Cryptographic Boolean Functions in Lean

3.2. Nonlinearity🔗

Definition3.2.1
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 2
Statement dependency previews
Preview
Definition 1.4.3
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
Used by 13
Reverse dependency previews
Preview
Theorem 3.2.2
Loading preview
Reverse dependency preview content is loaded from the rendered-fragment cache.
L∃∀N

Nonlinearity (Carlet, pp. 49--51). For f:V_n\to\mathbb F_2, define \operatorname{nl}(f) =\min_{a\in V_n,\ b\in\mathbb F_2} d_H\bigl(f,x\mapsto a\mathbin\cdot x+b\bigr).

Lean code for Definition3.2.11 definition
  • defdefined in CryptBoolean/Carlet/Chapter04/Nonlinearity.lean
    complete
    def CryptBoolean.nonlinearity {n : } (f : CryptBoolean.BooleanFunction n) :
      
    def CryptBoolean.nonlinearity {n : }
      (f : CryptBoolean.BooleanFunction n) : 
    The minimum raw Hamming distance from a Boolean function to an affine function. 
Theorem3.2.2
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 2
Statement dependency previews
Preview
Theorem 1.4.6
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
used by 1L∃∀N

Affine invariance of nonlinearity (Carlet, p. 50). If L:V_n\to V_n is an affine automorphism, then every f:V_n\to\mathbb F_2 satisfies \operatorname{nl}(f\circ L)=\operatorname{nl}(f).

Lean code for Theorem3.2.24 theorems
  • theoremdefined in CryptBoolean/Carlet/Chapter04/Nonlinearity.lean
    complete
    theorem CryptBoolean.hammingDistance_comp_affineEquiv {n : }
      (f g : CryptBoolean.BooleanFunction n)
      (L : FABL.F₂Cube n ≃ᵃ[FABL.𝔽₂] FABL.F₂Cube n) :
      CryptBoolean.hammingDistance (f  L) (g  L) =
        CryptBoolean.hammingDistance f g
    theorem CryptBoolean.hammingDistance_comp_affineEquiv
      {n : }
      (f g : CryptBoolean.BooleanFunction n)
      (L :
        FABL.F₂Cube n ≃ᵃ[FABL.𝔽₂]
          FABL.F₂Cube n) :
      CryptBoolean.hammingDistance (f  L)
          (g  L) =
        CryptBoolean.hammingDistance f g
    Hamming distance is invariant under a simultaneous affine reindexing of
    its two arguments. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/Nonlinearity.lean
    complete
    theorem CryptBoolean.exists_affineFunction_comp_affineEquiv {n : }
      (b : FABL.𝔽₂) (a : FABL.F₂Cube n)
      (L : FABL.F₂Cube n ≃ᵃ[FABL.𝔽₂] FABL.F₂Cube n) :
       c d, FABL.affineFunction b a  L = FABL.affineFunction c d
    theorem CryptBoolean.exists_affineFunction_comp_affineEquiv
      {n : } (b : FABL.𝔽₂)
      (a : FABL.F₂Cube n)
      (L :
        FABL.F₂Cube n ≃ᵃ[FABL.𝔽₂]
          FABL.F₂Cube n) :
       c d,
        FABL.affineFunction b a  L =
          FABL.affineFunction c d
    Precomposition of an affine Boolean function by an affine equivalence is
    again affine. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/Nonlinearity.lean
    complete
    theorem CryptBoolean.nonlinearity_comp_affineEquiv_le {n : }
      (f : CryptBoolean.BooleanFunction n)
      (L : FABL.F₂Cube n ≃ᵃ[FABL.𝔽₂] FABL.F₂Cube n) :
      CryptBoolean.nonlinearity (f  L)  CryptBoolean.nonlinearity f
    theorem CryptBoolean.nonlinearity_comp_affineEquiv_le
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (L :
        FABL.F₂Cube n ≃ᵃ[FABL.𝔽₂]
          FABL.F₂Cube n) :
      CryptBoolean.nonlinearity (f  L) 
        CryptBoolean.nonlinearity f
    Affine reindexing cannot increase nonlinearity. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/Nonlinearity.lean
    complete
    theorem CryptBoolean.nonlinearity_comp_affineEquiv {n : }
      (f : CryptBoolean.BooleanFunction n)
      (L : FABL.F₂Cube n ≃ᵃ[FABL.𝔽₂] FABL.F₂Cube n) :
      CryptBoolean.nonlinearity (f  L) = CryptBoolean.nonlinearity f
    theorem CryptBoolean.nonlinearity_comp_affineEquiv
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (L :
        FABL.F₂Cube n ≃ᵃ[FABL.𝔽₂]
          FABL.F₂Cube n) :
      CryptBoolean.nonlinearity (f  L) =
        CryptBoolean.nonlinearity f
    Carlet's nonlinearity is invariant under affine automorphisms of the
    binary cube. 
Theorem3.2.3
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 2
Statement dependency previews
Preview
Definition 1.7.1
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
Used by 30
Reverse dependency previews
Preview
Theorem 3.2.4
Loading preview
Reverse dependency preview content is loaded from the rendered-fragment cache.
L∃∀N

Relation (35) (Carlet, p. 51). For a\in V_n, write \ell_a(x)=a\mathbin\cdot x. Then d_H(f,\ell_a)=2^{n-1}-\frac12W_f(a), \qquad d_H(f,\ell_a+1)=2^{n-1}+\frac12W_f(a), and hence \operatorname{nl}(f) =2^{n-1}-\frac12\max_{a\in V_n}|W_f(a)|.

Lean code for Theorem3.2.310 declarations
  • defdefined in CryptBoolean/Carlet/Chapter04/Nonlinearity.lean
    complete
    def CryptBoolean.maxWalshMagnitude {n : }
      (f : CryptBoolean.BooleanFunction n) : 
    def CryptBoolean.maxWalshMagnitude {n : }
      (f : CryptBoolean.BooleanFunction n) : 
    The largest absolute value in Carlet's unnormalized integer Walsh spectrum. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/Nonlinearity.lean
    complete
    theorem CryptBoolean.hammingDistance_cast_affineFunction {n : }
      (f : CryptBoolean.BooleanFunction n) (b : FABL.𝔽₂)
      (a : FABL.F₂Cube n) :
      (CryptBoolean.hammingDistance f (FABL.affineFunction b a)) =
        2 ^ n *
          FABL.relativeHammingDist (CryptBoolean.realSignView f)
            (FABL.affineSignFunction (FABL.signEncode b) a)
    theorem CryptBoolean.hammingDistance_cast_affineFunction
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (b : FABL.𝔽₂) (a : FABL.F₂Cube n) :
      (CryptBoolean.hammingDistance f
            (FABL.affineFunction b a)) =
        2 ^ n *
          FABL.relativeHammingDist
            (CryptBoolean.realSignView f)
            (FABL.affineSignFunction
              (FABL.signEncode b) a)
    Raw distance from an affine Boolean function is the cube size times the
    relative distance from the corresponding affine sign. 
  • theoremdefined in CryptBoolean/Carlet/Chapter02/Foundations.lean
    complete
    theorem CryptBoolean.bitSignInt_cast (b : FABL.𝔽₂) :
      (CryptBoolean.bitSignInt b) = FABL.binarySign b
    theorem CryptBoolean.bitSignInt_cast
      (b : FABL.𝔽₂) :
      (CryptBoolean.bitSignInt b) =
        FABL.binarySign b
    The real cast of Carlet's integer sign is FABL's additive character. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/Nonlinearity.lean
    complete
    theorem CryptBoolean.hammingDistance_cast_affineFunction_eq {n : }
      (f : CryptBoolean.BooleanFunction n) (b : FABL.𝔽₂)
      (a : FABL.F₂Cube n) :
      (CryptBoolean.hammingDistance f (FABL.affineFunction b a)) =
        2 ^ n / 2 -
          (CryptBoolean.bitSignInt b) *
              (CryptBoolean.walshTransform f a) /
            2
    theorem CryptBoolean.hammingDistance_cast_affineFunction_eq
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (b : FABL.𝔽₂) (a : FABL.F₂Cube n) :
      (CryptBoolean.hammingDistance f
            (FABL.affineFunction b a)) =
        2 ^ n / 2 -
          (CryptBoolean.bitSignInt b) *
              (CryptBoolean.walshTransform f
                  a) /
            2
    Raw distance to an affine function in terms of its signed Walsh coefficient. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/Nonlinearity.lean
    complete
    theorem CryptBoolean.hammingDistance_cast_linearFunction_eq {n : }
      (f : CryptBoolean.BooleanFunction n) (a : FABL.F₂Cube n) :
      (CryptBoolean.hammingDistance f (FABL.affineFunction 0 a)) =
        2 ^ n / 2 - (CryptBoolean.walshTransform f a) / 2
    theorem CryptBoolean.hammingDistance_cast_linearFunction_eq
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (a : FABL.F₂Cube n) :
      (CryptBoolean.hammingDistance f
            (FABL.affineFunction 0 a)) =
        2 ^ n / 2 -
          (CryptBoolean.walshTransform f a) /
            2
    Distance from a linear function is `2^n/2-W_f(a)/2`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/Nonlinearity.lean
    complete
    theorem CryptBoolean.hammingDistance_cast_complementLinearFunction_eq {n : }
      (f : CryptBoolean.BooleanFunction n) (a : FABL.F₂Cube n) :
      (CryptBoolean.hammingDistance f (FABL.affineFunction 1 a)) =
        2 ^ n / 2 + (CryptBoolean.walshTransform f a) / 2
    theorem CryptBoolean.hammingDistance_cast_complementLinearFunction_eq
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (a : FABL.F₂Cube n) :
      (CryptBoolean.hammingDistance f
            (FABL.affineFunction 1 a)) =
        2 ^ n / 2 +
          (CryptBoolean.walshTransform f a) /
            2
    Distance from the complement of a linear function is `2^n/2+W_f(a)/2`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/Nonlinearity.lean
    complete
    theorem CryptBoolean.nonlinearity_cast_eq_distanceToAffineSigns {n : }
      (f : CryptBoolean.BooleanFunction n) :
      (CryptBoolean.nonlinearity f) =
        2 ^ n * FABL.distanceToAffineSigns (CryptBoolean.realSignView f)
    theorem CryptBoolean.nonlinearity_cast_eq_distanceToAffineSigns
      {n : }
      (f : CryptBoolean.BooleanFunction n) :
      (CryptBoolean.nonlinearity f) =
        2 ^ n *
          FABL.distanceToAffineSigns
            (CryptBoolean.realSignView f)
    Carlet's raw nonlinearity is exactly the scaled FABL distance to affine signs. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/Nonlinearity.lean
    complete
    theorem CryptBoolean.maxWalshMagnitude_cast_eq_spectralInfinityNorm {n : }
      (f : CryptBoolean.BooleanFunction n) :
      (CryptBoolean.maxWalshMagnitude f) =
        2 ^ n * FABL.spectralInfinityNorm (CryptBoolean.realSignView f)
    theorem CryptBoolean.maxWalshMagnitude_cast_eq_spectralInfinityNorm
      {n : }
      (f : CryptBoolean.BooleanFunction n) :
      (CryptBoolean.maxWalshMagnitude f) =
        2 ^ n *
          FABL.spectralInfinityNorm
            (CryptBoolean.realSignView f)
    The raw maximum Walsh magnitude is the cube size times FABL's normalized
    spectral infinity norm. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/Nonlinearity.lean
    complete
    theorem CryptBoolean.two_mul_nonlinearity_add_maxWalshMagnitude {n : }
      (f : CryptBoolean.BooleanFunction n) :
      2 * CryptBoolean.nonlinearity f + CryptBoolean.maxWalshMagnitude f =
        2 ^ n
    theorem CryptBoolean.two_mul_nonlinearity_add_maxWalshMagnitude
      {n : }
      (f : CryptBoolean.BooleanFunction n) :
      2 * CryptBoolean.nonlinearity f +
          CryptBoolean.maxWalshMagnitude f =
        2 ^ n
    Division-free form of Carlet's Relation (35). 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/Nonlinearity.lean
    complete
    theorem CryptBoolean.nonlinearity_cast_eq_relation_35 {n : }
      (f : CryptBoolean.BooleanFunction n) :
      (CryptBoolean.nonlinearity f) =
        2 ^ n / 2 - (CryptBoolean.maxWalshMagnitude f) / 2
    theorem CryptBoolean.nonlinearity_cast_eq_relation_35
      {n : }
      (f : CryptBoolean.BooleanFunction n) :
      (CryptBoolean.nonlinearity f) =
        2 ^ n / 2 -
          (CryptBoolean.maxWalshMagnitude
                f) /
            2
    Carlet Relation (35), written over the reals to preserve the factor one half
    in every dimension. 
Theorem3.2.4
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 3
Statement dependency previews
Preview
Theorem 1.7.3
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
Used by 8
Reverse dependency previews
Preview
Lemma 3.2.11
Loading preview
Reverse dependency preview content is loaded from the rendered-fragment cache.
L∃∀N

Covering-radius bound and bent equality (Carlet, Relation (36), p. 51). Every f:V_n\to\mathbb F_2 satisfies \operatorname{nl}(f)\le2^{n-1}-2^{n/2-1}. Equality holds exactly when |W_f(a)|=2^{n/2} for every a\in V_n. Such a function is bent; it can exist only for even n and is not balanced.

