCharacterSum
      {n : } (k : )
      (f : CryptBoolean.BooleanFunction n)
      (hn : 3  n) :
      CryptBoolean.orderTwoCorrelationPowerSum
          k f =
        (Nat.card
              (CryptBoolean.reedMuller 2
                  n)) *
          
            h 
              CryptBoolean.orderTwoDualWords
                n,
            (∑ g,
                  FABL.binarySign
                      (((CryptBoolean.booleanFunctionPairing
                            n)
                          g)
                        h) *
                    (2 ^ n -
                        2 *
                          (CryptBoolean.hammingWeight
                              g)) ^
                      (2 * k)) /
                2 ^ 2 ^ n *
              FABL.binarySign
                (((CryptBoolean.booleanFunctionPairing
                      n)
                    f)
                  h)
    Proposition 9.2.5 with each tuple multiplicity replaced by its exact finite
    Fourier inversion formula. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.lean
    complete
    theorem CryptBoolean.orderTwoCorrelationPowerSum_eq_dualKrawtchoukMultiplicityCharacterSum
      {n : } (k : ) (f : CryptBoolean.BooleanFunction n) (hn : 3  n) :
      CryptBoolean.orderTwoCorrelationPowerSum k f =
        (Nat.card (CryptBoolean.reedMuller 2 n)) *
           h  CryptBoolean.orderTwoDualWords n,
            CryptBoolean.tuplePointParityKrawtchoukMultiplicity k n
                (CryptBoolean.hammingWeight h) *
              FABL.binarySign
                (((CryptBoolean.booleanFunctionPairing n) f) h)
    theorem CryptBoolean.orderTwoCorrelationPowerSum_eq_dualKrawtchoukMultiplicityCharacterSum
      {n : } (k : )
      (f : CryptBoolean.BooleanFunction n)
      (hn : 3  n) :
      CryptBoolean.orderTwoCorrelationPowerSum
          k f =
        (Nat.card
              (CryptBoolean.reedMuller 2
                  n)) *
          
            h 
              CryptBoolean.orderTwoDualWords
                n,
            CryptBoolean.tuplePointParityKrawtchoukMultiplicity
                k n
                (CryptBoolean.hammingWeight
                  h) *
              FABL.binarySign
                (((CryptBoolean.booleanFunctionPairing
                      n)
                    f)
                  h)
    Proposition 9.2.5 with each tuple multiplicity replaced by the explicit
    finite Krawtchouk sum equivalent to Mesnager's generating-function formula. 

Permuting the Boolean cube identifies all tuple-parity fibers of equal weight. Character orthogonality on the full Boolean-function group gives finite Fourier inversion, and the Krawtchouk expansion groups the Fourier sum by Hamming weight. This is the finite form of Carlet--Mesnager Proposition 9.2.5 and Lemma 9.2.7.

Lemma3.3.9
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 2
Statement dependency previews
Preview
Theorem 2.1.4
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
Used by 4
Reverse dependency previews
Preview
Lemma 3.3.10
Loading preview
Reverse dependency preview content is loaded from the rendered-fragment cache.
L∃∀N

Support of the seventh/eighth moment difference. Let h\in R(n-3,n) and n\ge7. Among even weights at most 16, the only possibilities are 0,\ 8,\ 12,\ 14,\ 16. Moreover, a point-parity multiplicity for ordered 2k-tuples vanishes when w>2k. Hence the coefficient of h in S_8(f)-15\cdot2^nS_7(f) vanishes for w>16, so this moment difference is supported only at the five displayed weights.

Lean code for Lemma3.3.94 theorems
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoLowWeightSpectrum.lean
    complete
    theorem CryptBoolean.hasOrderTwoLowWeightSpectrum {n : } (hn : 3  n) :
      CryptBoolean.HasOrderTwoLowWeightSpectrum n
    theorem CryptBoolean.hasOrderTwoLowWeightSpectrum
      {n : } (hn : 3  n) :
      CryptBoolean.HasOrderTwoLowWeightSpectrum
        n
    Below weight sixteen, the only even weights in the codimension-three
    dual code are `0, 8, 12, 14, 16`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoMomentDifference.lean
    complete
    theorem CryptBoolean.tuplePointParityMultiplicityByWeight_eq_zero_of_lt {n : }
      (k : ) (h : CryptBoolean.BooleanFunction n)
      (hweight : 2 * k < CryptBoolean.hammingWeight h) :
      CryptBoolean.tuplePointParityMultiplicityByWeight k n
          (CryptBoolean.hammingWeight h) =
        0
    theorem CryptBoolean.tuplePointParityMultiplicityByWeight_eq_zero_of_lt
      {n : } (k : )
      (h : CryptBoolean.BooleanFunction n)
      (hweight :
        2 * k <
          CryptBoolean.hammingWeight h) :
      CryptBoolean.tuplePointParityMultiplicityByWeight
          k n (CryptBoolean.hammingWeight h) =
        0
    A tuple-parity multiplicity vanishes when the prescribed word has more
    support points than the tuple has entries. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoMomentDifference.lean
    complete
    theorem CryptBoolean.tuplePointParityMomentDifference_eq_zero_of_sixteen_lt
      {n : } (h : CryptBoolean.BooleanFunction n)
      (hweight : 16 < CryptBoolean.hammingWeight h) :
      CryptBoolean.tuplePointParityMomentDifference n
          (CryptBoolean.hammingWeight h) =
        0
    theorem CryptBoolean.tuplePointParityMomentDifference_eq_zero_of_sixteen_lt
      {n : }
      (h : CryptBoolean.BooleanFunction n)
      (hweight :
        16 < CryptBoolean.hammingWeight h) :
      CryptBoolean.tuplePointParityMomentDifference
          n (CryptBoolean.hammingWeight h) =
        0
    Above weight sixteen, the coefficient in the seventh/eighth moment
    difference vanishes. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoMomentDifference.lean
    complete
    theorem CryptBoolean.orderTwoMomentDifferenceCharacterSum_eq_lowWeights {n : }
      (f : CryptBoolean.BooleanFunction n) (hn : 7  n) :
       h  CryptBoolean.orderTwoDualWords n,
          CryptBoolean.tuplePointParityMomentDifference n
              (CryptBoolean.hammingWeight h) *
            FABL.binarySign
              (((CryptBoolean.booleanFunctionPairing n) f) h) =
        CryptBoolean.tuplePointParityMomentDifference n 0 +
                CryptBoolean.tuplePointParityMomentDifference n 8 *
                  CryptBoolean.orderTwoWeightEightCharacterSum f +
              CryptBoolean.tuplePointParityMomentDifference n 12 *
                CryptBoolean.orderTwoWeightTwelveCharacterSum f +
            CryptBoolean.tuplePointParityMomentDifference n 14 *
              CryptBoolean.orderTwoWeightFourteenCharacterSum f +
          CryptBoolean.tuplePointParityMomentDifference n 16 *
            CryptBoolean.orderTwoWeightSixteenCharacterSum f
    theorem CryptBoolean.orderTwoMomentDifferenceCharacterSum_eq_lowWeights
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hn : 7  n) :
       h  CryptBoolean.orderTwoDualWords n,
          CryptBoolean.tuplePointParityMomentDifference
              n
              (CryptBoolean.hammingWeight h) *
            FABL.binarySign
              (((CryptBoolean.booleanFunctionPairing
                    n)
                  f)
                h) =
        CryptBoolean.tuplePointParityMomentDifference
                  n 0 +
                CryptBoolean.tuplePointParityMomentDifference
                    n 8 *
                  CryptBoolean.orderTwoWeightEightCharacterSum
                    f +
              CryptBoolean.tuplePointParityMomentDifference
                  n 12 *
                CryptBoolean.orderTwoWeightTwelveCharacterSum
                  f +
            CryptBoolean.tuplePointParityMomentDifference
                n 14 *
              CryptBoolean.orderTwoWeightFourteenCharacterSum
                f +
          CryptBoolean.tuplePointParityMomentDifference
              n 16 *
            CryptBoolean.orderTwoWeightSixteenCharacterSum
              f
    The dual-code coefficient sum is supported only at weights
    `0, 8, 12, 14, 16`. 

The minimum-distance theorem excludes weights below eight and the codimension-three spectrum excludes weight ten; tuple support alone removes weights above sixteen. This is the finite support reduction used before the individual low-weight estimates in Carlet and Mesnager (2007).

Lemma3.3.10
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 2
Statement dependency previews
Preview
Proposition 2.1.5
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
used by 1L∃∀N

Weight-eight dual character bound. For n\ge3, the weight-eight words of R(n-3,n) are precisely the indicators of affine three-flats. If M_8(f)=\sum_{\substack{h\in R(n-3,n)\\\operatorname{wt}(h)=8}} (-1)^{\langle f,h\rangle}, then M_8(f)\ge -\frac{2^n(2^n-1)(2^n-2)}{336}.

