Cryptographic Boolean Functions in Lean

3.6. Linear structures🔗

Definition3.6.1
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
uses 1
Used by 12
Reverse dependency previews
Preview
Proposition 3.6.2
Loading preview
Reverse dependency preview content is loaded from the rendered-fragment cache.
L∃∀N

Linear kernel (Carlet, p. 59). Define \ker_{\mathrm{lin}}(f) =\{e\in V_n:D_ef\text{ is constant}\}. This is an \mathbb F_2-linear subspace of V_n, and its elements are the linear structures of f.

Lean code for Definition3.6.17 declarations
  • defdefined in CryptBoolean/Carlet/Chapter04/LinearStructures.lean
    complete
    def CryptBoolean.IsLinearStructure {n : }
      (f : CryptBoolean.BooleanFunction n) (e : FABL.F₂Cube n) : Prop
    def CryptBoolean.IsLinearStructure {n : }
      (f : CryptBoolean.BooleanFunction n)
      (e : FABL.F₂Cube n) : Prop
    A direction is a linear structure when the corresponding binary derivative is constant. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/LinearStructures.lean
    complete
    theorem CryptBoolean.isLinearStructure_zero {n : }
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.IsLinearStructure f 0
    theorem CryptBoolean.isLinearStructure_zero
      {n : }
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.IsLinearStructure f 0
    The zero direction is a linear structure of every Boolean function. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/LinearStructures.lean
    complete
    theorem CryptBoolean.booleanDerivative_add_direction {n : }
      (f : CryptBoolean.BooleanFunction n) (e d x : FABL.F₂Cube n) :
      FABL.booleanDerivative f (e + d) x =
        FABL.booleanDerivative f e (x + d) + FABL.booleanDerivative f d x
    theorem CryptBoolean.booleanDerivative_add_direction
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (e d x : FABL.F₂Cube n) :
      FABL.booleanDerivative f (e + d) x =
        FABL.booleanDerivative f e (x + d) +
          FABL.booleanDerivative f d x
    The derivative in a sum of directions is the sum of two translated derivatives. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/LinearStructures.lean
    complete
    theorem CryptBoolean.IsLinearStructure.add {n : }
      {f : CryptBoolean.BooleanFunction n} {e d : FABL.F₂Cube n}
      (he : CryptBoolean.IsLinearStructure f e)
      (hd : CryptBoolean.IsLinearStructure f d) :
      CryptBoolean.IsLinearStructure f (e + d)
    theorem CryptBoolean.IsLinearStructure.add {n : }
      {f : CryptBoolean.BooleanFunction n}
      {e d : FABL.F₂Cube n}
      (he :
        CryptBoolean.IsLinearStructure f e)
      (hd :
        CryptBoolean.IsLinearStructure f d) :
      CryptBoolean.IsLinearStructure f (e + d)
    The sum of two linear structures is a linear structure. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/LinearStructures.lean
    complete
    theorem CryptBoolean.IsLinearStructure.smul {n : }
      {f : CryptBoolean.BooleanFunction n} {e : FABL.F₂Cube n}
      (he : CryptBoolean.IsLinearStructure f e) (c : FABL.𝔽₂) :
      CryptBoolean.IsLinearStructure f (c  e)
    theorem CryptBoolean.IsLinearStructure.smul
      {n : }
      {f : CryptBoolean.BooleanFunction n}
      {e : FABL.F₂Cube n}
      (he :
        CryptBoolean.IsLinearStructure f e)
      (c : FABL.𝔽₂) :
      CryptBoolean.IsLinearStructure f (c  e)
    Scalar multiples of linear structures are linear structures. 
  • defdefined in CryptBoolean/Carlet/Chapter04/LinearStructures.lean
    complete
    def CryptBoolean.linearKernel {n : } (f : CryptBoolean.BooleanFunction n) :
      Submodule FABL.𝔽₂ (FABL.F₂Cube n)
    def CryptBoolean.linearKernel {n : }
      (f : CryptBoolean.BooleanFunction n) :
      Submodule FABL.𝔽₂ (FABL.F₂Cube n)
    Carlet's linear kernel, consisting of all linear structures of a Boolean function. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/LinearStructures.lean
    complete
    theorem CryptBoolean.mem_linearKernel {n : }
      (f : CryptBoolean.BooleanFunction n) (e : FABL.F₂Cube n) :
      e  CryptBoolean.linearKernel f  CryptBoolean.IsLinearStructure f e
    theorem CryptBoolean.mem_linearKernel {n : }
      (f : CryptBoolean.BooleanFunction n)
      (e : FABL.F₂Cube n) :
      e  CryptBoolean.linearKernel f 
        CryptBoolean.IsLinearStructure f e
    Membership in the linear kernel is exactly the linear-structure condition. 
Proposition3.6.2
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 2
Statement dependency previews
Preview
Definition 1.4.5
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
Used by 2
Reverse dependency previews
Preview
Corollary 3.6.3
Loading preview
Reverse dependency preview content is loaded from the rendered-fragment cache.
L∃∀N