Lean code for Theorem3.2.424 declarations
  • theoremdefined in CryptBoolean/Carlet/Chapter04/Nonlinearity.lean
    complete
    theorem CryptBoolean.exists_inv_sqrt_card_le_vectorFourierCoeff_abs {n : }
      {f : FABL.F₂Cube n  } (hf : FABL.IsSignValued f) :
       γ, ((2 ^ n))⁻¹  |FABL.vectorFourierCoeff f γ|
    theorem CryptBoolean.exists_inv_sqrt_card_le_vectorFourierCoeff_abs
      {n : } {f : FABL.F₂Cube n  }
      (hf : FABL.IsSignValued f) :
       γ,
        ((2 ^ n))⁻¹ 
          |FABL.vectorFourierCoeff f γ|
    Some normalized Fourier coefficient of a sign-valued function has
    magnitude at least the reciprocal square root of the cube cardinality. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/Nonlinearity.lean
    complete
    theorem CryptBoolean.spectralInfinityNorm_ge_inv_sqrt_card {n : }
      {f : FABL.F₂Cube n  } (hf : FABL.IsSignValued f) :
      ((2 ^ n))⁻¹  FABL.spectralInfinityNorm f
    theorem CryptBoolean.spectralInfinityNorm_ge_inv_sqrt_card
      {n : } {f : FABL.F₂Cube n  }
      (hf : FABL.IsSignValued f) :
      ((2 ^ n))⁻¹ 
        FABL.spectralInfinityNorm f
    The Fourier infinity norm of a sign-valued function is at least the
    reciprocal square root of the cube cardinality. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/Nonlinearity.lean
    complete
    theorem CryptBoolean.distanceToAffineSigns_le_coveringRadius {n : }
      {f : FABL.F₂Cube n  } (hf : FABL.IsSignValued f) :
      FABL.distanceToAffineSigns f  1 / 2 - ((2 ^ n))⁻¹ / 2
    theorem CryptBoolean.distanceToAffineSigns_le_coveringRadius
      {n : } {f : FABL.F₂Cube n  }
      (hf : FABL.IsSignValued f) :
      FABL.distanceToAffineSigns f 
        1 / 2 - ((2 ^ n))⁻¹ / 2
    No sign-valued function is farther from affine signs than the flat-spectrum
    bound, in arbitrary dimension. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/Nonlinearity.lean
    complete
    theorem CryptBoolean.two_pow_mul_inv_sqrt {n : } :
      2 ^ n * ((2 ^ n))⁻¹ = (2 ^ n)
    theorem CryptBoolean.two_pow_mul_inv_sqrt
      {n : } :
      2 ^ n * ((2 ^ n))⁻¹ = (2 ^ n)
    Multiplying the reciprocal square root of the cube cardinality by the
    cardinality recovers its square root. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/Nonlinearity.lean
    complete
    theorem CryptBoolean.sqrt_two_pow_eq_rpow {n : } : (2 ^ n) = 2 ^ (n / 2)
    theorem CryptBoolean.sqrt_two_pow_eq_rpow
      {n : } : (2 ^ n) = 2 ^ (n / 2)
    The square root of the cube cardinality is `2^(n/2)` with a real
    exponent. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/Nonlinearity.lean
    complete
    theorem CryptBoolean.coveringRadius_eq_relation_36 {n : } :
      2 ^ n / 2 - (2 ^ n) / 2 = 2 ^ (n - 1) - 2 ^ (n / 2 - 1)
    theorem CryptBoolean.coveringRadius_eq_relation_36
      {n : } :
      2 ^ n / 2 - (2 ^ n) / 2 =
        2 ^ (n - 1) - 2 ^ (n / 2 - 1)
    The square-root covering-radius expression is the printed form of
    Carlet's Relation (36). 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/Nonlinearity.lean
    complete
    theorem CryptBoolean.nonlinearity_cast_le_coveringRadius {n : }
      (f : CryptBoolean.BooleanFunction n) :
      (CryptBoolean.nonlinearity f)  2 ^ n / 2 - (2 ^ n) / 2
    theorem CryptBoolean.nonlinearity_cast_le_coveringRadius
      {n : }
      (f : CryptBoolean.BooleanFunction n) :
      (CryptBoolean.nonlinearity f) 
        2 ^ n / 2 - (2 ^ n) / 2
    The raw nonlinearity covering-radius bound in a dimension-zero-safe
    square-root form. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/Nonlinearity.lean
    complete
    theorem CryptBoolean.nonlinearity_cast_le_relation_36 {n : }
      (f : CryptBoolean.BooleanFunction n) :
      (CryptBoolean.nonlinearity f)  2 ^ (n - 1) - 2 ^ (n / 2 - 1)
    theorem CryptBoolean.nonlinearity_cast_le_relation_36
      {n : }
      (f : CryptBoolean.BooleanFunction n) :
      (CryptBoolean.nonlinearity f) 
        2 ^ (n - 1) - 2 ^ (n / 2 - 1)
    Carlet Relation (36): every Boolean function satisfies
    `nl(f) ≤ 2^(n-1) - 2^(n/2-1)`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/Nonlinearity.lean
    complete
    theorem CryptBoolean.vectorFourierCoeff_abs_eq_inv_sqrt_of_spectralInfinityNorm_eq
      {n : } {f : FABL.F₂Cube n  } (hf : FABL.IsSignValued f)
      (hspectral : FABL.spectralInfinityNorm f = ((2 ^ n))⁻¹)
      (γ : FABL.F₂Cube n) : |FABL.vectorFourierCoeff f γ| = ((2 ^ n))⁻¹
    theorem CryptBoolean.vectorFourierCoeff_abs_eq_inv_sqrt_of_spectralInfinityNorm_eq
      {n : } {f : FABL.F₂Cube n  }
      (hf : FABL.IsSignValued f)
      (hspectral :
        FABL.spectralInfinityNorm f =
          ((2 ^ n))⁻¹)
      (γ : FABL.F₂Cube n) :
      |FABL.vectorFourierCoeff f γ| =
        ((2 ^ n))⁻¹
    Equality in the Fourier-infinity lower bound forces every Fourier
    magnitude to equal the reciprocal square root of the cube cardinality. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/Nonlinearity.lean
    complete
    theorem CryptBoolean.spectralInfinityNorm_eq_inv_sqrt_of_forall_abs {n : }
      {f : FABL.F₂Cube n  }
      (hflat :
         (γ : FABL.F₂Cube n),
          |FABL.vectorFourierCoeff f γ| = ((2 ^ n))⁻¹) :
      FABL.spectralInfinityNorm f = ((2 ^ n))⁻¹
    theorem CryptBoolean.spectralInfinityNorm_eq_inv_sqrt_of_forall_abs
      {n : } {f : FABL.F₂Cube n  }
      (hflat :
         (γ : FABL.F₂Cube n),
          |FABL.vectorFourierCoeff f γ| =
            ((2 ^ n))⁻¹) :
      FABL.spectralInfinityNorm f =
        ((2 ^ n))⁻¹
    A flat normalized Fourier spectrum attains the Fourier-infinity lower
    bound. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/Nonlinearity.lean
    complete
    theorem CryptBoolean.distanceToAffineSigns_eq_coveringRadius_iff {n : }
      {f : FABL.F₂Cube n  } (hf : FABL.IsSignValued f) :
      FABL.distanceToAffineSigns f = 1 / 2 - ((2 ^ n))⁻¹ / 2 
         (γ : FABL.F₂Cube n), |FABL.vectorFourierCoeff f γ| = ((2 ^ n))⁻¹
    theorem CryptBoolean.distanceToAffineSigns_eq_coveringRadius_iff
      {n : } {f : FABL.F₂Cube n  }
      (hf : FABL.IsSignValued f) :
      FABL.distanceToAffineSigns f =
          1 / 2 - ((2 ^ n))⁻¹ / 2 
         (γ : FABL.F₂Cube n),
          |FABL.vectorFourierCoeff f γ| =
            ((2 ^ n))⁻¹
    Equality in the normalized covering-radius bound is equivalent to a flat
    normalized Fourier spectrum. 
  • defdefined in CryptBoolean/Carlet/Chapter04/Nonlinearity.lean
    complete
    def CryptBoolean.HasFlatWalshSpectrum {n : }
      (f : CryptBoolean.BooleanFunction n) : Prop
    def CryptBoolean.HasFlatWalshSpectrum {n : }
      (f : CryptBoolean.BooleanFunction n) :
      Prop
    Carlet's flat raw Walsh-spectrum condition. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/Nonlinearity.lean
    complete
    theorem CryptBoolean.hasFlatWalshSpectrum_iff_vectorFourierCoeff {n : }
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.HasFlatWalshSpectrum f 
         (a : FABL.F₂Cube n),
          |FABL.vectorFourierCoeff (CryptBoolean.realSignView f) a| =
            ((2 ^ n))⁻¹
    theorem CryptBoolean.hasFlatWalshSpectrum_iff_vectorFourierCoeff
      {n : }
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.HasFlatWalshSpectrum f 
         (a : FABL.F₂Cube n),
          |FABL.vectorFourierCoeff
                (CryptBoolean.realSignView f)
                a| =
            ((2 ^ n))⁻¹
    Flatness of Carlet's raw Walsh spectrum is equivalent to flatness of
    FABL's normalized vector Fourier spectrum. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/Nonlinearity.lean
    complete
    theorem CryptBoolean.nonlinearity_eq_coveringRadius_iff_flatWalshSpectrum
      {n : } (f : CryptBoolean.BooleanFunction n) :
      (CryptBoolean.nonlinearity f) = 2 ^ n / 2 - (2 ^ n) / 2 
        CryptBoolean.HasFlatWalshSpectrum f
    theorem CryptBoolean.nonlinearity_eq_coveringRadius_iff_flatWalshSpectrum
      {n : }
      (f : CryptBoolean.BooleanFunction n) :
      (CryptBoolean.nonlinearity f) =
          2 ^ n / 2 - (2 ^ n) / 2 
        CryptBoolean.HasFlatWalshSpectrum f
    Equality in the raw covering-radius bound is equivalent to a flat raw
    Walsh spectrum. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/Nonlinearity.lean
    complete
    theorem CryptBoolean.nonlinearity_cast_eq_relation_36_iff_flatWalshSpectrum
      {n : } (f : CryptBoolean.BooleanFunction n) :
      (CryptBoolean.nonlinearity f) = 2 ^ (n - 1) - 2 ^ (n / 2 - 1) 
        CryptBoolean.HasFlatWalshSpectrum f
    theorem CryptBoolean.nonlinearity_cast_eq_relation_36_iff_flatWalshSpectrum
      {n : }
      (f : CryptBoolean.BooleanFunction n) :
      (CryptBoolean.nonlinearity f) =
          2 ^ (n - 1) - 2 ^ (n / 2 - 1) 
        CryptBoolean.HasFlatWalshSpectrum f
    Equality in Carlet's printed Relation (36) is equivalent to a flat raw
    Walsh spectrum. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/Nonlinearity.lean
    complete
    theorem CryptBoolean.even_of_hasFlatWalshSpectrum {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hflat : CryptBoolean.HasFlatWalshSpectrum f) : Even n
    theorem CryptBoolean.even_of_hasFlatWalshSpectrum
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hflat :
        CryptBoolean.HasFlatWalshSpectrum f) :
      Even n
    A flat integer Walsh spectrum can occur only in even dimension. 
  • abbrevdefined in CryptBoolean/Carlet/Chapter04/Nonlinearity.lean
    complete
    abbrev CryptBoolean.IsBent {n : } (f : CryptBoolean.BooleanFunction n) : Prop
    abbrev CryptBoolean.IsBent {n : }
      (f : CryptBoolean.BooleanFunction n) :
      Prop
    A cryptographic Boolean function is bent when its real sign view satisfies
    FABL's canonical bent predicate. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/Nonlinearity.lean
    complete
    theorem CryptBoolean.sqrt_two_pow_eq_pow_half {n : } (hn : Even n) :
      (2 ^ n) = 2 ^ (n / 2)
    theorem CryptBoolean.sqrt_two_pow_eq_pow_half
      {n : } (hn : Even n) :
      (2 ^ n) = 2 ^ (n / 2)
    In even dimension the square root of the cube cardinality is the integer
    power indexed by half the dimension. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/Nonlinearity.lean
    complete
    theorem CryptBoolean.even_of_isBent {n : } (f : CryptBoolean.BooleanFunction n)
      (hf : CryptBoolean.IsBent f) : Even n
    theorem CryptBoolean.even_of_isBent {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hf : CryptBoolean.IsBent f) : Even n
    Every bent Boolean function has even dimension. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/Nonlinearity.lean
    complete
    theorem CryptBoolean.hasFlatWalshSpectrum_iff_isBent {n : }
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.HasFlatWalshSpectrum f  CryptBoolean.IsBent f
    theorem CryptBoolean.hasFlatWalshSpectrum_iff_isBent
      {n : }
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.HasFlatWalshSpectrum f 
        CryptBoolean.IsBent f
    Carlet's raw flat-spectrum characterization is equivalent to FABL
    bentness. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/Nonlinearity.lean
    complete
    theorem CryptBoolean.even_of_exists_isBent {n : }
      (h :  f, CryptBoolean.IsBent f) : Even n
    theorem CryptBoolean.even_of_exists_isBent {n : }
      (h :  f, CryptBoolean.IsBent f) :
      Even n
    Bent Boolean functions can exist only in even dimension. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/Nonlinearity.lean
    complete
    theorem CryptBoolean.not_isBalanced_of_isBent {n : }
      (f : CryptBoolean.BooleanFunction n) (hf : CryptBoolean.IsBent f) :
      ¬CryptBoolean.IsBalanced f
    theorem CryptBoolean.not_isBalanced_of_isBent
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hf : CryptBoolean.IsBent f) :
      ¬CryptBoolean.IsBalanced f
    A bent Boolean function is not balanced. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/Nonlinearity.lean
    complete
    theorem CryptBoolean.isBent_iff_nonlinearity_cast_eq_relation_36_of_even {n : }
      (f : CryptBoolean.BooleanFunction n) (hn : Even n) :
      CryptBoolean.IsBent f 
        (CryptBoolean.nonlinearity f) = 2 ^ (n - 1) - 2 ^ (n / 2 - 1)
    theorem CryptBoolean.isBent_iff_nonlinearity_cast_eq_relation_36_of_even
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hn : Even n) :
      CryptBoolean.IsBent f 
        (CryptBoolean.nonlinearity f) =
          2 ^ (n - 1) - 2 ^ (n / 2 - 1)
    In even dimension, FABL's bent-distance theorem gives Carlet Relation (36) after raw-distance
    normalization. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/Nonlinearity.lean
    complete
    theorem CryptBoolean.nonlinearity_cast_eq_relation_36_iff_isBent {n : }
      (f : CryptBoolean.BooleanFunction n) :
      (CryptBoolean.nonlinearity f) = 2 ^ (n - 1) - 2 ^ (n / 2 - 1) 
        CryptBoolean.IsBent f
    theorem CryptBoolean.nonlinearity_cast_eq_relation_36_iff_isBent
      {n : }
      (f : CryptBoolean.BooleanFunction n) :
      (CryptBoolean.nonlinearity f) =
          2 ^ (n - 1) - 2 ^ (n / 2 - 1) 
        CryptBoolean.IsBent f
    Equality in Carlet Relation (36) holds exactly for bent Boolean
    functions. 
Theorem3.2.5
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
uses 1used by 0L∃∀N

