3.3. Higher-order nonlinearity
-
CryptBoolean.higherOrderNonlinearity[complete] -
CryptBoolean.nonlinearity_eq_higherOrderNonlinearity_one[complete] -
CryptBoolean.higherOrderNonlinearity_le_hammingDistance[complete] -
CryptBoolean.exists_reedMuller_hammingDistance_eq_higherOrderNonlinearity[complete] -
CryptBoolean.higherOrderNonlinearity_antitone[complete]
Higher-order nonlinearity (Carlet, pp. 53--54). For 0\le r<n, define
\operatorname{nl}_r(f)
=\min_{g\in R(r,n)}d_H(f,g).
The sequence (\operatorname{nl}_r(f))_{0\le r<n} is the nonlinearity
profile of f.
Lean code for Definition3.3.1●5 declarations
Associated Lean declarations
-
CryptBoolean.higherOrderNonlinearity[complete]
-
CryptBoolean.nonlinearity_eq_higherOrderNonlinearity_one[complete]
-
CryptBoolean.higherOrderNonlinearity_le_hammingDistance[complete]
-
CryptBoolean.exists_reedMuller_hammingDistance_eq_higherOrderNonlinearity[complete]
-
CryptBoolean.higherOrderNonlinearity_antitone[complete]
-
CryptBoolean.higherOrderNonlinearity[complete] -
CryptBoolean.nonlinearity_eq_higherOrderNonlinearity_one[complete] -
CryptBoolean.higherOrderNonlinearity_le_hammingDistance[complete] -
CryptBoolean.exists_reedMuller_hammingDistance_eq_higherOrderNonlinearity[complete] -
CryptBoolean.higherOrderNonlinearity_antitone[complete]
-
defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderNonlinearity.leancomplete
def CryptBoolean.higherOrderNonlinearity {n : ℕ} (r : ℕ) (f : CryptBoolean.BooleanFunction n) : ℕ
def CryptBoolean.higherOrderNonlinearity {n : ℕ} (r : ℕ) (f : CryptBoolean.BooleanFunction n) : ℕ
The order-`r` nonlinearity is the minimum raw Hamming distance to `R(r,n)`.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderNonlinearity.leancomplete
theorem CryptBoolean.nonlinearity_eq_higherOrderNonlinearity_one {n : ℕ} (f : CryptBoolean.BooleanFunction n) : CryptBoolean.nonlinearity f = CryptBoolean.higherOrderNonlinearity 1 f
theorem CryptBoolean.nonlinearity_eq_higherOrderNonlinearity_one {n : ℕ} (f : CryptBoolean.BooleanFunction n) : CryptBoolean.nonlinearity f = CryptBoolean.higherOrderNonlinearity 1 f
Ordinary nonlinearity is first-order Reed--Muller distance.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderNonlinearity.leancomplete
theorem CryptBoolean.higherOrderNonlinearity_le_hammingDistance {n : ℕ} (r : ℕ) (f g : CryptBoolean.BooleanFunction n) (hg : g ∈ CryptBoolean.reedMuller r n) : CryptBoolean.higherOrderNonlinearity r f ≤ CryptBoolean.hammingDistance f g
theorem CryptBoolean.higherOrderNonlinearity_le_hammingDistance {n : ℕ} (r : ℕ) (f g : CryptBoolean.BooleanFunction n) (hg : g ∈ CryptBoolean.reedMuller r n) : CryptBoolean.higherOrderNonlinearity r f ≤ CryptBoolean.hammingDistance f g
Distance to `R(r,n)` is bounded by the distance to each of its codewords.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderNonlinearity.leancomplete
theorem CryptBoolean.exists_reedMuller_hammingDistance_eq_higherOrderNonlinearity {n : ℕ} (r : ℕ) (f : CryptBoolean.BooleanFunction n) : ∃ g ∈ CryptBoolean.reedMuller r n, CryptBoolean.hammingDistance f g = CryptBoolean.higherOrderNonlinearity r f
theorem CryptBoolean.exists_reedMuller_hammingDistance_eq_higherOrderNonlinearity {n : ℕ} (r : ℕ) (f : CryptBoolean.BooleanFunction n) : ∃ g ∈ CryptBoolean.reedMuller r n, CryptBoolean.hammingDistance f g = CryptBoolean.higherOrderNonlinearity r f
The finite Reed--Muller code contains a closest codeword.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderNonlinearity.leancomplete
theorem CryptBoolean.higherOrderNonlinearity_antitone {n r s : ℕ} (hrs : r ≤ s) (f : CryptBoolean.BooleanFunction n) : CryptBoolean.higherOrderNonlinearity s f ≤ CryptBoolean.higherOrderNonlinearity r f
theorem CryptBoolean.higherOrderNonlinearity_antitone {n r s : ℕ} (hrs : r ≤ s) (f : CryptBoolean.BooleanFunction n) : CryptBoolean.higherOrderNonlinearity s f ≤ CryptBoolean.higherOrderNonlinearity r f
Increasing the Reed--Muller order can only decrease the distance to the code.
Distance to functions on a prescribed coordinate set (Carlet, p. 53). If
I\subseteq\{1,\ldots,n\} and |I|=r, then
\operatorname{nl}_r(f)
\le \min_{g\text{ depending only on }I}d_H(f,g).
Lean code for Theorem3.3.2●4 theorems
Associated Lean declarations
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderJuntaDistance.leancomplete
theorem CryptBoolean.anfCoeff_eq_zero_of_coordinate_invariant {n : ℕ} (g : CryptBoolean.BooleanFunction n) (S : Finset (Fin n)) (i : Fin n) (hiS : i ∈ S) (hinvariant : ∀ (x : FABL.F₂Cube n), g (Function.update x i 1) = g (Function.update x i 0)) : FABL.anfCoeff g S = 0
theorem CryptBoolean.anfCoeff_eq_zero_of_coordinate_invariant {n : ℕ} (g : CryptBoolean.BooleanFunction n) (S : Finset (Fin n)) (i : Fin n) (hiS : i ∈ S) (hinvariant : ∀ (x : FABL.F₂Cube n), g (Function.update x i 1) = g (Function.update x i 0)) : FABL.anfCoeff g S = 0
Invariance under one binary coordinate forces every ANF coefficient containing that coordinate to vanish.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderJuntaDistance.leancomplete
theorem CryptBoolean.anfCoeff_eq_zero_of_dependsOn_of_not_subset {n : ℕ} (g : CryptBoolean.BooleanFunction n) {I S : Finset (Fin n)} (hdepends : DependsOn g ↑I) (hS : ¬S ⊆ I) : FABL.anfCoeff g S = 0
theorem CryptBoolean.anfCoeff_eq_zero_of_dependsOn_of_not_subset {n : ℕ} (g : CryptBoolean.BooleanFunction n) {I S : Finset (Fin n)} (hdepends : DependsOn g ↑I) (hS : ¬S ⊆ I) : FABL.anfCoeff g S = 0
A function depending only on `I` has no ANF coefficient supported outside `I`.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderJuntaDistance.leancomplete
theorem CryptBoolean.functionAlgebraicDegree_le_card_of_dependsOn {n : ℕ} (g : CryptBoolean.BooleanFunction n) (I : Finset (Fin n)) (hdepends : DependsOn g ↑I) : FABL.functionAlgebraicDegree g ≤ I.card
theorem CryptBoolean.functionAlgebraicDegree_le_card_of_dependsOn {n : ℕ} (g : CryptBoolean.BooleanFunction n) (I : Finset (Fin n)) (hdepends : DependsOn g ↑I) : FABL.functionAlgebraicDegree g ≤ I.card
A Boolean function depending only on `I` has algebraic degree at most the cardinality of `I`.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderJuntaDistance.leancomplete
theorem CryptBoolean.higherOrderNonlinearity_le_hammingDistance_of_dependsOn {n : ℕ} (r : ℕ) (f g : CryptBoolean.BooleanFunction n) (I : Finset (Fin n)) (hI : I.card = r) (hdepends : DependsOn g ↑I) : CryptBoolean.higherOrderNonlinearity r f ≤ CryptBoolean.hammingDistance f g
theorem CryptBoolean.higherOrderNonlinearity_le_hammingDistance_of_dependsOn {n : ℕ} (r : ℕ) (f g : CryptBoolean.BooleanFunction n) (I : Finset (Fin n)) (hI : I.card = r) (hdepends : DependsOn g ↑I) : CryptBoolean.higherOrderNonlinearity r f ≤ CryptBoolean.hammingDistance f g
Carlet's coordinate-junta bound: every function depending on a set `I` of `r` coordinates is an admissible order-`r` approximant.
Finite sphere-covering criterion for Carlet's p. 54 lower bound. Put
V(N,t)=\sum_{j=0}^{t}\binom Nj,
\qquad
D=\sum_{j=0}^{r}\binom nj.
If
2^D V(2^n,t)<2^{2^n},
then some f:V_n\to\mathbb F_2 satisfies
t<\operatorname{nl}_r(f). Equivalently, it suffices that
V(2^n,t)<2^{2^n-D}.
Lean code for Lemma3.3.3●3 declarations
Associated Lean declarations
-
defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderGeneralBounds.leancomplete
def CryptBoolean.hammingBallVolume (N t : ℕ) : ℕ
def CryptBoolean.hammingBallVolume (N t : ℕ) : ℕ
The cardinality of a binary Hamming ball of radius `t` in dimension `N`.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderGeneralBounds.leancomplete
theorem CryptBoolean.exists_higherOrderNonlinearity_gt_of_counting (r n t : ℕ) (hcount : (2 ^ ∑ j ∈ Finset.range (r + 1), n.choose j) * CryptBoolean.hammingBallVolume (2 ^ n) t < 2 ^ 2 ^ n) : ∃ f, t < CryptBoolean.higherOrderNonlinearity r f
theorem CryptBoolean.exists_higherOrderNonlinearity_gt_of_counting (r n t : ℕ) (hcount : (2 ^ ∑ j ∈ Finset.range (r + 1), n.choose j) * CryptBoolean.hammingBallVolume (2 ^ n) t < 2 ^ 2 ^ n) : ∃ f, t < CryptBoolean.higherOrderNonlinearity r f
If the Reed--Muller Hamming balls of radius `t` have total cardinality strictly below the Boolean-function space, some function has order-`r` nonlinearity greater than `t`.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderGeneralBounds.leancomplete
theorem CryptBoolean.exists_higherOrderNonlinearity_gt_of_hammingBallVolume_lt (r n t : ℕ) (hdimension : ∑ j ∈ Finset.range (r + 1), n.choose j ≤ 2 ^ n) (hvolume : CryptBoolean.hammingBallVolume (2 ^ n) t < 2 ^ (2 ^ n - ∑ j ∈ Finset.range (r + 1), n.choose j)) : ∃ f, t < CryptBoolean.higherOrderNonlinearity r f
theorem CryptBoolean.exists_higherOrderNonlinearity_gt_of_hammingBallVolume_lt (r n t : ℕ) (hdimension : ∑ j ∈ Finset.range (r + 1), n.choose j ≤ 2 ^ n) (hvolume : CryptBoolean.hammingBallVolume (2 ^ n) t < 2 ^ (2 ^ n - ∑ j ∈ Finset.range (r + 1), n.choose j)) : ∃ f, t < CryptBoolean.higherOrderNonlinearity r f
Power-of-two form of the exact finite sphere-covering criterion.
Asymptotic lower existence bound for higher-order nonlinearity (Carlet, pp. 53--54).
For each fixed r and all sufficiently large n, there is a function
f:V_n\to\mathbb F_2 such that
\operatorname{nl}_r(f)>
2^{n-1}-\sqrt{2^{n-1}\sum_{i=0}^{r}\binom ni}.
Lean code for Theorem3.3.4●3 theorems
Associated Lean declarations
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderGeneralBounds.leancomplete
theorem CryptBoolean.exists_higherOrderNonlinearity_gt_lower_bound_of_dimension (r n : ℕ) (hdimension : 2 * ∑ j ∈ Finset.range (r + 1), n.choose j ≤ 2 ^ n) : ∃ f, 2 ^ n / 2 - √(2 ^ n / 2 * ↑(∑ j ∈ Finset.range (r + 1), n.choose j)) < ↑(CryptBoolean.higherOrderNonlinearity r f)
theorem CryptBoolean.exists_higherOrderNonlinearity_gt_lower_bound_of_dimension (r n : ℕ) (hdimension : 2 * ∑ j ∈ Finset.range (r + 1), n.choose j ≤ 2 ^ n) : ∃ f, 2 ^ n / 2 - √(2 ^ n / 2 * ↑(∑ j ∈ Finset.range (r + 1), n.choose j)) < ↑(CryptBoolean.higherOrderNonlinearity r f)
Finite-dimensional form of Carlet's probabilistic lower bound.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderGeneralBounds.leancomplete
theorem CryptBoolean.eventually_twice_sum_choose_le_two_pow (r : ℕ) : ∀ᶠ (n : ℕ) in Filter.atTop, 2 * ∑ j ∈ Finset.range (r + 1), n.choose j ≤ 2 ^ n
theorem CryptBoolean.eventually_twice_sum_choose_le_two_pow (r : ℕ) : ∀ᶠ (n : ℕ) in Filter.atTop, 2 * ∑ j ∈ Finset.range (r + 1), n.choose j ≤ 2 ^ n
For fixed order `r`, the Reed--Muller dimension is eventually at most half of the ambient Boolean cube dimension.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderGeneralBounds.leancomplete
theorem CryptBoolean.eventually_exists_higherOrderNonlinearity_gt_carlet_lower_bound (r : ℕ) : ∀ᶠ (n : ℕ) in Filter.atTop, ∃ f, 2 ^ (↑n - 1) - √(2 ^ (↑n - 1) * ↑(∑ j ∈ Finset.range (r + 1), n.choose j)) < ↑(CryptBoolean.higherOrderNonlinearity r f)
theorem CryptBoolean.eventually_exists_higherOrderNonlinearity_gt_carlet_lower_bound (r : ℕ) : ∀ᶠ (n : ℕ) in Filter.atTop, ∃ f, 2 ^ (↑n - 1) - √(2 ^ (↑n - 1) * ↑(∑ j ∈ Finset.range (r + 1), n.choose j)) < ↑(CryptBoolean.higherOrderNonlinearity r f)
Carlet's fixed-order asymptotic lower bound for higher-order nonlinearity.
-
CryptBoolean.maximumHigherOrderNonlinearity[complete] -
CryptBoolean.higherOrderNonlinearity_le_maximum[complete] -
CryptBoolean.exists_higherOrderNonlinearity_eq_maximum[complete] -
CryptBoolean.maximumHigherOrderNonlinearity_succ_le[complete] -
CryptBoolean.maximumHigherOrderNonlinearity_self[complete] -
CryptBoolean.maximumHigherOrderNonlinearity_le_sum_Ico[complete] -
CryptBoolean.maximumHigherOrderNonlinearity_cast_le_sum_Ico_of_le[complete] -
CryptBoolean.maximumHigherOrderNonlinearity_cast_le_carlet_step[complete]
Finite Plotkin induction for the cited upper bound. Define
\rho(r,n)=\max_f\operatorname{nl}_r(f). For 1\le r\le n,
\rho(r,n)\le\sum_{j=r}^{n-1}\rho(r-1,j).
More generally, if throughout this range
\rho(r-1,j)\le 2^{j-1}-A(\sqrt2)^j+e(j),
then
\rho(r,n)\le
\frac{2^n-2^r}{2}
-A(1+\sqrt2)\big((\sqrt2)^n-(\sqrt2)^r\big)
+\sum_{j=r}^{n-1}e(j).
Lean code for Lemma3.3.5●8 declarations
Associated Lean declarations
-
CryptBoolean.maximumHigherOrderNonlinearity[complete]
-
CryptBoolean.higherOrderNonlinearity_le_maximum[complete]
-
CryptBoolean.exists_higherOrderNonlinearity_eq_maximum[complete]
-
CryptBoolean.maximumHigherOrderNonlinearity_succ_le[complete]
-
CryptBoolean.maximumHigherOrderNonlinearity_self[complete]
-
CryptBoolean.maximumHigherOrderNonlinearity_le_sum_Ico[complete]
-
CryptBoolean.maximumHigherOrderNonlinearity_cast_le_sum_Ico_of_le[complete]
-
CryptBoolean.maximumHigherOrderNonlinearity_cast_le_carlet_step[complete]
-
CryptBoolean.maximumHigherOrderNonlinearity[complete] -
CryptBoolean.higherOrderNonlinearity_le_maximum[complete] -
CryptBoolean.exists_higherOrderNonlinearity_eq_maximum[complete] -
CryptBoolean.maximumHigherOrderNonlinearity_succ_le[complete] -
CryptBoolean.maximumHigherOrderNonlinearity_self[complete] -
CryptBoolean.maximumHigherOrderNonlinearity_le_sum_Ico[complete] -
CryptBoolean.maximumHigherOrderNonlinearity_cast_le_sum_Ico_of_le[complete] -
CryptBoolean.maximumHigherOrderNonlinearity_cast_le_carlet_step[complete]
-
defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderGeneralBounds.leancomplete
def CryptBoolean.maximumHigherOrderNonlinearity (r n : ℕ) : ℕ
def CryptBoolean.maximumHigherOrderNonlinearity (r n : ℕ) : ℕ
The covering radius `ρ(r,n)`: the largest order-`r` nonlinearity in dimension `n`.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderGeneralBounds.leancomplete
theorem CryptBoolean.higherOrderNonlinearity_le_maximum {n : ℕ} (r : ℕ) (f : CryptBoolean.BooleanFunction n) : CryptBoolean.higherOrderNonlinearity r f ≤ CryptBoolean.maximumHigherOrderNonlinearity r n
theorem CryptBoolean.higherOrderNonlinearity_le_maximum {n : ℕ} (r : ℕ) (f : CryptBoolean.BooleanFunction n) : CryptBoolean.higherOrderNonlinearity r f ≤ CryptBoolean.maximumHigherOrderNonlinearity r n
Every order-`r` nonlinearity is bounded by the Reed--Muller covering radius.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderGeneralBounds.leancomplete
theorem CryptBoolean.exists_higherOrderNonlinearity_eq_maximum (r n : ℕ) : ∃ f, CryptBoolean.higherOrderNonlinearity r f = CryptBoolean.maximumHigherOrderNonlinearity r n
theorem CryptBoolean.exists_higherOrderNonlinearity_eq_maximum (r n : ℕ) : ∃ f, CryptBoolean.higherOrderNonlinearity r f = CryptBoolean.maximumHigherOrderNonlinearity r n
The finite Boolean-function space contains a word attaining the order-`r` Reed--Muller covering radius.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderGeneralBounds.leancomplete
theorem CryptBoolean.maximumHigherOrderNonlinearity_succ_le (r n : ℕ) (hr : 1 ≤ r) : CryptBoolean.maximumHigherOrderNonlinearity r (n + 1) ≤ CryptBoolean.maximumHigherOrderNonlinearity r n + CryptBoolean.maximumHigherOrderNonlinearity (r - 1) n
theorem CryptBoolean.maximumHigherOrderNonlinearity_succ_le (r n : ℕ) (hr : 1 ≤ r) : CryptBoolean.maximumHigherOrderNonlinearity r (n + 1) ≤ CryptBoolean.maximumHigherOrderNonlinearity r n + CryptBoolean.maximumHigherOrderNonlinearity (r - 1) n
The Reed--Muller covering radii satisfy the Plotkin recurrence `ρ(r,n+1) ≤ ρ(r,n) + ρ(r-1,n)`.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderGeneralBounds.leancomplete
theorem CryptBoolean.maximumHigherOrderNonlinearity_self (n : ℕ) : CryptBoolean.maximumHigherOrderNonlinearity n n = 0
theorem CryptBoolean.maximumHigherOrderNonlinearity_self (n : ℕ) : CryptBoolean.maximumHigherOrderNonlinearity n n = 0
The order-`n` Reed--Muller code has covering radius zero in dimension `n`.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderGeneralBounds.leancomplete
theorem CryptBoolean.maximumHigherOrderNonlinearity_le_sum_Ico (r n : ℕ) (hr : 1 ≤ r) (hrn : r ≤ n) : CryptBoolean.maximumHigherOrderNonlinearity r n ≤ ∑ j ∈ Finset.Ico r n, CryptBoolean.maximumHigherOrderNonlinearity (r - 1) j
theorem CryptBoolean.maximumHigherOrderNonlinearity_le_sum_Ico (r n : ℕ) (hr : 1 ≤ r) (hrn : r ≤ n) : CryptBoolean.maximumHigherOrderNonlinearity r n ≤ ∑ j ∈ Finset.Ico r n, CryptBoolean.maximumHigherOrderNonlinearity (r - 1) j
Iterating the Plotkin recurrence bounds `ρ(r,n)` by the sum of the order-`r-1` covering radii in dimensions `r,…,n-1`.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderGeneralBounds.leancomplete
theorem CryptBoolean.maximumHigherOrderNonlinearity_cast_le_sum_Ico_of_le (r n : ℕ) (hr : 1 ≤ r) (hrn : r ≤ n) (bound : ℕ → ℝ) (hbound : ∀ j ∈ Finset.Ico r n, ↑(CryptBoolean.maximumHigherOrderNonlinearity (r - 1) j) ≤ bound j) : ↑(CryptBoolean.maximumHigherOrderNonlinearity r n) ≤ ∑ j ∈ Finset.Ico r n, bound j
theorem CryptBoolean.maximumHigherOrderNonlinearity_cast_le_sum_Ico_of_le (r n : ℕ) (hr : 1 ≤ r) (hrn : r ≤ n) (bound : ℕ → ℝ) (hbound : ∀ j ∈ Finset.Ico r n, ↑(CryptBoolean.maximumHigherOrderNonlinearity (r - 1) j) ≤ bound j) : ↑(CryptBoolean.maximumHigherOrderNonlinearity r n) ≤ ∑ j ∈ Finset.Ico r n, bound j
A pointwise real-valued bound for the order-`r-1` covering radii can be summed through the Plotkin recurrence to bound the order-`r` covering radius.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderGeneralBounds.leancomplete
theorem CryptBoolean.maximumHigherOrderNonlinearity_cast_le_carlet_step (r n : ℕ) (hr : 1 ≤ r) (hrn : r ≤ n) (A : ℝ) (error : ℕ → ℝ) (hlower : ∀ j ∈ Finset.Ico r n, ↑(CryptBoolean.maximumHigherOrderNonlinearity (r - 1) j) ≤ 2 ^ j / 2 - A * √2 ^ j + error j) : ↑(CryptBoolean.maximumHigherOrderNonlinearity r n) ≤ (2 ^ n - 2 ^ r) / 2 - A * (1 + √2) * (√2 ^ n - √2 ^ r) + ∑ j ∈ Finset.Ico r n, error j
theorem CryptBoolean.maximumHigherOrderNonlinearity_cast_le_carlet_step (r n : ℕ) (hr : 1 ≤ r) (hrn : r ≤ n) (A : ℝ) (error : ℕ → ℝ) (hlower : ∀ j ∈ Finset.Ico r n, ↑(CryptBoolean.maximumHigherOrderNonlinearity (r - 1) j) ≤ 2 ^ j / 2 - A * √2 ^ j + error j) : ↑(CryptBoolean.maximumHigherOrderNonlinearity r n) ≤ (2 ^ n - 2 ^ r) / 2 - A * (1 + √2) * (√2 ^ n - √2 ^ r) + ∑ j ∈ Finset.Ico r n, error j
Carlet's finite higher-order induction step: a bound with leading coefficient `A` at order `r-1` yields coefficient `A * (1 + √2)` at order `r`, with the finite error terms summed over dimensions `r,…,n-1`.