Lean code for Lemma3.3.106 theorems
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightEight.lean
    complete
    theorem CryptBoolean.orderTwoWeightEightDualWords_eq_affineFlatIndicators
      {n : } (hn : 3  n) :
      CryptBoolean.orderTwoWeightEightDualWords n =
        Finset.image CryptBoolean.binaryAffineFlatIndicator
          (CryptBoolean.binaryAffineFlats 3 n)
    theorem CryptBoolean.orderTwoWeightEightDualWords_eq_affineFlatIndicators
      {n : } (hn : 3  n) :
      CryptBoolean.orderTwoWeightEightDualWords
          n =
        Finset.image
          CryptBoolean.binaryAffineFlatIndicator
          (CryptBoolean.binaryAffineFlats 3 n)
    Minimum-weight classification identifies the weight-eight dual words
    with the indicators of the canonical three-dimensional affine flats. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightEight.lean
    complete
    theorem CryptBoolean.orderTwoWeightEightCharacterSum_eq_affineFlatCharacterSum
      {n : } (f : CryptBoolean.BooleanFunction n) (hn : 3  n) :
      CryptBoolean.orderTwoWeightEightCharacterSum f =
        CryptBoolean.binaryAffineFlatCharacterSum 3 f
    theorem CryptBoolean.orderTwoWeightEightCharacterSum_eq_affineFlatCharacterSum
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hn : 3  n) :
      CryptBoolean.orderTwoWeightEightCharacterSum
          f =
        CryptBoolean.binaryAffineFlatCharacterSum
          3 f
    The dual-code definition of `M_f^(8)` is the affine-three-flat
    character sum used in Proposition 9.2.10. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightEight.lean
    complete
    theorem CryptBoolean.card_binaryAffineFlats_two (n : ) :
      (CryptBoolean.binaryAffineFlats 2 n).card * 24 =
        2 ^ n * (2 ^ n - 1) * (2 ^ n - 2)
    theorem CryptBoolean.card_binaryAffineFlats_two
      (n : ) :
      (CryptBoolean.binaryAffineFlats 2
              n).card *
          24 =
        2 ^ n * (2 ^ n - 1) * (2 ^ n - 2)
    The number of affine two-flats is
    `2^n (2^n - 1) (2^n - 2) / 24`, in division-free form. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightEight.lean
    complete
    theorem CryptBoolean.binaryAffineFlatCharacterSum_three_ge_neg_card {n : }
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.binaryAffineFlatCharacterSum 3 f 
        -(CryptBoolean.binaryAffineFlats 2 n).card / 14
    theorem CryptBoolean.binaryAffineFlatCharacterSum_three_ge_neg_card
      {n : }
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.binaryAffineFlatCharacterSum
          3 f 
        -(CryptBoolean.binaryAffineFlats 2
                  n).card /
          14
    The three-flat character sum is bounded below by minus one fourteenth
    of the number of affine two-flats. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightEight.lean
    complete
    theorem CryptBoolean.binaryAffineFlatCharacterSum_three_ge {n : }
      (f : CryptBoolean.BooleanFunction n) (hn : 3  n) :
      CryptBoolean.binaryAffineFlatCharacterSum 3 f 
        -(2 ^ n * (2 ^ n - 1) * (2 ^ n - 2)) / 336
    theorem CryptBoolean.binaryAffineFlatCharacterSum_three_ge
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hn : 3  n) :
      CryptBoolean.binaryAffineFlatCharacterSum
          3 f 
        -(2 ^ n * (2 ^ n - 1) * (2 ^ n - 2)) /
          336
    Carlet--Mesnager Proposition 9.2.10(1), in its affine-flat form:
    `M_f^(8) ≥ -2^n(2^n-1)(2^n-2)/336`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightEight.lean
    complete
    theorem CryptBoolean.orderTwoWeightEightCharacterSum_ge {n : }
      (f : CryptBoolean.BooleanFunction n) (hn : 3  n) :
      CryptBoolean.orderTwoWeightEightCharacterSum f 
        -(2 ^ n * (2 ^ n - 1) * (2 ^ n - 2)) / 336
    theorem CryptBoolean.orderTwoWeightEightCharacterSum_ge
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hn : 3  n) :
      CryptBoolean.orderTwoWeightEightCharacterSum
          f 
        -(2 ^ n * (2 ^ n - 1) * (2 ^ n - 2)) /
          336
    Carlet--Mesnager Proposition 9.2.10(1) for the canonical weight-eight
    dual-code character sum. 

Proposition 12 supplies the affine-flat normal form. The character sum over parallel affine two-flat pairs is a square; removing the diagonal leaves the stated lower bound. This is Carlet--Mesnager Proposition 9.2.10(1) (Carlet and Mesnager, 2007).

Lemma3.3.11
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 2
Statement dependency previews
Preview
Theorem 2.1.7
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
used by 1L∃∀N

Weight-twelve dual character bound. For n\ge5, every weight-twelve word of R(n-3,n) has exactly twenty ordered representations as the sum of two affine three-flat indicators whose intersection is an affine line. Consequently, with M_{12}(f)=\sum_{\substack{h\in R(n-3,n)\\\operatorname{wt}(h)=12}} (-1)^{\langle f,h\rangle}, one has M_{12}(f)\ge-\frac{(2^n)^5}{20}.

Lean code for Lemma3.3.114 theorems
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightTwelveClassification.lean
    complete
    theorem CryptBoolean.hasWeightTwelveFlatPairClassification (n : )
      (hn : 5  n) : CryptBoolean.HasWeightTwelveFlatPairClassification n
    theorem CryptBoolean.hasWeightTwelveFlatPairClassification
      (n : ) (hn : 5  n) :
      CryptBoolean.HasWeightTwelveFlatPairClassification
        n
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightTwelve.lean
    complete
    theorem CryptBoolean.weightTwelveRepresentationCharacterSum_ge {n : }
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.weightTwelveRepresentationCharacterSum f 
        -(2 ^ n) ^ 5 / 20
    theorem CryptBoolean.weightTwelveRepresentationCharacterSum_ge
      {n : }
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.weightTwelveRepresentationCharacterSum
          f 
        -(2 ^ n) ^ 5 / 20
    The affine representation form of the weight-twelve character sum is at
    least `-(2^n)^5 / 20`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightTwelve.lean
    complete
    theorem CryptBoolean.orderTwoWeightTwelveCharacterSum_eq_representation {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hclassification :
        CryptBoolean.HasWeightTwelveFlatPairClassification n) :
      CryptBoolean.orderTwoWeightTwelveCharacterSum f =
        CryptBoolean.weightTwelveRepresentationCharacterSum f
    theorem CryptBoolean.orderTwoWeightTwelveCharacterSum_eq_representation
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hclassification :
        CryptBoolean.HasWeightTwelveFlatPairClassification
          n) :
      CryptBoolean.orderTwoWeightTwelveCharacterSum
          f =
        CryptBoolean.weightTwelveRepresentationCharacterSum
          f
    Under the Kasami--Tokura finite-fiber classification, the canonical
    weight-twelve character sum is the affine representation sum. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightTwelve.lean
    complete
    theorem CryptBoolean.orderTwoWeightTwelveCharacterSum_ge {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hclassification :
        CryptBoolean.HasWeightTwelveFlatPairClassification n) :
      CryptBoolean.orderTwoWeightTwelveCharacterSum f  -(2 ^ n) ^ 5 / 20
    theorem CryptBoolean.orderTwoWeightTwelveCharacterSum_ge
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hclassification :
        CryptBoolean.HasWeightTwelveFlatPairClassification
          n) :
      CryptBoolean.orderTwoWeightTwelveCharacterSum
          f 
        -(2 ^ n) ^ 5 / 20
    A reusable `O((2^n)^5)` lower bound for the weight-twelve contribution,
    conditional only on the cited Kasami--Tokura classification. 

The exact fiber size converts the word sum into a normalized affine-flat representation sum. The unrestricted sum is a sum of squares indexed by affine lines; the excluded nontransverse configurations inject into five ambient vectors. The low-weight classification follows the Kasami--Tokura analysis (Kasami and Tokura, 1970; Kasami et al., 1976).

Lemma3.3.12
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 2
Statement dependency previews
Preview
Theorem 2.1.7
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
used by 1L∃∀N

Weight-fourteen dual character bound. Every weight-fourteen word of R(n-3,n) is the sum of two affine three-flat indicators meeting in one point, with exactly the two ordered representations obtained by exchanging the flats. Therefore M_{14}(f)=\sum_{\substack{h\in R(n-3,n)\\\operatorname{wt}(h)=14}} (-1)^{\langle f,h\rangle} \ge-\frac{(2^n)^6}{2}.

Lean code for Lemma3.3.124 theorems
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightFourteenClassification.lean
    complete
    theorem CryptBoolean.hasWeightFourteenFlatPairClassification (n : ) :
      CryptBoolean.HasWeightFourteenFlatPairClassification n
    theorem CryptBoolean.hasWeightFourteenFlatPairClassification
      (n : ) :
      CryptBoolean.HasWeightFourteenFlatPairClassification
        n
    Kasami--Tokura's weight-fourteen existence classification. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightFourteen.lean
    complete
    theorem CryptBoolean.weightFourteenRepresentationCharacterSum_ge {n : }
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.weightFourteenRepresentationCharacterSum f 
        -(2 ^ n) ^ 6 / 2
    theorem CryptBoolean.weightFourteenRepresentationCharacterSum_ge
      {n : }
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.weightFourteenRepresentationCharacterSum
          f 
        -(2 ^ n) ^ 6 / 2
    A dimension-free coarse form of the weight-fourteen square-sum bound.
    It has the `O(2^(6n))` order needed by the moment argument. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightFourteen.lean
    complete
    theorem CryptBoolean.orderTwoWeightFourteenCharacterSum_eq_representation
      {n : } (f : CryptBoolean.BooleanFunction n)
      (hclassification :
        CryptBoolean.HasWeightFourteenFlatPairClassification n) :
      CryptBoolean.orderTwoWeightFourteenCharacterSum f =
        CryptBoolean.weightFourteenRepresentationCharacterSum f
    theorem CryptBoolean.orderTwoWeightFourteenCharacterSum_eq_representation
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hclassification :
        CryptBoolean.HasWeightFourteenFlatPairClassification
          n) :
      CryptBoolean.orderTwoWeightFourteenCharacterSum
          f =
        CryptBoolean.weightFourteenRepresentationCharacterSum
          f
    Under the Kasami--Tokura existence classification, the canonical
    weight-fourteen character sum is exactly the normalized representation
    sum. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightFourteen.lean
    complete
    theorem CryptBoolean.orderTwoWeightFourteenCharacterSum_ge {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hclassification :
        CryptBoolean.HasWeightFourteenFlatPairClassification n) :
      CryptBoolean.orderTwoWeightFourteenCharacterSum f  -(2 ^ n) ^ 6 / 2
    theorem CryptBoolean.orderTwoWeightFourteenCharacterSum_ge
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hclassification :
        CryptBoolean.HasWeightFourteenFlatPairClassification
          n) :
      CryptBoolean.orderTwoWeightFourteenCharacterSum
          f 
        -(2 ^ n) ^ 6 / 2
    A reusable `O((2^n)^6)` lower bound for the canonical weight-fourteen
    contribution, conditional only on the cited Kasami--Tokura existence
    classification. 

The complete ordered-pair sum at each base point is a square. Nontransverse pairs inject into five ambient vectors, and the exact two-element representation fiber transfers the resulting bound to distinct dual words. The classification is the relevant Kasami--Tokura low-weight case (Kasami and Tokura, 1970; Kasami et al., 1976).