Random-function nonlinearity lower bound (Olejár--Stanek; Carlet, p. 51). As n\to\infty, the uniform probability tends to 1 that f:V_n\to\mathbb F_2 satisfies \operatorname{nl}(f)>2^{n-1}-\sqrt n\,2^{(n-1)/2}.

Lean code for Theorem3.2.515 declarations
  • defdefined in CryptBoolean/Carlet/Chapter04/RandomNonlinearityAsymptotics.lean
    complete
    def CryptBoolean.carletRandomFourierThreshold (n : ) : 
    def CryptBoolean.carletRandomFourierThreshold
      (n : ) : 
    The normalized Fourier threshold corresponding to Carlet's displayed
    nonlinearity threshold. 
  • defdefined in CryptBoolean/Carlet/Chapter04/RandomNonlinearityAsymptotics.lean
    complete
    def CryptBoolean.carletRandomNonlinearityThreshold (n : ) : 
    def CryptBoolean.carletRandomNonlinearityThreshold
      (n : ) : 
    Carlet's displayed lower threshold
    `2^(n-1) - sqrt(n) * 2^((n-1)/2)`, in an algebraically convenient form. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/RandomNonlinearityAsymptotics.lean
    complete
    theorem CryptBoolean.carletRandomNonlinearityThreshold_eq_displayed (n : ) :
      CryptBoolean.carletRandomNonlinearityThreshold n =
        2 ^ (n - 1) - n * 2 ^ ((n - 1) / 2)
    theorem CryptBoolean.carletRandomNonlinearityThreshold_eq_displayed
      (n : ) :
      CryptBoolean.carletRandomNonlinearityThreshold
          n =
        2 ^ (n - 1) -
          n * 2 ^ ((n - 1) / 2)
    The implementation threshold is exactly Carlet's typography
    `2^(n-1) - sqrt(n) * 2^((n-1)/2)`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/RandomNonlinearityAsymptotics.lean
    complete
    theorem CryptBoolean.carletRandomFourierThreshold_nonneg (n : ) :
      0  CryptBoolean.carletRandomFourierThreshold n
    theorem CryptBoolean.carletRandomFourierThreshold_nonneg
      (n : ) :
      0 
        CryptBoolean.carletRandomFourierThreshold
          n
  • theoremdefined in CryptBoolean/Carlet/Chapter04/RandomNonlinearityAsymptotics.lean
    complete
    theorem CryptBoolean.card_mul_carletRandomFourierThreshold_sq_div_two (n : ) :
      (Fintype.card (FABL.SignCube n)) *
            CryptBoolean.carletRandomFourierThreshold n ^ 2 /
          2 =
        n
    theorem CryptBoolean.card_mul_carletRandomFourierThreshold_sq_div_two
      (n : ) :
      (Fintype.card (FABL.SignCube n)) *
            CryptBoolean.carletRandomFourierThreshold
                n ^
              2 /
          2 =
        n
  • theoremdefined in CryptBoolean/Carlet/Chapter04/RandomNonlinearityAsymptotics.lean
    complete
    theorem CryptBoolean.measure_fourierInfinityNorm_ge_carletThreshold_le (n : ) :
      (FABL.uniformPMF (FABL.BooleanFunction n)).toMeasure.real
          {f |
            CryptBoolean.carletRandomFourierThreshold n 
              FABL.fourierInfinityNorm f.toReal} 
        2 ^ n * (2 * Real.exp (-n))
    theorem CryptBoolean.measure_fourierInfinityNorm_ge_carletThreshold_le
      (n : ) :
      (FABL.uniformPMF
                (FABL.BooleanFunction
                  n)).toMeasure.real
          {f |
            CryptBoolean.carletRandomFourierThreshold
                n 
              FABL.fourierInfinityNorm
                f.toReal} 
        2 ^ n * (2 * Real.exp (-n))
    The finite Hoeffding--union-bound estimate at the exact threshold needed by
    Carlet's asymptotic nonlinearity statement. 
  • defdefined in CryptBoolean/Carlet/Chapter04/RandomNonlinearityAsymptotics.lean
    complete
    def CryptBoolean.carletRandomNonlinearityFailureBound (n : ) : 
    def CryptBoolean.carletRandomNonlinearityFailureBound
      (n : ) : 
    The finite failure bound in geometric form. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/RandomNonlinearityAsymptotics.lean
    complete
    theorem CryptBoolean.fourier_union_bound_eq_failureBound (n : ) :
      2 ^ n * (2 * Real.exp (-n)) =
        CryptBoolean.carletRandomNonlinearityFailureBound n
    theorem CryptBoolean.fourier_union_bound_eq_failureBound
      (n : ) :
      2 ^ n * (2 * Real.exp (-n)) =
        CryptBoolean.carletRandomNonlinearityFailureBound
          n
  • theoremdefined in CryptBoolean/Carlet/Chapter04/RandomNonlinearityAsymptotics.lean
    complete
    theorem CryptBoolean.tendsto_carletRandomNonlinearityFailureBound :
      Filter.Tendsto CryptBoolean.carletRandomNonlinearityFailureBound
        Filter.atTop (nhds 0)
    theorem CryptBoolean.tendsto_carletRandomNonlinearityFailureBound :
      Filter.Tendsto
        CryptBoolean.carletRandomNonlinearityFailureBound
        Filter.atTop (nhds 0)
  • theoremdefined in CryptBoolean/Carlet/Chapter04/RandomNonlinearityAsymptotics.lean
    complete
    theorem CryptBoolean.spectralInfinityNorm_encoding_eq_fourierInfinityNorm
      {n : } (g : FABL.BooleanFunction n) :
      FABL.spectralInfinityNorm
          (CryptBoolean.realSignView (FABL.booleanFunctionF₂Encoding g)) =
        FABL.fourierInfinityNorm g.toReal
    theorem CryptBoolean.spectralInfinityNorm_encoding_eq_fourierInfinityNorm
      {n : } (g : FABL.BooleanFunction n) :
      FABL.spectralInfinityNorm
          (CryptBoolean.realSignView
            (FABL.booleanFunctionF₂Encoding
              g)) =
        FABL.fourierInfinityNorm g.toReal
    The vector- and subset-indexed Fourier infinity norms agree across the
    canonical Boolean-function encoding. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/RandomNonlinearityAsymptotics.lean
    complete
    theorem CryptBoolean.nonlinearity_encoding_eq_fourierInfinityNorm {n : }
      (g : FABL.BooleanFunction n) :
      (CryptBoolean.nonlinearity (FABL.booleanFunctionF₂Encoding g)) =
        2 ^ n / 2 - 2 ^ n * FABL.fourierInfinityNorm g.toReal / 2
    theorem CryptBoolean.nonlinearity_encoding_eq_fourierInfinityNorm
      {n : } (g : FABL.BooleanFunction n) :
      (CryptBoolean.nonlinearity
            (FABL.booleanFunctionF₂Encoding
              g)) =
        2 ^ n / 2 -
          2 ^ n *
              FABL.fourierInfinityNorm
                g.toReal /
            2
    Relation (35), transported to the uniform sign-cube model used by FABL's
    concentration theorem. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/RandomNonlinearityAsymptotics.lean
    complete
    theorem CryptBoolean.carletRandomNonlinearityThreshold_lt_of_fourierInfinityNorm_lt
      {n : } (g : FABL.BooleanFunction n)
      (h :
        FABL.fourierInfinityNorm g.toReal <
          CryptBoolean.carletRandomFourierThreshold n) :
      CryptBoolean.carletRandomNonlinearityThreshold n <
        (CryptBoolean.nonlinearity (FABL.booleanFunctionF₂Encoding g))
    theorem CryptBoolean.carletRandomNonlinearityThreshold_lt_of_fourierInfinityNorm_lt
      {n : } (g : FABL.BooleanFunction n)
      (h :
        FABL.fourierInfinityNorm g.toReal <
          CryptBoolean.carletRandomFourierThreshold
            n) :
      CryptBoolean.carletRandomNonlinearityThreshold
          n <
        (CryptBoolean.nonlinearity
            (FABL.booleanFunctionF₂Encoding
              g))
  • defdefined in CryptBoolean/Carlet/Chapter04/RandomNonlinearityAsymptotics.lean
    complete
    def CryptBoolean.carletRandomNonlinearityProbability (n : ) : 
    def CryptBoolean.carletRandomNonlinearityProbability
      (n : ) : 
    The uniform probability that an `n`-variable Boolean function exceeds
    Carlet's random-function nonlinearity threshold. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/RandomNonlinearityAsymptotics.lean
    complete
    theorem CryptBoolean.one_sub_failureBound_le_carletRandomNonlinearityProbability
      (n : ) :
      1 - CryptBoolean.carletRandomNonlinearityFailureBound n 
        CryptBoolean.carletRandomNonlinearityProbability n
    theorem CryptBoolean.one_sub_failureBound_le_carletRandomNonlinearityProbability
      (n : ) :
      1 -
          CryptBoolean.carletRandomNonlinearityFailureBound
            n 
        CryptBoolean.carletRandomNonlinearityProbability
          n
    The finite failure estimate underlying the almost-all theorem. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/RandomNonlinearityAsymptotics.lean
    complete
    theorem CryptBoolean.tendsto_carletRandomNonlinearityProbability :
      Filter.Tendsto CryptBoolean.carletRandomNonlinearityProbability
        Filter.atTop (nhds 1)
    theorem CryptBoolean.tendsto_carletRandomNonlinearityProbability :
      Filter.Tendsto
        CryptBoolean.carletRandomNonlinearityProbability
        Filter.atTop (nhds 1)
    Olejár--Stanek/Carlet: the proportion of Boolean functions whose
    nonlinearity exceeds the displayed threshold tends to one. 