The proof constructs the Plotkin approximant from the two coordinate slices and then evaluates the two finite geometric sums exactly. Thus the cited sharp constant reduces to the order-two covering-radius theorem.
Outline of the sharp upper bound.
The sharp upper bound follows from a chain of lemmas. The correlation-moment ratio turns a lower
bound for two consecutive even moments into an upper bound for the
order-two covering radius. Character orthogonality then rewrites those moments
as signed counts of words in the dual Reed--Muller code, and finite Fourier
inversion groups the counts by Hamming weight. The difference of the seventh
and eighth moments is supported only at weights 0,8,12,14,16; separate
geometric or classification arguments bound the character sum at each weight.
The resulting moment inequality gives the sharp \sqrt{15}/2 order-two
coefficient, and the Plotkin recurrence propagates it to every fixed order
r\ge2, multiplying it by 1+\sqrt2 at each step.
The weight-sixteen branch is the only exceptional part of this spine. Its
rank-seven words are normalized through an augmented self-dual
[16,8,\ge4] code, classified into the three affine orbits 2E_8,
D_{16}^{+}, and F_{16}, and controlled by an orbit-wise sum-of-squares
identity. Words of affine-span rank at most six are handled by a separate
rank-deficient affine-mask cover. Adding these two estimates supplies the
single weight-sixteen character bound used by the moment argument; no
later analytic step depends on the details of the finite classification.
More explicitly, the exceptional branch uses the following six steps.
-
Orthogonality to
R(2,n)bounds the affine-span dimension of a weight-sixteen support by seven and, in dimension seven, produces an augmented self-dual[16,8,\ge4]code. -
Choosing a support point and seven genuine support differences identifies the full-rank support with a systematic sixteen-point subset of
V_7; its quadratic parity constraints are precisely those inherited from the dual Reed--Muller condition. -
The systematic constraints classify the normalized support into one of the three canonical patterns. Affine composition transports that classification back to
V_n, and pairwise orbit disjointness makes the three alternatives unique. -
For each canonical pattern, a nonnegative complete affine-map sum is split into injective and rank-deficient maps. Counting the latter and then dividing by the common positive fiber size gives the lower bound for the corresponding set of distinct image words.
-
If the affine-span dimension is at most six, a padded basis realizes the support as the image of a mask on
V_7under a rank-deficient affine map. Counting maps and masks bounds both the residual family and its character loss. -
The exact rank-seven/residual partition adds the three orbit estimates and the residual estimate. This is the sole weight-sixteen ingredient in the seventh/eighth moment inequality.
-
CryptBoolean.orderTwoCorrelation[complete] -
CryptBoolean.orderTwoCorrelation_eq_two_pow_sub_two_hammingDistance[complete] -
CryptBoolean.maximumOrderTwoCorrelation[complete] -
CryptBoolean.maximumOrderTwoCorrelation_eq[complete] -
CryptBoolean.orderTwoCorrelation_le_maximum[complete] -
CryptBoolean.exists_orderTwoCorrelation_eq_maximum[complete] -
CryptBoolean.maximumOrderTwoCorrelation_nonneg[complete] -
CryptBoolean.abs_orderTwoCorrelation_le_maximum[complete] -
CryptBoolean.orderTwoCorrelationPowerSum[complete] -
CryptBoolean.orderTwoCorrelationPowerSum_nonneg[complete] -
CryptBoolean.orderTwoCorrelationPowerSum_pos[complete] -
CryptBoolean.orderTwoCorrelationPowerSum_succ_le[complete] -
CryptBoolean.sqrt_orderTwoCorrelationPowerSum_ratio_le[complete] -
CryptBoolean.minimumOrderTwoMomentRatio[complete] -
CryptBoolean.maximumHigherOrderNonlinearity_two_cast_le_momentRatio[complete]
Second-order correlation moment ratio. For
f:V_n\to\mathbb F_2 and g\in R(2,n), put
C_f(g)=2^n-2d_H(f,g),
\qquad
S_k(f)=\sum_{g\in R(2,n)} C_f(g)^{2k}.
Then S_k(f)>0 and
\sqrt{\frac{S_{k+1}(f)}{S_k(f)}}
\le 2^n-2\operatorname{nl}_2(f).
Consequently, if \rho(2,n)=\max_f\operatorname{nl}_2(f) and
\mu_{k,n}=\min_f\sqrt{S_{k+1}(f)/S_k(f)}, then
\rho(2,n)\le 2^{n-1}-\frac{\mu_{k,n}}2.
Lean code for Lemma3.3.6●15 declarations
Associated Lean declarations
-
CryptBoolean.orderTwoCorrelation[complete]
-
CryptBoolean.orderTwoCorrelation_eq_two_pow_sub_two_hammingDistance[complete]
-
CryptBoolean.maximumOrderTwoCorrelation[complete]
-
CryptBoolean.maximumOrderTwoCorrelation_eq[complete]
-
CryptBoolean.orderTwoCorrelation_le_maximum[complete]
-
CryptBoolean.exists_orderTwoCorrelation_eq_maximum[complete]
-
CryptBoolean.maximumOrderTwoCorrelation_nonneg[complete]
-
CryptBoolean.abs_orderTwoCorrelation_le_maximum[complete]
-
CryptBoolean.orderTwoCorrelationPowerSum[complete]
-
CryptBoolean.orderTwoCorrelationPowerSum_nonneg[complete]
-
CryptBoolean.orderTwoCorrelationPowerSum_pos[complete]
-
CryptBoolean.orderTwoCorrelationPowerSum_succ_le[complete]
-
CryptBoolean.sqrt_orderTwoCorrelationPowerSum_ratio_le[complete]
-
CryptBoolean.minimumOrderTwoMomentRatio[complete]
-
CryptBoolean.maximumHigherOrderNonlinearity_two_cast_le_momentRatio[complete]
-
CryptBoolean.orderTwoCorrelation[complete] -
CryptBoolean.orderTwoCorrelation_eq_two_pow_sub_two_hammingDistance[complete] -
CryptBoolean.maximumOrderTwoCorrelation[complete] -
CryptBoolean.maximumOrderTwoCorrelation_eq[complete] -
CryptBoolean.orderTwoCorrelation_le_maximum[complete] -
CryptBoolean.exists_orderTwoCorrelation_eq_maximum[complete] -
CryptBoolean.maximumOrderTwoCorrelation_nonneg[complete] -
CryptBoolean.abs_orderTwoCorrelation_le_maximum[complete] -
CryptBoolean.orderTwoCorrelationPowerSum[complete] -
CryptBoolean.orderTwoCorrelationPowerSum_nonneg[complete] -
CryptBoolean.orderTwoCorrelationPowerSum_pos[complete] -
CryptBoolean.orderTwoCorrelationPowerSum_succ_le[complete] -
CryptBoolean.sqrt_orderTwoCorrelationPowerSum_ratio_le[complete] -
CryptBoolean.minimumOrderTwoMomentRatio[complete] -
CryptBoolean.maximumHigherOrderNonlinearity_two_cast_le_momentRatio[complete]
-
defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.leancomplete
def CryptBoolean.orderTwoCorrelation {n : ℕ} (f g : CryptBoolean.BooleanFunction n) : ℝ
def CryptBoolean.orderTwoCorrelation {n : ℕ} (f g : CryptBoolean.BooleanFunction n) : ℝ
The raw correlation of `f` with a Reed--Muller approximant `g`.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.leancomplete
theorem CryptBoolean.orderTwoCorrelation_eq_two_pow_sub_two_hammingDistance {n : ℕ} (f g : CryptBoolean.BooleanFunction n) : CryptBoolean.orderTwoCorrelation f g = 2 ^ n - 2 * ↑(CryptBoolean.hammingDistance f g)
theorem CryptBoolean.orderTwoCorrelation_eq_two_pow_sub_two_hammingDistance {n : ℕ} (f g : CryptBoolean.BooleanFunction n) : CryptBoolean.orderTwoCorrelation f g = 2 ^ n - 2 * ↑(CryptBoolean.hammingDistance f g)
Raw correlation is cube size minus twice Hamming distance.
-
defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.leancomplete
def CryptBoolean.maximumOrderTwoCorrelation {n : ℕ} (f : CryptBoolean.BooleanFunction n) : ℝ
def CryptBoolean.maximumOrderTwoCorrelation {n : ℕ} (f : CryptBoolean.BooleanFunction n) : ℝ
Carlet--Mesnager's `A₂(f)`, expressed through the exact distance-- correlation relation.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.leancomplete
theorem CryptBoolean.maximumOrderTwoCorrelation_eq {n : ℕ} (f : CryptBoolean.BooleanFunction n) : CryptBoolean.maximumOrderTwoCorrelation f = 2 ^ n - 2 * ↑(CryptBoolean.higherOrderNonlinearity 2 f)
theorem CryptBoolean.maximumOrderTwoCorrelation_eq {n : ℕ} (f : CryptBoolean.BooleanFunction n) : CryptBoolean.maximumOrderTwoCorrelation f = 2 ^ n - 2 * ↑(CryptBoolean.higherOrderNonlinearity 2 f)
The definition of `A₂(f)` is the complement of twice the second-order nonlinearity.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.leancomplete
theorem CryptBoolean.orderTwoCorrelation_le_maximum {n : ℕ} (f g : CryptBoolean.BooleanFunction n) (hg : g ∈ CryptBoolean.reedMuller 2 n) : CryptBoolean.orderTwoCorrelation f g ≤ CryptBoolean.maximumOrderTwoCorrelation f
theorem CryptBoolean.orderTwoCorrelation_le_maximum {n : ℕ} (f g : CryptBoolean.BooleanFunction n) (hg : g ∈ CryptBoolean.reedMuller 2 n) : CryptBoolean.orderTwoCorrelation f g ≤ CryptBoolean.maximumOrderTwoCorrelation f
Every second-order Reed--Muller correlation is at most `A₂(f)`.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.leancomplete
theorem CryptBoolean.exists_orderTwoCorrelation_eq_maximum {n : ℕ} (f : CryptBoolean.BooleanFunction n) : ∃ g ∈ CryptBoolean.reedMuller 2 n, CryptBoolean.orderTwoCorrelation f g = CryptBoolean.maximumOrderTwoCorrelation f
theorem CryptBoolean.exists_orderTwoCorrelation_eq_maximum {n : ℕ} (f : CryptBoolean.BooleanFunction n) : ∃ g ∈ CryptBoolean.reedMuller 2 n, CryptBoolean.orderTwoCorrelation f g = CryptBoolean.maximumOrderTwoCorrelation f
A closest second-order Reed--Muller word attains `A₂(f)`.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.leancomplete
theorem CryptBoolean.maximumOrderTwoCorrelation_nonneg {n : ℕ} (f : CryptBoolean.BooleanFunction n) : 0 ≤ CryptBoolean.maximumOrderTwoCorrelation f
theorem CryptBoolean.maximumOrderTwoCorrelation_nonneg {n : ℕ} (f : CryptBoolean.BooleanFunction n) : 0 ≤ CryptBoolean.maximumOrderTwoCorrelation f
The maximum second-order correlation is nonnegative.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.leancomplete
theorem CryptBoolean.abs_orderTwoCorrelation_le_maximum {n : ℕ} (f g : CryptBoolean.BooleanFunction n) (hg : g ∈ CryptBoolean.reedMuller 2 n) : |CryptBoolean.orderTwoCorrelation f g| ≤ CryptBoolean.maximumOrderTwoCorrelation f
theorem CryptBoolean.abs_orderTwoCorrelation_le_maximum {n : ℕ} (f g : CryptBoolean.BooleanFunction n) (hg : g ∈ CryptBoolean.reedMuller 2 n) : |CryptBoolean.orderTwoCorrelation f g| ≤ CryptBoolean.maximumOrderTwoCorrelation f
Every second-order correlation has absolute value at most `A₂(f)`.
-
defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.leancomplete
def CryptBoolean.orderTwoCorrelationPowerSum {n : ℕ} (k : ℕ) (f : CryptBoolean.BooleanFunction n) : ℝ
def CryptBoolean.orderTwoCorrelationPowerSum {n : ℕ} (k : ℕ) (f : CryptBoolean.BooleanFunction n) : ℝ
The even `2k`-th correlation power sum over `RM(2,n)`.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.leancomplete
theorem CryptBoolean.orderTwoCorrelationPowerSum_nonneg {n : ℕ} (k : ℕ) (f : CryptBoolean.BooleanFunction n) : 0 ≤ CryptBoolean.orderTwoCorrelationPowerSum k f
theorem CryptBoolean.orderTwoCorrelationPowerSum_nonneg {n : ℕ} (k : ℕ) (f : CryptBoolean.BooleanFunction n) : 0 ≤ CryptBoolean.orderTwoCorrelationPowerSum k f
Correlation power sums are nonnegative.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.leancomplete
theorem CryptBoolean.orderTwoCorrelationPowerSum_pos {n : ℕ} (k : ℕ) (f : CryptBoolean.BooleanFunction n) : 0 < CryptBoolean.orderTwoCorrelationPowerSum k f
theorem CryptBoolean.orderTwoCorrelationPowerSum_pos {n : ℕ} (k : ℕ) (f : CryptBoolean.BooleanFunction n) : 0 < CryptBoolean.orderTwoCorrelationPowerSum k f
Every correlation power sum has a nonzero affine-correlation summand.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.leancomplete
theorem CryptBoolean.orderTwoCorrelationPowerSum_succ_le {n : ℕ} (k : ℕ) (f : CryptBoolean.BooleanFunction n) : CryptBoolean.orderTwoCorrelationPowerSum (k + 1) f ≤ CryptBoolean.maximumOrderTwoCorrelation f ^ 2 * CryptBoolean.orderTwoCorrelationPowerSum k f
theorem CryptBoolean.orderTwoCorrelationPowerSum_succ_le {n : ℕ} (k : ℕ) (f : CryptBoolean.BooleanFunction n) : CryptBoolean.orderTwoCorrelationPowerSum (k + 1) f ≤ CryptBoolean.maximumOrderTwoCorrelation f ^ 2 * CryptBoolean.orderTwoCorrelationPowerSum k f
The consecutive power sums satisfy the finite maximum-moment inequality used in Carlet--Mesnager Relation (9.9).
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.leancomplete
theorem CryptBoolean.sqrt_orderTwoCorrelationPowerSum_ratio_le {n : ℕ} (k : ℕ) (f : CryptBoolean.BooleanFunction n) : √(CryptBoolean.orderTwoCorrelationPowerSum (k + 1) f / CryptBoolean.orderTwoCorrelationPowerSum k f) ≤ CryptBoolean.maximumOrderTwoCorrelation f
theorem CryptBoolean.sqrt_orderTwoCorrelationPowerSum_ratio_le {n : ℕ} (k : ℕ) (f : CryptBoolean.BooleanFunction n) : √(CryptBoolean.orderTwoCorrelationPowerSum (k + 1) f / CryptBoolean.orderTwoCorrelationPowerSum k f) ≤ CryptBoolean.maximumOrderTwoCorrelation f
Carlet--Mesnager Relation (9.9): the square root of a consecutive power-sum ratio is bounded by the maximum second-order correlation.
-
defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.leancomplete
def CryptBoolean.minimumOrderTwoMomentRatio (k n : ℕ) : ℝ
def CryptBoolean.minimumOrderTwoMomentRatio (k n : ℕ) : ℝ
The minimum consecutive moment ratio appearing in Relation (9.10).
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.leancomplete
theorem CryptBoolean.maximumHigherOrderNonlinearity_two_cast_le_momentRatio (k n : ℕ) : ↑(CryptBoolean.maximumHigherOrderNonlinearity 2 n) ≤ 2 ^ n / 2 - CryptBoolean.minimumOrderTwoMomentRatio k n / 2
theorem CryptBoolean.maximumHigherOrderNonlinearity_two_cast_le_momentRatio (k n : ℕ) : ↑(CryptBoolean.maximumHigherOrderNonlinearity 2 n) ≤ 2 ^ n / 2 - CryptBoolean.minimumOrderTwoMomentRatio k n / 2
Carlet--Mesnager Relation (9.10), before inserting the low-weight dual-code character-sum estimate.