Proposition 14 (Carlet, p. 59). A function f has a nonzero linear structure if and only if it is linearly equivalent to g(x_1,\ldots,x_{n-1})+\varepsilon x_n. More generally, \dim\ker_{\mathrm{lin}}(f)\ge k if and only if f is linearly equivalent to g(x_1,\ldots,x_{n-k}) +\sum_{i=n-k+1}^{n}\varepsilon_i x_i.

Lean code for Proposition3.6.23 declarations
  • defdefined in CryptBoolean/Carlet/Chapter04/LinearStructureNormalForm.lean
    complete
    def CryptBoolean.HasSeparatedLinearStructureNormalForm {m k : }
      (f : CryptBoolean.BooleanFunction (m + k)) : Prop
    def CryptBoolean.HasSeparatedLinearStructureNormalForm
      {m k : }
      (f :
        CryptBoolean.BooleanFunction
          (m + k)) :
      Prop
    The source-facing separated-coordinate normal form in Carlet Proposition 14. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/LinearStructureNormalForm.lean
    complete
    theorem CryptBoolean.finrank_linearKernel_ge_iff_hasSeparatedLinearStructureNormalForm
      {m k : } (f : CryptBoolean.BooleanFunction (m + k)) :
      k  Module.finrank FABL.𝔽₂ (CryptBoolean.linearKernel f) 
        CryptBoolean.HasSeparatedLinearStructureNormalForm f
    theorem CryptBoolean.finrank_linearKernel_ge_iff_hasSeparatedLinearStructureNormalForm
      {m k : }
      (f :
        CryptBoolean.BooleanFunction
          (m + k)) :
      k 
          Module.finrank FABL.𝔽₂
            (CryptBoolean.linearKernel f) 
        CryptBoolean.HasSeparatedLinearStructureNormalForm
          f
    Carlet Proposition 14, general form: `k` linear-kernel dimensions are exactly `k`
    separated affine coordinates after an invertible linear change of variables. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/LinearStructureNormalForm.lean
    complete
    theorem CryptBoolean.exists_nonzero_linearStructure_iff_exists_single_coordinate_normalForm
      {m : } (f : CryptBoolean.BooleanFunction (m + 1)) :
      (∃ e, e  0  CryptBoolean.IsLinearStructure f e) 
         L g ε,
           (x : FABL.F₂Cube m) (a : FABL.𝔽₂),
            f (L (Fin.append x ![a])) = g x + ε * a
    theorem CryptBoolean.exists_nonzero_linearStructure_iff_exists_single_coordinate_normalForm
      {m : }
      (f :
        CryptBoolean.BooleanFunction
          (m + 1)) :
      (∃ e,
          e  0 
            CryptBoolean.IsLinearStructure f
              e) 
         L g ε,
           (x : FABL.F₂Cube m) (a : FABL.𝔽₂),
            f (L (Fin.append x ![a])) =
              g x + ε * a
    Carlet Proposition 14, one-direction form: a nonzero linear structure is equivalent to
    separating the final coordinate as `g(x₁,…,xₙ₋₁) + ε xₙ`. 

Writing the ambient dimension as m+k expresses exactly the feasible range of Carlet's n-k.

Corollary3.6.3
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 2
Statement dependency previews
Preview
Theorem 3.2.4
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
used by 0L∃∀N

Nonlinearity bound from the linear kernel (Carlet, p. 59). If \dim\ker_{\mathrm{lin}}(f)=k, then \operatorname{nl}(f) \le2^{n-1}-2^{(n+k-2)/2}. In particular, a nonzero linear structure gives \operatorname{nl}(f)\le2^{n-1}-2^{(n-1)/2}.