The failure probability is at most 2(2/e)^n, using the exact Walsh threshold, a single-frequency Hoeffding bound, and a union bound over all 2^n frequencies. Relation (35) transports the estimate to Carlet's raw nonlinearity normalization.

Theorem3.2.6
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
uses 1used by 1L∃∀N

Rodier lower endpoint (one-sided consequence of the sharp interval; Carlet, p. 51). As n\to\infty, the uniform probability tends to 1 that f:V_n\to\mathbb F_2 satisfies \operatorname{nl}(f)> 2^{n-1}-2^{n/2-1}\sqrt n \left(\sqrt{2\ln2}+\frac{4\ln n}{n}\right).

Lean code for Theorem3.2.612 declarations
  • defdefined in CryptBoolean/Carlet/Chapter04/RandomNonlinearityAsymptotics.lean
    complete
    def CryptBoolean.rodierRandomFourierUpperThreshold (n : ) : 
    def CryptBoolean.rodierRandomFourierUpperThreshold
      (n : ) : 
    Rodier's upper spectral-amplitude threshold, normalized as a FABL Fourier
    coefficient. 
  • defdefined in CryptBoolean/Carlet/Chapter04/RandomNonlinearityAsymptotics.lean
    complete
    def CryptBoolean.rodierRandomNonlinearityLowerThreshold (n : ) : 
    def CryptBoolean.rodierRandomNonlinearityLowerThreshold
      (n : ) : 
    The lower endpoint of Rodier's nonlinearity interval. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/RandomNonlinearityAsymptotics.lean
    complete
    theorem CryptBoolean.rodierRandomNonlinearityLowerThreshold_eq_displayed
      (n : ) :
      CryptBoolean.rodierRandomNonlinearityLowerThreshold n =
        2 ^ (n - 1) -
          2 ^ (n / 2 - 1) * n *
            ((2 * Real.log 2) + 4 * Real.log n / n)
    theorem CryptBoolean.rodierRandomNonlinearityLowerThreshold_eq_displayed
      (n : ) :
      CryptBoolean.rodierRandomNonlinearityLowerThreshold
          n =
        2 ^ (n - 1) -
          2 ^ (n / 2 - 1) * n *
            ((2 * Real.log 2) +
              4 * Real.log n / n)
    Rodier's lower nonlinearity endpoint in the displayed source
    normalization. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/RandomNonlinearityAsymptotics.lean
    complete
    theorem CryptBoolean.rodierRandomFourierUpperThreshold_nonneg (n : ) :
      0  CryptBoolean.rodierRandomFourierUpperThreshold n
    theorem CryptBoolean.rodierRandomFourierUpperThreshold_nonneg
      (n : ) :
      0 
        CryptBoolean.rodierRandomFourierUpperThreshold
          n
  • theoremdefined in CryptBoolean/Carlet/Chapter04/RandomNonlinearityAsymptotics.lean
    complete
    theorem CryptBoolean.card_mul_rodierRandomFourierUpperThreshold_sq_div_two_ge
      {n : } (hn : 1  n) :
      n * Real.log 2 + Real.log n 
        (Fintype.card (FABL.SignCube n)) *
            CryptBoolean.rodierRandomFourierUpperThreshold n ^ 2 /
          2
    theorem CryptBoolean.card_mul_rodierRandomFourierUpperThreshold_sq_div_two_ge
      {n : } (hn : 1  n) :
      n * Real.log 2 + Real.log n 
        (Fintype.card (FABL.SignCube n)) *
            CryptBoolean.rodierRandomFourierUpperThreshold
                n ^
              2 /
          2
  • theoremdefined in CryptBoolean/Carlet/Chapter04/RandomNonlinearityAsymptotics.lean
    complete
    theorem CryptBoolean.measure_fourierInfinityNorm_ge_rodierUpperThreshold_le
      {n : } (hn : 1  n) :
      (FABL.uniformPMF (FABL.BooleanFunction n)).toMeasure.real
          {f |
            CryptBoolean.rodierRandomFourierUpperThreshold n 
              FABL.fourierInfinityNorm f.toReal} 
        2 * (↑n)⁻¹
    theorem CryptBoolean.measure_fourierInfinityNorm_ge_rodierUpperThreshold_le
      {n : } (hn : 1  n) :
      (FABL.uniformPMF
                (FABL.BooleanFunction
                  n)).toMeasure.real
          {f |
            CryptBoolean.rodierRandomFourierUpperThreshold
                n 
              FABL.fourierInfinityNorm
                f.toReal} 
        2 * (↑n)⁻¹
    A finite Hoeffding--union-bound estimate for the easy side of Rodier's
    sharp interval. 
  • defdefined in CryptBoolean/Carlet/Chapter04/RandomNonlinearityAsymptotics.lean
    complete
    def CryptBoolean.rodierRandomNonlinearityLowerFailureBound (n : ) : 
    def CryptBoolean.rodierRandomNonlinearityLowerFailureBound
      (n : ) : 
    A summable-rate surrogate is unnecessary for convergence in probability;
    this explicit bound already vanishes. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/RandomNonlinearityAsymptotics.lean
    complete
    theorem CryptBoolean.tendsto_rodierRandomNonlinearityLowerFailureBound :
      Filter.Tendsto CryptBoolean.rodierRandomNonlinearityLowerFailureBound
        Filter.atTop (nhds 0)
    theorem CryptBoolean.tendsto_rodierRandomNonlinearityLowerFailureBound :
      Filter.Tendsto
        CryptBoolean.rodierRandomNonlinearityLowerFailureBound
        Filter.atTop (nhds 0)
  • theoremdefined in CryptBoolean/Carlet/Chapter04/RandomNonlinearityAsymptotics.lean
    complete
    theorem CryptBoolean.rodierRandomNonlinearityLowerThreshold_lt_of_fourierInfinityNorm_lt
      {n : } (g : FABL.BooleanFunction n)
      (h :
        FABL.fourierInfinityNorm g.toReal <
          CryptBoolean.rodierRandomFourierUpperThreshold n) :
      CryptBoolean.rodierRandomNonlinearityLowerThreshold n <
        (CryptBoolean.nonlinearity (FABL.booleanFunctionF₂Encoding g))
    theorem CryptBoolean.rodierRandomNonlinearityLowerThreshold_lt_of_fourierInfinityNorm_lt
      {n : } (g : FABL.BooleanFunction n)
      (h :
        FABL.fourierInfinityNorm g.toReal <
          CryptBoolean.rodierRandomFourierUpperThreshold
            n) :
      CryptBoolean.rodierRandomNonlinearityLowerThreshold
          n <
        (CryptBoolean.nonlinearity
            (FABL.booleanFunctionF₂Encoding
              g))
  • defdefined in CryptBoolean/Carlet/Chapter04/RandomNonlinearityAsymptotics.lean
    complete
    def CryptBoolean.rodierRandomNonlinearityLowerProbability (n : ) : 
    def CryptBoolean.rodierRandomNonlinearityLowerProbability
      (n : ) : 
    The uniform probability that the nonlinearity exceeds Rodier's lower
    endpoint. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/RandomNonlinearityAsymptotics.lean
    complete
    theorem CryptBoolean.one_sub_rodierLowerFailureBound_le_probability {n : }
      (hn : 1  n) :
      1 - CryptBoolean.rodierRandomNonlinearityLowerFailureBound n 
        CryptBoolean.rodierRandomNonlinearityLowerProbability n
    theorem CryptBoolean.one_sub_rodierLowerFailureBound_le_probability
      {n : } (hn : 1  n) :
      1 -
          CryptBoolean.rodierRandomNonlinearityLowerFailureBound
            n 
        CryptBoolean.rodierRandomNonlinearityLowerProbability
          n
    The finite failure estimate for the Hoeffding side of Rodier's interval. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/RandomNonlinearityAsymptotics.lean
    complete
    theorem CryptBoolean.tendsto_rodierRandomNonlinearityLowerProbability :
      Filter.Tendsto CryptBoolean.rodierRandomNonlinearityLowerProbability
        Filter.atTop (nhds 1)
    theorem CryptBoolean.tendsto_rodierRandomNonlinearityLowerProbability :
      Filter.Tendsto
        CryptBoolean.rodierRandomNonlinearityLowerProbability
        Filter.atTop (nhds 1)
    The Hoeffding side of Rodier's sharp interval: with probability tending
    to one, random nonlinearity exceeds the displayed lower endpoint. 