Relations (9.7)--(9.10) of the cited Carlet--Mesnager argument reduce the sharp order-two bound to a uniform lower estimate for consecutive even correlation moments. The low-weight dual Reed--Muller classification supplies that estimate through the subsequent weight-by-weight decomposition.
-
CryptBoolean.tuplePointParity[complete] -
CryptBoolean.booleanFunctionPairing_tuplePointParity[complete] -
CryptBoolean.orderTwoAdmissibleTuples[complete] -
CryptBoolean.reedMullerTwoPairingCharacterSum[complete] -
CryptBoolean.reedMullerTwoPairingCharacterSum_eq_card_of_mem_dual[complete] -
CryptBoolean.reedMullerTwoPairingCharacterSum_eq_zero_of_not_mem_dual[complete] -
CryptBoolean.orderTwoCorrelationPowerSum_eq_admissibleTupleCharacterSum[complete]
Dual-code decomposition of second-order correlation moments.
For an ordered 2k-tuple x=(x_i) of points of V_n, let p_x be
the Boolean function recording the parity of the multiplicity of each point,
and let
U_{k,n}=\{x:p_x\in R(n-3,n)\}.
If n\ge3, then
S_k(f)=|R(2,n)|
\sum_{x\in U_{k,n}}(-1)^{\langle f,p_x\rangle}.
Lean code for Lemma3.3.7●7 declarations
Associated Lean declarations
-
CryptBoolean.tuplePointParity[complete]
-
CryptBoolean.booleanFunctionPairing_tuplePointParity[complete]
-
CryptBoolean.orderTwoAdmissibleTuples[complete]
-
CryptBoolean.reedMullerTwoPairingCharacterSum[complete]
-
CryptBoolean.reedMullerTwoPairingCharacterSum_eq_card_of_mem_dual[complete]
-
CryptBoolean.reedMullerTwoPairingCharacterSum_eq_zero_of_not_mem_dual[complete]
-
CryptBoolean.orderTwoCorrelationPowerSum_eq_admissibleTupleCharacterSum[complete]
-
CryptBoolean.tuplePointParity[complete] -
CryptBoolean.booleanFunctionPairing_tuplePointParity[complete] -
CryptBoolean.orderTwoAdmissibleTuples[complete] -
CryptBoolean.reedMullerTwoPairingCharacterSum[complete] -
CryptBoolean.reedMullerTwoPairingCharacterSum_eq_card_of_mem_dual[complete] -
CryptBoolean.reedMullerTwoPairingCharacterSum_eq_zero_of_not_mem_dual[complete] -
CryptBoolean.orderTwoCorrelationPowerSum_eq_admissibleTupleCharacterSum[complete]
-
defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.leancomplete
def CryptBoolean.tuplePointParity {n m : ℕ} (x : Fin m → FABL.F₂Cube n) : CryptBoolean.BooleanFunction n
def CryptBoolean.tuplePointParity {n m : ℕ} (x : Fin m → FABL.F₂Cube n) : CryptBoolean.BooleanFunction n
The parity of the multiset of points in an ordered tuple, viewed as a Boolean function.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.leancomplete
theorem CryptBoolean.booleanFunctionPairing_tuplePointParity {n m : ℕ} (f : CryptBoolean.BooleanFunction n) (x : Fin m → FABL.F₂Cube n) : ((CryptBoolean.booleanFunctionPairing n) f) (CryptBoolean.tuplePointParity x) = ∑ i, f (x i)
theorem CryptBoolean.booleanFunctionPairing_tuplePointParity {n m : ℕ} (f : CryptBoolean.BooleanFunction n) (x : Fin m → FABL.F₂Cube n) : ((CryptBoolean.booleanFunctionPairing n) f) (CryptBoolean.tuplePointParity x) = ∑ i, f (x i)
Pairing with the tuple point-parity function evaluates a Boolean function on every entry of the tuple and adds the results.
-
defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.leancomplete
def CryptBoolean.orderTwoAdmissibleTuples (k n : ℕ) : Finset (Fin (2 * k) → FABL.F₂Cube n)
def CryptBoolean.orderTwoAdmissibleTuples (k n : ℕ) : Finset (Fin (2 * k) → FABL.F₂Cube n)
The ordered `2k`-tuples whose point-parity function belongs to the dual Reed--Muller code occurring in Carlet--Mesnager Lemma 9.2.2.
-
defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.leancomplete
def CryptBoolean.reedMullerTwoPairingCharacterSum {n : ℕ} (h : CryptBoolean.BooleanFunction n) : ℝ
def CryptBoolean.reedMullerTwoPairingCharacterSum {n : ℕ} (h : CryptBoolean.BooleanFunction n) : ℝ
The character sum over `RM(2,n)` induced by pairing with `h`.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.leancomplete
theorem CryptBoolean.reedMullerTwoPairingCharacterSum_eq_card_of_mem_dual {n : ℕ} (h : CryptBoolean.BooleanFunction n) (hdual : h ∈ CryptBoolean.reedMullerDual 2 n) : CryptBoolean.reedMullerTwoPairingCharacterSum h = ↑(Nat.card ↥(CryptBoolean.reedMuller 2 n))
theorem CryptBoolean.reedMullerTwoPairingCharacterSum_eq_card_of_mem_dual {n : ℕ} (h : CryptBoolean.BooleanFunction n) (hdual : h ∈ CryptBoolean.reedMullerDual 2 n) : CryptBoolean.reedMullerTwoPairingCharacterSum h = ↑(Nat.card ↥(CryptBoolean.reedMuller 2 n))
Character orthogonality on `RM(2,n)` at a word in the dual code.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.leancomplete
theorem CryptBoolean.reedMullerTwoPairingCharacterSum_eq_zero_of_not_mem_dual {n : ℕ} (h : CryptBoolean.BooleanFunction n) (hdual : h ∉ CryptBoolean.reedMullerDual 2 n) : CryptBoolean.reedMullerTwoPairingCharacterSum h = 0
theorem CryptBoolean.reedMullerTwoPairingCharacterSum_eq_zero_of_not_mem_dual {n : ℕ} (h : CryptBoolean.BooleanFunction n) (hdual : h ∉ CryptBoolean.reedMullerDual 2 n) : CryptBoolean.reedMullerTwoPairingCharacterSum h = 0
Character orthogonality on `RM(2,n)` away from the dual code.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.leancomplete
theorem CryptBoolean.orderTwoCorrelationPowerSum_eq_admissibleTupleCharacterSum {n : ℕ} (k : ℕ) (f : CryptBoolean.BooleanFunction n) (hn : 3 ≤ n) : CryptBoolean.orderTwoCorrelationPowerSum k f = ↑(Nat.card ↥(CryptBoolean.reedMuller 2 n)) * ∑ x ∈ CryptBoolean.orderTwoAdmissibleTuples k n, FABL.binarySign (((CryptBoolean.booleanFunctionPairing n) f) (CryptBoolean.tuplePointParity x))
theorem CryptBoolean.orderTwoCorrelationPowerSum_eq_admissibleTupleCharacterSum {n : ℕ} (k : ℕ) (f : CryptBoolean.BooleanFunction n) (hn : 3 ≤ n) : CryptBoolean.orderTwoCorrelationPowerSum k f = ↑(Nat.card ↥(CryptBoolean.reedMuller 2 n)) * ∑ x ∈ CryptBoolean.orderTwoAdmissibleTuples k n, FABL.binarySign (((CryptBoolean.booleanFunctionPairing n) f) (CryptBoolean.tuplePointParity x))
Carlet--Mesnager Lemma 9.2.2: the `2k`-th correlation power sum is the cardinality of `RM(2,n)` times the character sum over the ordered tuples whose point-parity function belongs to `RM(n-3,n)`.
Expanding the even power gives ordered tuples. Character
orthogonality over R(2,n) leaves exactly its dual, and Chapter 3 duality
identifies that code with R(n-3,n). This is Carlet--Mesnager Lemma 9.2.2;
the subsequent grouping by low dual weights remains separate.
-
CryptBoolean.orderTwoDualWords[complete] -
CryptBoolean.tuplePointParityFiber[complete] -
CryptBoolean.tuplePointParityMultiplicity[complete] -
CryptBoolean.tuplePointParityMultiplicity_comp_perm[complete] -
CryptBoolean.tuplePointParityMultiplicity_eq_of_hammingWeight_eq[complete] -
CryptBoolean.tuplePointParityMultiplicityByWeight[complete] -
CryptBoolean.tuplePointParityMultiplicity_eq_byWeight[complete] -
CryptBoolean.tuplePointParityMultiplicityByWeight_eq_fourierSum[complete] -
CryptBoolean.tuplePointParityKrawtchoukMultiplicity[complete] -
CryptBoolean.tuplePointParityMultiplicityByWeight_eq_krawtchoukSum[complete] -
CryptBoolean.orderTwoCorrelationPowerSum_eq_dualWeightGroupedCharacterSum[complete] -
CryptBoolean.orderTwoCorrelationPowerSum_eq_dualFourierMultiplicityCharacterSum[complete] -
CryptBoolean.orderTwoCorrelationPowerSum_eq_dualKrawtchoukMultiplicityCharacterSum[complete]
Weight grouping and finite inversion of tuple multiplicities.
Let N_k(w) be the number of ordered 2k-tuples whose point-parity word
is a prescribed Boolean function of Hamming weight w. This number depends
only on w, and
N_k(w)=2^{-2^n}\sum_{j=0}^{2^n}
K_j^{(2^n)}(w)(2^n-2j)^{2k},
where K_j^{(2^n)} is the binary Krawtchouk polynomial. Consequently the
dual-code moment decomposition can be grouped by dual words and then by their
Hamming weights using these exact multiplicities.
Lean code for Lemma3.3.8●13 declarations
Associated Lean declarations
-
CryptBoolean.orderTwoDualWords[complete]
-
CryptBoolean.tuplePointParityFiber[complete]
-
CryptBoolean.tuplePointParityMultiplicity[complete]
-
CryptBoolean.tuplePointParityMultiplicity_comp_perm[complete]
-
CryptBoolean.tuplePointParityMultiplicity_eq_of_hammingWeight_eq[complete]
-
CryptBoolean.tuplePointParityMultiplicityByWeight[complete]
-
CryptBoolean.tuplePointParityMultiplicity_eq_byWeight[complete]
-
CryptBoolean.tuplePointParityMultiplicityByWeight_eq_fourierSum[complete]
-
CryptBoolean.tuplePointParityKrawtchoukMultiplicity[complete]
-
CryptBoolean.tuplePointParityMultiplicityByWeight_eq_krawtchoukSum[complete]
-
CryptBoolean.orderTwoCorrelationPowerSum_eq_dualWeightGroupedCharacterSum[complete]
-
CryptBoolean.orderTwoCorrelationPowerSum_eq_dualFourierMultiplicityCharacterSum[complete]
-
CryptBoolean.orderTwoCorrelationPowerSum_eq_dualKrawtchoukMultiplicityCharacterSum[complete]
-
CryptBoolean.orderTwoDualWords[complete] -
CryptBoolean.tuplePointParityFiber[complete] -
CryptBoolean.tuplePointParityMultiplicity[complete] -
CryptBoolean.tuplePointParityMultiplicity_comp_perm[complete] -
CryptBoolean.tuplePointParityMultiplicity_eq_of_hammingWeight_eq[complete] -
CryptBoolean.tuplePointParityMultiplicityByWeight[complete] -
CryptBoolean.tuplePointParityMultiplicity_eq_byWeight[complete] -
CryptBoolean.tuplePointParityMultiplicityByWeight_eq_fourierSum[complete] -
CryptBoolean.tuplePointParityKrawtchoukMultiplicity[complete] -
CryptBoolean.tuplePointParityMultiplicityByWeight_eq_krawtchoukSum[complete] -
CryptBoolean.orderTwoCorrelationPowerSum_eq_dualWeightGroupedCharacterSum[complete] -
CryptBoolean.orderTwoCorrelationPowerSum_eq_dualFourierMultiplicityCharacterSum[complete] -
CryptBoolean.orderTwoCorrelationPowerSum_eq_dualKrawtchoukMultiplicityCharacterSum[complete]
-
defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.leancomplete
def CryptBoolean.orderTwoDualWords (n : ℕ) : Finset (CryptBoolean.BooleanFunction n)
def CryptBoolean.orderTwoDualWords (n : ℕ) : Finset (CryptBoolean.BooleanFunction n)
The dual Reed--Muller words used to group the admissible tuples.
-
defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.leancomplete
def CryptBoolean.tuplePointParityFiber {n : ℕ} (k : ℕ) (h : CryptBoolean.BooleanFunction n) : Finset (Fin (2 * k) → FABL.F₂Cube n)
def CryptBoolean.tuplePointParityFiber {n : ℕ} (k : ℕ) (h : CryptBoolean.BooleanFunction n) : Finset (Fin (2 * k) → FABL.F₂Cube n)
The fiber of ordered tuples having a prescribed point-parity word.
-
defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.leancomplete
def CryptBoolean.tuplePointParityMultiplicity {n : ℕ} (k : ℕ) (h : CryptBoolean.BooleanFunction n) : ℕ
def CryptBoolean.tuplePointParityMultiplicity {n : ℕ} (k : ℕ) (h : CryptBoolean.BooleanFunction n) : ℕ
The number of ordered tuples having a prescribed point-parity word.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.leancomplete
theorem CryptBoolean.tuplePointParityMultiplicity_comp_perm {n : ℕ} (k : ℕ) (h : CryptBoolean.BooleanFunction n) (σ : Equiv.Perm (FABL.F₂Cube n)) : CryptBoolean.tuplePointParityMultiplicity k h = CryptBoolean.tuplePointParityMultiplicity k (h ∘ ⇑(Equiv.symm σ))
theorem CryptBoolean.tuplePointParityMultiplicity_comp_perm {n : ℕ} (k : ℕ) (h : CryptBoolean.BooleanFunction n) (σ : Equiv.Perm (FABL.F₂Cube n)) : CryptBoolean.tuplePointParityMultiplicity k h = CryptBoolean.tuplePointParityMultiplicity k (h ∘ ⇑(Equiv.symm σ))
Relabeling all cube points by a permutation preserves point-parity fiber cardinality.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.leancomplete
theorem CryptBoolean.tuplePointParityMultiplicity_eq_of_hammingWeight_eq {n : ℕ} (k : ℕ) (h₁ h₂ : CryptBoolean.BooleanFunction n) (hweight : CryptBoolean.hammingWeight h₁ = CryptBoolean.hammingWeight h₂) : CryptBoolean.tuplePointParityMultiplicity k h₁ = CryptBoolean.tuplePointParityMultiplicity k h₂
theorem CryptBoolean.tuplePointParityMultiplicity_eq_of_hammingWeight_eq {n : ℕ} (k : ℕ) (h₁ h₂ : CryptBoolean.BooleanFunction n) (hweight : CryptBoolean.hammingWeight h₁ = CryptBoolean.hammingWeight h₂) : CryptBoolean.tuplePointParityMultiplicity k h₁ = CryptBoolean.tuplePointParityMultiplicity k h₂
Point-parity fiber cardinality depends only on the Hamming weight of the prescribed word.
-
defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.leancomplete
def CryptBoolean.tuplePointParityMultiplicityByWeight (k n w : ℕ) : ℕ
def CryptBoolean.tuplePointParityMultiplicityByWeight (k n w : ℕ) : ℕ
The common point-parity multiplicity of words of Hamming weight `w`, or zero when no such word exists.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.leancomplete
theorem CryptBoolean.tuplePointParityMultiplicity_eq_byWeight {n : ℕ} (k : ℕ) (h : CryptBoolean.BooleanFunction n) : CryptBoolean.tuplePointParityMultiplicity k h = CryptBoolean.tuplePointParityMultiplicityByWeight k n (CryptBoolean.hammingWeight h)
theorem CryptBoolean.tuplePointParityMultiplicity_eq_byWeight {n : ℕ} (k : ℕ) (h : CryptBoolean.BooleanFunction n) : CryptBoolean.tuplePointParityMultiplicity k h = CryptBoolean.tuplePointParityMultiplicityByWeight k n (CryptBoolean.hammingWeight h)
A point-parity fiber multiplicity is its weight-indexed multiplicity.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.leancomplete
theorem CryptBoolean.tuplePointParityMultiplicityByWeight_eq_fourierSum {n : ℕ} (k : ℕ) (h : CryptBoolean.BooleanFunction n) : ↑(CryptBoolean.tuplePointParityMultiplicityByWeight k n (CryptBoolean.hammingWeight h)) = (∑ g, FABL.binarySign (((CryptBoolean.booleanFunctionPairing n) g) h) * (2 ^ n - 2 * ↑(CryptBoolean.hammingWeight g)) ^ (2 * k)) / 2 ^ 2 ^ n
theorem CryptBoolean.tuplePointParityMultiplicityByWeight_eq_fourierSum {n : ℕ} (k : ℕ) (h : CryptBoolean.BooleanFunction n) : ↑(CryptBoolean.tuplePointParityMultiplicityByWeight k n (CryptBoolean.hammingWeight h)) = (∑ g, FABL.binarySign (((CryptBoolean.booleanFunctionPairing n) g) h) * (2 ^ n - 2 * ↑(CryptBoolean.hammingWeight g)) ^ (2 * k)) / 2 ^ 2 ^ n
Mesnager HDR Lemma 9.2.7 in finite Fourier form: the ordered-tuple multiplicity at a realizable weight is the inverse Fourier transform of the `2k`-th powers of the one-point character sums.