Lean code for Corollary3.6.32 theorems
  • theoremdefined in CryptBoolean/Carlet/Chapter04/LinearKernelNonlinearity.lean
    complete
    theorem CryptBoolean.nonlinearity_cast_le_of_finrank_linearKernel_eq {m k : }
      (f : CryptBoolean.BooleanFunction (m + k))
      (hker : Module.finrank FABL.𝔽₂ (CryptBoolean.linearKernel f) = k) :
      (CryptBoolean.nonlinearity f) 
        2 ^ ((m + k) - 1) - 2 ^ (((m + k) + k - 2) / 2)
    theorem CryptBoolean.nonlinearity_cast_le_of_finrank_linearKernel_eq
      {m k : }
      (f :
        CryptBoolean.BooleanFunction (m + k))
      (hker :
        Module.finrank FABL.𝔽₂
            (CryptBoolean.linearKernel f) =
          k) :
      (CryptBoolean.nonlinearity f) 
        2 ^ ((m + k) - 1) -
          2 ^ (((m + k) + k - 2) / 2)
    If the linear kernel has dimension `k`, Carlet Relation (36) improves to
    `nl(f) ≤ 2^(n-1) - 2^((n+k-2)/2)` for `n = m + k`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/LinearKernelNonlinearity.lean
    complete
    theorem CryptBoolean.nonlinearity_cast_le_of_exists_nonzero_linearStructure
      {m : } (f : CryptBoolean.BooleanFunction (m + 1))
      (hstructure :  e, e  0  CryptBoolean.IsLinearStructure f e) :
      (CryptBoolean.nonlinearity f) 
        2 ^ ((m + 1) - 1) - 2 ^ (((m + 1) - 1) / 2)
    theorem CryptBoolean.nonlinearity_cast_le_of_exists_nonzero_linearStructure
      {m : }
      (f :
        CryptBoolean.BooleanFunction (m + 1))
      (hstructure :
         e,
          e  0 
            CryptBoolean.IsLinearStructure f
              e) :
      (CryptBoolean.nonlinearity f) 
        2 ^ ((m + 1) - 1) -
          2 ^ (((m + 1) - 1) / 2)
    A nonzero linear structure gives Carlet's bound
    `nl(f) ≤ 2^(n-1) - 2^((n-1)/2)` in dimension `n = m + 1`. 
Theorem3.6.4
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 2
Statement dependency previews
Preview
Corollary 1.8.6
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
Used by 2
Reverse dependency previews
Preview
Theorem 3.2.21
Loading preview
Reverse dependency preview content is loaded from the rendered-fragment cache.
L∃∀N

Hyperplane Walsh--autocorrelation identity (Carlet, pp. 59--60). Let e\ne0, E=\{0,e\}^{\perp}, and a\in V_n. Then \sum_{u\in a+E}W_f(u)^2 =2^{n-1}\left(2^n+(-1)^{a\mathbin\cdot e}\Delta_f(e)\right).