A one-frequency Hoeffding estimate followed by a union bound over all Walsh frequencies gives failure probability at most 2/n. Relation (35) converts the spectral event to the displayed nonlinearity event.

Lemma3.2.7
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
uses 1used by 1L∃∀N

Reduction of Rodier's upper endpoint to a spectral lower tail. Put \tau_n=\sqrt n\left(\sqrt{2\ln2}-\frac{5\ln n}{n}\right)2^{-n/2}. If the uniform probability of \tau_n<\|\widehat{(-1)^f}\|_\infty tends to 1, then the uniform probability tends to 1 that \operatorname{nl}(f)< 2^{n-1}-2^{n/2-1}\sqrt n \left(\sqrt{2\ln2}-\frac{5\ln n}{n}\right).

Lean code for Lemma3.2.78 declarations
  • defdefined in CryptBoolean/Carlet/Chapter04/RodierLowerTail.lean
    complete
    def CryptBoolean.rodierRandomFourierLowerThreshold (n : ) : 
    def CryptBoolean.rodierRandomFourierLowerThreshold
      (n : ) : 
    Rodier's lower spectral-amplitude threshold in FABL's normalized Fourier
    scale. 
  • defdefined in CryptBoolean/Carlet/Chapter04/RodierLowerTail.lean
    complete
    def CryptBoolean.rodierRandomNonlinearityUpperThreshold (n : ) : 
    def CryptBoolean.rodierRandomNonlinearityUpperThreshold
      (n : ) : 
    The upper endpoint of Rodier's random-nonlinearity interval. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/RodierLowerTail.lean
    complete
    theorem CryptBoolean.rodierRandomNonlinearityUpperThreshold_eq_displayed
      (n : ) :
      CryptBoolean.rodierRandomNonlinearityUpperThreshold n =
        2 ^ (n - 1) -
          2 ^ (n / 2 - 1) * n *
            ((2 * Real.log 2) - 5 * Real.log n / n)
    theorem CryptBoolean.rodierRandomNonlinearityUpperThreshold_eq_displayed
      (n : ) :
      CryptBoolean.rodierRandomNonlinearityUpperThreshold
          n =
        2 ^ (n - 1) -
          2 ^ (n / 2 - 1) * n *
            ((2 * Real.log 2) -
              5 * Real.log n / n)
    Rodier's upper nonlinearity endpoint in Carlet's displayed normalization. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/RodierLowerTail.lean
    complete
    theorem CryptBoolean.nonlinearity_lt_rodierRandomNonlinearityUpperThreshold
      {n : } (g : FABL.BooleanFunction n)
      (h :
        CryptBoolean.rodierRandomFourierLowerThreshold n <
          FABL.fourierInfinityNorm g.toReal) :
      (CryptBoolean.nonlinearity (FABL.booleanFunctionF₂Encoding g)) <
        CryptBoolean.rodierRandomNonlinearityUpperThreshold n
    theorem CryptBoolean.nonlinearity_lt_rodierRandomNonlinearityUpperThreshold
      {n : } (g : FABL.BooleanFunction n)
      (h :
        CryptBoolean.rodierRandomFourierLowerThreshold
            n <
          FABL.fourierInfinityNorm g.toReal) :
      (CryptBoolean.nonlinearity
            (FABL.booleanFunctionF₂Encoding
              g)) <
        CryptBoolean.rodierRandomNonlinearityUpperThreshold
          n
    Relation (35) converts a strict lower bound for the normalized spectral
    maximum into the matching upper bound for nonlinearity. 
  • defdefined in CryptBoolean/Carlet/Chapter04/RodierLowerTail.lean
    complete
    def CryptBoolean.rodierRandomFourierLowerProbability (n : ) : 
    def CryptBoolean.rodierRandomFourierLowerProbability
      (n : ) : 
    The uniform probability of Rodier's lower spectral-amplitude event. 
  • defdefined in CryptBoolean/Carlet/Chapter04/RodierLowerTail.lean
    complete
    def CryptBoolean.rodierRandomNonlinearityUpperProbability (n : ) : 
    def CryptBoolean.rodierRandomNonlinearityUpperProbability
      (n : ) : 
    The uniform probability that nonlinearity lies below Rodier's displayed
    upper endpoint. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/RodierLowerTail.lean
    complete
    theorem CryptBoolean.rodierRandomFourierLowerProbability_le_nonlinearityUpperProbability
      (n : ) :
      CryptBoolean.rodierRandomFourierLowerProbability n 
        CryptBoolean.rodierRandomNonlinearityUpperProbability n
    theorem CryptBoolean.rodierRandomFourierLowerProbability_le_nonlinearityUpperProbability
      (n : ) :
      CryptBoolean.rodierRandomFourierLowerProbability
          n 
        CryptBoolean.rodierRandomNonlinearityUpperProbability
          n
    Relation (35) transports the lower spectral-amplitude event into the
    upper nonlinearity event. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/RodierLowerTail.lean
    complete
    theorem CryptBoolean.tendsto_rodierRandomNonlinearityUpperProbability_of_fourierLower
      (h :
        Filter.Tendsto CryptBoolean.rodierRandomFourierLowerProbability
          Filter.atTop (nhds 1)) :
      Filter.Tendsto CryptBoolean.rodierRandomNonlinearityUpperProbability
        Filter.atTop (nhds 1)
    theorem CryptBoolean.tendsto_rodierRandomNonlinearityUpperProbability_of_fourierLower
      (h :
        Filter.Tendsto
          CryptBoolean.rodierRandomFourierLowerProbability
          Filter.atTop (nhds 1)) :
      Filter.Tendsto
        CryptBoolean.rodierRandomNonlinearityUpperProbability
        Filter.atTop (nhds 1)
    The missing analytic lower-tail limit is sufficient for Rodier's upper
    nonlinearity endpoint. 

Relation (35) proves the deterministic event inclusion; monotonicity of the uniform measure transports the assumed spectral limit. Thus only the lower tail of the maximum Walsh coefficient remains analytic.

Lemma3.2.8
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
uses 0used by 1L∃∀N

Rodier's two-character characteristic-function moments. For distinct Walsh characters \chi_S,\chi_T and real t,r, put u_x=t\chi_S(x)+r\chi_T(x). Then the joint characteristic function of the corresponding raw Walsh coefficients is \prod_{x\in\{-1,1\}^n}\cos u_x, and \sum_xu_x^2=2^n(t^2+r^2), \qquad \sum_xu_x^4=2^n(t^4+6t^2r^2+r^4).

Lean code for Lemma3.2.86 declarations
  • defdefined in CryptBoolean/Carlet/Chapter04/RodierLowerTail.lean
    complete
    def CryptBoolean.rodierPairPhase {n : } (S T : Finset (Fin n)) (t r : )
      (x : FABL.SignCube n) : 
    def CryptBoolean.rodierPairPhase {n : }
      (S T : Finset (Fin n)) (t r : )
      (x : FABL.SignCube n) : 
    The linear combination of two Walsh characters occurring in Rodier's
    bivariate characteristic-function calculation. 
  • defdefined in CryptBoolean/Carlet/Chapter04/RodierLowerTail.lean
    complete
    def CryptBoolean.rodierPairCharacteristic {n : } (S T : Finset (Fin n))
      (t r : ) : 
    def CryptBoolean.rodierPairCharacteristic
      {n : } (S T : Finset (Fin n))
      (t r : ) : 
    The joint characteristic function of two raw Walsh coefficients. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/RodierLowerTail.lean
    complete
    theorem CryptBoolean.rodierPairCharacteristic_eq_prod_cos {n : }
      (S T : Finset (Fin n)) (t r : ) :
      CryptBoolean.rodierPairCharacteristic S T t r =
         x, (Real.cos (CryptBoolean.rodierPairPhase S T t r x))
    theorem CryptBoolean.rodierPairCharacteristic_eq_prod_cos
      {n : } (S T : Finset (Fin n))
      (t r : ) :
      CryptBoolean.rodierPairCharacteristic S
          T t r =
         x,
          (Real.cos
              (CryptBoolean.rodierPairPhase S
                T t r x))
    The exact independent-coordinate product underlying Rodier Lemma 6.4. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/RodierLowerTail.lean
    complete
    theorem CryptBoolean.sum_monomial_mul_eq_zero_of_ne {n : }
      {S T : Finset (Fin n)} (hST : S  T) :
       x, FABL.monomial S x * FABL.monomial T x = 0
    theorem CryptBoolean.sum_monomial_mul_eq_zero_of_ne
      {n : } {S T : Finset (Fin n)}
      (hST : S  T) :
       x,
          FABL.monomial S x *
            FABL.monomial T x =
        0
    Distinct Walsh characters have zero raw correlation on the sign cube. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/RodierLowerTail.lean
    complete
    theorem CryptBoolean.sum_rodierPairPhase_sq {n : } {S T : Finset (Fin n)}
      (hST : S  T) (t r : ) :
       x, CryptBoolean.rodierPairPhase S T t r x ^ 2 =
        2 ^ n * (t ^ 2 + r ^ 2)
    theorem CryptBoolean.sum_rodierPairPhase_sq
      {n : } {S T : Finset (Fin n)}
      (hST : S  T) (t r : ) :
       x,
          CryptBoolean.rodierPairPhase S T t r
              x ^
            2 =
        2 ^ n * (t ^ 2 + r ^ 2)
    The exact quadratic character sum in Rodier Lemma 6.4. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/RodierLowerTail.lean
    complete
    theorem CryptBoolean.sum_rodierPairPhase_fourth {n : } {S T : Finset (Fin n)}
      (hST : S  T) (t r : ) :
       x, CryptBoolean.rodierPairPhase S T t r x ^ 4 =
        2 ^ n * (t ^ 4 + 6 * t ^ 2 * r ^ 2 + r ^ 4)
    theorem CryptBoolean.sum_rodierPairPhase_fourth
      {n : } {S T : Finset (Fin n)}
      (hST : S  T) (t r : ) :
       x,
          CryptBoolean.rodierPairPhase S T t r
              x ^
            4 =
        2 ^ n *
          (t ^ 4 + 6 * t ^ 2 * r ^ 2 + r ^ 4)
    The exact quartic character sum in Rodier Lemma 6.4. 

Independence gives the cosine product and Walsh-character orthogonality cancels the mixed odd terms. These are the exact finite identities used before Rodier's smoothed Fourier estimates.

Theorem3.2.9
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 3
Statement dependency previews
Preview
Theorem 3.2.6
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
used by 0L∃∀N

Sharp random-function nonlinearity interval (Rodier; Carlet, p. 51). As n\to\infty, the uniform probability tends to 1 that f:V_n\to\mathbb F_2 has nonlinearity between 2^{n-1}-2^{n/2-1}\sqrt n \left(\sqrt{2\ln2}+\frac{4\ln n}{n}\right) and 2^{n-1}-2^{n/2-1}\sqrt n \left(\sqrt{2\ln2}-\frac{5\ln n}{n}\right).