Lemma3.3.13
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 2
Statement dependency previews
Preview
Theorem 2.1.7
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
Used by 2
Reverse dependency previews
Preview
Lemma 3.3.14
Loading preview
Reverse dependency preview content is loaded from the rendered-fragment cache.
L∃∀N

Rank reduction and the augmented self-dual code. Let h\in R(n-3,n) have weight 16, and choose p\in\operatorname{supp}(h). Then the affine span of the support differences has dimension at most seven. Whenever this dimension is r, one can choose r actual support differences that form a basis of the span. If its dimension is seven, adjoining the constant coordinate to affine evaluation on the sixteen support points produces a binary self-dual code of length 16, dimension 8, and minimum distance at least 4.

Lean code for Lemma3.3.136 theorems
  • theoremdefined in CryptBoolean/Carlet/Chapter03/ReedMullerLowWeightAffineSpan.lean
    complete
    theorem CryptBoolean.finrank_supportDifferenceSpan_le_seven_of_weight_sixteen
      {n : } (h : CryptBoolean.BooleanFunction n) (p : FABL.F₂Cube n)
      (hp : p  CryptBoolean.support h) (hn : 3  n)
      (hmem : h  CryptBoolean.reedMuller (n - 3) n)
      (hweight : CryptBoolean.hammingWeight h = 16) :
      Module.finrank FABL.𝔽₂ (CryptBoolean.supportDifferenceSpan h p)  7
    theorem CryptBoolean.finrank_supportDifferenceSpan_le_seven_of_weight_sixteen
      {n : }
      (h : CryptBoolean.BooleanFunction n)
      (p : FABL.F₂Cube n)
      (hp : p  CryptBoolean.support h)
      (hn : 3  n)
      (hmem :
        h  CryptBoolean.reedMuller (n - 3) n)
      (hweight :
        CryptBoolean.hammingWeight h = 16) :
      Module.finrank FABL.𝔽₂
          (CryptBoolean.supportDifferenceSpan
              h p) 
        7
    A weight-sixteen codimension-three word is contained in an affine flat
    of dimension at most seven. 
  • theoremdefined in CryptBoolean/Carlet/Chapter03/ReedMullerLowWeightAffineSpan.lean
    complete
    theorem CryptBoolean.exists_supportDifferenceBasis_of_finrank_eq {n : }
      (h : CryptBoolean.BooleanFunction n) (p : FABL.F₂Cube n) {r : }
      (hrank :
        Module.finrank FABL.𝔽₂ (CryptBoolean.supportDifferenceSpan h p) =
          r) :
       v,
        (∀ (i : Fin r), v i  CryptBoolean.supportDifferences h p) 
          Submodule.span FABL.𝔽₂ (Set.range v) =
              CryptBoolean.supportDifferenceSpan h p 
            LinearIndependent FABL.𝔽₂ v
    theorem CryptBoolean.exists_supportDifferenceBasis_of_finrank_eq
      {n : }
      (h : CryptBoolean.BooleanFunction n)
      (p : FABL.F₂Cube n) {r : }
      (hrank :
        Module.finrank FABL.𝔽₂
            (CryptBoolean.supportDifferenceSpan
                h p) =
          r) :
       v,
        (∀ (i : Fin r),
            v i 
              CryptBoolean.supportDifferences
                h p) 
          Submodule.span FABL.𝔽₂
                (Set.range v) =
              CryptBoolean.supportDifferenceSpan
                h p 
            LinearIndependent FABL.𝔽₂ v
    If the support-difference span has dimension `r`, then `r` actual
    support differences form a basis of that span. 
  • theoremdefined in CryptBoolean/Carlet/Chapter03/ReedMullerWeightSixteenSelfDual.lean
    complete
    theorem CryptBoolean.augmentedSupportDifferenceCode_le_perpendicular {n : }
      (h : CryptBoolean.BooleanFunction n) (p : FABL.F₂Cube n)
      (hp : p  CryptBoolean.support h)
      (hdual : h  CryptBoolean.reedMullerDual 2 n)
      (hweight : CryptBoolean.hammingWeight h = 16) :
      CryptBoolean.augmentedSupportDifferenceCode h p 
        FABL.perpendicularSubspace
          (CryptBoolean.augmentedSupportDifferenceCode h p)
    theorem CryptBoolean.augmentedSupportDifferenceCode_le_perpendicular
      {n : }
      (h : CryptBoolean.BooleanFunction n)
      (p : FABL.F₂Cube n)
      (hp : p  CryptBoolean.support h)
      (hdual :
        h  CryptBoolean.reedMullerDual 2 n)
      (hweight :
        CryptBoolean.hammingWeight h = 16) :
      CryptBoolean.augmentedSupportDifferenceCode
          h p 
        FABL.perpendicularSubspace
          (CryptBoolean.augmentedSupportDifferenceCode
            h p)
    The full affine-evaluation code of a weight-sixteen dual word is
    self-orthogonal. 
  • theoremdefined in CryptBoolean/Carlet/Chapter03/ReedMullerWeightSixteenSelfDual.lean
    complete
    theorem CryptBoolean.four_le_binaryVectorWeight_of_mem_augmentedSupportDifferenceCode
      {n : } (h : CryptBoolean.BooleanFunction n) (p : FABL.F₂Cube n)
      (hp : p  CryptBoolean.support h)
      (hdual : h  CryptBoolean.reedMullerDual 2 n)
      (hweight : CryptBoolean.hammingWeight h = 16)
      (x : FABL.F₂Cube (((CryptBoolean.support h).erase p).card + 1))
      (hx : x  CryptBoolean.augmentedSupportDifferenceCode h p)
      (hxne : x  0) : 4  CryptBoolean.binaryVectorWeight x
    theorem CryptBoolean.four_le_binaryVectorWeight_of_mem_augmentedSupportDifferenceCode
      {n : }
      (h : CryptBoolean.BooleanFunction n)
      (p : FABL.F₂Cube n)
      (hp : p  CryptBoolean.support h)
      (hdual :
        h  CryptBoolean.reedMullerDual 2 n)
      (hweight :
        CryptBoolean.hammingWeight h = 16)
      (x :
        FABL.F₂Cube
          (((CryptBoolean.support h).erase
                p).card +
            1))
      (hx :
        x 
          CryptBoolean.augmentedSupportDifferenceCode
            h p)
      (hxne : x  0) :
      4  CryptBoolean.binaryVectorWeight x
    Every nonzero word in the full affine-evaluation code has weight at
    least four. 
  • theoremdefined in CryptBoolean/Carlet/Chapter03/ReedMullerWeightSixteenSelfDual.lean
    complete
    theorem CryptBoolean.finrank_augmentedSupportDifferenceCode_eq_eight {n : }
      (h : CryptBoolean.BooleanFunction n) (p : FABL.F₂Cube n)
      (hspan :
        Module.finrank FABL.𝔽₂ (CryptBoolean.supportDifferenceSpan h p) =
          7) :
      Module.finrank FABL.𝔽₂
          (CryptBoolean.augmentedSupportDifferenceCode h p) =
        8
    theorem CryptBoolean.finrank_augmentedSupportDifferenceCode_eq_eight
      {n : }
      (h : CryptBoolean.BooleanFunction n)
      (p : FABL.F₂Cube n)
      (hspan :
        Module.finrank FABL.𝔽₂
            (CryptBoolean.supportDifferenceSpan
                h p) =
          7) :
      Module.finrank FABL.𝔽₂
          (CryptBoolean.augmentedSupportDifferenceCode
              h p) =
        8
    In the full affine-span case the augmented code has dimension eight. 
  • theoremdefined in CryptBoolean/Carlet/Chapter03/ReedMullerWeightSixteenSelfDual.lean
    complete
    theorem CryptBoolean.augmentedSupportDifferenceCode_eq_perpendicular {n : }
      (h : CryptBoolean.BooleanFunction n) (p : FABL.F₂Cube n)
      (hp : p  CryptBoolean.support h)
      (hdual : h  CryptBoolean.reedMullerDual 2 n)
      (hweight : CryptBoolean.hammingWeight h = 16)
      (hspan :
        Module.finrank FABL.𝔽₂ (CryptBoolean.supportDifferenceSpan h p) =
          7) :
      CryptBoolean.augmentedSupportDifferenceCode h p =
        FABL.perpendicularSubspace
          (CryptBoolean.augmentedSupportDifferenceCode h p)
    theorem CryptBoolean.augmentedSupportDifferenceCode_eq_perpendicular
      {n : }
      (h : CryptBoolean.BooleanFunction n)
      (p : FABL.F₂Cube n)
      (hp : p  CryptBoolean.support h)
      (hdual :
        h  CryptBoolean.reedMullerDual 2 n)
      (hweight :
        CryptBoolean.hammingWeight h = 16)
      (hspan :
        Module.finrank FABL.𝔽₂
            (CryptBoolean.supportDifferenceSpan
                h p) =
          7) :
      CryptBoolean.augmentedSupportDifferenceCode
          h p =
        FABL.perpendicularSubspace
          (CryptBoolean.augmentedSupportDifferenceCode
            h p)
    A full-span weight-sixteen dual word canonically produces a binary
    self-dual code of length sixteen and dimension eight. 

Orthogonality to R(2,n) gives self-orthogonality of the augmented evaluation code; the full-span rank calculation upgrades this to self-duality. A basis is then extracted from the genuine support differences spanning the direction space. Thus the rank-seven branch reduces to the classification of projective binary self-dual [16,8,\ge4] codes, whose three types are described in Pless (1972) and surveyed by Rains and Sloane (1998).

Lemma3.3.14
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
uses 1used by 1L∃∀N

Rank-seven weight-sixteen classification. A weight-sixteen word h\in R(n-3,n) whose support has affine-span dimension seven is an injective affine image of exactly one of the three canonical sixteen-point patterns 2E_8, D_{16}^{+}, and F_{16}. Conversely, every such image has weight sixteen, belongs to R(n-3,n), and has support-affine-span dimension seven; the three affine orbits are pairwise disjoint.