Lean code for Theorem3.6.44 declarations
  • defdefined in CryptBoolean/Carlet/Chapter04/LinearStructureSpectrum.lean
    complete
    def CryptBoolean.walshHyperplane {n : } (e : FABL.F₂Cube n) :
      Submodule FABL.𝔽₂ (FABL.F₂Cube n)
    def CryptBoolean.walshHyperplane {n : }
      (e : FABL.F₂Cube n) :
      Submodule FABL.𝔽₂ (FABL.F₂Cube n)
    The Walsh hyperplane perpendicular to the direction `e`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/LinearStructureSpectrum.lean
    complete
    theorem CryptBoolean.mem_walshHyperplane_iff {n : } (e u : FABL.F₂Cube n) :
      u  CryptBoolean.walshHyperplane e  FABL.f₂DotProduct u e = 0
    theorem CryptBoolean.mem_walshHyperplane_iff
      {n : } (e u : FABL.F₂Cube n) :
      u  CryptBoolean.walshHyperplane e 
        FABL.f₂DotProduct u e = 0
    Membership in the Walsh hyperplane is the vanishing dot-product condition. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/LinearStructureSpectrum.lean
    complete
    theorem CryptBoolean.natCard_walshHyperplane {n : } (e : FABL.F₂Cube n)
      (he : e  0) :
      Nat.card (CryptBoolean.walshHyperplane e) = 2 ^ (n - 1)
    theorem CryptBoolean.natCard_walshHyperplane
      {n : } (e : FABL.F₂Cube n)
      (he : e  0) :
      Nat.card
          (CryptBoolean.walshHyperplane e) =
        2 ^ (n - 1)
    The cardinality of a nondegenerate Walsh hyperplane is `2^(n-1)`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/LinearStructureSpectrum.lean
    complete
    theorem CryptBoolean.sum_walshTransform_sq_hyperplane_coset {n : }
      (f : CryptBoolean.BooleanFunction n) (e a : FABL.F₂Cube n)
      (he : e  0) :
       u, (CryptBoolean.walshTransform f (a + u)) ^ 2 =
        2 ^ (n - 1) *
          (2 ^ n +
            (FABL.vectorWalshCharacter a) e *
              CryptBoolean.autocorrelation f e)
    theorem CryptBoolean.sum_walshTransform_sq_hyperplane_coset
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (e a : FABL.F₂Cube n) (he : e  0) :
       u,
          (CryptBoolean.walshTransform f
                (a + u)) ^
            2 =
        2 ^ (n - 1) *
          (2 ^ n +
            (FABL.vectorWalshCharacter a) e *
              CryptBoolean.autocorrelation f
                e)
    Carlet's hyperplane Walsh--autocorrelation identity: for `e ≠ 0`, the squared raw
    Walsh spectrum on `a + {0,e}ᵖ` has the displayed unnormalized sum. 
Proposition3.6.5
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 3
Statement dependency previews
Preview
Definition 1.7.1
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
used by 0L∃∀N

Proposition 15 (Carlet, p. 60). For e\ne0, one has D_ef=0 if and only if \operatorname{supp}(W_f)\subseteq\{0,e\}^{\perp}, and D_ef=1 if and only if the Walsh support is contained in the other coset of this hyperplane. The latter condition implies that f is balanced. If f is not balanced, it has no nonzero linear structure exactly when its Walsh support has rank n.