-
defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.leancomplete
def CryptBoolean.tuplePointParityKrawtchoukMultiplicity (k n w : ℕ) : ℝ
def CryptBoolean.tuplePointParityKrawtchoukMultiplicity (k n w : ℕ) : ℝ
The finite Krawtchouk sum equal to Mesnager's exponential-generating coefficient `[z^(2k)] sinh(z)^w cosh(z)^(2^n-w)`. Here `w` is the full Hamming weight; Mesnager's parameter is half this value.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.leancomplete
theorem CryptBoolean.tuplePointParityMultiplicityByWeight_eq_krawtchoukSum {n : ℕ} (k : ℕ) (h : CryptBoolean.BooleanFunction n) : ↑(CryptBoolean.tuplePointParityMultiplicityByWeight k n (CryptBoolean.hammingWeight h)) = CryptBoolean.tuplePointParityKrawtchoukMultiplicity k n (CryptBoolean.hammingWeight h)
theorem CryptBoolean.tuplePointParityMultiplicityByWeight_eq_krawtchoukSum {n : ℕ} (k : ℕ) (h : CryptBoolean.BooleanFunction n) : ↑(CryptBoolean.tuplePointParityMultiplicityByWeight k n (CryptBoolean.hammingWeight h)) = CryptBoolean.tuplePointParityKrawtchoukMultiplicity k n (CryptBoolean.hammingWeight h)
Mesnager HDR Lemma 9.2.7 in explicit finite Krawtchouk form.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.leancomplete
theorem CryptBoolean.orderTwoCorrelationPowerSum_eq_dualWeightGroupedCharacterSum {n : ℕ} (k : ℕ) (f : CryptBoolean.BooleanFunction n) (hn : 3 ≤ n) : CryptBoolean.orderTwoCorrelationPowerSum k f = ↑(Nat.card ↥(CryptBoolean.reedMuller 2 n)) * ∑ h ∈ CryptBoolean.orderTwoDualWords n, ↑(CryptBoolean.tuplePointParityMultiplicityByWeight k n (CryptBoolean.hammingWeight h)) * FABL.binarySign (((CryptBoolean.booleanFunctionPairing n) f) h)
theorem CryptBoolean.orderTwoCorrelationPowerSum_eq_dualWeightGroupedCharacterSum {n : ℕ} (k : ℕ) (f : CryptBoolean.BooleanFunction n) (hn : 3 ≤ n) : CryptBoolean.orderTwoCorrelationPowerSum k f = ↑(Nat.card ↥(CryptBoolean.reedMuller 2 n)) * ∑ h ∈ CryptBoolean.orderTwoDualWords n, ↑(CryptBoolean.tuplePointParityMultiplicityByWeight k n (CryptBoolean.hammingWeight h)) * FABL.binarySign (((CryptBoolean.booleanFunctionPairing n) f) h)
Carlet--Mesnager Proposition 9.2.5, first grouping layer: the correlation power sum is grouped by dual Reed--Muller words, with a tuple multiplicity that depends only on the word's Hamming weight.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.leancomplete
theorem CryptBoolean.orderTwoCorrelationPowerSum_eq_dualFourierMultiplicityCharacterSum {n : ℕ} (k : ℕ) (f : CryptBoolean.BooleanFunction n) (hn : 3 ≤ n) : CryptBoolean.orderTwoCorrelationPowerSum k f = ↑(Nat.card ↥(CryptBoolean.reedMuller 2 n)) * ∑ h ∈ CryptBoolean.orderTwoDualWords n, (∑ g, FABL.binarySign (((CryptBoolean.booleanFunctionPairing n) g) h) * (2 ^ n - 2 * ↑(CryptBoolean.hammingWeight g)) ^ (2 * k)) / 2 ^ 2 ^ n * FABL.binarySign (((CryptBoolean.booleanFunctionPairing n) f) h)
theorem CryptBoolean.orderTwoCorrelationPowerSum_eq_dualFourierMultiplicityCharacterSum {n : ℕ} (k : ℕ) (f : CryptBoolean.BooleanFunction n) (hn : 3 ≤ n) : CryptBoolean.orderTwoCorrelationPowerSum k f = ↑(Nat.card ↥(CryptBoolean.reedMuller 2 n)) * ∑ h ∈ CryptBoolean.orderTwoDualWords n, (∑ g, FABL.binarySign (((CryptBoolean.booleanFunctionPairing n) g) h) * (2 ^ n - 2 * ↑(CryptBoolean.hammingWeight g)) ^ (2 * k)) / 2 ^ 2 ^ n * FABL.binarySign (((CryptBoolean.booleanFunctionPairing n) f) h)
Proposition 9.2.5 with each tuple multiplicity replaced by its exact finite Fourier inversion formula.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwo.leancomplete
theorem CryptBoolean.orderTwoCorrelationPowerSum_eq_dualKrawtchoukMultiplicityCharacterSum {n : ℕ} (k : ℕ) (f : CryptBoolean.BooleanFunction n) (hn : 3 ≤ n) : CryptBoolean.orderTwoCorrelationPowerSum k f = ↑(Nat.card ↥(CryptBoolean.reedMuller 2 n)) * ∑ h ∈ CryptBoolean.orderTwoDualWords n, CryptBoolean.tuplePointParityKrawtchoukMultiplicity k n (CryptBoolean.hammingWeight h) * FABL.binarySign (((CryptBoolean.booleanFunctionPairing n) f) h)
theorem CryptBoolean.orderTwoCorrelationPowerSum_eq_dualKrawtchoukMultiplicityCharacterSum {n : ℕ} (k : ℕ) (f : CryptBoolean.BooleanFunction n) (hn : 3 ≤ n) : CryptBoolean.orderTwoCorrelationPowerSum k f = ↑(Nat.card ↥(CryptBoolean.reedMuller 2 n)) * ∑ h ∈ CryptBoolean.orderTwoDualWords n, CryptBoolean.tuplePointParityKrawtchoukMultiplicity k n (CryptBoolean.hammingWeight h) * FABL.binarySign (((CryptBoolean.booleanFunctionPairing n) f) h)
Proposition 9.2.5 with each tuple multiplicity replaced by the explicit finite Krawtchouk sum equivalent to Mesnager's generating-function formula.
Permuting the Boolean cube identifies all tuple-parity fibers of equal weight. Character orthogonality on the full Boolean-function group gives finite Fourier inversion, and the Krawtchouk expansion groups the Fourier sum by Hamming weight. This is the finite form of Carlet--Mesnager Proposition 9.2.5 and Lemma 9.2.7.
Support of the seventh/eighth moment difference. Let
h\in R(n-3,n) and n\ge7. Among even weights at most 16, the only
possibilities are
0,\ 8,\ 12,\ 14,\ 16.
Moreover, a point-parity multiplicity for ordered 2k-tuples vanishes
when w>2k. Hence the coefficient of h in
S_8(f)-15\cdot2^nS_7(f) vanishes for w>16, so this moment difference
is supported only at the five displayed weights.
Lean code for Lemma3.3.9●4 theorems
Associated Lean declarations
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoLowWeightSpectrum.leancomplete
theorem CryptBoolean.hasOrderTwoLowWeightSpectrum {n : ℕ} (hn : 3 ≤ n) : CryptBoolean.HasOrderTwoLowWeightSpectrum n
theorem CryptBoolean.hasOrderTwoLowWeightSpectrum {n : ℕ} (hn : 3 ≤ n) : CryptBoolean.HasOrderTwoLowWeightSpectrum n
Below weight sixteen, the only even weights in the codimension-three dual code are `0, 8, 12, 14, 16`.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoMomentDifference.leancomplete
theorem CryptBoolean.tuplePointParityMultiplicityByWeight_eq_zero_of_lt {n : ℕ} (k : ℕ) (h : CryptBoolean.BooleanFunction n) (hweight : 2 * k < CryptBoolean.hammingWeight h) : CryptBoolean.tuplePointParityMultiplicityByWeight k n (CryptBoolean.hammingWeight h) = 0
theorem CryptBoolean.tuplePointParityMultiplicityByWeight_eq_zero_of_lt {n : ℕ} (k : ℕ) (h : CryptBoolean.BooleanFunction n) (hweight : 2 * k < CryptBoolean.hammingWeight h) : CryptBoolean.tuplePointParityMultiplicityByWeight k n (CryptBoolean.hammingWeight h) = 0
A tuple-parity multiplicity vanishes when the prescribed word has more support points than the tuple has entries.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoMomentDifference.leancomplete
theorem CryptBoolean.tuplePointParityMomentDifference_eq_zero_of_sixteen_lt {n : ℕ} (h : CryptBoolean.BooleanFunction n) (hweight : 16 < CryptBoolean.hammingWeight h) : CryptBoolean.tuplePointParityMomentDifference n (CryptBoolean.hammingWeight h) = 0
theorem CryptBoolean.tuplePointParityMomentDifference_eq_zero_of_sixteen_lt {n : ℕ} (h : CryptBoolean.BooleanFunction n) (hweight : 16 < CryptBoolean.hammingWeight h) : CryptBoolean.tuplePointParityMomentDifference n (CryptBoolean.hammingWeight h) = 0
Above weight sixteen, the coefficient in the seventh/eighth moment difference vanishes.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoMomentDifference.leancomplete
theorem CryptBoolean.orderTwoMomentDifferenceCharacterSum_eq_lowWeights {n : ℕ} (f : CryptBoolean.BooleanFunction n) (hn : 7 ≤ n) : ∑ h ∈ CryptBoolean.orderTwoDualWords n, CryptBoolean.tuplePointParityMomentDifference n (CryptBoolean.hammingWeight h) * FABL.binarySign (((CryptBoolean.booleanFunctionPairing n) f) h) = CryptBoolean.tuplePointParityMomentDifference n 0 + CryptBoolean.tuplePointParityMomentDifference n 8 * CryptBoolean.orderTwoWeightEightCharacterSum f + CryptBoolean.tuplePointParityMomentDifference n 12 * CryptBoolean.orderTwoWeightTwelveCharacterSum f + CryptBoolean.tuplePointParityMomentDifference n 14 * CryptBoolean.orderTwoWeightFourteenCharacterSum f + CryptBoolean.tuplePointParityMomentDifference n 16 * CryptBoolean.orderTwoWeightSixteenCharacterSum f
theorem CryptBoolean.orderTwoMomentDifferenceCharacterSum_eq_lowWeights {n : ℕ} (f : CryptBoolean.BooleanFunction n) (hn : 7 ≤ n) : ∑ h ∈ CryptBoolean.orderTwoDualWords n, CryptBoolean.tuplePointParityMomentDifference n (CryptBoolean.hammingWeight h) * FABL.binarySign (((CryptBoolean.booleanFunctionPairing n) f) h) = CryptBoolean.tuplePointParityMomentDifference n 0 + CryptBoolean.tuplePointParityMomentDifference n 8 * CryptBoolean.orderTwoWeightEightCharacterSum f + CryptBoolean.tuplePointParityMomentDifference n 12 * CryptBoolean.orderTwoWeightTwelveCharacterSum f + CryptBoolean.tuplePointParityMomentDifference n 14 * CryptBoolean.orderTwoWeightFourteenCharacterSum f + CryptBoolean.tuplePointParityMomentDifference n 16 * CryptBoolean.orderTwoWeightSixteenCharacterSum f
The dual-code coefficient sum is supported only at weights `0, 8, 12, 14, 16`.
The minimum-distance theorem excludes weights below eight and the codimension-three spectrum excludes weight ten; tuple support alone removes weights above sixteen. This is the finite support reduction used before the individual low-weight estimates in Carlet and Mesnager (2007).
-
CryptBoolean.orderTwoWeightEightDualWords_eq_affineFlatIndicators[complete] -
CryptBoolean.orderTwoWeightEightCharacterSum_eq_affineFlatCharacterSum[complete] -
CryptBoolean.card_binaryAffineFlats_two[complete] -
CryptBoolean.binaryAffineFlatCharacterSum_three_ge_neg_card[complete] -
CryptBoolean.binaryAffineFlatCharacterSum_three_ge[complete] -
CryptBoolean.orderTwoWeightEightCharacterSum_ge[complete]
Weight-eight dual character bound. For n\ge3, the
weight-eight words of R(n-3,n) are precisely the indicators of affine
three-flats. If
M_8(f)=\sum_{\substack{h\in R(n-3,n)\\\operatorname{wt}(h)=8}}
(-1)^{\langle f,h\rangle},
then
M_8(f)\ge
-\frac{2^n(2^n-1)(2^n-2)}{336}.
Lean code for Lemma3.3.10●6 theorems
Associated Lean declarations
-
CryptBoolean.orderTwoWeightEightDualWords_eq_affineFlatIndicators[complete]
-
CryptBoolean.orderTwoWeightEightCharacterSum_eq_affineFlatCharacterSum[complete]
-
CryptBoolean.card_binaryAffineFlats_two[complete]
-
CryptBoolean.binaryAffineFlatCharacterSum_three_ge_neg_card[complete]
-
CryptBoolean.binaryAffineFlatCharacterSum_three_ge[complete]
-
CryptBoolean.orderTwoWeightEightCharacterSum_ge[complete]
-
CryptBoolean.orderTwoWeightEightDualWords_eq_affineFlatIndicators[complete] -
CryptBoolean.orderTwoWeightEightCharacterSum_eq_affineFlatCharacterSum[complete] -
CryptBoolean.card_binaryAffineFlats_two[complete] -
CryptBoolean.binaryAffineFlatCharacterSum_three_ge_neg_card[complete] -
CryptBoolean.binaryAffineFlatCharacterSum_three_ge[complete] -
CryptBoolean.orderTwoWeightEightCharacterSum_ge[complete]
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightEight.leancomplete
theorem CryptBoolean.orderTwoWeightEightDualWords_eq_affineFlatIndicators {n : ℕ} (hn : 3 ≤ n) : CryptBoolean.orderTwoWeightEightDualWords n = Finset.image CryptBoolean.binaryAffineFlatIndicator (CryptBoolean.binaryAffineFlats 3 n)
theorem CryptBoolean.orderTwoWeightEightDualWords_eq_affineFlatIndicators {n : ℕ} (hn : 3 ≤ n) : CryptBoolean.orderTwoWeightEightDualWords n = Finset.image CryptBoolean.binaryAffineFlatIndicator (CryptBoolean.binaryAffineFlats 3 n)
Minimum-weight classification identifies the weight-eight dual words with the indicators of the canonical three-dimensional affine flats.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightEight.leancomplete
theorem CryptBoolean.orderTwoWeightEightCharacterSum_eq_affineFlatCharacterSum {n : ℕ} (f : CryptBoolean.BooleanFunction n) (hn : 3 ≤ n) : CryptBoolean.orderTwoWeightEightCharacterSum f = CryptBoolean.binaryAffineFlatCharacterSum 3 f
theorem CryptBoolean.orderTwoWeightEightCharacterSum_eq_affineFlatCharacterSum {n : ℕ} (f : CryptBoolean.BooleanFunction n) (hn : 3 ≤ n) : CryptBoolean.orderTwoWeightEightCharacterSum f = CryptBoolean.binaryAffineFlatCharacterSum 3 f
The dual-code definition of `M_f^(8)` is the affine-three-flat character sum used in Proposition 9.2.10.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightEight.leancomplete
theorem CryptBoolean.card_binaryAffineFlats_two (n : ℕ) : (CryptBoolean.binaryAffineFlats 2 n).card * 24 = 2 ^ n * (2 ^ n - 1) * (2 ^ n - 2)
theorem CryptBoolean.card_binaryAffineFlats_two (n : ℕ) : (CryptBoolean.binaryAffineFlats 2 n).card * 24 = 2 ^ n * (2 ^ n - 1) * (2 ^ n - 2)
The number of affine two-flats is `2^n (2^n - 1) (2^n - 2) / 24`, in division-free form.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightEight.leancomplete
theorem CryptBoolean.binaryAffineFlatCharacterSum_three_ge_neg_card {n : ℕ} (f : CryptBoolean.BooleanFunction n) : CryptBoolean.binaryAffineFlatCharacterSum 3 f ≥ -↑(CryptBoolean.binaryAffineFlats 2 n).card / 14
theorem CryptBoolean.binaryAffineFlatCharacterSum_three_ge_neg_card {n : ℕ} (f : CryptBoolean.BooleanFunction n) : CryptBoolean.binaryAffineFlatCharacterSum 3 f ≥ -↑(CryptBoolean.binaryAffineFlats 2 n).card / 14
The three-flat character sum is bounded below by minus one fourteenth of the number of affine two-flats.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightEight.leancomplete
theorem CryptBoolean.binaryAffineFlatCharacterSum_three_ge {n : ℕ} (f : CryptBoolean.BooleanFunction n) (hn : 3 ≤ n) : CryptBoolean.binaryAffineFlatCharacterSum 3 f ≥ -(2 ^ n * (2 ^ n - 1) * (2 ^ n - 2)) / 336
theorem CryptBoolean.binaryAffineFlatCharacterSum_three_ge {n : ℕ} (f : CryptBoolean.BooleanFunction n) (hn : 3 ≤ n) : CryptBoolean.binaryAffineFlatCharacterSum 3 f ≥ -(2 ^ n * (2 ^ n - 1) * (2 ^ n - 2)) / 336
Carlet--Mesnager Proposition 9.2.10(1), in its affine-flat form: `M_f^(8) ≥ -2^n(2^n-1)(2^n-2)/336`.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightEight.leancomplete
theorem CryptBoolean.orderTwoWeightEightCharacterSum_ge {n : ℕ} (f : CryptBoolean.BooleanFunction n) (hn : 3 ≤ n) : CryptBoolean.orderTwoWeightEightCharacterSum f ≥ -(2 ^ n * (2 ^ n - 1) * (2 ^ n - 2)) / 336
theorem CryptBoolean.orderTwoWeightEightCharacterSum_ge {n : ℕ} (f : CryptBoolean.BooleanFunction n) (hn : 3 ≤ n) : CryptBoolean.orderTwoWeightEightCharacterSum f ≥ -(2 ^ n * (2 ^ n - 1) * (2 ^ n - 2)) / 336
Carlet--Mesnager Proposition 9.2.10(1) for the canonical weight-eight dual-code character sum.
Proposition 12 supplies the affine-flat normal form. The character sum over parallel affine two-flat pairs is a square; removing the diagonal leaves the stated lower bound. This is Carlet--Mesnager Proposition 9.2.10(1) (Carlet and Mesnager, 2007).
Weight-twelve dual character bound. For n\ge5, every
weight-twelve word of R(n-3,n) has exactly twenty ordered
representations as the sum of two affine three-flat indicators whose
intersection is an affine line. Consequently, with
M_{12}(f)=\sum_{\substack{h\in R(n-3,n)\\\operatorname{wt}(h)=12}}
(-1)^{\langle f,h\rangle},
one has
M_{12}(f)\ge-\frac{(2^n)^5}{20}.
Lean code for Lemma3.3.11●4 theorems
Associated Lean declarations
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightTwelveClassification.leancomplete
theorem CryptBoolean.hasWeightTwelveFlatPairClassification (n : ℕ) (hn : 5 ≤ n) : CryptBoolean.HasWeightTwelveFlatPairClassification n
theorem CryptBoolean.hasWeightTwelveFlatPairClassification (n : ℕ) (hn : 5 ≤ n) : CryptBoolean.HasWeightTwelveFlatPairClassification n
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightTwelve.leancomplete
theorem CryptBoolean.weightTwelveRepresentationCharacterSum_ge {n : ℕ} (f : CryptBoolean.BooleanFunction n) : CryptBoolean.weightTwelveRepresentationCharacterSum f ≥ -(2 ^ n) ^ 5 / 20
theorem CryptBoolean.weightTwelveRepresentationCharacterSum_ge {n : ℕ} (f : CryptBoolean.BooleanFunction n) : CryptBoolean.weightTwelveRepresentationCharacterSum f ≥ -(2 ^ n) ^ 5 / 20
The affine representation form of the weight-twelve character sum is at least `-(2^n)^5 / 20`.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightTwelve.leancomplete
theorem CryptBoolean.orderTwoWeightTwelveCharacterSum_eq_representation {n : ℕ} (f : CryptBoolean.BooleanFunction n) (hclassification : CryptBoolean.HasWeightTwelveFlatPairClassification n) : CryptBoolean.orderTwoWeightTwelveCharacterSum f = CryptBoolean.weightTwelveRepresentationCharacterSum f
theorem CryptBoolean.orderTwoWeightTwelveCharacterSum_eq_representation {n : ℕ} (f : CryptBoolean.BooleanFunction n) (hclassification : CryptBoolean.HasWeightTwelveFlatPairClassification n) : CryptBoolean.orderTwoWeightTwelveCharacterSum f = CryptBoolean.weightTwelveRepresentationCharacterSum f
Under the Kasami--Tokura finite-fiber classification, the canonical weight-twelve character sum is the affine representation sum.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightTwelve.leancomplete
theorem CryptBoolean.orderTwoWeightTwelveCharacterSum_ge {n : ℕ} (f : CryptBoolean.BooleanFunction n) (hclassification : CryptBoolean.HasWeightTwelveFlatPairClassification n) : CryptBoolean.orderTwoWeightTwelveCharacterSum f ≥ -(2 ^ n) ^ 5 / 20
theorem CryptBoolean.orderTwoWeightTwelveCharacterSum_ge {n : ℕ} (f : CryptBoolean.BooleanFunction n) (hclassification : CryptBoolean.HasWeightTwelveFlatPairClassification n) : CryptBoolean.orderTwoWeightTwelveCharacterSum f ≥ -(2 ^ n) ^ 5 / 20
A reusable `O((2^n)^5)` lower bound for the weight-twelve contribution, conditional only on the cited Kasami--Tokura classification.
The exact fiber size converts the word sum into a normalized affine-flat representation sum. The unrestricted sum is a sum of squares indexed by affine lines; the excluded nontransverse configurations inject into five ambient vectors. The low-weight classification follows the Kasami--Tokura analysis (Kasami and Tokura, 1970; Kasami et al., 1976).
Weight-fourteen dual character bound. Every
weight-fourteen word of R(n-3,n) is the sum of two affine three-flat
indicators meeting in one point, with exactly the two ordered
representations obtained by exchanging the flats. Therefore
M_{14}(f)=\sum_{\substack{h\in R(n-3,n)\\\operatorname{wt}(h)=14}}
(-1)^{\langle f,h\rangle}
\ge-\frac{(2^n)^6}{2}.