Lean code for Lemma3.3.142 declarations
  • defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightSixteen/RankSevenClassification.lean
    complete
    def CryptBoolean.rankSevenWeightSixteenPatternCertificate {n : }
      (hn : 3  n) {h : CryptBoolean.BooleanFunction n}
      (hh : h  CryptBoolean.orderTwoWeightSixteenDualWords n)
      (hrank : CryptBoolean.HasSupportAffineSpanRankSeven h) :
      CryptBoolean.RankSevenWeightSixteenPatternCertificate h
    def CryptBoolean.rankSevenWeightSixteenPatternCertificate
      {n : } (hn : 3  n)
      {h : CryptBoolean.BooleanFunction n}
      (hh :
        h 
          CryptBoolean.orderTwoWeightSixteenDualWords
            n)
      (hrank :
        CryptBoolean.HasSupportAffineSpanRankSeven
          h) :
      CryptBoolean.RankSevenWeightSixteenPatternCertificate
        h
    Every rank-seven weight-sixteen dual word has a selected canonical-pattern
    certificate. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightSixteen/RankSevenClassification.lean
    complete
    theorem CryptBoolean.hasRankSevenWeightSixteenOrbitClassification (n : )
      (hn : 3  n) :
      CryptBoolean.HasRankSevenWeightSixteenOrbitClassification n
    theorem CryptBoolean.hasRankSevenWeightSixteenOrbitClassification
      (n : ) (hn : 3  n) :
      CryptBoolean.HasRankSevenWeightSixteenOrbitClassification
        n
    The rank-seven weight-sixteen dual words are exactly the disjoint union of
    the three canonical affine-pattern orbits. 

Choosing a support point and a basis of support differences gives an affine embedding of a normalized sixteen-point set in V_7. In these coordinates the quadratic dual-code constraints become systematic parity conditions on the residual columns, each an odd, non-unit vector of \mathbb F_2^8. Classifying the strictly increasing, pairwise-orthogonal column systems that meet these conditions shows that every support is an injective affine image of exactly one of the three canonical patterns 2E_8, D_{16}^{+}, and F_{16}. Pairwise orbit disjointness makes the pattern unique. The resulting three-orbit classification agrees with the enumeration of Mesnager and Oblaukhov (2022) and with the self-dual code types in Pless (1972); Rains and Sloane (1998).

Lemma3.3.15
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
uses 0used by 1L∃∀N

Nonnegative affine-map sums for rank-seven patterns. Let \sigma:V_n\to\{-1,1\}. For each c\in\{2E_8,D_{16}^{+},F_{16}\}, the sum over all affine maps A:V_7\to V_n of \prod_{x\in c}\sigma(Ax) is nonnegative. Restricting to injective affine maps and then to distinct image words gives, for every f:V_n\to\mathbb F_2, \sum_{h\in\mathcal O_c}(-1)^{\langle f,h\rangle} \ge-127(2^n)^7.

Lean code for Lemma3.3.158 declarations
  • defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightSixteen/PatternOrbitSums.lean
    complete
    def CryptBoolean.rankSevenWeightSixteenPatternAffineProduct {n : }
      (σ : FABL.F₂Cube n  )
      (c : CryptBoolean.RankSevenWeightSixteenPatternClass)
      (d : CryptBoolean.SevenVariableAffineMapData n) : 
    def CryptBoolean.rankSevenWeightSixteenPatternAffineProduct
      {n : } (σ : FABL.F₂Cube n  )
      (c :
        CryptBoolean.RankSevenWeightSixteenPatternClass)
      (d :
        CryptBoolean.SevenVariableAffineMapData
          n) :
      
    The character product obtained by mapping a canonical rank-seven pattern
    into an ambient binary cube. 
  • defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightSixteen/PatternOrbitSums.lean
    complete
    def CryptBoolean.rankSevenWeightSixteenPatternCompleteAffineMapCharacterSum
      {n : } (σ : FABL.F₂Cube n  )
      (c : CryptBoolean.RankSevenWeightSixteenPatternClass) : 
    def CryptBoolean.rankSevenWeightSixteenPatternCompleteAffineMapCharacterSum
      {n : } (σ : FABL.F₂Cube n  )
      (c :
        CryptBoolean.RankSevenWeightSixteenPatternClass) :
      
    The complete affine-map character sum of a canonical rank-seven pattern. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightSixteen/PatternOrbitSums.lean
    complete
    theorem CryptBoolean.rankSevenWeightSixteenPatternCompleteAffineMapCharacterSum_nonneg
      {n : } (σ : FABL.F₂Cube n  )
      (c : CryptBoolean.RankSevenWeightSixteenPatternClass) :
      0 
        CryptBoolean.rankSevenWeightSixteenPatternCompleteAffineMapCharacterSum
          σ c
    theorem CryptBoolean.rankSevenWeightSixteenPatternCompleteAffineMapCharacterSum_nonneg
      {n : } (σ : FABL.F₂Cube n  )
      (c :
        CryptBoolean.RankSevenWeightSixteenPatternClass) :
      0 
        CryptBoolean.rankSevenWeightSixteenPatternCompleteAffineMapCharacterSum
          σ c
    Every canonical rank-seven weight-sixteen pattern has a nonnegative
    complete affine-map character sum. 
  • defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightSixteen/OrbitAggregation.lean
    complete
    def CryptBoolean.rankSevenWeightSixteenInjectiveAffineMapData (n : ) :
      Finset (CryptBoolean.SevenVariableAffineMapData n)
    def CryptBoolean.rankSevenWeightSixteenInjectiveAffineMapData
      (n : ) :
      Finset
        (CryptBoolean.SevenVariableAffineMapData
          n)
    Injective affine maps from the seven-variable cube into the ambient cube. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightSixteen/OrbitAggregation.lean
    complete
    theorem CryptBoolean.rankSevenWeightSixteenInjectiveAffineMapCharacterSum_ge
      {n : } (f : CryptBoolean.BooleanFunction n)
      (c : CryptBoolean.RankSevenWeightSixteenPatternClass) :
       d  CryptBoolean.rankSevenWeightSixteenInjectiveAffineMapData n,
          CryptBoolean.rankSevenWeightSixteenPatternAffineProduct
            (CryptBoolean.realSignView f) c d 
        -(127 * (2 ^ n) ^ 7)
    theorem CryptBoolean.rankSevenWeightSixteenInjectiveAffineMapCharacterSum_ge
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (c :
        CryptBoolean.RankSevenWeightSixteenPatternClass) :
      
          d 
            CryptBoolean.rankSevenWeightSixteenInjectiveAffineMapData
              n,
          CryptBoolean.rankSevenWeightSixteenPatternAffineProduct
            (CryptBoolean.realSignView f) c
            d 
        -(127 * (2 ^ n) ^ 7)
    Dimension-free `127 q⁷` lower bound for injective affine-map
    characters in each canonical rank-seven pattern class. 
  • defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightSixteen/OrbitAggregation.lean
    complete
    def CryptBoolean.rankSevenWeightSixteenPatternOrbitWords (n : )
      (c : CryptBoolean.RankSevenWeightSixteenPatternClass) :
      Finset (CryptBoolean.BooleanFunction n)
    def CryptBoolean.rankSevenWeightSixteenPatternOrbitWords
      (n : )
      (c :
        CryptBoolean.RankSevenWeightSixteenPatternClass) :
      Finset (CryptBoolean.BooleanFunction n)
    The distinct support words in one canonical rank-seven affine orbit. 
  • defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightSixteen/OrbitAggregation.lean
    complete
    def CryptBoolean.rankSevenWeightSixteenPatternOrbitCharacterSum {n : }
      (f : CryptBoolean.BooleanFunction n)
      (c : CryptBoolean.RankSevenWeightSixteenPatternClass) : 
    def CryptBoolean.rankSevenWeightSixteenPatternOrbitCharacterSum
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (c :
        CryptBoolean.RankSevenWeightSixteenPatternClass) :
      
    Character sum over the distinct words in one canonical rank-seven
    pattern orbit. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightSixteen/OrbitAggregation.lean
    complete
    theorem CryptBoolean.rankSevenWeightSixteenPatternOrbitCharacterSum_ge {n : }
      (f : CryptBoolean.BooleanFunction n)
      (c : CryptBoolean.RankSevenWeightSixteenPatternClass) :
      CryptBoolean.rankSevenWeightSixteenPatternOrbitCharacterSum f c 
        -(127 * (2 ^ n) ^ 7)
    theorem CryptBoolean.rankSevenWeightSixteenPatternOrbitCharacterSum_ge
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (c :
        CryptBoolean.RankSevenWeightSixteenPatternClass) :
      CryptBoolean.rankSevenWeightSixteenPatternOrbitCharacterSum
          f c 
        -(127 * (2 ^ n) ^ 7)
    Each distinct canonical rank-seven word orbit inherits the same
    `-127 q⁷` lower bound as its injective affine-map sum; the unknown positive
    automorphism multiplicity need not be computed. 

The 2E_8 sum is a square, the D_{16}^{+} sum is a sum of squares after a fourfold convolution, and the F_{16} sum is a nonnegative four-cycle trace. Splitting the complete sum into injective and rank-deficient maps loses at most 127(2^n)^7, since every character product is at most one. Postcomposition by affine automorphisms identifies the fibers over distinct injective images and gives them one common positive cardinality; division by this cardinality yields the orbit bound. This is the repaired orbit-level substitute for the overextended disjoint-three-flat step in Carlet and Mesnager (2007).

Lemma3.3.16
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
uses 1used by 1L∃∀N

Rank-at-most-six residual cover. For n\ge3, every weight-sixteen word of R(n-3,n) whose support-affine-span dimension is at most six is the image of an arbitrary mask on V_7 under a rank-deficient affine map V_7\to V_n. Hence the residual family has cardinality at most 127\cdot2^{128}(2^n)^7, and its character sum is at least the negative of this quantity.