Lean code for Proposition3.6.511 declarations
  • defdefined in CryptBoolean/Carlet/Chapter04/LinearStructureSpectrum.lean
    complete
    def CryptBoolean.walshSupport {n : } (f : CryptBoolean.BooleanFunction n) :
      Finset (FABL.F₂Cube n)
    def CryptBoolean.walshSupport {n : }
      (f : CryptBoolean.BooleanFunction n) :
      Finset (FABL.F₂Cube n)
    Carlet's raw Walsh support. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/LinearStructureSpectrum.lean
    complete
    theorem CryptBoolean.mem_walshSupport {n : }
      (f : CryptBoolean.BooleanFunction n) (u : FABL.F₂Cube n) :
      u  CryptBoolean.walshSupport f  CryptBoolean.walshTransform f u  0
    theorem CryptBoolean.mem_walshSupport {n : }
      (f : CryptBoolean.BooleanFunction n)
      (u : FABL.F₂Cube n) :
      u  CryptBoolean.walshSupport f 
        CryptBoolean.walshTransform f u  0
    Membership in Carlet's Walsh support is nonvanishing of the raw integer coefficient. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/LinearStructureSpectrum.lean
    complete
    theorem CryptBoolean.booleanDerivative_eq_zero_iff_walshSupport_subset_hyperplane
      {n : } (f : CryptBoolean.BooleanFunction n) (e : FABL.F₂Cube n)
      (he : e  0) :
      FABL.booleanDerivative f e = 0 
        (CryptBoolean.walshSupport f)  (CryptBoolean.walshHyperplane e)
    theorem CryptBoolean.booleanDerivative_eq_zero_iff_walshSupport_subset_hyperplane
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (e : FABL.F₂Cube n) (he : e  0) :
      FABL.booleanDerivative f e = 0 
        (CryptBoolean.walshSupport f) 
          (CryptBoolean.walshHyperplane e)
    Carlet Proposition 15, null-derivative case: for a nonzero direction, the derivative is
    zero exactly when the raw Walsh support lies in the perpendicular hyperplane. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/LinearStructureSpectrum.lean
    complete
    theorem CryptBoolean.booleanDerivative_eq_one_iff_walshSupport_subset_hyperplane_compl
      {n : } (f : CryptBoolean.BooleanFunction n) (e : FABL.F₂Cube n)
      (he : e  0) :
      FABL.booleanDerivative f e = 1 
        (CryptBoolean.walshSupport f) 
          (↑(CryptBoolean.walshHyperplane e))
    theorem CryptBoolean.booleanDerivative_eq_one_iff_walshSupport_subset_hyperplane_compl
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (e : FABL.F₂Cube n) (he : e  0) :
      FABL.booleanDerivative f e = 1 
        (CryptBoolean.walshSupport f) 
          (↑(CryptBoolean.walshHyperplane e))
    Carlet Proposition 15, one-derivative case: for a nonzero direction, the derivative is
    one exactly when the raw Walsh support lies in the complementary hyperplane coset. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/LinearStructureSpectrum.lean
    complete
    theorem CryptBoolean.isBalanced_of_booleanDerivative_eq_one {n : }
      (f : CryptBoolean.BooleanFunction n) (e : FABL.F₂Cube n)
      (hderivative : FABL.booleanDerivative f e = 1) :
      CryptBoolean.IsBalanced f
    theorem CryptBoolean.isBalanced_of_booleanDerivative_eq_one
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (e : FABL.F₂Cube n)
      (hderivative :
        FABL.booleanDerivative f e = 1) :
      CryptBoolean.IsBalanced f
    A derivative equal to one pairs the inputs of `f` into opposite-valued translates, so `f`
    is balanced. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/LinearStructureSpectrum.lean
    complete
    theorem CryptBoolean.isLinearStructure_iff_booleanDerivative_eq_zero_of_not_balanced
      {n : } (f : CryptBoolean.BooleanFunction n) (e : FABL.F₂Cube n)