Lean code for Lemma3.3.12●4 theorems
Associated Lean declarations
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightFourteenClassification.leancomplete
theorem CryptBoolean.hasWeightFourteenFlatPairClassification (n : ℕ) : CryptBoolean.HasWeightFourteenFlatPairClassification n
theorem CryptBoolean.hasWeightFourteenFlatPairClassification (n : ℕ) : CryptBoolean.HasWeightFourteenFlatPairClassification n
Kasami--Tokura's weight-fourteen existence classification.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightFourteen.leancomplete
theorem CryptBoolean.weightFourteenRepresentationCharacterSum_ge {n : ℕ} (f : CryptBoolean.BooleanFunction n) : CryptBoolean.weightFourteenRepresentationCharacterSum f ≥ -(2 ^ n) ^ 6 / 2
theorem CryptBoolean.weightFourteenRepresentationCharacterSum_ge {n : ℕ} (f : CryptBoolean.BooleanFunction n) : CryptBoolean.weightFourteenRepresentationCharacterSum f ≥ -(2 ^ n) ^ 6 / 2
A dimension-free coarse form of the weight-fourteen square-sum bound. It has the `O(2^(6n))` order needed by the moment argument.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightFourteen.leancomplete
theorem CryptBoolean.orderTwoWeightFourteenCharacterSum_eq_representation {n : ℕ} (f : CryptBoolean.BooleanFunction n) (hclassification : CryptBoolean.HasWeightFourteenFlatPairClassification n) : CryptBoolean.orderTwoWeightFourteenCharacterSum f = CryptBoolean.weightFourteenRepresentationCharacterSum f
theorem CryptBoolean.orderTwoWeightFourteenCharacterSum_eq_representation {n : ℕ} (f : CryptBoolean.BooleanFunction n) (hclassification : CryptBoolean.HasWeightFourteenFlatPairClassification n) : CryptBoolean.orderTwoWeightFourteenCharacterSum f = CryptBoolean.weightFourteenRepresentationCharacterSum f
Under the Kasami--Tokura existence classification, the canonical weight-fourteen character sum is exactly the normalized representation sum.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightFourteen.leancomplete
theorem CryptBoolean.orderTwoWeightFourteenCharacterSum_ge {n : ℕ} (f : CryptBoolean.BooleanFunction n) (hclassification : CryptBoolean.HasWeightFourteenFlatPairClassification n) : CryptBoolean.orderTwoWeightFourteenCharacterSum f ≥ -(2 ^ n) ^ 6 / 2
theorem CryptBoolean.orderTwoWeightFourteenCharacterSum_ge {n : ℕ} (f : CryptBoolean.BooleanFunction n) (hclassification : CryptBoolean.HasWeightFourteenFlatPairClassification n) : CryptBoolean.orderTwoWeightFourteenCharacterSum f ≥ -(2 ^ n) ^ 6 / 2
A reusable `O((2^n)^6)` lower bound for the canonical weight-fourteen contribution, conditional only on the cited Kasami--Tokura existence classification.
The complete ordered-pair sum at each base point is a square. Nontransverse pairs inject into five ambient vectors, and the exact two-element representation fiber transfers the resulting bound to distinct dual words. The classification is the relevant Kasami--Tokura low-weight case (Kasami and Tokura, 1970; Kasami et al., 1976).
-
CryptBoolean.finrank_supportDifferenceSpan_le_seven_of_weight_sixteen[complete] -
CryptBoolean.exists_supportDifferenceBasis_of_finrank_eq[complete] -
CryptBoolean.augmentedSupportDifferenceCode_le_perpendicular[complete] -
CryptBoolean.four_le_binaryVectorWeight_of_mem_augmentedSupportDifferenceCode[complete] -
CryptBoolean.finrank_augmentedSupportDifferenceCode_eq_eight[complete] -
CryptBoolean.augmentedSupportDifferenceCode_eq_perpendicular[complete]
Rank reduction and the augmented self-dual code. Let
h\in R(n-3,n) have weight 16, and choose p\in\operatorname{supp}(h).
Then the affine span of the support differences has dimension at most seven.
Whenever this dimension is r, one can choose r actual support
differences that form a basis of the span.
If its dimension is seven, adjoining the constant coordinate to affine
evaluation on the sixteen support points produces a binary self-dual code
of length 16, dimension 8, and minimum distance at least 4.
Lean code for Lemma3.3.13●6 theorems
Associated Lean declarations
-
CryptBoolean.finrank_supportDifferenceSpan_le_seven_of_weight_sixteen[complete]
-
CryptBoolean.exists_supportDifferenceBasis_of_finrank_eq[complete]
-
CryptBoolean.augmentedSupportDifferenceCode_le_perpendicular[complete]
-
CryptBoolean.four_le_binaryVectorWeight_of_mem_augmentedSupportDifferenceCode[complete]
-
CryptBoolean.finrank_augmentedSupportDifferenceCode_eq_eight[complete]
-
CryptBoolean.augmentedSupportDifferenceCode_eq_perpendicular[complete]
-
CryptBoolean.finrank_supportDifferenceSpan_le_seven_of_weight_sixteen[complete] -
CryptBoolean.exists_supportDifferenceBasis_of_finrank_eq[complete] -
CryptBoolean.augmentedSupportDifferenceCode_le_perpendicular[complete] -
CryptBoolean.four_le_binaryVectorWeight_of_mem_augmentedSupportDifferenceCode[complete] -
CryptBoolean.finrank_augmentedSupportDifferenceCode_eq_eight[complete] -
CryptBoolean.augmentedSupportDifferenceCode_eq_perpendicular[complete]
-
theoremdefined in CryptBoolean/Carlet/Chapter03/ReedMullerLowWeightAffineSpan.leancomplete
theorem CryptBoolean.finrank_supportDifferenceSpan_le_seven_of_weight_sixteen {n : ℕ} (h : CryptBoolean.BooleanFunction n) (p : FABL.F₂Cube n) (hp : p ∈ CryptBoolean.support h) (hn : 3 ≤ n) (hmem : h ∈ CryptBoolean.reedMuller (n - 3) n) (hweight : CryptBoolean.hammingWeight h = 16) : Module.finrank FABL.𝔽₂ ↥(CryptBoolean.supportDifferenceSpan h p) ≤ 7
theorem CryptBoolean.finrank_supportDifferenceSpan_le_seven_of_weight_sixteen {n : ℕ} (h : CryptBoolean.BooleanFunction n) (p : FABL.F₂Cube n) (hp : p ∈ CryptBoolean.support h) (hn : 3 ≤ n) (hmem : h ∈ CryptBoolean.reedMuller (n - 3) n) (hweight : CryptBoolean.hammingWeight h = 16) : Module.finrank FABL.𝔽₂ ↥(CryptBoolean.supportDifferenceSpan h p) ≤ 7
A weight-sixteen codimension-three word is contained in an affine flat of dimension at most seven.
-
theoremdefined in CryptBoolean/Carlet/Chapter03/ReedMullerLowWeightAffineSpan.leancomplete
theorem CryptBoolean.exists_supportDifferenceBasis_of_finrank_eq {n : ℕ} (h : CryptBoolean.BooleanFunction n) (p : FABL.F₂Cube n) {r : ℕ} (hrank : Module.finrank FABL.𝔽₂ ↥(CryptBoolean.supportDifferenceSpan h p) = r) : ∃ v, (∀ (i : Fin r), v i ∈ CryptBoolean.supportDifferences h p) ∧ Submodule.span FABL.𝔽₂ (Set.range v) = CryptBoolean.supportDifferenceSpan h p ∧ LinearIndependent FABL.𝔽₂ v
theorem CryptBoolean.exists_supportDifferenceBasis_of_finrank_eq {n : ℕ} (h : CryptBoolean.BooleanFunction n) (p : FABL.F₂Cube n) {r : ℕ} (hrank : Module.finrank FABL.𝔽₂ ↥(CryptBoolean.supportDifferenceSpan h p) = r) : ∃ v, (∀ (i : Fin r), v i ∈ CryptBoolean.supportDifferences h p) ∧ Submodule.span FABL.𝔽₂ (Set.range v) = CryptBoolean.supportDifferenceSpan h p ∧ LinearIndependent FABL.𝔽₂ v
If the support-difference span has dimension `r`, then `r` actual support differences form a basis of that span.
-
theoremdefined in CryptBoolean/Carlet/Chapter03/ReedMullerWeightSixteenSelfDual.leancomplete
theorem CryptBoolean.augmentedSupportDifferenceCode_le_perpendicular {n : ℕ} (h : CryptBoolean.BooleanFunction n) (p : FABL.F₂Cube n) (hp : p ∈ CryptBoolean.support h) (hdual : h ∈ CryptBoolean.reedMullerDual 2 n) (hweight : CryptBoolean.hammingWeight h = 16) : CryptBoolean.augmentedSupportDifferenceCode h p ≤ FABL.perpendicularSubspace (CryptBoolean.augmentedSupportDifferenceCode h p)
theorem CryptBoolean.augmentedSupportDifferenceCode_le_perpendicular {n : ℕ} (h : CryptBoolean.BooleanFunction n) (p : FABL.F₂Cube n) (hp : p ∈ CryptBoolean.support h) (hdual : h ∈ CryptBoolean.reedMullerDual 2 n) (hweight : CryptBoolean.hammingWeight h = 16) : CryptBoolean.augmentedSupportDifferenceCode h p ≤ FABL.perpendicularSubspace (CryptBoolean.augmentedSupportDifferenceCode h p)
The full affine-evaluation code of a weight-sixteen dual word is self-orthogonal.
-
theoremdefined in CryptBoolean/Carlet/Chapter03/ReedMullerWeightSixteenSelfDual.leancomplete
theorem CryptBoolean.four_le_binaryVectorWeight_of_mem_augmentedSupportDifferenceCode {n : ℕ} (h : CryptBoolean.BooleanFunction n) (p : FABL.F₂Cube n) (hp : p ∈ CryptBoolean.support h) (hdual : h ∈ CryptBoolean.reedMullerDual 2 n) (hweight : CryptBoolean.hammingWeight h = 16) (x : FABL.F₂Cube (((CryptBoolean.support h).erase p).card + 1)) (hx : x ∈ CryptBoolean.augmentedSupportDifferenceCode h p) (hxne : x ≠ 0) : 4 ≤ CryptBoolean.binaryVectorWeight x
theorem CryptBoolean.four_le_binaryVectorWeight_of_mem_augmentedSupportDifferenceCode {n : ℕ} (h : CryptBoolean.BooleanFunction n) (p : FABL.F₂Cube n) (hp : p ∈ CryptBoolean.support h) (hdual : h ∈ CryptBoolean.reedMullerDual 2 n) (hweight : CryptBoolean.hammingWeight h = 16) (x : FABL.F₂Cube (((CryptBoolean.support h).erase p).card + 1)) (hx : x ∈ CryptBoolean.augmentedSupportDifferenceCode h p) (hxne : x ≠ 0) : 4 ≤ CryptBoolean.binaryVectorWeight x
Every nonzero word in the full affine-evaluation code has weight at least four.
-
theoremdefined in CryptBoolean/Carlet/Chapter03/ReedMullerWeightSixteenSelfDual.leancomplete
theorem CryptBoolean.finrank_augmentedSupportDifferenceCode_eq_eight {n : ℕ} (h : CryptBoolean.BooleanFunction n) (p : FABL.F₂Cube n) (hspan : Module.finrank FABL.𝔽₂ ↥(CryptBoolean.supportDifferenceSpan h p) = 7) : Module.finrank FABL.𝔽₂ ↥(CryptBoolean.augmentedSupportDifferenceCode h p) = 8
theorem CryptBoolean.finrank_augmentedSupportDifferenceCode_eq_eight {n : ℕ} (h : CryptBoolean.BooleanFunction n) (p : FABL.F₂Cube n) (hspan : Module.finrank FABL.𝔽₂ ↥(CryptBoolean.supportDifferenceSpan h p) = 7) : Module.finrank FABL.𝔽₂ ↥(CryptBoolean.augmentedSupportDifferenceCode h p) = 8
In the full affine-span case the augmented code has dimension eight.
-
theoremdefined in CryptBoolean/Carlet/Chapter03/ReedMullerWeightSixteenSelfDual.leancomplete
theorem CryptBoolean.augmentedSupportDifferenceCode_eq_perpendicular {n : ℕ} (h : CryptBoolean.BooleanFunction n) (p : FABL.F₂Cube n) (hp : p ∈ CryptBoolean.support h) (hdual : h ∈ CryptBoolean.reedMullerDual 2 n) (hweight : CryptBoolean.hammingWeight h = 16) (hspan : Module.finrank FABL.𝔽₂ ↥(CryptBoolean.supportDifferenceSpan h p) = 7) : CryptBoolean.augmentedSupportDifferenceCode h p = FABL.perpendicularSubspace (CryptBoolean.augmentedSupportDifferenceCode h p)
theorem CryptBoolean.augmentedSupportDifferenceCode_eq_perpendicular {n : ℕ} (h : CryptBoolean.BooleanFunction n) (p : FABL.F₂Cube n) (hp : p ∈ CryptBoolean.support h) (hdual : h ∈ CryptBoolean.reedMullerDual 2 n) (hweight : CryptBoolean.hammingWeight h = 16) (hspan : Module.finrank FABL.𝔽₂ ↥(CryptBoolean.supportDifferenceSpan h p) = 7) : CryptBoolean.augmentedSupportDifferenceCode h p = FABL.perpendicularSubspace (CryptBoolean.augmentedSupportDifferenceCode h p)
A full-span weight-sixteen dual word canonically produces a binary self-dual code of length sixteen and dimension eight.
Orthogonality to R(2,n) gives self-orthogonality of
the augmented evaluation code; the full-span rank calculation upgrades this
to self-duality. A basis is then extracted from the genuine support
differences spanning the direction space. Thus the rank-seven branch reduces
to the classification of
projective binary self-dual [16,8,\ge4] codes, whose three types are
described in Pless (1972) and surveyed by
Rains and Sloane (1998).
Rank-seven weight-sixteen classification. A weight-sixteen
word h\in R(n-3,n) whose support has affine-span dimension seven is an
injective affine image of exactly one of the three canonical sixteen-point
patterns 2E_8, D_{16}^{+}, and F_{16}. Conversely, every such image
has weight sixteen, belongs to R(n-3,n), and has support-affine-span
dimension seven; the three affine orbits are pairwise disjoint.
Lean code for Lemma3.3.14●2 declarations
Associated Lean declarations
-
defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightSixteen/RankSevenClassification.leancomplete
def CryptBoolean.rankSevenWeightSixteenPatternCertificate {n : ℕ} (hn : 3 ≤ n) {h : CryptBoolean.BooleanFunction n} (hh : h ∈ CryptBoolean.orderTwoWeightSixteenDualWords n) (hrank : CryptBoolean.HasSupportAffineSpanRankSeven h) : CryptBoolean.RankSevenWeightSixteenPatternCertificate h
def CryptBoolean.rankSevenWeightSixteenPatternCertificate {n : ℕ} (hn : 3 ≤ n) {h : CryptBoolean.BooleanFunction n} (hh : h ∈ CryptBoolean.orderTwoWeightSixteenDualWords n) (hrank : CryptBoolean.HasSupportAffineSpanRankSeven h) : CryptBoolean.RankSevenWeightSixteenPatternCertificate h
Every rank-seven weight-sixteen dual word has a selected canonical-pattern certificate.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightSixteen/RankSevenClassification.leancomplete
theorem CryptBoolean.hasRankSevenWeightSixteenOrbitClassification (n : ℕ) (hn : 3 ≤ n) : CryptBoolean.HasRankSevenWeightSixteenOrbitClassification n
theorem CryptBoolean.hasRankSevenWeightSixteenOrbitClassification (n : ℕ) (hn : 3 ≤ n) : CryptBoolean.HasRankSevenWeightSixteenOrbitClassification n
The rank-seven weight-sixteen dual words are exactly the disjoint union of the three canonical affine-pattern orbits.
Choosing a support point and a basis of support
differences gives an affine embedding of a normalized sixteen-point set in
V_7. In these coordinates the quadratic dual-code constraints become
systematic parity conditions on the residual columns, each an odd, non-unit
vector of \mathbb F_2^8. Classifying the strictly increasing,
pairwise-orthogonal column systems that meet these conditions shows that every
support is an injective affine image of exactly one of the three canonical
patterns 2E_8, D_{16}^{+}, and F_{16}. Pairwise orbit disjointness
makes the pattern unique. The resulting three-orbit
classification agrees with the enumeration of
Mesnager and Oblaukhov (2022) and with the self-dual code types in
Pless (1972); Rains and Sloane (1998).
-
CryptBoolean.rankSevenWeightSixteenPatternAffineProduct[complete] -
CryptBoolean.rankSevenWeightSixteenPatternCompleteAffineMapCharacterSum[complete] -
CryptBoolean.rankSevenWeightSixteenPatternCompleteAffineMapCharacterSum_nonneg[complete] -
CryptBoolean.rankSevenWeightSixteenInjectiveAffineMapData[complete] -
CryptBoolean.rankSevenWeightSixteenInjectiveAffineMapCharacterSum_ge[complete] -
CryptBoolean.rankSevenWeightSixteenPatternOrbitWords[complete] -
CryptBoolean.rankSevenWeightSixteenPatternOrbitCharacterSum[complete] -
CryptBoolean.rankSevenWeightSixteenPatternOrbitCharacterSum_ge[complete]
Nonnegative affine-map sums for rank-seven patterns. Let
\sigma:V_n\to\{-1,1\}. For each
c\in\{2E_8,D_{16}^{+},F_{16}\}, the sum over all affine maps
A:V_7\to V_n of
\prod_{x\in c}\sigma(Ax)
is nonnegative. Restricting to injective affine maps and then to distinct
image words gives, for every f:V_n\to\mathbb F_2,
\sum_{h\in\mathcal O_c}(-1)^{\langle f,h\rangle}
\ge-127(2^n)^7.
Lean code for Lemma3.3.15●8 declarations
Associated Lean declarations
-
CryptBoolean.rankSevenWeightSixteenPatternAffineProduct[complete]
-
CryptBoolean.rankSevenWeightSixteenPatternCompleteAffineMapCharacterSum[complete]
-
CryptBoolean.rankSevenWeightSixteenPatternCompleteAffineMapCharacterSum_nonneg[complete]
-
CryptBoolean.rankSevenWeightSixteenInjectiveAffineMapData[complete]
-
CryptBoolean.rankSevenWeightSixteenInjectiveAffineMapCharacterSum_ge[complete]
-
CryptBoolean.rankSevenWeightSixteenPatternOrbitWords[complete]
-
CryptBoolean.rankSevenWeightSixteenPatternOrbitCharacterSum[complete]
-
CryptBoolean.rankSevenWeightSixteenPatternOrbitCharacterSum_ge[complete]
-
CryptBoolean.rankSevenWeightSixteenPatternAffineProduct[complete] -
CryptBoolean.rankSevenWeightSixteenPatternCompleteAffineMapCharacterSum[complete] -
CryptBoolean.rankSevenWeightSixteenPatternCompleteAffineMapCharacterSum_nonneg[complete] -
CryptBoolean.rankSevenWeightSixteenInjectiveAffineMapData[complete] -
CryptBoolean.rankSevenWeightSixteenInjectiveAffineMapCharacterSum_ge[complete] -
CryptBoolean.rankSevenWeightSixteenPatternOrbitWords[complete] -
CryptBoolean.rankSevenWeightSixteenPatternOrbitCharacterSum[complete] -
CryptBoolean.rankSevenWeightSixteenPatternOrbitCharacterSum_ge[complete]
-
defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightSixteen/PatternOrbitSums.leancomplete
def CryptBoolean.rankSevenWeightSixteenPatternAffineProduct {n : ℕ} (σ : FABL.F₂Cube n → ℝ) (c : CryptBoolean.RankSevenWeightSixteenPatternClass) (d : CryptBoolean.SevenVariableAffineMapData n) : ℝ
def CryptBoolean.rankSevenWeightSixteenPatternAffineProduct {n : ℕ} (σ : FABL.F₂Cube n → ℝ) (c : CryptBoolean.RankSevenWeightSixteenPatternClass) (d : CryptBoolean.SevenVariableAffineMapData n) : ℝ
The character product obtained by mapping a canonical rank-seven pattern into an ambient binary cube.