Lean code for Lemma3.3.169 declarations
  • defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightSixteen/OrbitAggregation.lean
    complete
    def CryptBoolean.sevenVariableAffineMaskWord {n : }
      (d : CryptBoolean.SevenVariableAffineMapData n)
      (m : Finset (FABL.F₂Cube 7)) : CryptBoolean.BooleanFunction n
    def CryptBoolean.sevenVariableAffineMaskWord
      {n : }
      (d :
        CryptBoolean.SevenVariableAffineMapData
          n)
      (m : Finset (FABL.F₂Cube 7)) :
      CryptBoolean.BooleanFunction n
    The Boolean word whose support is the image of an arbitrary mask under a
    seven-variable affine map. 
  • defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightSixteen/OrbitAggregation.lean
    complete
    def CryptBoolean.rankDeficientSevenVariableAffineMaskImageWords (n : ) :
      Finset (CryptBoolean.BooleanFunction n)
    def CryptBoolean.rankDeficientSevenVariableAffineMaskImageWords
      (n : ) :
      Finset (CryptBoolean.BooleanFunction n)
    Every word produced by rank-deficient affine data and an arbitrary
    seven-variable mask. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightSixteen/OrbitAggregation.lean
    complete
    theorem CryptBoolean.card_rankDeficientSevenVariableAffineMaskImageWords_le
      (n : ) :
      (CryptBoolean.rankDeficientSevenVariableAffineMaskImageWords n).card 
        127 * 2 ^ 128 * (2 ^ n) ^ 7
    theorem CryptBoolean.card_rankDeficientSevenVariableAffineMaskImageWords_le
      (n : ) :
      (CryptBoolean.rankDeficientSevenVariableAffineMaskImageWords
            n).card 
        127 * 2 ^ 128 * (2 ^ n) ^ 7
    Arbitrary-mask images of rank-deficient affine maps contribute at most
    `127 · 2^128 · q⁷` distinct words. 
  • defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightSixteen/OrbitAggregation.lean
    complete
    def CryptBoolean.HasRankAtMostSixWeightSixteenDeficientAffineMaskCover
      (n : ) : Prop
    def CryptBoolean.HasRankAtMostSixWeightSixteenDeficientAffineMaskCover
      (n : ) : Prop
    Minimal low-rank covering interface: every residual word is an arbitrary
    mask image of one rank-deficient seven-variable affine map. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightSixteen/OrbitAggregation.lean
    complete
    theorem CryptBoolean.hasRankAtMostSixWeightSixteenDeficientAffineMaskCover
      {n : } (hn : 3  n) :
      CryptBoolean.HasRankAtMostSixWeightSixteenDeficientAffineMaskCover n
    theorem CryptBoolean.hasRankAtMostSixWeightSixteenDeficientAffineMaskCover
      {n : } (hn : 3  n) :
      CryptBoolean.HasRankAtMostSixWeightSixteenDeficientAffineMaskCover
        n
    Every rank-at-most-six residual word has an arbitrary-mask
    rank-deficient affine representation. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightSixteen/OrbitAggregation.lean
    complete
    theorem CryptBoolean.orderTwoWeightSixteenRankAtMostSixResidualWords_subset_affineMaskImage_of_cover
      {n : }
      (hcover :
        CryptBoolean.HasRankAtMostSixWeightSixteenDeficientAffineMaskCover
          n) :
      CryptBoolean.orderTwoWeightSixteenRankAtMostSixResidualWords n 
        CryptBoolean.rankDeficientSevenVariableAffineMaskImageWords n
    theorem CryptBoolean.orderTwoWeightSixteenRankAtMostSixResidualWords_subset_affineMaskImage_of_cover
      {n : }
      (hcover :
        CryptBoolean.HasRankAtMostSixWeightSixteenDeficientAffineMaskCover
          n) :
      CryptBoolean.orderTwoWeightSixteenRankAtMostSixResidualWords
          n 
        CryptBoolean.rankDeficientSevenVariableAffineMaskImageWords
          n
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightSixteen/OrbitAggregation.lean
    complete
    theorem CryptBoolean.card_orderTwoWeightSixteenRankAtMostSixResidualWords_le
      {n : } (hn : 3  n) :
      (CryptBoolean.orderTwoWeightSixteenRankAtMostSixResidualWords
            n).card 
        127 * 2 ^ 128 * (2 ^ n) ^ 7
    theorem CryptBoolean.card_orderTwoWeightSixteenRankAtMostSixResidualWords_le
      {n : } (hn : 3  n) :
      (CryptBoolean.orderTwoWeightSixteenRankAtMostSixResidualWords
            n).card 
        127 * 2 ^ 128 * (2 ^ n) ^ 7
    Unconditional low-rank residual count obtained from support-affine-span
    parameterization. 
  • defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightSixteen/OrbitAggregation.lean
    complete
    def CryptBoolean.orderTwoWeightSixteenRankAtMostSixResidualCharacterSum
      {n : } (f : CryptBoolean.BooleanFunction n) : 
    def CryptBoolean.orderTwoWeightSixteenRankAtMostSixResidualCharacterSum
      {n : }
      (f : CryptBoolean.BooleanFunction n) : 
    Character sum over the complementary rank-at-most-six residual words. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightSixteen/OrbitAggregation.lean
    complete
    theorem CryptBoolean.orderTwoWeightSixteenRankAtMostSixResidualCharacterSum_ge
      {n : } (f : CryptBoolean.BooleanFunction n)
      (hcover :
        CryptBoolean.HasRankAtMostSixWeightSixteenDeficientAffineMaskCover
          n) :
      CryptBoolean.orderTwoWeightSixteenRankAtMostSixResidualCharacterSum
          f 
        -(127 * 2 ^ 128 * (2 ^ n) ^ 7)
    theorem CryptBoolean.orderTwoWeightSixteenRankAtMostSixResidualCharacterSum_ge
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hcover :
        CryptBoolean.HasRankAtMostSixWeightSixteenDeficientAffineMaskCover
          n) :
      CryptBoolean.orderTwoWeightSixteenRankAtMostSixResidualCharacterSum
          f 
        -(127 * 2 ^ 128 * (2 ^ n) ^ 7)
    The covered rank-at-most-six residual character sum loses at most its
    `127 · 2^128 · q⁷` arbitrary-mask cardinality bound. 

A padded basis of the support-difference span supplies the rank-deficient affine map, while the inverse image of the support supplies the mask. There are at most 127(2^n)^7 such affine maps and exactly 2^{128} masks; taking images cannot increase cardinality, and a sum of \{-1,1\} characters is bounded below by minus the number of words. This deliberately coarse cover handles the weight-sixteen words missed by the non-minimal disjoint-flat classification of Borissov et al. (2003); the existence of minimal weight-sixteen words is documented by Borissov and Manev (2004).

Lemma3.3.17
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 3
Statement dependency previews
Preview
Lemma 3.3.14
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
Used by 2
Reverse dependency previews
Preview
Lemma 3.3.18
Loading preview
Reverse dependency preview content is loaded from the rendered-fragment cache.
L∃∀N

Aggregate weight-sixteen character bound. For n\ge3 and every f:V_n\to\mathbb F_2, M_{16}(f)= \sum_{\substack{h\in R(n-3,n)\\\operatorname{wt}(h)=16}} (-1)^{\langle f,h\rangle} \ge-\bigl(3\cdot127+127\cdot2^{128}\bigr)(2^n)^7.

Lean code for Lemma3.3.171 theorem
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightSixteen/RankSevenClassification.lean
    complete
    theorem CryptBoolean.orderTwoWeightSixteenCharacterSum_ge_rankSevenClassification
      {n : } (f : CryptBoolean.BooleanFunction n) (hn : 3  n) :
      CryptBoolean.orderTwoWeightSixteenCharacterSum f 
        -((3 * 127 + 127 * 2 ^ 128) * (2 ^ n) ^ 7)
    theorem CryptBoolean.orderTwoWeightSixteenCharacterSum_ge_rankSevenClassification
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hn : 3  n) :
      CryptBoolean.orderTwoWeightSixteenCharacterSum
          f 
        -((3 * 127 + 127 * 2 ^ 128) *
            (2 ^ n) ^ 7)
    The complete weight-sixteen dual character sum has a uniform seventh-power
    lower bound. 

The rank-seven classification and the low-rank cover partition the weight-sixteen words into the three canonical affine orbits and the rank-at-most-six residual family. The orbit estimates and the residual cardinality estimate then add without requiring a universal disjoint-flat representation.

Lemma3.3.18
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 4
Statement dependency previews
Preview
Lemma 3.3.10
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
used by 1L∃∀N

Seventh/eighth moment-difference estimate. Put q=2^n. For n\ge7, the exact dual-weight decomposition gives S_8(f)-15qS_7(f) =|R(2,n)|\sum_{w\in\{0,8,12,14,16\}} \Delta_w(n)M_w(f), where \Delta_w(n)=N_8(w)-15qN_7(w). If M_{16}(f)\ge-Bq^7 with B\ge0, then S_8(f)-15qS_7(f) \ge-\bigl(133000020000000+21000000000000B\bigr) |R(2,n)|q^7.