Lean code for Theorem3.2.94 declarations
  • theoremdefined in CryptBoolean/Carlet/Chapter04/RodierSharpAsymptotics.lean
    complete
    theorem CryptBoolean.exists_rodierAsymptoticOffDiagonalPairError_bound :
       C,
        0  C 
          ∀ᶠ (n : ) in Filter.atTop,
             (hM : 0 < CryptBoolean.rodierAsymptoticM n)
              ( : 0 < CryptBoolean.rodierAsymptoticDelta n),
              CryptBoolean.rodierOffDiagonalPairError n
                  (CryptBoolean.rodierAsymptoticM n)
                  (CryptBoolean.rodierAsymptoticDelta n) hM  
                C *
                  (n ^ 6 / CryptBoolean.rodierAsymptoticQ n ^ 2 +
                    n ^ 4 / CryptBoolean.rodierAsymptoticQ n *
                      Real.exp (-n))
    theorem CryptBoolean.exists_rodierAsymptoticOffDiagonalPairError_bound :
       C,
        0  C 
          ∀ᶠ (n : ) in Filter.atTop,
            
              (hM :
                0 <
                  CryptBoolean.rodierAsymptoticM
                    n)
              ( :
                0 <
                  CryptBoolean.rodierAsymptoticDelta
                    n),
              CryptBoolean.rodierOffDiagonalPairError
                  n
                  (CryptBoolean.rodierAsymptoticM
                    n)
                  (CryptBoolean.rodierAsymptoticDelta
                    n)
                  hM  
                C *
                  (n ^ 6 /
                      CryptBoolean.rodierAsymptoticQ
                          n ^
                        2 +
                    n ^ 4 /
                        CryptBoolean.rodierAsymptoticQ
                          n *
                      Real.exp (-n))
    Rodier's off-diagonal pair error has a uniform polynomial-exponential
    majorant at the sharp cutoff scale. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/RodierSharpAsymptotics.lean
    complete
    theorem CryptBoolean.tendsto_rodierRandomFourierLowerProbability :
      Filter.Tendsto CryptBoolean.rodierRandomFourierLowerProbability
        Filter.atTop (nhds 1)
    theorem CryptBoolean.tendsto_rodierRandomFourierLowerProbability :
      Filter.Tendsto
        CryptBoolean.rodierRandomFourierLowerProbability
        Filter.atTop (nhds 1)
    Rodier's sharp lower spectral-amplitude event has probability tending to
    one for uniformly random Boolean functions. 
  • defdefined in CryptBoolean/Carlet/Chapter04/RodierSharpAsymptotics.lean
    complete
    def CryptBoolean.rodierSharpRandomNonlinearityIntervalProbability (n : ) :
      
    def CryptBoolean.rodierSharpRandomNonlinearityIntervalProbability
      (n : ) : 
    The probability that a uniformly random Boolean function lies strictly
    between both endpoints of Rodier's sharp nonlinearity interval. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/RodierSharpAsymptotics.lean
    complete
    theorem CryptBoolean.tendsto_rodierSharpRandomNonlinearityIntervalProbability :
      Filter.Tendsto
        CryptBoolean.rodierSharpRandomNonlinearityIntervalProbability
        Filter.atTop (nhds 1)
    theorem CryptBoolean.tendsto_rodierSharpRandomNonlinearityIntervalProbability :
      Filter.Tendsto
        CryptBoolean.rodierSharpRandomNonlinearityIntervalProbability
        Filter.atTop (nhds 1)
    The proportion of Boolean functions in Rodier's simultaneous sharp
    two-sided nonlinearity interval tends to one. 

Following Rodier (2006), the proof uses correlated Walsh pairs, smoothed cutoff estimates, and a second-moment argument. A uniform off-diagonal covariance error tends to zero at the required scale; the resulting spectral lower tail is intersected with the one-sided upper tail above. Relation (35) then gives the simultaneous nonlinearity interval, including the exact +4\ln(n)/n and -5\ln(n)/n corrections.

Theorem3.2.10
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 4
Statement dependency previews
Preview
Theorem 2.1.1
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
used by 0L∃∀N

Exact best nonlinearity in dimension five (Carlet, pp. 51--52). If M_n denotes the maximum nonlinearity of an n-variable Boolean function, then M_5=2^4-2^2=12.

Lean code for Theorem3.2.101 theorem
  • theoremdefined in CryptBoolean/Carlet/Chapter04/FiveVariableMaximumNonlinearity.lean
    complete
    theorem CryptBoolean.maximumNonlinearity_five :
      CryptBoolean.maximumNonlinearity 5 = 12
    theorem CryptBoolean.maximumNonlinearity_five :
      CryptBoolean.maximumNonlinearity 5 = 12
    The largest nonlinearity of a five-variable Boolean function is twelve. 

The quadratic construction gives the lower bound. For the upper bound, a hypothetical weight-thirteen first-order Reed--Muller coset leader yields a self-complementary binary [13,6,\ge5] code. Residuation at a minimum-weight word produces a binary [7,5,\ge3] or [8,5,\ge3] code, and the radius-one Hamming bound rules out both cases.

Lemma3.2.11
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
uses 1used by 1L∃∀N

Coordinate-covering leaders of six-variable deep cosets. Let f:V_6\to\mathbb F_2 have \operatorname{nl}(f)=28. For every x\in V_6, there is an affine function \ell such that d_H(f,\ell)=28 \qquad\text{and}\qquad (f+\ell)(x)=1.

Lean code for Lemma3.2.111 theorem
  • theoremdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    theorem CryptBoolean.exists_minimum_affine_error_one_at_of_nonlinearity_eq_28
      (f : CryptBoolean.BooleanFunction 6)
      (hf : CryptBoolean.nonlinearity f = 28) (x : FABL.F₂Cube 6) :
       b a,
        CryptBoolean.hammingDistance f (FABL.affineFunction b a) = 28 
          (f + FABL.affineFunction b a) x = 1
    theorem CryptBoolean.exists_minimum_affine_error_one_at_of_nonlinearity_eq_28
      (f : CryptBoolean.BooleanFunction 6)
      (hf : CryptBoolean.nonlinearity f = 28)
      (x : FABL.F₂Cube 6) :
       b a,
        CryptBoolean.hammingDistance f
              (FABL.affineFunction b a) =
            28 
          (f + FABL.affineFunction b a) x = 1
    A six-variable coset at covering radius has, through every coordinate,
    a minimum-weight representative modulo the first-order Reed--Muller code. 

This lemma is used in Hou's dimension-seven argument. Relation (36) gives the flat Walsh spectrum, and Walsh inversion forces a minimum representative through every prescribed coordinate. The conclusion holds without a degree hypothesis.

Lemma3.2.12
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 3
Statement dependency previews
Preview
Theorem 1.9.2
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
used by 1L∃∀N

Coordinate-covering leaders of degree-four six-variable cosets. Let f:V_6\to\mathbb F_2 have algebraic degree at most 4 and \operatorname{nl}(f)=26. For every x\in V_6, there is an affine function \ell such that d_H(f,\ell)=26 \qquad\text{and}\qquad (f+\ell)(x)=1.

Lean code for Lemma3.2.121 theorem
  • theoremdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    theorem CryptBoolean.exists_minimum_affine_error_one_at_of_degree_le_four_nonlinearity_eq_26
      (f : CryptBoolean.BooleanFunction 6)
      (hdegree : FABL.functionAlgebraicDegree f  4)
      (hf : CryptBoolean.nonlinearity f = 26) (x : FABL.F₂Cube 6) :
       b a,
        CryptBoolean.hammingDistance f (FABL.affineFunction b a) = 26 
          (f + FABL.affineFunction b a) x = 1
    theorem CryptBoolean.exists_minimum_affine_error_one_at_of_degree_le_four_nonlinearity_eq_26
      (f : CryptBoolean.BooleanFunction 6)
      (hdegree :
        FABL.functionAlgebraicDegree f  4)
      (hf : CryptBoolean.nonlinearity f = 26)
      (x : FABL.F₂Cube 6) :
       b a,
        CryptBoolean.hammingDistance f
              (FABL.affineFunction b a) =
            26 
          (f + FABL.affineFunction b a) x = 1
    A degree-at-most-four six-variable coset of nonlinearity `26` has,
    through every coordinate, a minimum-weight representative modulo the
    first-order Reed--Muller code. 

Reed--Muller duality forces all affine-coset weights to be congruent modulo four. Relation (35) and Parseval then give exactly 24 Walsh coefficients of magnitude 12 and 40 of magnitude 4; Walsh inversion forces a minimum representative through every prescribed coordinate.

Theorem3.2.13
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 3
Statement dependency previews
Preview
Lemma 3.2.11
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
used by 0L∃∀N

Exact best nonlinearity in dimension seven (Carlet, pp. 51--52). If M_n denotes the maximum nonlinearity of an n-variable Boolean function, then M_7=2^6-2^3=56.

Lean code for Theorem3.2.136 declarations
  • defdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    def CryptBoolean.firstCoordinateSliceSeven
      (f : CryptBoolean.BooleanFunction 7) (c : FABL.𝔽₂) :
      CryptBoolean.BooleanFunction 6
    def CryptBoolean.firstCoordinateSliceSeven
      (f : CryptBoolean.BooleanFunction 7)
      (c : FABL.𝔽₂) :
      CryptBoolean.BooleanFunction 6
    The six-variable slice of a seven-variable Boolean function at a fixed
    first coordinate. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    theorem CryptBoolean.exists_linearEquiv_firstCoordinateSlices_degree_le_four
      (f : CryptBoolean.BooleanFunction 7)
      (hf : FABL.functionAlgebraicDegree f  5) :
       P,
        FABL.functionAlgebraicDegree
              (CryptBoolean.firstCoordinateSliceSeven (f  P) 0) 
            4 
          FABL.functionAlgebraicDegree
              (CryptBoolean.firstCoordinateSliceSeven (f  P) 1) 
            4
    theorem CryptBoolean.exists_linearEquiv_firstCoordinateSlices_degree_le_four
      (f : CryptBoolean.BooleanFunction 7)
      (hf :
        FABL.functionAlgebraicDegree f  5) :
       P,
        FABL.functionAlgebraicDegree
              (CryptBoolean.firstCoordinateSliceSeven
                (f  P) 0) 
            4 
          FABL.functionAlgebraicDegree
              (CryptBoolean.firstCoordinateSliceSeven
                (f  P) 1) 
            4
    Hou's odd-dimensional degree-five normal form: after an invertible
    linear change of variables, both six-variable coordinate slices have degree
    at most four. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    theorem CryptBoolean.nonlinearity_le_56_of_degree_le_five_seven
      (f : CryptBoolean.BooleanFunction 7)
      (hf : FABL.functionAlgebraicDegree f  5) :
      CryptBoolean.nonlinearity f  56
    theorem CryptBoolean.nonlinearity_le_56_of_degree_le_five_seven
      (f : CryptBoolean.BooleanFunction 7)
      (hf :
        FABL.functionAlgebraicDegree f  5) :
      CryptBoolean.nonlinearity f  56
    Every seven-variable Boolean function of algebraic degree at most five
    has nonlinearity at most `56`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    theorem CryptBoolean.exists_minimum_affine_error_one_at_of_degree_le_five_nonlinearity_eq_56_seven
      (f : CryptBoolean.BooleanFunction 7)
      (hf : FABL.functionAlgebraicDegree f  5)
      (hnonlinearity : CryptBoolean.nonlinearity f = 56)
      (x : FABL.F₂Cube 7) :
       b a,
        CryptBoolean.hammingDistance f (FABL.affineFunction b a) = 56 
          (f + FABL.affineFunction b a) x = 1
    theorem CryptBoolean.exists_minimum_affine_error_one_at_of_degree_le_five_nonlinearity_eq_56_seven
      (f : CryptBoolean.BooleanFunction 7)
      (hf :
        FABL.functionAlgebraicDegree f  5)
      (hnonlinearity :
        CryptBoolean.nonlinearity f = 56)
      (x : FABL.F₂Cube 7) :
       b a,
        CryptBoolean.hammingDistance f
              (FABL.affineFunction b a) =
            56 
          (f + FABL.affineFunction b a) x = 1
    A seven-variable degree-at-most-five coset at nonlinearity `56` has,
    through every coordinate, a minimum-weight representative modulo the
    first-order Reed--Muller code. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/SevenVariableMaximumNonlinearity.lean
    complete
    theorem CryptBoolean.nonlinearity_le_fifty_six_of_degree_five_covering
      (hleader :
         (g : CryptBoolean.BooleanFunction 7),
          FABL.functionAlgebraicDegree g  5 
            CryptBoolean.nonlinearity g = 56 
               (x : FABL.F₂Cube 7),
                 b a,
                  CryptBoolean.hammingDistance g (FABL.affineFunction b a) =
                      56 
                    (g + FABL.affineFunction b a) x = 1)
      (f : CryptBoolean.BooleanFunction 7) :
      CryptBoolean.nonlinearity f  56
    theorem CryptBoolean.nonlinearity_le_fifty_six_of_degree_five_covering
      (hleader :
        