-
defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightSixteen/PatternOrbitSums.leancomplete
def CryptBoolean.rankSevenWeightSixteenPatternCompleteAffineMapCharacterSum {n : ℕ} (σ : FABL.F₂Cube n → ℝ) (c : CryptBoolean.RankSevenWeightSixteenPatternClass) : ℝ
def CryptBoolean.rankSevenWeightSixteenPatternCompleteAffineMapCharacterSum {n : ℕ} (σ : FABL.F₂Cube n → ℝ) (c : CryptBoolean.RankSevenWeightSixteenPatternClass) : ℝ
The complete affine-map character sum of a canonical rank-seven pattern.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightSixteen/PatternOrbitSums.leancomplete
theorem CryptBoolean.rankSevenWeightSixteenPatternCompleteAffineMapCharacterSum_nonneg {n : ℕ} (σ : FABL.F₂Cube n → ℝ) (c : CryptBoolean.RankSevenWeightSixteenPatternClass) : 0 ≤ CryptBoolean.rankSevenWeightSixteenPatternCompleteAffineMapCharacterSum σ c
theorem CryptBoolean.rankSevenWeightSixteenPatternCompleteAffineMapCharacterSum_nonneg {n : ℕ} (σ : FABL.F₂Cube n → ℝ) (c : CryptBoolean.RankSevenWeightSixteenPatternClass) : 0 ≤ CryptBoolean.rankSevenWeightSixteenPatternCompleteAffineMapCharacterSum σ c
Every canonical rank-seven weight-sixteen pattern has a nonnegative complete affine-map character sum.
-
defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightSixteen/OrbitAggregation.leancomplete
def CryptBoolean.rankSevenWeightSixteenInjectiveAffineMapData (n : ℕ) : Finset (CryptBoolean.SevenVariableAffineMapData n)
def CryptBoolean.rankSevenWeightSixteenInjectiveAffineMapData (n : ℕ) : Finset (CryptBoolean.SevenVariableAffineMapData n)
Injective affine maps from the seven-variable cube into the ambient cube.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightSixteen/OrbitAggregation.leancomplete
theorem CryptBoolean.rankSevenWeightSixteenInjectiveAffineMapCharacterSum_ge {n : ℕ} (f : CryptBoolean.BooleanFunction n) (c : CryptBoolean.RankSevenWeightSixteenPatternClass) : ∑ d ∈ CryptBoolean.rankSevenWeightSixteenInjectiveAffineMapData n, CryptBoolean.rankSevenWeightSixteenPatternAffineProduct (CryptBoolean.realSignView f) c d ≥ -(127 * (2 ^ n) ^ 7)
theorem CryptBoolean.rankSevenWeightSixteenInjectiveAffineMapCharacterSum_ge {n : ℕ} (f : CryptBoolean.BooleanFunction n) (c : CryptBoolean.RankSevenWeightSixteenPatternClass) : ∑ d ∈ CryptBoolean.rankSevenWeightSixteenInjectiveAffineMapData n, CryptBoolean.rankSevenWeightSixteenPatternAffineProduct (CryptBoolean.realSignView f) c d ≥ -(127 * (2 ^ n) ^ 7)
Dimension-free `127 q⁷` lower bound for injective affine-map characters in each canonical rank-seven pattern class.
-
defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightSixteen/OrbitAggregation.leancomplete
def CryptBoolean.rankSevenWeightSixteenPatternOrbitWords (n : ℕ) (c : CryptBoolean.RankSevenWeightSixteenPatternClass) : Finset (CryptBoolean.BooleanFunction n)
def CryptBoolean.rankSevenWeightSixteenPatternOrbitWords (n : ℕ) (c : CryptBoolean.RankSevenWeightSixteenPatternClass) : Finset (CryptBoolean.BooleanFunction n)
The distinct support words in one canonical rank-seven affine orbit.
-
defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightSixteen/OrbitAggregation.leancomplete
def CryptBoolean.rankSevenWeightSixteenPatternOrbitCharacterSum {n : ℕ} (f : CryptBoolean.BooleanFunction n) (c : CryptBoolean.RankSevenWeightSixteenPatternClass) : ℝ
def CryptBoolean.rankSevenWeightSixteenPatternOrbitCharacterSum {n : ℕ} (f : CryptBoolean.BooleanFunction n) (c : CryptBoolean.RankSevenWeightSixteenPatternClass) : ℝ
Character sum over the distinct words in one canonical rank-seven pattern orbit.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightSixteen/OrbitAggregation.leancomplete
theorem CryptBoolean.rankSevenWeightSixteenPatternOrbitCharacterSum_ge {n : ℕ} (f : CryptBoolean.BooleanFunction n) (c : CryptBoolean.RankSevenWeightSixteenPatternClass) : CryptBoolean.rankSevenWeightSixteenPatternOrbitCharacterSum f c ≥ -(127 * (2 ^ n) ^ 7)
theorem CryptBoolean.rankSevenWeightSixteenPatternOrbitCharacterSum_ge {n : ℕ} (f : CryptBoolean.BooleanFunction n) (c : CryptBoolean.RankSevenWeightSixteenPatternClass) : CryptBoolean.rankSevenWeightSixteenPatternOrbitCharacterSum f c ≥ -(127 * (2 ^ n) ^ 7)
Each distinct canonical rank-seven word orbit inherits the same `-127 q⁷` lower bound as its injective affine-map sum; the unknown positive automorphism multiplicity need not be computed.
The 2E_8 sum is a square, the D_{16}^{+} sum is a
sum of squares after a fourfold convolution, and the F_{16} sum is a
nonnegative four-cycle trace. Splitting the complete sum into injective and
rank-deficient maps loses at most 127(2^n)^7, since every character product
is at most one. Postcomposition by affine automorphisms identifies the fibers
over distinct injective images and gives them one common positive cardinality;
division by this cardinality yields the orbit bound. This is the repaired
orbit-level substitute for the overextended disjoint-three-flat step in
Carlet and Mesnager (2007).
-
CryptBoolean.sevenVariableAffineMaskWord[complete] -
CryptBoolean.rankDeficientSevenVariableAffineMaskImageWords[complete] -
CryptBoolean.card_rankDeficientSevenVariableAffineMaskImageWords_le[complete] -
CryptBoolean.HasRankAtMostSixWeightSixteenDeficientAffineMaskCover[complete] -
CryptBoolean.hasRankAtMostSixWeightSixteenDeficientAffineMaskCover[complete] -
CryptBoolean.orderTwoWeightSixteenRankAtMostSixResidualWords_subset_affineMaskImage_of_cover[complete] -
CryptBoolean.card_orderTwoWeightSixteenRankAtMostSixResidualWords_le[complete] -
CryptBoolean.orderTwoWeightSixteenRankAtMostSixResidualCharacterSum[complete] -
CryptBoolean.orderTwoWeightSixteenRankAtMostSixResidualCharacterSum_ge[complete]
Rank-at-most-six residual cover. For n\ge3, every
weight-sixteen word of R(n-3,n) whose support-affine-span dimension is at
most six is the image of an arbitrary mask on V_7 under a rank-deficient
affine map V_7\to V_n. Hence the residual family has cardinality at most
127\cdot2^{128}(2^n)^7,
and its character sum is at least the negative of this quantity.
Lean code for Lemma3.3.16●9 declarations
Associated Lean declarations
-
CryptBoolean.sevenVariableAffineMaskWord[complete]
-
CryptBoolean.rankDeficientSevenVariableAffineMaskImageWords[complete]
-
CryptBoolean.card_rankDeficientSevenVariableAffineMaskImageWords_le[complete]
-
CryptBoolean.HasRankAtMostSixWeightSixteenDeficientAffineMaskCover[complete]
-
CryptBoolean.hasRankAtMostSixWeightSixteenDeficientAffineMaskCover[complete]
-
CryptBoolean.orderTwoWeightSixteenRankAtMostSixResidualWords_subset_affineMaskImage_of_cover[complete]
-
CryptBoolean.card_orderTwoWeightSixteenRankAtMostSixResidualWords_le[complete]
-
CryptBoolean.orderTwoWeightSixteenRankAtMostSixResidualCharacterSum[complete]
-
CryptBoolean.orderTwoWeightSixteenRankAtMostSixResidualCharacterSum_ge[complete]
-
CryptBoolean.sevenVariableAffineMaskWord[complete] -
CryptBoolean.rankDeficientSevenVariableAffineMaskImageWords[complete] -
CryptBoolean.card_rankDeficientSevenVariableAffineMaskImageWords_le[complete] -
CryptBoolean.HasRankAtMostSixWeightSixteenDeficientAffineMaskCover[complete] -
CryptBoolean.hasRankAtMostSixWeightSixteenDeficientAffineMaskCover[complete] -
CryptBoolean.orderTwoWeightSixteenRankAtMostSixResidualWords_subset_affineMaskImage_of_cover[complete] -
CryptBoolean.card_orderTwoWeightSixteenRankAtMostSixResidualWords_le[complete] -
CryptBoolean.orderTwoWeightSixteenRankAtMostSixResidualCharacterSum[complete] -
CryptBoolean.orderTwoWeightSixteenRankAtMostSixResidualCharacterSum_ge[complete]
-
defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightSixteen/OrbitAggregation.leancomplete
def CryptBoolean.sevenVariableAffineMaskWord {n : ℕ} (d : CryptBoolean.SevenVariableAffineMapData n) (m : Finset (FABL.F₂Cube 7)) : CryptBoolean.BooleanFunction n
def CryptBoolean.sevenVariableAffineMaskWord {n : ℕ} (d : CryptBoolean.SevenVariableAffineMapData n) (m : Finset (FABL.F₂Cube 7)) : CryptBoolean.BooleanFunction n
The Boolean word whose support is the image of an arbitrary mask under a seven-variable affine map.
-
defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightSixteen/OrbitAggregation.leancomplete
def CryptBoolean.rankDeficientSevenVariableAffineMaskImageWords (n : ℕ) : Finset (CryptBoolean.BooleanFunction n)
def CryptBoolean.rankDeficientSevenVariableAffineMaskImageWords (n : ℕ) : Finset (CryptBoolean.BooleanFunction n)
Every word produced by rank-deficient affine data and an arbitrary seven-variable mask.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightSixteen/OrbitAggregation.leancomplete
theorem CryptBoolean.card_rankDeficientSevenVariableAffineMaskImageWords_le (n : ℕ) : (CryptBoolean.rankDeficientSevenVariableAffineMaskImageWords n).card ≤ 127 * 2 ^ 128 * (2 ^ n) ^ 7
theorem CryptBoolean.card_rankDeficientSevenVariableAffineMaskImageWords_le (n : ℕ) : (CryptBoolean.rankDeficientSevenVariableAffineMaskImageWords n).card ≤ 127 * 2 ^ 128 * (2 ^ n) ^ 7
Arbitrary-mask images of rank-deficient affine maps contribute at most `127 · 2^128 · q⁷` distinct words.
-
defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightSixteen/OrbitAggregation.leancomplete
def CryptBoolean.HasRankAtMostSixWeightSixteenDeficientAffineMaskCover (n : ℕ) : Prop
def CryptBoolean.HasRankAtMostSixWeightSixteenDeficientAffineMaskCover (n : ℕ) : Prop
Minimal low-rank covering interface: every residual word is an arbitrary mask image of one rank-deficient seven-variable affine map.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightSixteen/OrbitAggregation.leancomplete
theorem CryptBoolean.hasRankAtMostSixWeightSixteenDeficientAffineMaskCover {n : ℕ} (hn : 3 ≤ n) : CryptBoolean.HasRankAtMostSixWeightSixteenDeficientAffineMaskCover n
theorem CryptBoolean.hasRankAtMostSixWeightSixteenDeficientAffineMaskCover {n : ℕ} (hn : 3 ≤ n) : CryptBoolean.HasRankAtMostSixWeightSixteenDeficientAffineMaskCover n
Every rank-at-most-six residual word has an arbitrary-mask rank-deficient affine representation.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightSixteen/OrbitAggregation.leancomplete
theorem CryptBoolean.orderTwoWeightSixteenRankAtMostSixResidualWords_subset_affineMaskImage_of_cover {n : ℕ} (hcover : CryptBoolean.HasRankAtMostSixWeightSixteenDeficientAffineMaskCover n) : CryptBoolean.orderTwoWeightSixteenRankAtMostSixResidualWords n ⊆ CryptBoolean.rankDeficientSevenVariableAffineMaskImageWords n
theorem CryptBoolean.orderTwoWeightSixteenRankAtMostSixResidualWords_subset_affineMaskImage_of_cover {n : ℕ} (hcover : CryptBoolean.HasRankAtMostSixWeightSixteenDeficientAffineMaskCover n) : CryptBoolean.orderTwoWeightSixteenRankAtMostSixResidualWords n ⊆ CryptBoolean.rankDeficientSevenVariableAffineMaskImageWords n
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightSixteen/OrbitAggregation.leancomplete
theorem CryptBoolean.card_orderTwoWeightSixteenRankAtMostSixResidualWords_le {n : ℕ} (hn : 3 ≤ n) : (CryptBoolean.orderTwoWeightSixteenRankAtMostSixResidualWords n).card ≤ 127 * 2 ^ 128 * (2 ^ n) ^ 7
theorem CryptBoolean.card_orderTwoWeightSixteenRankAtMostSixResidualWords_le {n : ℕ} (hn : 3 ≤ n) : (CryptBoolean.orderTwoWeightSixteenRankAtMostSixResidualWords n).card ≤ 127 * 2 ^ 128 * (2 ^ n) ^ 7
Unconditional low-rank residual count obtained from support-affine-span parameterization.
-
defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightSixteen/OrbitAggregation.leancomplete
def CryptBoolean.orderTwoWeightSixteenRankAtMostSixResidualCharacterSum {n : ℕ} (f : CryptBoolean.BooleanFunction n) : ℝ
def CryptBoolean.orderTwoWeightSixteenRankAtMostSixResidualCharacterSum {n : ℕ} (f : CryptBoolean.BooleanFunction n) : ℝ
Character sum over the complementary rank-at-most-six residual words.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightSixteen/OrbitAggregation.leancomplete
theorem CryptBoolean.orderTwoWeightSixteenRankAtMostSixResidualCharacterSum_ge {n : ℕ} (f : CryptBoolean.BooleanFunction n) (hcover : CryptBoolean.HasRankAtMostSixWeightSixteenDeficientAffineMaskCover n) : CryptBoolean.orderTwoWeightSixteenRankAtMostSixResidualCharacterSum f ≥ -(127 * 2 ^ 128 * (2 ^ n) ^ 7)
theorem CryptBoolean.orderTwoWeightSixteenRankAtMostSixResidualCharacterSum_ge {n : ℕ} (f : CryptBoolean.BooleanFunction n) (hcover : CryptBoolean.HasRankAtMostSixWeightSixteenDeficientAffineMaskCover n) : CryptBoolean.orderTwoWeightSixteenRankAtMostSixResidualCharacterSum f ≥ -(127 * 2 ^ 128 * (2 ^ n) ^ 7)
The covered rank-at-most-six residual character sum loses at most its `127 · 2^128 · q⁷` arbitrary-mask cardinality bound.
A padded basis of the support-difference span supplies
the rank-deficient affine map, while the inverse image of the support supplies
the mask. There are at most 127(2^n)^7 such affine maps and exactly
2^{128} masks; taking images cannot increase cardinality, and a sum of
\{-1,1\} characters is bounded below by minus the number of words. This
deliberately coarse cover handles the weight-sixteen words missed by the
non-minimal disjoint-flat classification of
Borissov et al. (2003); the existence of minimal
weight-sixteen words is documented by Borissov and Manev (2004).
Aggregate weight-sixteen character bound. For n\ge3
and every f:V_n\to\mathbb F_2,
M_{16}(f)=
\sum_{\substack{h\in R(n-3,n)\\\operatorname{wt}(h)=16}}
(-1)^{\langle f,h\rangle}
\ge-\bigl(3\cdot127+127\cdot2^{128}\bigr)(2^n)^7.
Lean code for Lemma3.3.17●1 theorem
Associated Lean declarations
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightSixteen/RankSevenClassification.leancomplete
theorem CryptBoolean.orderTwoWeightSixteenCharacterSum_ge_rankSevenClassification {n : ℕ} (f : CryptBoolean.BooleanFunction n) (hn : 3 ≤ n) : CryptBoolean.orderTwoWeightSixteenCharacterSum f ≥ -((3 * 127 + 127 * 2 ^ 128) * (2 ^ n) ^ 7)
theorem CryptBoolean.orderTwoWeightSixteenCharacterSum_ge_rankSevenClassification {n : ℕ} (f : CryptBoolean.BooleanFunction n) (hn : 3 ≤ n) : CryptBoolean.orderTwoWeightSixteenCharacterSum f ≥ -((3 * 127 + 127 * 2 ^ 128) * (2 ^ n) ^ 7)
The complete weight-sixteen dual character sum has a uniform seventh-power lower bound.
The rank-seven classification and the low-rank cover partition the weight-sixteen words into the three canonical affine orbits and the rank-at-most-six residual family. The orbit estimates and the residual cardinality estimate then add without requiring a universal disjoint-flat representation.
-
CryptBoolean.tuplePointParityMomentDifference_zero_ge[complete] -
CryptBoolean.tuplePointParityMomentDifference_eight_bounds[complete] -
CryptBoolean.tuplePointParityMomentDifference_twelve_bounds[complete] -
CryptBoolean.tuplePointParityMomentDifference_fourteen_bounds[complete] -
CryptBoolean.tuplePointParityMomentDifference_sixteen_bounds[complete] -
CryptBoolean.orderTwoCorrelationPowerSum_difference_eq_lowWeights[complete] -
CryptBoolean.orderTwoCorrelationPowerSum_difference_ge_of_weightSixteenCharacterSum[complete]
Seventh/eighth moment-difference estimate. Put q=2^n.
For n\ge7, the exact dual-weight decomposition gives
S_8(f)-15qS_7(f)
=|R(2,n)|\sum_{w\in\{0,8,12,14,16\}}
\Delta_w(n)M_w(f),
where \Delta_w(n)=N_8(w)-15qN_7(w). If
M_{16}(f)\ge-Bq^7 with B\ge0, then
S_8(f)-15qS_7(f)
\ge-\bigl(133000020000000+21000000000000B\bigr)
|R(2,n)|q^7.