Lean code for Lemma3.3.187 theorems
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderTupleCountDifferences.lean
    complete
    theorem CryptBoolean.tuplePointParityMomentDifference_zero_ge (n : )
      (hn : 7  n) :
      CryptBoolean.tuplePointParityMomentDifference n 0 
        -20000000 * (2 ^ n) ^ 7
    theorem CryptBoolean.tuplePointParityMomentDifference_zero_ge
      (n : ) (hn : 7  n) :
      CryptBoolean.tuplePointParityMomentDifference
          n 0 
        -20000000 * (2 ^ n) ^ 7
    The null-word coefficient has magnitude `O((2^n)^7)` in the direction
    needed for the lower moment bound. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderTupleCountDifferences.lean
    complete
    theorem CryptBoolean.tuplePointParityMomentDifference_eight_bounds (n : )
      (hn : 7  n) :
      0  CryptBoolean.tuplePointParityMomentDifference n 8 
        CryptBoolean.tuplePointParityMomentDifference n 8 
          120000000000000 * (2 ^ n) ^ 4
    theorem CryptBoolean.tuplePointParityMomentDifference_eight_bounds
      (n : ) (hn : 7  n) :
      0 
          CryptBoolean.tuplePointParityMomentDifference
            n 8 
        CryptBoolean.tuplePointParityMomentDifference
            n 8 
          120000000000000 * (2 ^ n) ^ 4
    The weight-eight coefficient is nonnegative and at most a fixed multiple
    of `(2^n)^4`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderTupleCountDifferences.lean
    complete
    theorem CryptBoolean.tuplePointParityMomentDifference_twelve_bounds (n : )
      (hn : 7  n) :
      0  CryptBoolean.tuplePointParityMomentDifference n 12 
        CryptBoolean.tuplePointParityMomentDifference n 12 
          3000000000000 * (2 ^ n) ^ 2
    theorem CryptBoolean.tuplePointParityMomentDifference_twelve_bounds
      (n : ) (hn : 7  n) :
      0 
          CryptBoolean.tuplePointParityMomentDifference
            n 12 
        CryptBoolean.tuplePointParityMomentDifference
            n 12 
          3000000000000 * (2 ^ n) ^ 2
    The weight-twelve coefficient is nonnegative and at most a fixed
    multiple of `(2^n)^2`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderTupleCountDifferences.lean
    complete
    theorem CryptBoolean.tuplePointParityMomentDifference_fourteen_bounds (n : )
      (hn : 7  n) :
      0  CryptBoolean.tuplePointParityMomentDifference n 14 
        CryptBoolean.tuplePointParityMomentDifference n 14 
          10000000000000 * 2 ^ n
    theorem CryptBoolean.tuplePointParityMomentDifference_fourteen_bounds
      (n : ) (hn : 7  n) :
      0 
          CryptBoolean.tuplePointParityMomentDifference
            n 14 
        CryptBoolean.tuplePointParityMomentDifference
            n 14 
          10000000000000 * 2 ^ n
    The weight-fourteen coefficient is nonnegative and at most a fixed
    multiple of `2^n`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderTupleCountDifferences.lean
    complete
    theorem CryptBoolean.tuplePointParityMomentDifference_sixteen_bounds (n : )
      (hn : 7  n) :
      0  CryptBoolean.tuplePointParityMomentDifference n 16 
        CryptBoolean.tuplePointParityMomentDifference n 16  21000000000000
    theorem CryptBoolean.tuplePointParityMomentDifference_sixteen_bounds
      (n : ) (hn : 7  n) :
      0 
          CryptBoolean.tuplePointParityMomentDifference
            n 16 
        CryptBoolean.tuplePointParityMomentDifference
            n 16 
          21000000000000
    The weight-sixteen coefficient is positive and bounded by a fixed
    constant. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoMomentDifference.lean
    complete
    theorem CryptBoolean.orderTwoCorrelationPowerSum_difference_eq_lowWeights
      {n : } (f : CryptBoolean.BooleanFunction n) (hn : 7  n) :
      CryptBoolean.orderTwoCorrelationPowerSum 8 f -
          15 * 2 ^ n * CryptBoolean.orderTwoCorrelationPowerSum 7 f =
        (Nat.card (CryptBoolean.reedMuller 2 n)) *
          (CryptBoolean.tuplePointParityMomentDifference n 0 +
                  CryptBoolean.tuplePointParityMomentDifference n 8 *
                    CryptBoolean.orderTwoWeightEightCharacterSum f +
                CryptBoolean.tuplePointParityMomentDifference n 12 *
                  CryptBoolean.orderTwoWeightTwelveCharacterSum f +
              CryptBoolean.tuplePointParityMomentDifference n 14 *
                CryptBoolean.orderTwoWeightFourteenCharacterSum f +
            CryptBoolean.tuplePointParityMomentDifference n 16 *
              CryptBoolean.orderTwoWeightSixteenCharacterSum f)
    theorem CryptBoolean.orderTwoCorrelationPowerSum_difference_eq_lowWeights
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hn : 7  n) :
      CryptBoolean.orderTwoCorrelationPowerSum
            8 f -
          15 * 2 ^ n *
            CryptBoolean.orderTwoCorrelationPowerSum
              7 f =
        (Nat.card
              (CryptBoolean.reedMuller 2
                  n)) *
          (CryptBoolean.tuplePointParityMomentDifference
                    n 0 +
                  CryptBoolean.tuplePointParityMomentDifference
                      n 8 *
                    CryptBoolean.orderTwoWeightEightCharacterSum
                      f +
                CryptBoolean.tuplePointParityMomentDifference
                    n 12 *
                  CryptBoolean.orderTwoWeightTwelveCharacterSum
                    f +
              CryptBoolean.tuplePointParityMomentDifference
                  n 14 *
                CryptBoolean.orderTwoWeightFourteenCharacterSum
                  f +
            CryptBoolean.tuplePointParityMomentDifference
                n 16 *
              CryptBoolean.orderTwoWeightSixteenCharacterSum
                f)
    The correlation-power difference is the common code cardinality times
    the low-weight coefficient sum. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoMomentDifference.lean
    complete
    theorem CryptBoolean.orderTwoCorrelationPowerSum_difference_ge_of_weightSixteenCharacterSum
      {n : } (f : CryptBoolean.BooleanFunction n) (hn : 7  n)
      (hweightTwelve : CryptBoolean.HasWeightTwelveFlatPairClassification n)
      (hweightFourteen :
        CryptBoolean.HasWeightFourteenFlatPairClassification n)
      (B : ) (hB : 0  B)
      (hweightSixteen :
        -B * (2 ^ n) ^ 7 
          CryptBoolean.orderTwoWeightSixteenCharacterSum f) :
      CryptBoolean.orderTwoCorrelationPowerSum 8 f -
          15 * 2 ^ n * CryptBoolean.orderTwoCorrelationPowerSum 7 f 
        -(133000020000000 + 21000000000000 * B) *
          ((Nat.card (CryptBoolean.reedMuller 2 n)) * (2 ^ n) ^ 7)
    theorem CryptBoolean.orderTwoCorrelationPowerSum_difference_ge_of_weightSixteenCharacterSum
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hn : 7  n)
      (hweightTwelve :
        CryptBoolean.HasWeightTwelveFlatPairClassification
          n)
      (hweightFourteen :
        CryptBoolean.HasWeightFourteenFlatPairClassification
          n)
      (B : ) (hB : 0  B)
      (hweightSixteen :
        -B * (2 ^ n) ^ 7 
          CryptBoolean.orderTwoWeightSixteenCharacterSum
            f) :
      CryptBoolean.orderTwoCorrelationPowerSum
            8 f -
          15 * 2 ^ n *
            CryptBoolean.orderTwoCorrelationPowerSum
              7 f 
        -(133000020000000 +
              21000000000000 * B) *
          ((Nat.card
                (CryptBoolean.reedMuller 2
                    n)) *
            (2 ^ n) ^ 7)
    A dimension-independent `q⁷` lower bound for the weight-sixteen character
    sum gives a code-cardinality-scaled seventh/eighth moment remainder. 

Exact tuple-count polynomials provide one-sided bounds for the five coefficients \Delta_w; the weight-eight, twelve, and fourteen sum estimates control the corresponding terms, leaving only the parameter B for weight sixteen. This is the quantitative meeting point of the finite classification and moment branches.

Lemma3.3.19
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 2
Statement dependency previews
Preview
Lemma 3.3.6
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
used by 1L∃∀N

Order-two asymptotic extraction. If some K\ge0 satisfies, for every f:V_n\to\mathbb F_2, 15\cdot2^nS_7(f)-K|R(2,n)|(2^n)^7\le S_8(f), then \rho(2,n)\le 2^{n-1}-\frac{\sqrt{15}}2(\sqrt2)^n+\frac{\sqrt K}{2}. The same implication holds eventually when the moment hypothesis holds eventually and uniformly in f.

Lean code for Lemma3.3.195 theorems
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoAsymptotics.lean
    complete
    theorem CryptBoolean.reedMuller_card_mul_two_pow_seven_le_orderTwoCorrelationPowerSum_seven
      {n : } (f : CryptBoolean.BooleanFunction n) (hn : 3  n) :
      (Nat.card (CryptBoolean.reedMuller 2 n)) * (2 ^ n) ^ 7 
        CryptBoolean.orderTwoCorrelationPowerSum 7 f
    theorem CryptBoolean.reedMuller_card_mul_two_pow_seven_le_orderTwoCorrelationPowerSum_seven
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hn : 3  n) :
      (Nat.card
              (CryptBoolean.reedMuller 2
                  n)) *
          (2 ^ n) ^ 7 
        CryptBoolean.orderTwoCorrelationPowerSum
          7 f
    Jensen's inequality and the exact second moment give the code-cardinality
    scaled denominator required by the seventh/eighth moment comparison. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoAsymptotics.lean
    complete
    theorem CryptBoolean.orderTwoCorrelationPowerSum_eight_div_seven_ge_of_card_scaled
      {n : } (f : CryptBoolean.BooleanFunction n) (K : ) (hK : 0  K)
      (hn : 3  n)
      (hdifference :
        15 * 2 ^ n * CryptBoolean.orderTwoCorrelationPowerSum 7 f -
            K * ((Nat.card (CryptBoolean.reedMuller 2 n)) * (2 ^ n) ^ 7) 
          CryptBoolean.orderTwoCorrelationPowerSum 8 f) :
      15 * 2 ^ n - K 
        CryptBoolean.orderTwoCorrelationPowerSum 8 f /
          CryptBoolean.orderTwoCorrelationPowerSum 7 f
    theorem CryptBoolean.orderTwoCorrelationPowerSum_eight_div_seven_ge_of_card_scaled
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (K : ) (hK : 0  K) (hn : 3  n)
      (hdifference :
        15 * 2 ^ n *
              CryptBoolean.orderTwoCorrelationPowerSum
                7 f -
            K *
              ((Nat.card
                    (CryptBoolean.reedMuller
                        2 n)) *
                (2 ^ n) ^ 7) 
          CryptBoolean.orderTwoCorrelationPowerSum
            8 f) :
      15 * 2 ^ n - K 
        CryptBoolean.orderTwoCorrelationPowerSum
            8 f /
          CryptBoolean.orderTwoCorrelationPowerSum
            7 f
    The code-cardinality-scaled remainder produced by dual-weight grouping
    also becomes an additive constant in the seventh/eighth moment quotient. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoAsymptotics.lean
    complete
    theorem CryptBoolean.sqrt_fifteen_mul_sqrtTwo_pow_sub_sqrt_le_momentRatio
      {n : } (f : CryptBoolean.BooleanFunction n) (K : ) (hK : 0  K)
      (hratio :
        15 * 2 ^ n - K 
          CryptBoolean.orderTwoCorrelationPowerSum 8 f /
            CryptBoolean.orderTwoCorrelationPowerSum 7 f) :
      15 * 2 ^ n - K 
        (CryptBoolean.orderTwoCorrelationPowerSum 8 f /
            CryptBoolean.orderTwoCorrelationPowerSum 7 f)
    theorem CryptBoolean.sqrt_fifteen_mul_sqrtTwo_pow_sub_sqrt_le_momentRatio
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (K : ) (hK : 0  K)
      (hratio :
        15 * 2 ^ n - K 
          CryptBoolean.orderTwoCorrelationPowerSum
              8 f /
            CryptBoolean.orderTwoCorrelationPowerSum
              7 f) :
      15 * 2 ^ n - K 
        (CryptBoolean.orderTwoCorrelationPowerSum
              8 f /
            CryptBoolean.orderTwoCorrelationPowerSum
              7 f)
    The quotient estimate gives the sharp square-root term with an additive
    `sqrt K` loss. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoAsymptotics.lean
    complete
    theorem CryptBoolean.maximumHigherOrderNonlinearity_two_cast_le_of_card_scaled_moment_difference
      {n : } (K : ) (hK : 0  K) (hn : 3  n)
      (hdifference :
         (f : CryptBoolean.BooleanFunction n),
          15 * 2 ^ n * CryptBoolean.orderTwoCorrelationPowerSum 7 f -
              K *
                ((Nat.card (CryptBoolean.reedMuller 2 n)) * (2 ^ n) ^ 7) 
            CryptBoolean.orderTwoCorrelationPowerSum 8 f) :
      (CryptBoolean.maximumHigherOrderNonlinearity 2 n) 
        2 ^ n / 2 - 15 / 2 * 2 ^ n + K / 2
    theorem CryptBoolean.maximumHigherOrderNonlinearity_two_cast_le_of_card_scaled_moment_difference
      {n : } (K : ) (hK : 0  K)
      (hn : 3  n)
      (hdifference :
        