          (g :
            CryptBoolean.BooleanFunction 7),
          FABL.functionAlgebraicDegree g  5 
            CryptBoolean.nonlinearity g = 56 
               (x : FABL.F₂Cube 7),
                 b a,
                  CryptBoolean.hammingDistance
                        g
                        (FABL.affineFunction b
                          a) =
                      56 
                    (g +
                          FABL.affineFunction
                            b a)
                        x =
                      1)
      (f : CryptBoolean.BooleanFunction 7) :
      CryptBoolean.nonlinearity f  56
    Hou's quotient reduction: a radius-`56` bound on the degree-at-most-five
    subcode, together with a minimum leader through every coordinate of each
    radius-`56` coset, bounds every seven-variable Boolean function by `56`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/SevenVariableMaximumNonlinearity.lean
    complete
    theorem CryptBoolean.maximumNonlinearity_seven :
      CryptBoolean.maximumNonlinearity 7 = 56
    theorem CryptBoolean.maximumNonlinearity_seven :
      CryptBoolean.maximumNonlinearity 7 = 56
    Carlet's exact best nonlinearity in seven variables. 

The proof follows Hou's alternative to Mykkeltveit's self-complementary-code argument. A point-indicator quotient reduces an arbitrary seven-variable word to degree at most five. An alternating-form radical supplies a linear coordinate in which both six-variable slices have degree at most four; the two coordinate-covering results above close the nonlinearity-24, 26, and 28 equality cases. The quadratic construction gives the matching lower bound.

Theorem3.2.14
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 2
Statement dependency previews
Preview
Theorem 3.2.3
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
Used by 4
Reverse dependency previews
Preview
Theorem 3.2.10
Loading preview
Reverse dependency preview content is loaded from the rendered-fragment cache.
L∃∀N

Quadratic and covering-radius bounds in odd dimension (Carlet, pp. 51--52). For every odd n, if M_n is the maximum nonlinearity of an n-variable Boolean function, then 2^{n-1}-2^{(n-1)/2} \le M_n\le 2^{n-1}-2^{n/2-1}.

Lean code for Theorem3.2.1410 declarations
  • defdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    def CryptBoolean.maximumNonlinearity (n : ) : 
    def CryptBoolean.maximumNonlinearity (n : ) :
      
    The largest nonlinearity among Boolean functions in dimension `n`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    theorem CryptBoolean.nonlinearity_le_maximumNonlinearity {n : }
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.nonlinearity f  CryptBoolean.maximumNonlinearity n
    theorem CryptBoolean.nonlinearity_le_maximumNonlinearity
      {n : }
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.nonlinearity f 
        CryptBoolean.maximumNonlinearity n
    Every Boolean function is bounded by the maximum nonlinearity in its dimension. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    theorem CryptBoolean.exists_nonlinearity_eq_maximumNonlinearity (n : ) :
       f, CryptBoolean.nonlinearity f = CryptBoolean.maximumNonlinearity n
    theorem CryptBoolean.exists_nonlinearity_eq_maximumNonlinearity
      (n : ) :
       f,
        CryptBoolean.nonlinearity f =
          CryptBoolean.maximumNonlinearity n
    The finite Boolean-function space contains a function attaining the
    maximum nonlinearity. 
  • defdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    def CryptBoolean.oddQuadraticFunction (m : ) :
      CryptBoolean.BooleanFunction (m + m + 1)
    def CryptBoolean.oddQuadraticFunction
      (m : ) :
      CryptBoolean.BooleanFunction (m + m + 1)
    The quadratic odd-dimensional construction: a complete inner-product
    block together with one dummy coordinate. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    theorem CryptBoolean.walshTransform_oddQuadraticFunction (m : )
      (a : FABL.F₂Cube (m + m + 1)) :
      CryptBoolean.walshTransform (CryptBoolean.oddQuadraticFunction m) a =
        if a 0 = 0 then
          2 *
            CryptBoolean.walshTransform FABL.innerProductModTwoBit
              (Fin.tail a)
        else 0
    theorem CryptBoolean.walshTransform_oddQuadraticFunction
      (m : ) (a : FABL.F₂Cube (m + m + 1)) :
      CryptBoolean.walshTransform
          (CryptBoolean.oddQuadraticFunction
            m)
          a =
        if a 0 = 0 then
          2 *
            CryptBoolean.walshTransform
              FABL.innerProductModTwoBit
              (Fin.tail a)
        else 0
    The dummy coordinate doubles the inner-product Walsh transform at zero
    frequency and annihilates it at frequency one. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    theorem CryptBoolean.maxWalshMagnitude_oddQuadraticFunction (m : ) :
      CryptBoolean.maxWalshMagnitude (CryptBoolean.oddQuadraticFunction m) =
        2 ^ (m + 1)
    theorem CryptBoolean.maxWalshMagnitude_oddQuadraticFunction
      (m : ) :
      CryptBoolean.maxWalshMagnitude
          (CryptBoolean.oddQuadraticFunction
            m) =
        2 ^ (m + 1)
    The quadratic odd-dimensional construction has maximum raw Walsh
    magnitude `2^(m+1)`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    theorem CryptBoolean.nonlinearity_oddQuadraticFunction (m : ) :
      CryptBoolean.nonlinearity (CryptBoolean.oddQuadraticFunction m) =
        2 ^ (m + m) - 2 ^ m
    theorem CryptBoolean.nonlinearity_oddQuadraticFunction
      (m : ) :
      CryptBoolean.nonlinearity
          (CryptBoolean.oddQuadraticFunction
            m) =
        2 ^ (m + m) - 2 ^ m
    The quadratic odd-dimensional construction attains the quadratic
    nonlinearity bound. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    theorem CryptBoolean.quadraticBound_le_maximumNonlinearity_of_odd {n : }
      (hn : Odd n) :
      2 ^ (n - 1) - 2 ^ ((n - 1) / 2)  CryptBoolean.maximumNonlinearity n
    theorem CryptBoolean.quadraticBound_le_maximumNonlinearity_of_odd
      {n : } (hn : Odd n) :
      2 ^ (n - 1) - 2 ^ ((n - 1) / 2) 
        CryptBoolean.maximumNonlinearity n
    In every odd dimension, the maximum nonlinearity is at least the
    quadratic bound. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    theorem CryptBoolean.maximumNonlinearity_cast_le_relation_36 (n : ) :
      (CryptBoolean.maximumNonlinearity n) 
        2 ^ (n - 1) - 2 ^ (n / 2 - 1)
    theorem CryptBoolean.maximumNonlinearity_cast_le_relation_36
      (n : ) :
      (CryptBoolean.maximumNonlinearity n) 
        2 ^ (n - 1) - 2 ^ (n / 2 - 1)
    The maximum nonlinearity satisfies Carlet's covering-radius bound in
    every dimension. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    theorem CryptBoolean.maximumNonlinearity_odd_bounds {n : } (hn : Odd n) :
      2 ^ (n - 1) - 2 ^ ((n - 1) / 2)  CryptBoolean.maximumNonlinearity n 
        (CryptBoolean.maximumNonlinearity n) 
          2 ^ (n - 1) - 2 ^ (n / 2 - 1)
    theorem CryptBoolean.maximumNonlinearity_odd_bounds
      {n : } (hn : Odd n) :
      2 ^ (n - 1) - 2 ^ ((n - 1) / 2) 
          CryptBoolean.maximumNonlinearity n 
        (CryptBoolean.maximumNonlinearity
              n) 
          2 ^ (n - 1) - 2 ^ (n / 2 - 1)
    Carlet's lower quadratic bound and upper covering-radius bound for the
    best nonlinearity in odd dimension. 

The lower bound is attained by the complete inner-product bent function on n-1 variables, extended by one dummy coordinate. Relation (35) gives its exact nonlinearity. The upper bound is Relation (36), applied to a function attaining the finite maximum.

Theorem3.2.15
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
uses 1used by 0L∃∀N

Exact best nonlinearities in dimensions one and three (Carlet, p. 52). If M_n denotes the maximum nonlinearity of an n-variable Boolean function, then M_1=0\qquad\text{and}\qquad M_3=2.

Lean code for Theorem3.2.152 theorems
  • theoremdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    theorem CryptBoolean.maximumNonlinearity_one :
      CryptBoolean.maximumNonlinearity 1 = 0
    theorem CryptBoolean.maximumNonlinearity_one :
      CryptBoolean.maximumNonlinearity 1 = 0
    The best one-variable nonlinearity is the quadratic-bound value zero. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    theorem CryptBoolean.maximumNonlinearity_three :
      CryptBoolean.maximumNonlinearity 3 = 2
    theorem CryptBoolean.maximumNonlinearity_three :
      CryptBoolean.maximumNonlinearity 3 = 2
    The best three-variable nonlinearity is the quadratic-bound value two. 

The quadratic construction supplies the matching lower bounds, while Relation (36) makes the covering-radius upper bounds strict enough that integrality determines both maxima.

Theorem3.2.16
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
uses 1used by 0L∃∀N

Strict improvement above the quadratic bound (Carlet, pp. 51--52). For every odd n>7, there exists f:V_n\to\mathbb F_2 such that \operatorname{nl}(f)>2^{n-1}-2^{(n-1)/2}.