Lean code for Lemma3.3.18●7 theorems
Associated Lean declarations
-
CryptBoolean.tuplePointParityMomentDifference_zero_ge[complete]
-
CryptBoolean.tuplePointParityMomentDifference_eight_bounds[complete]
-
CryptBoolean.tuplePointParityMomentDifference_twelve_bounds[complete]
-
CryptBoolean.tuplePointParityMomentDifference_fourteen_bounds[complete]
-
CryptBoolean.tuplePointParityMomentDifference_sixteen_bounds[complete]
-
CryptBoolean.orderTwoCorrelationPowerSum_difference_eq_lowWeights[complete]
-
CryptBoolean.orderTwoCorrelationPowerSum_difference_ge_of_weightSixteenCharacterSum[complete]
-
CryptBoolean.tuplePointParityMomentDifference_zero_ge[complete] -
CryptBoolean.tuplePointParityMomentDifference_eight_bounds[complete] -
CryptBoolean.tuplePointParityMomentDifference_twelve_bounds[complete] -
CryptBoolean.tuplePointParityMomentDifference_fourteen_bounds[complete] -
CryptBoolean.tuplePointParityMomentDifference_sixteen_bounds[complete] -
CryptBoolean.orderTwoCorrelationPowerSum_difference_eq_lowWeights[complete] -
CryptBoolean.orderTwoCorrelationPowerSum_difference_ge_of_weightSixteenCharacterSum[complete]
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderTupleCountDifferences.leancomplete
theorem CryptBoolean.tuplePointParityMomentDifference_zero_ge (n : ℕ) (hn : 7 ≤ n) : CryptBoolean.tuplePointParityMomentDifference n 0 ≥ -20000000 * (2 ^ n) ^ 7
theorem CryptBoolean.tuplePointParityMomentDifference_zero_ge (n : ℕ) (hn : 7 ≤ n) : CryptBoolean.tuplePointParityMomentDifference n 0 ≥ -20000000 * (2 ^ n) ^ 7
The null-word coefficient has magnitude `O((2^n)^7)` in the direction needed for the lower moment bound.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderTupleCountDifferences.leancomplete
theorem CryptBoolean.tuplePointParityMomentDifference_eight_bounds (n : ℕ) (hn : 7 ≤ n) : 0 ≤ CryptBoolean.tuplePointParityMomentDifference n 8 ∧ CryptBoolean.tuplePointParityMomentDifference n 8 ≤ 120000000000000 * (2 ^ n) ^ 4
theorem CryptBoolean.tuplePointParityMomentDifference_eight_bounds (n : ℕ) (hn : 7 ≤ n) : 0 ≤ CryptBoolean.tuplePointParityMomentDifference n 8 ∧ CryptBoolean.tuplePointParityMomentDifference n 8 ≤ 120000000000000 * (2 ^ n) ^ 4
The weight-eight coefficient is nonnegative and at most a fixed multiple of `(2^n)^4`.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderTupleCountDifferences.leancomplete
theorem CryptBoolean.tuplePointParityMomentDifference_twelve_bounds (n : ℕ) (hn : 7 ≤ n) : 0 ≤ CryptBoolean.tuplePointParityMomentDifference n 12 ∧ CryptBoolean.tuplePointParityMomentDifference n 12 ≤ 3000000000000 * (2 ^ n) ^ 2
theorem CryptBoolean.tuplePointParityMomentDifference_twelve_bounds (n : ℕ) (hn : 7 ≤ n) : 0 ≤ CryptBoolean.tuplePointParityMomentDifference n 12 ∧ CryptBoolean.tuplePointParityMomentDifference n 12 ≤ 3000000000000 * (2 ^ n) ^ 2
The weight-twelve coefficient is nonnegative and at most a fixed multiple of `(2^n)^2`.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderTupleCountDifferences.leancomplete
theorem CryptBoolean.tuplePointParityMomentDifference_fourteen_bounds (n : ℕ) (hn : 7 ≤ n) : 0 ≤ CryptBoolean.tuplePointParityMomentDifference n 14 ∧ CryptBoolean.tuplePointParityMomentDifference n 14 ≤ 10000000000000 * 2 ^ n
theorem CryptBoolean.tuplePointParityMomentDifference_fourteen_bounds (n : ℕ) (hn : 7 ≤ n) : 0 ≤ CryptBoolean.tuplePointParityMomentDifference n 14 ∧ CryptBoolean.tuplePointParityMomentDifference n 14 ≤ 10000000000000 * 2 ^ n
The weight-fourteen coefficient is nonnegative and at most a fixed multiple of `2^n`.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderTupleCountDifferences.leancomplete
theorem CryptBoolean.tuplePointParityMomentDifference_sixteen_bounds (n : ℕ) (hn : 7 ≤ n) : 0 ≤ CryptBoolean.tuplePointParityMomentDifference n 16 ∧ CryptBoolean.tuplePointParityMomentDifference n 16 ≤ 21000000000000
theorem CryptBoolean.tuplePointParityMomentDifference_sixteen_bounds (n : ℕ) (hn : 7 ≤ n) : 0 ≤ CryptBoolean.tuplePointParityMomentDifference n 16 ∧ CryptBoolean.tuplePointParityMomentDifference n 16 ≤ 21000000000000
The weight-sixteen coefficient is positive and bounded by a fixed constant.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoMomentDifference.leancomplete
theorem CryptBoolean.orderTwoCorrelationPowerSum_difference_eq_lowWeights {n : ℕ} (f : CryptBoolean.BooleanFunction n) (hn : 7 ≤ n) : CryptBoolean.orderTwoCorrelationPowerSum 8 f - 15 * 2 ^ n * CryptBoolean.orderTwoCorrelationPowerSum 7 f = ↑(Nat.card ↥(CryptBoolean.reedMuller 2 n)) * (CryptBoolean.tuplePointParityMomentDifference n 0 + CryptBoolean.tuplePointParityMomentDifference n 8 * CryptBoolean.orderTwoWeightEightCharacterSum f + CryptBoolean.tuplePointParityMomentDifference n 12 * CryptBoolean.orderTwoWeightTwelveCharacterSum f + CryptBoolean.tuplePointParityMomentDifference n 14 * CryptBoolean.orderTwoWeightFourteenCharacterSum f + CryptBoolean.tuplePointParityMomentDifference n 16 * CryptBoolean.orderTwoWeightSixteenCharacterSum f)
theorem CryptBoolean.orderTwoCorrelationPowerSum_difference_eq_lowWeights {n : ℕ} (f : CryptBoolean.BooleanFunction n) (hn : 7 ≤ n) : CryptBoolean.orderTwoCorrelationPowerSum 8 f - 15 * 2 ^ n * CryptBoolean.orderTwoCorrelationPowerSum 7 f = ↑(Nat.card ↥(CryptBoolean.reedMuller 2 n)) * (CryptBoolean.tuplePointParityMomentDifference n 0 + CryptBoolean.tuplePointParityMomentDifference n 8 * CryptBoolean.orderTwoWeightEightCharacterSum f + CryptBoolean.tuplePointParityMomentDifference n 12 * CryptBoolean.orderTwoWeightTwelveCharacterSum f + CryptBoolean.tuplePointParityMomentDifference n 14 * CryptBoolean.orderTwoWeightFourteenCharacterSum f + CryptBoolean.tuplePointParityMomentDifference n 16 * CryptBoolean.orderTwoWeightSixteenCharacterSum f)
The correlation-power difference is the common code cardinality times the low-weight coefficient sum.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoMomentDifference.leancomplete
theorem CryptBoolean.orderTwoCorrelationPowerSum_difference_ge_of_weightSixteenCharacterSum {n : ℕ} (f : CryptBoolean.BooleanFunction n) (hn : 7 ≤ n) (hweightTwelve : CryptBoolean.HasWeightTwelveFlatPairClassification n) (hweightFourteen : CryptBoolean.HasWeightFourteenFlatPairClassification n) (B : ℝ) (hB : 0 ≤ B) (hweightSixteen : -B * (2 ^ n) ^ 7 ≤ CryptBoolean.orderTwoWeightSixteenCharacterSum f) : CryptBoolean.orderTwoCorrelationPowerSum 8 f - 15 * 2 ^ n * CryptBoolean.orderTwoCorrelationPowerSum 7 f ≥ -(133000020000000 + 21000000000000 * B) * (↑(Nat.card ↥(CryptBoolean.reedMuller 2 n)) * (2 ^ n) ^ 7)
theorem CryptBoolean.orderTwoCorrelationPowerSum_difference_ge_of_weightSixteenCharacterSum {n : ℕ} (f : CryptBoolean.BooleanFunction n) (hn : 7 ≤ n) (hweightTwelve : CryptBoolean.HasWeightTwelveFlatPairClassification n) (hweightFourteen : CryptBoolean.HasWeightFourteenFlatPairClassification n) (B : ℝ) (hB : 0 ≤ B) (hweightSixteen : -B * (2 ^ n) ^ 7 ≤ CryptBoolean.orderTwoWeightSixteenCharacterSum f) : CryptBoolean.orderTwoCorrelationPowerSum 8 f - 15 * 2 ^ n * CryptBoolean.orderTwoCorrelationPowerSum 7 f ≥ -(133000020000000 + 21000000000000 * B) * (↑(Nat.card ↥(CryptBoolean.reedMuller 2 n)) * (2 ^ n) ^ 7)
A dimension-independent `q⁷` lower bound for the weight-sixteen character sum gives a code-cardinality-scaled seventh/eighth moment remainder.
Exact tuple-count polynomials provide one-sided bounds
for the five coefficients \Delta_w; the weight-eight, twelve, and fourteen
sum estimates control the corresponding terms, leaving only the parameter
B for weight sixteen. This is the quantitative meeting point of
the finite classification and moment branches.
-
CryptBoolean.reedMuller_card_mul_two_pow_seven_le_orderTwoCorrelationPowerSum_seven[complete] -
CryptBoolean.orderTwoCorrelationPowerSum_eight_div_seven_ge_of_card_scaled[complete] -
CryptBoolean.sqrt_fifteen_mul_sqrtTwo_pow_sub_sqrt_le_momentRatio[complete] -
CryptBoolean.maximumHigherOrderNonlinearity_two_cast_le_of_card_scaled_moment_difference[complete] -
CryptBoolean.eventually_maximumHigherOrderNonlinearity_two_cast_le_of_card_scaled_moment_difference[complete]
Order-two asymptotic extraction. If some K\ge0
satisfies, for every f:V_n\to\mathbb F_2,
15\cdot2^nS_7(f)-K|R(2,n)|(2^n)^7\le S_8(f),
then
\rho(2,n)\le
2^{n-1}-\frac{\sqrt{15}}2(\sqrt2)^n+\frac{\sqrt K}{2}.
The same implication holds eventually when the moment hypothesis holds
eventually and uniformly in f.
Lean code for Lemma3.3.19●5 theorems
Associated Lean declarations
-
CryptBoolean.reedMuller_card_mul_two_pow_seven_le_orderTwoCorrelationPowerSum_seven[complete]
-
CryptBoolean.orderTwoCorrelationPowerSum_eight_div_seven_ge_of_card_scaled[complete]
-
CryptBoolean.sqrt_fifteen_mul_sqrtTwo_pow_sub_sqrt_le_momentRatio[complete]
-
CryptBoolean.maximumHigherOrderNonlinearity_two_cast_le_of_card_scaled_moment_difference[complete]
-
CryptBoolean.eventually_maximumHigherOrderNonlinearity_two_cast_le_of_card_scaled_moment_difference[complete]
-
CryptBoolean.reedMuller_card_mul_two_pow_seven_le_orderTwoCorrelationPowerSum_seven[complete] -
CryptBoolean.orderTwoCorrelationPowerSum_eight_div_seven_ge_of_card_scaled[complete] -
CryptBoolean.sqrt_fifteen_mul_sqrtTwo_pow_sub_sqrt_le_momentRatio[complete] -
CryptBoolean.maximumHigherOrderNonlinearity_two_cast_le_of_card_scaled_moment_difference[complete] -
CryptBoolean.eventually_maximumHigherOrderNonlinearity_two_cast_le_of_card_scaled_moment_difference[complete]
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoAsymptotics.leancomplete
theorem CryptBoolean.reedMuller_card_mul_two_pow_seven_le_orderTwoCorrelationPowerSum_seven {n : ℕ} (f : CryptBoolean.BooleanFunction n) (hn : 3 ≤ n) : ↑(Nat.card ↥(CryptBoolean.reedMuller 2 n)) * (2 ^ n) ^ 7 ≤ CryptBoolean.orderTwoCorrelationPowerSum 7 f
theorem CryptBoolean.reedMuller_card_mul_two_pow_seven_le_orderTwoCorrelationPowerSum_seven {n : ℕ} (f : CryptBoolean.BooleanFunction n) (hn : 3 ≤ n) : ↑(Nat.card ↥(CryptBoolean.reedMuller 2 n)) * (2 ^ n) ^ 7 ≤ CryptBoolean.orderTwoCorrelationPowerSum 7 f
Jensen's inequality and the exact second moment give the code-cardinality scaled denominator required by the seventh/eighth moment comparison.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoAsymptotics.leancomplete
theorem CryptBoolean.orderTwoCorrelationPowerSum_eight_div_seven_ge_of_card_scaled {n : ℕ} (f : CryptBoolean.BooleanFunction n) (K : ℝ) (hK : 0 ≤ K) (hn : 3 ≤ n) (hdifference : 15 * 2 ^ n * CryptBoolean.orderTwoCorrelationPowerSum 7 f - K * (↑(Nat.card ↥(CryptBoolean.reedMuller 2 n)) * (2 ^ n) ^ 7) ≤ CryptBoolean.orderTwoCorrelationPowerSum 8 f) : 15 * 2 ^ n - K ≤ CryptBoolean.orderTwoCorrelationPowerSum 8 f / CryptBoolean.orderTwoCorrelationPowerSum 7 f
theorem CryptBoolean.orderTwoCorrelationPowerSum_eight_div_seven_ge_of_card_scaled {n : ℕ} (f : CryptBoolean.BooleanFunction n) (K : ℝ) (hK : 0 ≤ K) (hn : 3 ≤ n) (hdifference : 15 * 2 ^ n * CryptBoolean.orderTwoCorrelationPowerSum 7 f - K * (↑(Nat.card ↥(CryptBoolean.reedMuller 2 n)) * (2 ^ n) ^ 7) ≤ CryptBoolean.orderTwoCorrelationPowerSum 8 f) : 15 * 2 ^ n - K ≤ CryptBoolean.orderTwoCorrelationPowerSum 8 f / CryptBoolean.orderTwoCorrelationPowerSum 7 f
The code-cardinality-scaled remainder produced by dual-weight grouping also becomes an additive constant in the seventh/eighth moment quotient.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoAsymptotics.leancomplete
theorem CryptBoolean.sqrt_fifteen_mul_sqrtTwo_pow_sub_sqrt_le_momentRatio {n : ℕ} (f : CryptBoolean.BooleanFunction n) (K : ℝ) (hK : 0 ≤ K) (hratio : 15 * 2 ^ n - K ≤ CryptBoolean.orderTwoCorrelationPowerSum 8 f / CryptBoolean.orderTwoCorrelationPowerSum 7 f) : √15 * √2 ^ n - √K ≤ √(CryptBoolean.orderTwoCorrelationPowerSum 8 f / CryptBoolean.orderTwoCorrelationPowerSum 7 f)
theorem CryptBoolean.sqrt_fifteen_mul_sqrtTwo_pow_sub_sqrt_le_momentRatio {n : ℕ} (f : CryptBoolean.BooleanFunction n) (K : ℝ) (hK : 0 ≤ K) (hratio : 15 * 2 ^ n - K ≤ CryptBoolean.orderTwoCorrelationPowerSum 8 f / CryptBoolean.orderTwoCorrelationPowerSum 7 f) : √15 * √2 ^ n - √K ≤ √(CryptBoolean.orderTwoCorrelationPowerSum 8 f / CryptBoolean.orderTwoCorrelationPowerSum 7 f)
The quotient estimate gives the sharp square-root term with an additive `sqrt K` loss.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoAsymptotics.leancomplete
theorem CryptBoolean.maximumHigherOrderNonlinearity_two_cast_le_of_card_scaled_moment_difference {n : ℕ} (K : ℝ) (hK : 0 ≤ K) (hn : 3 ≤ n) (hdifference : ∀ (f : CryptBoolean.BooleanFunction n), 15 * 2 ^ n * CryptBoolean.orderTwoCorrelationPowerSum 7 f - K * (↑(Nat.card ↥(CryptBoolean.reedMuller 2 n)) * (2 ^ n) ^ 7) ≤ CryptBoolean.orderTwoCorrelationPowerSum 8 f) : ↑(CryptBoolean.maximumHigherOrderNonlinearity 2 n) ≤ 2 ^ n / 2 - √15 / 2 * √2 ^ n + √K / 2
theorem CryptBoolean.maximumHigherOrderNonlinearity_two_cast_le_of_card_scaled_moment_difference {n : ℕ} (K : ℝ) (hK : 0 ≤ K) (hn : 3 ≤ n) (hdifference : ∀ (f : CryptBoolean.BooleanFunction n), 15 * 2 ^ n * CryptBoolean.orderTwoCorrelationPowerSum 7 f - K * (↑(Nat.card ↥(CryptBoolean.reedMuller 2 n)) * (2 ^ n) ^ 7) ≤ CryptBoolean.orderTwoCorrelationPowerSum 8 f) : ↑(CryptBoolean.maximumHigherOrderNonlinearity 2 n) ≤ 2 ^ n / 2 - √15 / 2 * √2 ^ n + √K / 2
A code-cardinality-scaled moment remainder gives the same sharp order-two covering-radius estimate.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoAsymptotics.leancomplete
theorem CryptBoolean.eventually_maximumHigherOrderNonlinearity_two_cast_le_of_card_scaled_moment_difference (K : ℝ) (hK : 0 ≤ K) (hdifference : ∀ᶠ (n : ℕ) in Filter.atTop, ∀ (f : CryptBoolean.BooleanFunction n), 15 * 2 ^ n * CryptBoolean.orderTwoCorrelationPowerSum 7 f - K * (↑(Nat.card ↥(CryptBoolean.reedMuller 2 n)) * (2 ^ n) ^ 7) ≤ CryptBoolean.orderTwoCorrelationPowerSum 8 f) : ∀ᶠ (n : ℕ) in Filter.atTop, ↑(CryptBoolean.maximumHigherOrderNonlinearity 2 n) ≤ 2 ^ n / 2 - √15 / 2 * √2 ^ n + √K / 2
theorem CryptBoolean.eventually_maximumHigherOrderNonlinearity_two_cast_le_of_card_scaled_moment_difference (K : ℝ) (hK : 0 ≤ K) (hdifference : ∀ᶠ (n : ℕ) in Filter.atTop, ∀ (f : CryptBoolean.BooleanFunction n), 15 * 2 ^ n * CryptBoolean.orderTwoCorrelationPowerSum 7 f - K * (↑(Nat.card ↥(CryptBoolean.reedMuller 2 n)) * (2 ^ n) ^ 7) ≤ CryptBoolean.orderTwoCorrelationPowerSum 8 f) : ∀ᶠ (n : ℕ) in Filter.atTop, ↑(CryptBoolean.maximumHigherOrderNonlinearity 2 n) ≤ 2 ^ n / 2 - √15 / 2 * √2 ^ n + √K / 2
Eventual code-cardinality-scaled moment control gives the sharp order-two `O(1)` base.
Jensen's inequality and the exact second moment give
S_7(f)\ge|R(2,n)|(2^n)^7. Division by this denominator, the consecutive
moment-ratio inequality, and one square-root estimate expose the sharp
\sqrt{15}/2 coefficient.
Propagation from order two to fixed order. Suppose there is
K\ge0 such that eventually, uniformly in f:V_n\to\mathbb F_2,
15\cdot2^nS_7(f)-K|R(2,n)|(2^n)^7\le S_8(f).
For every fixed r\ge2, there is D\ge0 such that, for all n\ge r,
\rho(r,n)\le
2^{n-1}-\frac{\sqrt{15}}2(1+\sqrt2)^{r-2}(\sqrt2)^n
+D(n+1)^{r-2}.