      (hf : ¬CryptBoolean.IsBalanced f) :
      CryptBoolean.IsLinearStructure f e  FABL.booleanDerivative f e = 0
    theorem CryptBoolean.isLinearStructure_iff_booleanDerivative_eq_zero_of_not_balanced
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (e : FABL.F₂Cube n)
      (hf : ¬CryptBoolean.IsBalanced f) :
      CryptBoolean.IsLinearStructure f e 
        FABL.booleanDerivative f e = 0
    For a non-balanced function, a direction is a linear structure exactly when its derivative
    is the null function. 
  • defdefined in CryptBoolean/Carlet/Chapter04/LinearStructureSpectrum.lean
    complete
    def CryptBoolean.walshSupportSpan {n : }
      (f : CryptBoolean.BooleanFunction n) :
      Submodule FABL.𝔽₂ (FABL.F₂Cube n)
    def CryptBoolean.walshSupportSpan {n : }
      (f : CryptBoolean.BooleanFunction n) :
      Submodule FABL.𝔽₂ (FABL.F₂Cube n)
    The linear span of the raw Walsh support. 
  • defdefined in CryptBoolean/Carlet/Chapter04/LinearStructureSpectrum.lean
    complete
    def CryptBoolean.walshSupportRank {n : }
      (f : CryptBoolean.BooleanFunction n) : 
    def CryptBoolean.walshSupportRank {n : }
      (f : CryptBoolean.BooleanFunction n) : 
    Carlet's rank of the raw Walsh support. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/LinearStructureSpectrum.lean
    complete
    theorem CryptBoolean.no_nonzero_null_derivative_iff_walshSupportSpan_eq_top
      {n : } (f : CryptBoolean.BooleanFunction n) :
      (∀ (e : FABL.F₂Cube n), e  0  FABL.booleanDerivative f e  0) 
        CryptBoolean.walshSupportSpan f = 
    theorem CryptBoolean.no_nonzero_null_derivative_iff_walshSupportSpan_eq_top
      {n : }
      (f : CryptBoolean.BooleanFunction n) :
      (∀ (e : FABL.F₂Cube n),
          e  0 
            FABL.booleanDerivative f e  0) 
        CryptBoolean.walshSupportSpan f = 
    The Walsh support spans the full cube exactly when no nonzero direction has null
    derivative. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/LinearStructureSpectrum.lean
    complete
    theorem CryptBoolean.walshSupportRank_eq_n_iff {n : }
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.walshSupportRank f = n 
        CryptBoolean.walshSupportSpan f = 
    theorem CryptBoolean.walshSupportRank_eq_n_iff
      {n : }
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.walshSupportRank f = n 
        CryptBoolean.walshSupportSpan f = 
    Full Walsh-support rank is equivalent to spanning the binary cube. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/LinearStructureSpectrum.lean
    complete
    theorem CryptBoolean.no_nonzero_linearStructure_iff_walshSupportRank_eq_n_of_not_balanced
      {n : } (f : CryptBoolean.BooleanFunction n)
      (hf : ¬CryptBoolean.IsBalanced f) :
      (∀ (e : FABL.F₂Cube n), e  0  ¬CryptBoolean.IsLinearStructure f e) 
        CryptBoolean.walshSupportRank f = n
    theorem CryptBoolean.no_nonzero_linearStructure_iff_walshSupportRank_eq_n_of_not_balanced
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hf : ¬CryptBoolean.IsBalanced f) :
      (∀ (e : FABL.F₂Cube n),
          e  0 
            ¬CryptBoolean.IsLinearStructure f
                e) 
        CryptBoolean.walshSupportRank f = n
    Carlet's full-rank consequence of Proposition 15: a non-balanced function has no nonzero
    linear structure exactly when its Walsh support has rank `n`. 
Theorem3.6.6
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 4
Statement dependency previews
Preview
Definition 1.4.3
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
used by 0L∃∀N