          (f :
            CryptBoolean.BooleanFunction n),
          15 * 2 ^ n *
                CryptBoolean.orderTwoCorrelationPowerSum
                  7 f -
              K *
                ((Nat.card
                      (CryptBoolean.reedMuller
                          2 n)) *
                  (2 ^ n) ^ 7) 
            CryptBoolean.orderTwoCorrelationPowerSum
              8 f) :
      (CryptBoolean.maximumHigherOrderNonlinearity
            2 n) 
        2 ^ n / 2 - 15 / 2 * 2 ^ n + K / 2
    A code-cardinality-scaled moment remainder gives the same sharp
    order-two covering-radius estimate. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoAsymptotics.lean
    complete
    theorem CryptBoolean.eventually_maximumHigherOrderNonlinearity_two_cast_le_of_card_scaled_moment_difference
      (K : ) (hK : 0  K)
      (hdifference :
        ∀ᶠ (n : ) in Filter.atTop,
           (f : CryptBoolean.BooleanFunction n),
            15 * 2 ^ n * CryptBoolean.orderTwoCorrelationPowerSum 7 f -
                K *
                  ((Nat.card (CryptBoolean.reedMuller 2 n)) *
                    (2 ^ n) ^ 7) 
              CryptBoolean.orderTwoCorrelationPowerSum 8 f) :
      ∀ᶠ (n : ) in Filter.atTop,
        (CryptBoolean.maximumHigherOrderNonlinearity 2 n) 
          2 ^ n / 2 - 15 / 2 * 2 ^ n + K / 2
    theorem CryptBoolean.eventually_maximumHigherOrderNonlinearity_two_cast_le_of_card_scaled_moment_difference
      (K : ) (hK : 0  K)
      (hdifference :
        ∀ᶠ (n : ) in Filter.atTop,
          
            (f :
              CryptBoolean.BooleanFunction n),
            15 * 2 ^ n *
                  CryptBoolean.orderTwoCorrelationPowerSum
                    7 f -
                K *
                  ((Nat.card
                        (CryptBoolean.reedMuller
                            2 n)) *
                    (2 ^ n) ^ 7) 
              CryptBoolean.orderTwoCorrelationPowerSum
                8 f) :
      ∀ᶠ (n : ) in Filter.atTop,
        (CryptBoolean.maximumHigherOrderNonlinearity
              2 n) 
          2 ^ n / 2 - 15 / 2 * 2 ^ n +
            K / 2
    Eventual code-cardinality-scaled moment control gives the sharp
    order-two `O(1)` base. 

Jensen's inequality and the exact second moment give S_7(f)\ge|R(2,n)|(2^n)^7. Division by this denominator, the consecutive moment-ratio inequality, and one square-root estimate expose the sharp \sqrt{15}/2 coefficient.

Lemma3.3.20
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 2
Statement dependency previews
Preview
Lemma 3.3.5
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
used by 1L∃∀N

Propagation from order two to fixed order. Suppose there is K\ge0 such that eventually, uniformly in f:V_n\to\mathbb F_2, 15\cdot2^nS_7(f)-K|R(2,n)|(2^n)^7\le S_8(f). For every fixed r\ge2, there is D\ge0 such that, for all n\ge r, \rho(r,n)\le 2^{n-1}-\frac{\sqrt{15}}2(1+\sqrt2)^{r-2}(\sqrt2)^n +D(n+1)^{r-2}.

Lean code for Lemma3.3.201 theorem
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoAsymptotics.lean
    complete
    theorem CryptBoolean.exists_maximumHigherOrderNonlinearity_cast_le_of_card_scaled_moment_difference
      (K : ) (hK : 0  K)
      (hdifference :
        ∀ᶠ (n : ) in Filter.atTop,
           (f : CryptBoolean.BooleanFunction n),
            15 * 2 ^ n * CryptBoolean.orderTwoCorrelationPowerSum 7 f -
                K *
                  ((Nat.card (CryptBoolean.reedMuller 2 n)) *
                    (2 ^ n) ^ 7) 
              CryptBoolean.orderTwoCorrelationPowerSum 8 f)
      (r : ) (hr : 2  r) :
       D,
        0  D 
           (n : ),
            r  n 
              (CryptBoolean.maximumHigherOrderNonlinearity r n) 
                2 ^ n / 2 - 15 / 2 * (1 + 2) ^ (r - 2) * 2 ^ n +
                  D * (n + 1) ^ (r - 2)
    theorem CryptBoolean.exists_maximumHigherOrderNonlinearity_cast_le_of_card_scaled_moment_difference
      (K : ) (hK : 0  K)
      (hdifference :
        ∀ᶠ (n : ) in Filter.atTop,
          
            (f :
              CryptBoolean.BooleanFunction n),
            15 * 2 ^ n *
                  CryptBoolean.orderTwoCorrelationPowerSum
                    7 f -
                K *
                  ((Nat.card
                        (CryptBoolean.reedMuller
                            2 n)) *
                    (2 ^ n) ^ 7) 
              CryptBoolean.orderTwoCorrelationPowerSum
                8 f)
      (r : ) (hr : 2  r) :
       D,
        0  D 
           (n : ),
            r  n 
              (CryptBoolean.maximumHigherOrderNonlinearity
                    r n) 
                2 ^ n / 2 -
                    15 / 2 *
                        (1 + 2) ^ (r - 2) *
                      2 ^ n +
                  D * (n + 1) ^ (r - 2)
    A code-cardinality-scaled seventh/eighth moment remainder propagates the
    sharp Carlet--Mesnager coefficient to every fixed higher order. 

The preceding order-two estimate supplies the base case. Iterating the Plotkin recurrence multiplies the square-root coefficient by 1+\sqrt2 at each order and turns the bounded base remainder into a polynomial error of degree r-2.

Theorem3.3.21
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 2
Statement dependency previews
Preview
Lemma 3.3.17
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
used by 0L∃∀N

Sharp asymptotic upper bound for higher-order nonlinearity (Carlet, p. 53). Define \rho(r,n)=\max_f\operatorname{nl}_r(f). For fixed r\ge2, the cited asymptotic upper bound is \rho(r,n)\le 2^{n-1}-\frac{\sqrt{15}}2(1+\sqrt2)^{r-2}2^{n/2} +O(n^{r-2}).

Lean code for Theorem3.3.211 theorem
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightSixteen/RankSevenClassification.lean
    complete
    theorem CryptBoolean.exists_maximumHigherOrderNonlinearity_cast_le_sharp (r : )
      (hr : 2  r) :
       D,
        0  D 
           (n : ),
            r  n 
              (CryptBoolean.maximumHigherOrderNonlinearity r n) 
                2 ^ n / 2 - 15 / 2 * (1 + 2) ^ (r - 2) * 2 ^ n +
                  D * (n + 1) ^ (r - 2)
    theorem CryptBoolean.exists_maximumHigherOrderNonlinearity_cast_le_sharp
      (r : ) (hr : 2  r) :
       D,
        0  D 
           (n : ),
            r  n 
              (CryptBoolean.maximumHigherOrderNonlinearity
                    r n) 
                2 ^ n / 2 -
                    15 / 2 *
                        (1 + 2) ^ (r - 2) *
                      2 ^ n +
                  D * (n + 1) ^ (r - 2)
    Carlet--Mesnager's sharp fixed-order upper bound for higher-order
    nonlinearity. 

The upper constant comes from the Carlet--Mesnager order-two covering-radius theorem (Carlet and Mesnager, 2007). The moment ratio reduces the order-two estimate to the seventh/eighth moment difference; dual-code orthogonality and Krawtchouk inversion reduce that difference to weights 0,8,12,14,16. At weight sixteen, the disjoint-three-flat description of Borissov et al. (2003) covers the non-minimal case. The minimal words are those exhibited by Borissov and Manev (2004). A complete alternative is the rank-seven three-orbit classification of Mesnager and Oblaukhov (2022) together with the rank-at-most-six affine-mask cover above. Their character estimates feed the moment inequality, and Plotkin induction propagates the resulting \sqrt{15}/2 coefficient by the factor 1+\sqrt2 at every increase of order.

Proposition3.3.22
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 2
Statement dependency previews
Preview
Definition 1.10.1
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
used by 0L∃∀N

Proposition 13 (Carlet, pp. 54--55). Let 1\le r<n. Then \operatorname{nl}_r(f) \ge\frac12\max_{a\in V_n}\operatorname{nl}_{r-1}(D_af) and \operatorname{nl}_r(f) \ge2^{n-1}-\frac12 \sqrt{2^{2n}-2\sum_{a\in V_n}\operatorname{nl}_{r-1}(D_af)}.