Lean code for Lemma3.3.20●1 theorem
Associated Lean declarations
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoAsymptotics.leancomplete
theorem CryptBoolean.exists_maximumHigherOrderNonlinearity_cast_le_of_card_scaled_moment_difference (K : ℝ) (hK : 0 ≤ K) (hdifference : ∀ᶠ (n : ℕ) in Filter.atTop, ∀ (f : CryptBoolean.BooleanFunction n), 15 * 2 ^ n * CryptBoolean.orderTwoCorrelationPowerSum 7 f - K * (↑(Nat.card ↥(CryptBoolean.reedMuller 2 n)) * (2 ^ n) ^ 7) ≤ CryptBoolean.orderTwoCorrelationPowerSum 8 f) (r : ℕ) (hr : 2 ≤ r) : ∃ D, 0 ≤ D ∧ ∀ (n : ℕ), r ≤ n → ↑(CryptBoolean.maximumHigherOrderNonlinearity r n) ≤ 2 ^ n / 2 - √15 / 2 * (1 + √2) ^ (r - 2) * √2 ^ n + D * (↑n + 1) ^ (r - 2)
theorem CryptBoolean.exists_maximumHigherOrderNonlinearity_cast_le_of_card_scaled_moment_difference (K : ℝ) (hK : 0 ≤ K) (hdifference : ∀ᶠ (n : ℕ) in Filter.atTop, ∀ (f : CryptBoolean.BooleanFunction n), 15 * 2 ^ n * CryptBoolean.orderTwoCorrelationPowerSum 7 f - K * (↑(Nat.card ↥(CryptBoolean.reedMuller 2 n)) * (2 ^ n) ^ 7) ≤ CryptBoolean.orderTwoCorrelationPowerSum 8 f) (r : ℕ) (hr : 2 ≤ r) : ∃ D, 0 ≤ D ∧ ∀ (n : ℕ), r ≤ n → ↑(CryptBoolean.maximumHigherOrderNonlinearity r n) ≤ 2 ^ n / 2 - √15 / 2 * (1 + √2) ^ (r - 2) * √2 ^ n + D * (↑n + 1) ^ (r - 2)
A code-cardinality-scaled seventh/eighth moment remainder propagates the sharp Carlet--Mesnager coefficient to every fixed higher order.
The preceding order-two estimate supplies the base case.
Iterating the Plotkin recurrence multiplies the square-root coefficient by
1+\sqrt2 at each order and turns the bounded base remainder into a
polynomial error of degree r-2.
Sharp asymptotic upper bound for higher-order nonlinearity (Carlet, p. 53).
Define
\rho(r,n)=\max_f\operatorname{nl}_r(f). For fixed r\ge2, the cited
asymptotic upper bound is
\rho(r,n)\le
2^{n-1}-\frac{\sqrt{15}}2(1+\sqrt2)^{r-2}2^{n/2}
+O(n^{r-2}).
Lean code for Theorem3.3.21●1 theorem
Associated Lean declarations
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderOrderTwoWeightSixteen/RankSevenClassification.leancomplete
theorem CryptBoolean.exists_maximumHigherOrderNonlinearity_cast_le_sharp (r : ℕ) (hr : 2 ≤ r) : ∃ D, 0 ≤ D ∧ ∀ (n : ℕ), r ≤ n → ↑(CryptBoolean.maximumHigherOrderNonlinearity r n) ≤ 2 ^ n / 2 - √15 / 2 * (1 + √2) ^ (r - 2) * √2 ^ n + D * (↑n + 1) ^ (r - 2)
theorem CryptBoolean.exists_maximumHigherOrderNonlinearity_cast_le_sharp (r : ℕ) (hr : 2 ≤ r) : ∃ D, 0 ≤ D ∧ ∀ (n : ℕ), r ≤ n → ↑(CryptBoolean.maximumHigherOrderNonlinearity r n) ≤ 2 ^ n / 2 - √15 / 2 * (1 + √2) ^ (r - 2) * √2 ^ n + D * (↑n + 1) ^ (r - 2)
Carlet--Mesnager's sharp fixed-order upper bound for higher-order nonlinearity.
The upper constant comes from the Carlet--Mesnager
order-two covering-radius theorem (Carlet and Mesnager, 2007). The
moment ratio reduces the order-two estimate to the seventh/eighth moment
difference; dual-code orthogonality and Krawtchouk inversion reduce that
difference to weights 0,8,12,14,16. At weight sixteen, the
disjoint-three-flat description of
Borissov et al. (2003) covers the non-minimal case. The
minimal words are those exhibited by Borissov and Manev (2004). A
complete alternative is the rank-seven three-orbit classification of
Mesnager and Oblaukhov (2022) together with the rank-at-most-six
affine-mask cover above. Their character estimates feed the moment inequality,
and Plotkin induction propagates the resulting \sqrt{15}/2 coefficient by
the factor 1+\sqrt2 at every increase of order.
-
CryptBoolean.hammingWeight_translate[complete] -
CryptBoolean.hammingWeight_booleanDerivative_le_two_mul[complete] -
CryptBoolean.booleanDerivative_add[complete] -
CryptBoolean.derivative_higherOrderNonlinearity_le_two_mul[complete] -
CryptBoolean.maxDerivativeHigherOrderNonlinearity[complete] -
CryptBoolean.maxDerivativeHigherOrderNonlinearity_le_two_mul[complete] -
CryptBoolean.proposition_13_first_bound[complete] -
CryptBoolean.two_mul_higherOrderNonlinearity_le_two_pow[complete] -
CryptBoolean.autocorrelation_eq_walshTransform_booleanDerivative_zero[complete] -
CryptBoolean.autocorrelation_eq_two_pow_sub_two_derivative_weight[complete] -
CryptBoolean.autocorrelation_le_two_pow_sub_two_higherOrderNonlinearity[complete] -
CryptBoolean.derivativeHigherOrderNonlinearitySum[complete] -
CryptBoolean.higherOrderNonlinearity_gap_sq_le[complete] -
CryptBoolean.proposition_13_second_bound[complete] -
CryptBoolean.proposition_13_second_bound_source_form[complete]
Proposition 13 (Carlet, pp. 54--55). Let 1\le r<n. Then
\operatorname{nl}_r(f)
\ge\frac12\max_{a\in V_n}\operatorname{nl}_{r-1}(D_af)
and
\operatorname{nl}_r(f)
\ge2^{n-1}-\frac12
\sqrt{2^{2n}-2\sum_{a\in V_n}\operatorname{nl}_{r-1}(D_af)}.
Lean code for Proposition3.3.22●15 declarations
Associated Lean declarations
-
CryptBoolean.hammingWeight_translate[complete]
-
CryptBoolean.hammingWeight_booleanDerivative_le_two_mul[complete]
-
CryptBoolean.booleanDerivative_add[complete]
-
CryptBoolean.derivative_higherOrderNonlinearity_le_two_mul[complete]
-
CryptBoolean.maxDerivativeHigherOrderNonlinearity[complete]
-
CryptBoolean.maxDerivativeHigherOrderNonlinearity_le_two_mul[complete]
-
CryptBoolean.proposition_13_first_bound[complete]
-
CryptBoolean.two_mul_higherOrderNonlinearity_le_two_pow[complete]
-
CryptBoolean.autocorrelation_eq_walshTransform_booleanDerivative_zero[complete]
-
CryptBoolean.autocorrelation_eq_two_pow_sub_two_derivative_weight[complete]
-
CryptBoolean.autocorrelation_le_two_pow_sub_two_higherOrderNonlinearity[complete]
-
CryptBoolean.derivativeHigherOrderNonlinearitySum[complete]
-
CryptBoolean.higherOrderNonlinearity_gap_sq_le[complete]
-
CryptBoolean.proposition_13_second_bound[complete]
-
CryptBoolean.proposition_13_second_bound_source_form[complete]
-
CryptBoolean.hammingWeight_translate[complete] -
CryptBoolean.hammingWeight_booleanDerivative_le_two_mul[complete] -
CryptBoolean.booleanDerivative_add[complete] -
CryptBoolean.derivative_higherOrderNonlinearity_le_two_mul[complete] -
CryptBoolean.maxDerivativeHigherOrderNonlinearity[complete] -
CryptBoolean.maxDerivativeHigherOrderNonlinearity_le_two_mul[complete] -
CryptBoolean.proposition_13_first_bound[complete] -
CryptBoolean.two_mul_higherOrderNonlinearity_le_two_pow[complete] -
CryptBoolean.autocorrelation_eq_walshTransform_booleanDerivative_zero[complete] -
CryptBoolean.autocorrelation_eq_two_pow_sub_two_derivative_weight[complete] -
CryptBoolean.autocorrelation_le_two_pow_sub_two_higherOrderNonlinearity[complete] -
CryptBoolean.derivativeHigherOrderNonlinearitySum[complete] -
CryptBoolean.higherOrderNonlinearity_gap_sq_le[complete] -
CryptBoolean.proposition_13_second_bound[complete] -
CryptBoolean.proposition_13_second_bound_source_form[complete]
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderNonlinearity.leancomplete
theorem CryptBoolean.hammingWeight_translate {n : ℕ} (f : CryptBoolean.BooleanFunction n) (a : FABL.F₂Cube n) : (CryptBoolean.hammingWeight fun x => f (x + a)) = CryptBoolean.hammingWeight f
theorem CryptBoolean.hammingWeight_translate {n : ℕ} (f : CryptBoolean.BooleanFunction n) (a : FABL.F₂Cube n) : (CryptBoolean.hammingWeight fun x => f (x + a)) = CryptBoolean.hammingWeight f
Translating the input preserves Hamming weight.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderNonlinearity.leancomplete
theorem CryptBoolean.hammingWeight_booleanDerivative_le_two_mul {n : ℕ} (f : CryptBoolean.BooleanFunction n) (a : FABL.F₂Cube n) : CryptBoolean.hammingWeight (FABL.booleanDerivative f a) ≤ 2 * CryptBoolean.hammingWeight f
theorem CryptBoolean.hammingWeight_booleanDerivative_le_two_mul {n : ℕ} (f : CryptBoolean.BooleanFunction n) (a : FABL.F₂Cube n) : CryptBoolean.hammingWeight (FABL.booleanDerivative f a) ≤ 2 * CryptBoolean.hammingWeight f
The weight of a directional derivative is at most twice the original weight.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderNonlinearity.leancomplete
theorem CryptBoolean.booleanDerivative_add {n : ℕ} (f g : CryptBoolean.BooleanFunction n) (a : FABL.F₂Cube n) : FABL.booleanDerivative (f + g) a = FABL.booleanDerivative f a + FABL.booleanDerivative g a
theorem CryptBoolean.booleanDerivative_add {n : ℕ} (f g : CryptBoolean.BooleanFunction n) (a : FABL.F₂Cube n) : FABL.booleanDerivative (f + g) a = FABL.booleanDerivative f a + FABL.booleanDerivative g a
Directional differentiation distributes over pointwise addition.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderNonlinearity.leancomplete
theorem CryptBoolean.derivative_higherOrderNonlinearity_le_two_mul {n : ℕ} (r : ℕ) (f : CryptBoolean.BooleanFunction n) (a : FABL.F₂Cube n) : CryptBoolean.higherOrderNonlinearity (r - 1) (FABL.booleanDerivative f a) ≤ 2 * CryptBoolean.higherOrderNonlinearity r f
theorem CryptBoolean.derivative_higherOrderNonlinearity_le_two_mul {n : ℕ} (r : ℕ) (f : CryptBoolean.BooleanFunction n) (a : FABL.F₂Cube n) : CryptBoolean.higherOrderNonlinearity (r - 1) (FABL.booleanDerivative f a) ≤ 2 * CryptBoolean.higherOrderNonlinearity r f
Every derivative's order-`r-1` nonlinearity is at most twice the order-`r` nonlinearity of the original function.
-
defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderNonlinearity.leancomplete
def CryptBoolean.maxDerivativeHigherOrderNonlinearity {n : ℕ} (r : ℕ) (f : CryptBoolean.BooleanFunction n) : ℕ
def CryptBoolean.maxDerivativeHigherOrderNonlinearity {n : ℕ} (r : ℕ) (f : CryptBoolean.BooleanFunction n) : ℕ
The largest lower-order nonlinearity among all directional derivatives.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderNonlinearity.leancomplete
theorem CryptBoolean.maxDerivativeHigherOrderNonlinearity_le_two_mul {n : ℕ} (r : ℕ) (f : CryptBoolean.BooleanFunction n) : CryptBoolean.maxDerivativeHigherOrderNonlinearity r f ≤ 2 * CryptBoolean.higherOrderNonlinearity r f
theorem CryptBoolean.maxDerivativeHigherOrderNonlinearity_le_two_mul {n : ℕ} (r : ℕ) (f : CryptBoolean.BooleanFunction n) : CryptBoolean.maxDerivativeHigherOrderNonlinearity r f ≤ 2 * CryptBoolean.higherOrderNonlinearity r f
Division-free form of the first bound in Carlet Proposition 13.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderNonlinearity.leancomplete
theorem CryptBoolean.proposition_13_first_bound {n : ℕ} (r : ℕ) (f : CryptBoolean.BooleanFunction n) : ↑(CryptBoolean.maxDerivativeHigherOrderNonlinearity r f) / 2 ≤ ↑(CryptBoolean.higherOrderNonlinearity r f)
theorem CryptBoolean.proposition_13_first_bound {n : ℕ} (r : ℕ) (f : CryptBoolean.BooleanFunction n) : ↑(CryptBoolean.maxDerivativeHigherOrderNonlinearity r f) / 2 ≤ ↑(CryptBoolean.higherOrderNonlinearity r f)
First recursive lower bound in Carlet Proposition 13.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderNonlinearity.leancomplete
theorem CryptBoolean.two_mul_higherOrderNonlinearity_le_two_pow {n : ℕ} (r : ℕ) (hr : 1 ≤ r) (f : CryptBoolean.BooleanFunction n) : 2 * CryptBoolean.higherOrderNonlinearity r f ≤ 2 ^ n
theorem CryptBoolean.two_mul_higherOrderNonlinearity_le_two_pow {n : ℕ} (r : ℕ) (hr : 1 ≤ r) (f : CryptBoolean.BooleanFunction n) : 2 * CryptBoolean.higherOrderNonlinearity r f ≤ 2 ^ n
For positive order, twice the distance to `R(r,n)` is at most the cube size.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderNonlinearity.leancomplete
theorem CryptBoolean.autocorrelation_eq_walshTransform_booleanDerivative_zero {n : ℕ} (f : CryptBoolean.BooleanFunction n) (a : FABL.F₂Cube n) : CryptBoolean.autocorrelation f a = ↑(CryptBoolean.walshTransform (FABL.booleanDerivative f a) 0)
theorem CryptBoolean.autocorrelation_eq_walshTransform_booleanDerivative_zero {n : ℕ} (f : CryptBoolean.BooleanFunction n) (a : FABL.F₂Cube n) : CryptBoolean.autocorrelation f a = ↑(CryptBoolean.walshTransform (FABL.booleanDerivative f a) 0)
Autocorrelation is the zero-frequency Walsh value of the derivative.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderNonlinearity.leancomplete
theorem CryptBoolean.autocorrelation_eq_two_pow_sub_two_derivative_weight {n : ℕ} (f : CryptBoolean.BooleanFunction n) (a : FABL.F₂Cube n) : CryptBoolean.autocorrelation f a = 2 ^ n - 2 * ↑(CryptBoolean.hammingWeight (FABL.booleanDerivative f a))
theorem CryptBoolean.autocorrelation_eq_two_pow_sub_two_derivative_weight {n : ℕ} (f : CryptBoolean.BooleanFunction n) (a : FABL.F₂Cube n) : CryptBoolean.autocorrelation f a = 2 ^ n - 2 * ↑(CryptBoolean.hammingWeight (FABL.booleanDerivative f a))
Autocorrelation is cube size minus twice the derivative weight.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderNonlinearity.leancomplete
theorem CryptBoolean.autocorrelation_le_two_pow_sub_two_higherOrderNonlinearity {n : ℕ} (r : ℕ) (f g : CryptBoolean.BooleanFunction n) (hg : g ∈ CryptBoolean.reedMuller r n) (a : FABL.F₂Cube n) : CryptBoolean.autocorrelation (f + g) a ≤ 2 ^ n - 2 * ↑(CryptBoolean.higherOrderNonlinearity (r - 1) (FABL.booleanDerivative f a))
theorem CryptBoolean.autocorrelation_le_two_pow_sub_two_higherOrderNonlinearity {n : ℕ} (r : ℕ) (f g : CryptBoolean.BooleanFunction n) (hg : g ∈ CryptBoolean.reedMuller r n) (a : FABL.F₂Cube n) : CryptBoolean.autocorrelation (f + g) a ≤ 2 ^ n - 2 * ↑(CryptBoolean.higherOrderNonlinearity (r - 1) (FABL.booleanDerivative f a))
The derivative of an order-`r` approximant bounds autocorrelation by the derivative's order-`r-1` nonlinearity.
-
defdefined in CryptBoolean/Carlet/Chapter04/HigherOrderNonlinearity.leancomplete
def CryptBoolean.derivativeHigherOrderNonlinearitySum {n : ℕ} (r : ℕ) (f : CryptBoolean.BooleanFunction n) : ℕ
def CryptBoolean.derivativeHigherOrderNonlinearitySum {n : ℕ} (r : ℕ) (f : CryptBoolean.BooleanFunction n) : ℕ
The sum of lower-order nonlinearities of all directional derivatives.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderNonlinearity.leancomplete
theorem CryptBoolean.higherOrderNonlinearity_gap_sq_le {n : ℕ} (r : ℕ) (f : CryptBoolean.BooleanFunction n) : (2 ^ n - 2 * ↑(CryptBoolean.higherOrderNonlinearity r f)) ^ 2 ≤ (2 ^ n) ^ 2 - 2 * ↑(CryptBoolean.derivativeHigherOrderNonlinearitySum r f)
theorem CryptBoolean.higherOrderNonlinearity_gap_sq_le {n : ℕ} (r : ℕ) (f : CryptBoolean.BooleanFunction n) : (2 ^ n - 2 * ↑(CryptBoolean.higherOrderNonlinearity r f)) ^ 2 ≤ (2 ^ n) ^ 2 - 2 * ↑(CryptBoolean.derivativeHigherOrderNonlinearitySum r f)
Squared-correlation form underlying the second bound in Carlet Proposition 13.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderNonlinearity.leancomplete
theorem CryptBoolean.proposition_13_second_bound {n : ℕ} (r : ℕ) (hr : 1 ≤ r) (f : CryptBoolean.BooleanFunction n) : 2 ^ n / 2 - √((2 ^ n) ^ 2 - 2 * ↑(CryptBoolean.derivativeHigherOrderNonlinearitySum r f)) / 2 ≤ ↑(CryptBoolean.higherOrderNonlinearity r f)
theorem CryptBoolean.proposition_13_second_bound {n : ℕ} (r : ℕ) (hr : 1 ≤ r) (f : CryptBoolean.BooleanFunction n) : 2 ^ n / 2 - √((2 ^ n) ^ 2 - 2 * ↑(CryptBoolean.derivativeHigherOrderNonlinearitySum r f)) / 2 ≤ ↑(CryptBoolean.higherOrderNonlinearity r f)
Second recursive lower bound in Carlet Proposition 13.
-
theoremdefined in CryptBoolean/Carlet/Chapter04/HigherOrderNonlinearity.leancomplete
theorem CryptBoolean.proposition_13_second_bound_source_form {n : ℕ} (r : ℕ) (hr : 1 ≤ r) (hrn : r < n) (f : CryptBoolean.BooleanFunction n) : 2 ^ (n - 1) - √(2 ^ (2 * n) - 2 * ↑(CryptBoolean.derivativeHigherOrderNonlinearitySum r f)) / 2 ≤ ↑(CryptBoolean.higherOrderNonlinearity r f)
theorem CryptBoolean.proposition_13_second_bound_source_form {n : ℕ} (r : ℕ) (hr : 1 ≤ r) (hrn : r < n) (f : CryptBoolean.BooleanFunction n) : 2 ^ (n - 1) - √(2 ^ (2 * n) - 2 * ↑(CryptBoolean.derivativeHigherOrderNonlinearitySum r f)) / 2 ≤ ↑(CryptBoolean.higherOrderNonlinearity r f)
Carlet Proposition 13 in the source's `2^(n-1)` and `2^(2n)` notation.