Distance to functions with a nonzero linear structure (Carlet, p. 60). For n\ge2, let d_{\mathrm{LS}}(f) be the least Hamming distance from f to such a function. Then d_{\mathrm{LS}}(f) =2^{n-2}-\frac14\max_{e\ne0}|\Delta_f(e)|. Consequently d_{\mathrm{LS}}(f)\le\operatorname{nl}(f) and d_{\mathrm{LS}}(f)\le2^{n-2}; equality in the latter bound holds exactly for bent f.

Lean code for Theorem3.6.610 declarations
  • defdefined in CryptBoolean/Carlet/Chapter04/DistanceToLinearStructures.lean
    complete
    def CryptBoolean.HasNonzeroLinearStructure {n : }
      (g : CryptBoolean.BooleanFunction n) : Prop
    def CryptBoolean.HasNonzeroLinearStructure
      {n : }
      (g : CryptBoolean.BooleanFunction n) :
      Prop
    A Boolean function admits a nonzero linear structure. 
  • defdefined in CryptBoolean/Carlet/Chapter04/DistanceToLinearStructures.lean
    complete
    def CryptBoolean.distanceToLinearStructures {n : }
      (f : CryptBoolean.BooleanFunction n) : 
    def CryptBoolean.distanceToLinearStructures
      {n : }
      (f : CryptBoolean.BooleanFunction n) : 
    The least raw Hamming distance to a Boolean function admitting a nonzero linear structure.
    The zero-dimensional empty-family value is defined to be zero. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/DistanceToLinearStructures.lean
    complete
    theorem CryptBoolean.distanceToLinearStructures_le_hammingDistance {n : }
      (hn : 0 < n) (f g : CryptBoolean.BooleanFunction n)
      (hg : CryptBoolean.HasNonzeroLinearStructure g) :
      CryptBoolean.distanceToLinearStructures f 
        CryptBoolean.hammingDistance f g
    theorem CryptBoolean.distanceToLinearStructures_le_hammingDistance
      {n : } (hn : 0 < n)
      (f g : CryptBoolean.BooleanFunction n)
      (hg :
        CryptBoolean.HasNonzeroLinearStructure
          g) :
      CryptBoolean.distanceToLinearStructures
          f 
        CryptBoolean.hammingDistance f g
    The distance to linear structures is bounded by the distance to every function with a
    nonzero linear structure. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/DistanceToLinearStructures.lean
    complete
    theorem CryptBoolean.exists_hammingDistance_eq_distanceToLinearStructures
      {n : } (hn : 0 < n) (f : CryptBoolean.BooleanFunction n) :
       g,
        CryptBoolean.HasNonzeroLinearStructure g 
          CryptBoolean.hammingDistance f g =
            CryptBoolean.distanceToLinearStructures f
    theorem CryptBoolean.exists_hammingDistance_eq_distanceToLinearStructures
      {n : } (hn : 0 < n)
      (f : CryptBoolean.BooleanFunction n) :
       g,
        CryptBoolean.HasNonzeroLinearStructure
            g 
          CryptBoolean.hammingDistance f g =
            CryptBoolean.distanceToLinearStructures
              f
    The nearest function with a nonzero linear structure exists in every positive dimension. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/DistanceToLinearStructures.lean
    complete
    theorem CryptBoolean.abs_autocorrelation_le_absoluteIndicator {n : }
      (f : CryptBoolean.BooleanFunction n) {e : FABL.F₂Cube n}
      (he : e  0) :
      |CryptBoolean.autocorrelation f e|  CryptBoolean.absoluteIndicator f
    theorem CryptBoolean.abs_autocorrelation_le_absoluteIndicator
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      {e : FABL.F₂Cube n} (he : e  0) :
      |CryptBoolean.autocorrelation f e| 
        CryptBoolean.absoluteIndicator f
    Every nonzero autocorrelation magnitude is bounded by Carlet's absolute indicator. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/DistanceToLinearStructures.lean
    complete
    theorem CryptBoolean.distanceToLinearStructures_cast_eq {n : } (hn : 2  n)
      (f : CryptBoolean.BooleanFunction n) :
      (CryptBoolean.distanceToLinearStructures f) =
        2 ^ n / 4 - CryptBoolean.absoluteIndicator f / 4
    theorem CryptBoolean.distanceToLinearStructures_cast_eq
      {n : } (hn : 2  n)
      (f : CryptBoolean.BooleanFunction n) :
      (CryptBoolean.distanceToLinearStructures
            f) =
        2 ^ n / 4 -
          CryptBoolean.absoluteIndicator f / 4
    Carlet's exact formula for the distance to functions admitting a nonzero linear structure. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/DistanceToLinearStructures.lean
    complete
    theorem CryptBoolean.distanceToLinearStructures_le_nonlinearity {n : }
      (hn : 2  n) (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.distanceToLinearStructures f 
        CryptBoolean.nonlinearity f
    theorem CryptBoolean.distanceToLinearStructures_le_nonlinearity
      {n : } (hn : 2  n)
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.distanceToLinearStructures
          f 
        CryptBoolean.nonlinearity f
    Distance to linear structures is no larger than ordinary nonlinearity. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/DistanceToLinearStructures.lean
    complete
    theorem CryptBoolean.distanceToLinearStructures_le_two_pow {n : } (hn : 2  n)
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.distanceToLinearStructures f  2 ^ (n - 2)
    theorem CryptBoolean.distanceToLinearStructures_le_two_pow
      {n : } (hn : 2  n)
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.distanceToLinearStructures
          f 
        2 ^ (n - 2)
    Every Boolean function is at distance at most `2^(n-2)` from a function with a nonzero
    linear structure. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/DistanceToLinearStructures.lean
    complete
    theorem CryptBoolean.absoluteIndicator_eq_zero_iff_isBent {n : }
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.absoluteIndicator f = 0  CryptBoolean.IsBent f
    theorem CryptBoolean.absoluteIndicator_eq_zero_iff_isBent
      {n : }
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.absoluteIndicator f = 0 
        CryptBoolean.IsBent f
    Vanishing nontrivial autocorrelation is equivalent to bentness. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/DistanceToLinearStructures.lean
    complete
    theorem CryptBoolean.distanceToLinearStructures_eq_two_pow_iff_isBent {n : }
      (hn : 2  n) (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.distanceToLinearStructures f = 2 ^ (n - 2) 
        CryptBoolean.IsBent f
    theorem CryptBoolean.distanceToLinearStructures_eq_two_pow_iff_isBent
      {n : } (hn : 2  n)
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.distanceToLinearStructures
            f =
          2 ^ (n - 2) 
        CryptBoolean.IsBent f
    The universal `2^(n-2)` bound is attained exactly by bent Boolean functions.