Lean code for Proposition3.3.2215 declarations
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderNonlinearity.lean
    complete
    theorem CryptBoolean.hammingWeight_translate {n : }
      (f : CryptBoolean.BooleanFunction n) (a : FABL.F₂Cube n) :
      (CryptBoolean.hammingWeight fun x => f (x + a)) =
        CryptBoolean.hammingWeight f
    theorem CryptBoolean.hammingWeight_translate
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (a : FABL.F₂Cube n) :
      (CryptBoolean.hammingWeight fun x =>
          f (x + a)) =
        CryptBoolean.hammingWeight f
    Translating the input preserves Hamming weight. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderNonlinearity.lean
    complete
    theorem CryptBoolean.hammingWeight_booleanDerivative_le_two_mul {n : }
      (f : CryptBoolean.BooleanFunction n) (a : FABL.F₂Cube n) :
      CryptBoolean.hammingWeight (FABL.booleanDerivative f a) 
        2 * CryptBoolean.hammingWeight f
    theorem CryptBoolean.hammingWeight_booleanDerivative_le_two_mul
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (a : FABL.F₂Cube n) :
      CryptBoolean.hammingWeight
          (FABL.booleanDerivative f a) 
        2 * CryptBoolean.hammingWeight f
    The weight of a directional derivative is at most twice the original weight. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderNonlinearity.lean
    complete
    theorem CryptBoolean.booleanDerivative_add {n : }
      (f g : CryptBoolean.BooleanFunction n) (a : FABL.F₂Cube n) :
      FABL.booleanDerivative (f + g) a =
        FABL.booleanDerivative f a + FABL.booleanDerivative g a
    theorem CryptBoolean.booleanDerivative_add {n : }
      (f g : CryptBoolean.BooleanFunction n)
      (a : FABL.F₂Cube n) :
      FABL.booleanDerivative (f + g) a =
        FABL.booleanDerivative f a +
          FABL.booleanDerivative g a
    Directional differentiation distributes over pointwise addition. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderNonlinearity.lean
    complete
    theorem CryptBoolean.derivative_higherOrderNonlinearity_le_two_mul {n : }
      (r : ) (f : CryptBoolean.BooleanFunction n) (a : FABL.F₂Cube n) :
      CryptBoolean.higherOrderNonlinearity (r - 1)
          (FABL.booleanDerivative f a) 
        2 * CryptBoolean.higherOrderNonlinearity r f
    theorem CryptBoolean.derivative_higherOrderNonlinearity_le_two_mul
      {n : } (r : )
      (f : CryptBoolean.BooleanFunction n)
      (a : FABL.F₂Cube n) :
      CryptBoolean.higherOrderNonlinearity
          (r - 1)
          (FABL.booleanDerivative f a) 
        2 *
          CryptBoolean.higherOrderNonlinearity
            r f
    Every derivative's order-`r-1` nonlinearity is at most twice the
    order-`r` nonlinearity of the original function. 
  • defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderNonlinearity.lean
    complete
    def CryptBoolean.maxDerivativeHigherOrderNonlinearity {n : } (r : )
      (f : CryptBoolean.BooleanFunction n) : 
    def CryptBoolean.maxDerivativeHigherOrderNonlinearity
      {n : } (r : )
      (f : CryptBoolean.BooleanFunction n) : 
    The largest lower-order nonlinearity among all directional derivatives. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderNonlinearity.lean
    complete
    theorem CryptBoolean.maxDerivativeHigherOrderNonlinearity_le_two_mul {n : }
      (r : ) (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.maxDerivativeHigherOrderNonlinearity r f 
        2 * CryptBoolean.higherOrderNonlinearity r f
    theorem CryptBoolean.maxDerivativeHigherOrderNonlinearity_le_two_mul
      {n : } (r : )
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.maxDerivativeHigherOrderNonlinearity
          r f 
        2 *
          CryptBoolean.higherOrderNonlinearity
            r f
    Division-free form of the first bound in Carlet Proposition 13. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderNonlinearity.lean
    complete
    theorem CryptBoolean.proposition_13_first_bound {n : } (r : )
      (f : CryptBoolean.BooleanFunction n) :
      (CryptBoolean.maxDerivativeHigherOrderNonlinearity r f) / 2 
        (CryptBoolean.higherOrderNonlinearity r f)
    theorem CryptBoolean.proposition_13_first_bound
      {n : } (r : )
      (f : CryptBoolean.BooleanFunction n) :
      (CryptBoolean.maxDerivativeHigherOrderNonlinearity
              r f) /
          2 
        (CryptBoolean.higherOrderNonlinearity
            r f)
    First recursive lower bound in Carlet Proposition 13. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderNonlinearity.lean
    complete
    theorem CryptBoolean.two_mul_higherOrderNonlinearity_le_two_pow {n : } (r : )
      (hr : 1  r) (f : CryptBoolean.BooleanFunction n) :
      2 * CryptBoolean.higherOrderNonlinearity r f  2 ^ n
    theorem CryptBoolean.two_mul_higherOrderNonlinearity_le_two_pow
      {n : } (r : ) (hr : 1  r)
      (f : CryptBoolean.BooleanFunction n) :
      2 *
          CryptBoolean.higherOrderNonlinearity
            r f 
        2 ^ n
    For positive order, twice the distance to `R(r,n)` is at most the cube size. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderNonlinearity.lean
    complete
    theorem CryptBoolean.autocorrelation_eq_walshTransform_booleanDerivative_zero
      {n : } (f : CryptBoolean.BooleanFunction n) (a : FABL.F₂Cube n) :
      CryptBoolean.autocorrelation f a =
        (CryptBoolean.walshTransform (FABL.booleanDerivative f a) 0)
    theorem CryptBoolean.autocorrelation_eq_walshTransform_booleanDerivative_zero
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (a : FABL.F₂Cube n) :
      CryptBoolean.autocorrelation f a =
        (CryptBoolean.walshTransform
            (FABL.booleanDerivative f a) 0)
    Autocorrelation is the zero-frequency Walsh value of the derivative. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderNonlinearity.lean
    complete
    theorem CryptBoolean.autocorrelation_eq_two_pow_sub_two_derivative_weight
      {n : } (f : CryptBoolean.BooleanFunction n) (a : FABL.F₂Cube n) :
      CryptBoolean.autocorrelation f a =
        2 ^ n -
          2 * (CryptBoolean.hammingWeight (FABL.booleanDerivative f a))
    theorem CryptBoolean.autocorrelation_eq_two_pow_sub_two_derivative_weight
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (a : FABL.F₂Cube n) :
      CryptBoolean.autocorrelation f a =
        2 ^ n -
          2 *
            (CryptBoolean.hammingWeight
                (FABL.booleanDerivative f a))
    Autocorrelation is cube size minus twice the derivative weight. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderNonlinearity.lean
    complete
    theorem CryptBoolean.autocorrelation_le_two_pow_sub_two_higherOrderNonlinearity
      {n : } (r : ) (f g : CryptBoolean.BooleanFunction n)
      (hg : g  CryptBoolean.reedMuller r n) (a : FABL.F₂Cube n) :
      CryptBoolean.autocorrelation (f + g) a 
        2 ^ n -
          2 *
            (CryptBoolean.higherOrderNonlinearity (r - 1)
                (FABL.booleanDerivative f a))
    theorem CryptBoolean.autocorrelation_le_two_pow_sub_two_higherOrderNonlinearity
      {n : } (r : )
      (f g : CryptBoolean.BooleanFunction n)
      (hg : g  CryptBoolean.reedMuller r n)
      (a : FABL.F₂Cube n) :
      CryptBoolean.autocorrelation (f + g) a 
        2 ^ n -
          2 *
            (CryptBoolean.higherOrderNonlinearity
                (r - 1)
                (FABL.booleanDerivative f a))
    The derivative of an order-`r` approximant bounds autocorrelation by the
    derivative's order-`r-1` nonlinearity. 
  • defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderNonlinearity.lean
    complete
    def CryptBoolean.derivativeHigherOrderNonlinearitySum {n : } (r : )
      (f : CryptBoolean.BooleanFunction n) : 
    def CryptBoolean.derivativeHigherOrderNonlinearitySum
      {n : } (r : )
      (f : CryptBoolean.BooleanFunction n) : 
    The sum of lower-order nonlinearities of all directional derivatives. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderNonlinearity.lean
    complete
    theorem CryptBoolean.higherOrderNonlinearity_gap_sq_le {n : } (r : )
      (f : CryptBoolean.BooleanFunction n) :
      (2 ^ n - 2 * (CryptBoolean.higherOrderNonlinearity r f)) ^ 2 
        (2 ^ n) ^ 2 -
          2 * (CryptBoolean.derivativeHigherOrderNonlinearitySum r f)
    theorem CryptBoolean.higherOrderNonlinearity_gap_sq_le
      {n : } (r : )
      (f : CryptBoolean.BooleanFunction n) :
      (2 ^ n -
            2 *
              (CryptBoolean.higherOrderNonlinearity
                  r f)) ^
          2 
        (2 ^ n) ^ 2 -
          2 *
            (CryptBoolean.derivativeHigherOrderNonlinearitySum
                r f)
    Squared-correlation form underlying the second bound in Carlet Proposition 13. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderNonlinearity.lean
    complete
    theorem CryptBoolean.proposition_13_second_bound {n : } (r : ) (hr : 1  r)
      (f : CryptBoolean.BooleanFunction n) :
      2 ^ n / 2 -
          ((2 ^ n) ^ 2 -
                2 *
                  (CryptBoolean.derivativeHigherOrderNonlinearitySum r
                      f)) /
            2 
        (CryptBoolean.higherOrderNonlinearity r f)
    theorem CryptBoolean.proposition_13_second_bound
      {n : } (r : ) (hr : 1  r)
      (f : CryptBoolean.BooleanFunction n) :
      2 ^ n / 2 -
          ((2 ^ n) ^ 2 -
                2 *
                  (CryptBoolean.derivativeHigherOrderNonlinearitySum
                      r f)) /
            2 
        (CryptBoolean.higherOrderNonlinearity
            r f)
    Second recursive lower bound in Carlet Proposition 13. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderNonlinearity.lean
    complete
    theorem CryptBoolean.proposition_13_second_bound_source_form {n : } (r : )
      (hr : 1  r) (hrn : r < n) (f : CryptBoolean.BooleanFunction n) :
      2 ^ (n - 1) -
          (2 ^ (2 * n) -
                2 *
                  (CryptBoolean.derivativeHigherOrderNonlinearitySum r
                      f)) /
            2 
        (CryptBoolean.higherOrderNonlinearity r f)
    theorem CryptBoolean.proposition_13_second_bound_source_form
      {n : } (r : ) (hr : 1  r)
      (hrn : r < n)
      (f : CryptBoolean.BooleanFunction n) :
      2 ^ (n - 1) -
          (2 ^ (2 * n) -
                2 *
                  (CryptBoolean.derivativeHigherOrderNonlinearitySum
                      r f)) /
            2 
        (CryptBoolean.higherOrderNonlinearity
            r f)
    Carlet Proposition 13 in the source's `2^(n-1)` and `2^(2n)` notation.