Lean code for Theorem3.2.1618 declarations
  • defdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    def CryptBoolean.f₂CubeNatIndex {n : } (x : FABL.F₂Cube n) : 
    def CryptBoolean.f₂CubeNatIndex {n : }
      (x : FABL.F₂Cube n) : 
    Interpret a binary cube point as a little-endian natural number. 
  • defdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    def CryptBoolean.f₂CubeOfNat (n k : ) : FABL.F₂Cube n
    def CryptBoolean.f₂CubeOfNat (n k : ) :
      FABL.F₂Cube n
    Interpret the low `n` bits of a natural number as a binary cube point. 
  • defdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    def CryptBoolean.kavutYucelTruthTable : 
    def CryptBoolean.kavutYucelTruthTable : 
    Kavut--Yücel ePrint 2007/308, p. 6, first 512-bit truth table. 
  • defdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    def CryptBoolean.kavutYucelFunction9 : CryptBoolean.BooleanFunction 9
    def CryptBoolean.kavutYucelFunction9 :
      CryptBoolean.BooleanFunction 9
    The nine-variable function printed by Kavut and Yücel, with source bits
    read left-to-right. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    theorem CryptBoolean.kavutYucelFunction9_walsh_bound (a : FABL.F₂Cube 9) :
      (CryptBoolean.walshTransform CryptBoolean.kavutYucelFunction9
            a).natAbs 
        28
    theorem CryptBoolean.kavutYucelFunction9_walsh_bound
      (a : FABL.F₂Cube 9) :
      (CryptBoolean.walshTransform
            CryptBoolean.kavutYucelFunction9
            a).natAbs 
        28
    Kernel-checked exhaustive certificate for the Walsh upper bound of the
    Kavut--Yücel truth table. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    theorem CryptBoolean.kavutYucelFunction9_walsh_witness :
      CryptBoolean.walshTransform CryptBoolean.kavutYucelFunction9
          (CryptBoolean.f₂CubeOfNat 9 7) =
        28
    theorem CryptBoolean.kavutYucelFunction9_walsh_witness :
      CryptBoolean.walshTransform
          CryptBoolean.kavutYucelFunction9
          (CryptBoolean.f₂CubeOfNat 9 7) =
        28
    Frequency seven witnesses that the certified Walsh upper bound is sharp. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    theorem CryptBoolean.maxWalshMagnitude_kavutYucelFunction9 :
      CryptBoolean.maxWalshMagnitude CryptBoolean.kavutYucelFunction9 = 28
    theorem CryptBoolean.maxWalshMagnitude_kavutYucelFunction9 :
      CryptBoolean.maxWalshMagnitude
          CryptBoolean.kavutYucelFunction9 =
        28
    The Kavut--Yücel function has maximum Walsh magnitude exactly 28. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    theorem CryptBoolean.nonlinearity_kavutYucelFunction9 :
      CryptBoolean.nonlinearity CryptBoolean.kavutYucelFunction9 = 242
    theorem CryptBoolean.nonlinearity_kavutYucelFunction9 :
      CryptBoolean.nonlinearity
          CryptBoolean.kavutYucelFunction9 =
        242
    The Kavut--Yücel truth table has nonlinearity 242. 
  • defdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    def CryptBoolean.kavutYucelBentExtension (m : ) :
      CryptBoolean.BooleanFunction (9 + (m + m))
    def CryptBoolean.kavutYucelBentExtension
      (m : ) :
      CryptBoolean.BooleanFunction
        (9 + (m + m))
    The Kavut--Yücel function extended by a complete `2m`-variable bent block. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    theorem CryptBoolean.realSignView_kavutYucelBentExtension (m : ) :
      CryptBoolean.realSignView (CryptBoolean.kavutYucelBentExtension m) =
        FABL.bentDirectProduct
          (CryptBoolean.realSignView CryptBoolean.kavutYucelFunction9)
          (FABL.innerProductModTwo m)
    theorem CryptBoolean.realSignView_kavutYucelBentExtension
      (m : ) :
      CryptBoolean.realSignView
          (CryptBoolean.kavutYucelBentExtension
            m) =
        FABL.bentDirectProduct
          (CryptBoolean.realSignView
            CryptBoolean.kavutYucelFunction9)
          (FABL.innerProductModTwo m)
    The sign view of the Kavut--Yücel extension is FABL's direct product. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    theorem CryptBoolean.walshTransform_kavutYucelBentExtension_append (m : )
      (a : FABL.F₂Cube 9) (b : FABL.F₂Cube (m + m)) :
      (CryptBoolean.walshTransform (CryptBoolean.kavutYucelBentExtension m)
            (Fin.append a b)) =
        (CryptBoolean.walshTransform CryptBoolean.kavutYucelFunction9 a) *
          (CryptBoolean.walshTransform FABL.innerProductModTwoBit b)
    theorem CryptBoolean.walshTransform_kavutYucelBentExtension_append
      (m : ) (a : FABL.F₂Cube 9)
      (b : FABL.F₂Cube (m + m)) :
      (CryptBoolean.walshTransform
            (CryptBoolean.kavutYucelBentExtension
              m)
            (Fin.append a b)) =
        (CryptBoolean.walshTransform
              CryptBoolean.kavutYucelFunction9
              a) *
          (CryptBoolean.walshTransform
              FABL.innerProductModTwoBit b)
    The raw Walsh transform of the Kavut--Yücel extension factors over the two blocks. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    theorem CryptBoolean.natAbs_walshTransform_innerProductModTwoBit (m : )
      (b : FABL.F₂Cube (m + m)) :
      (CryptBoolean.walshTransform FABL.innerProductModTwoBit b).natAbs =
        2 ^ m
    theorem CryptBoolean.natAbs_walshTransform_innerProductModTwoBit
      (m : ) (b : FABL.F₂Cube (m + m)) :
      (CryptBoolean.walshTransform
            FABL.innerProductModTwoBit
            b).natAbs =
        2 ^ m
    The complete `2m`-variable inner-product block has raw Walsh magnitude `2^m`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    theorem CryptBoolean.natAbs_walshTransform_kavutYucelBentExtension_append
      (m : ) (a : FABL.F₂Cube 9) (b : FABL.F₂Cube (m + m)) :
      (CryptBoolean.walshTransform (CryptBoolean.kavutYucelBentExtension m)
            (Fin.append a b)).natAbs =
        (CryptBoolean.walshTransform CryptBoolean.kavutYucelFunction9
              a).natAbs *
          2 ^ m
    theorem CryptBoolean.natAbs_walshTransform_kavutYucelBentExtension_append
      (m : ) (a : FABL.F₂Cube 9)
      (b : FABL.F₂Cube (m + m)) :
      (CryptBoolean.walshTransform
            (CryptBoolean.kavutYucelBentExtension
              m)
            (Fin.append a b)).natAbs =
        (CryptBoolean.walshTransform
              CryptBoolean.kavutYucelFunction9
              a).natAbs *
          2 ^ m
    Raw Walsh magnitudes of the extension are the base magnitudes scaled by `2^m`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    theorem CryptBoolean.maxWalshMagnitude_kavutYucelBentExtension (m : ) :
      CryptBoolean.maxWalshMagnitude
          (CryptBoolean.kavutYucelBentExtension m) =
        28 * 2 ^ m
    theorem CryptBoolean.maxWalshMagnitude_kavutYucelBentExtension
      (m : ) :
      CryptBoolean.maxWalshMagnitude
          (CryptBoolean.kavutYucelBentExtension
            m) =
        28 * 2 ^ m
    The extended function has maximum raw Walsh magnitude `28 * 2^m`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    theorem CryptBoolean.nonlinearity_kavutYucelBentExtension (m : ) :
      CryptBoolean.nonlinearity (CryptBoolean.kavutYucelBentExtension m) =
        2 ^ (8 + (m + m)) - 14 * 2 ^ m
    theorem CryptBoolean.nonlinearity_kavutYucelBentExtension
      (m : ) :
      CryptBoolean.nonlinearity
          (CryptBoolean.kavutYucelBentExtension
            m) =
        2 ^ (8 + (m + m)) - 14 * 2 ^ m
    The exact nonlinearity of the direct-product extension. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    theorem CryptBoolean.quadraticBound_lt_nonlinearity_kavutYucelBentExtension
      (m : ) :
      2 ^ (8 + (m + m)) - 2 ^ (4 + m) <
        CryptBoolean.nonlinearity (CryptBoolean.kavutYucelBentExtension m)
    theorem CryptBoolean.quadraticBound_lt_nonlinearity_kavutYucelBentExtension
      (m : ) :
      2 ^ (8 + (m + m)) - 2 ^ (4 + m) <
        CryptBoolean.nonlinearity
          (CryptBoolean.kavutYucelBentExtension
            m)
    Every member of the direct-product family strictly exceeds the odd-dimensional
    quadratic nonlinearity bound. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    theorem CryptBoolean.exists_nonlinearity_gt_quadraticBound_of_odd {n : }
      (hn : Odd n) (hn7 : 7 < n) :
       f, 2 ^ (n - 1) - 2 ^ ((n - 1) / 2) < CryptBoolean.nonlinearity f
    theorem CryptBoolean.exists_nonlinearity_gt_quadraticBound_of_odd
      {n : } (hn : Odd n) (hn7 : 7 < n) :
       f,
        2 ^ (n - 1) - 2 ^ ((n - 1) / 2) <
          CryptBoolean.nonlinearity f
    In every odd dimension above seven, some Boolean function strictly exceeds
    the quadratic nonlinearity bound. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    theorem CryptBoolean.quadraticBound_lt_maximumNonlinearity_of_odd {n : }
      (hn : Odd n) (hn7 : 7 < n) :
      2 ^ (n - 1) - 2 ^ ((n - 1) / 2) < CryptBoolean.maximumNonlinearity n
    theorem CryptBoolean.quadraticBound_lt_maximumNonlinearity_of_odd
      {n : } (hn : Odd n) (hn7 : 7 < n) :
      2 ^ (n - 1) - 2 ^ ((n - 1) / 2) <
        CryptBoolean.maximumNonlinearity n
    In every odd dimension above seven, the maximum nonlinearity strictly
    exceeds the quadratic bound. 

The base case is the first nine-variable truth table in Kavut--Yücel; its Walsh spectrum satisfies \max_a|W_f(a)|=28 and hence \operatorname{nl}(f)=242. Direct product with a complete 2m-variable bent block scales all raw Walsh magnitudes by 2^m, yielding every odd dimension above seven.

Theorem3.2.17
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 2
Statement dependency previews
Preview
Theorem 1.7.3
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
Used by 2
Reverse dependency previews
Preview
Theorem 3.2.18
Loading preview
Reverse dependency preview content is loaded from the rendered-fragment cache.
L∃∀N

Balanced functions above the quadratic bound (Carlet, p. 52, footnote 22). For every odd n\ge15, there exists a balanced Boolean function f:V_n\to\mathbb F_2 such that \operatorname{nl}(f)>2^{n-1}-2^{(n-1)/2}.

Lean code for Theorem3.2.1722 declarations
  • defdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    def CryptBoolean.flipOn {k : } (f : CryptBoolean.BooleanFunction k)
      (points : Finset (FABL.F₂Cube k)) : CryptBoolean.BooleanFunction k
    def CryptBoolean.flipOn {k : }
      (f : CryptBoolean.BooleanFunction k)
      (points : Finset (FABL.F₂Cube k)) :
      CryptBoolean.BooleanFunction k
    Toggle a finite set of truth-table positions. 
  • defdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    def CryptBoolean.MaitraKavutYucel.seedTruthTable : 
    def CryptBoolean.MaitraKavutYucel.seedTruthTable :
      
    BFCA 2008, p. 114: the nine-variable seed truth table. 
  • defdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    def CryptBoolean.MaitraKavutYucel.seedFunction9 :
      CryptBoolean.BooleanFunction 9
    def CryptBoolean.MaitraKavutYucel.seedFunction9 :
      CryptBoolean.BooleanFunction 9
    The nine-variable seed, with source bits read left-to-right. 
  • defdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    def CryptBoolean.MaitraKavutYucel.shiftFrequency9 : FABL.F₂Cube 9
    def CryptBoolean.MaitraKavutYucel.shiftFrequency9 :
      FABL.F₂Cube 9
    The paper's linear shift `w₁ = (0,0,0,0,1,1,0,1,1)`. 
  • defdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    def CryptBoolean.MaitraKavutYucel.shiftedSeedFunction9 :
      CryptBoolean.BooleanFunction 9
    def CryptBoolean.MaitraKavutYucel.shiftedSeedFunction9 :
      CryptBoolean.BooleanFunction 9
    The shifted seed `f₁(x) = f(x) ⊕ ⟨w₁,x⟩`. 
  • defdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    def CryptBoolean.MaitraKavutYucel.bentTruthTable : 
    def CryptBoolean.MaitraKavutYucel.bentTruthTable :
      
    BFCA 2008, p. 115: the four-variable bent truth table. 
  • defdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    def CryptBoolean.MaitraKavutYucel.bentFunction4 :
      CryptBoolean.BooleanFunction 4
    def CryptBoolean.MaitraKavutYucel.bentFunction4 :
      CryptBoolean.BooleanFunction 4
    The four-variable bent component, with source bits read left-to-right. 
  • defdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    def CryptBoolean.MaitraKavutYucel.initialFunction13 :
      CryptBoolean.BooleanFunction (9 + 4)
    def CryptBoolean.MaitraKavutYucel.initialFunction13 :
      CryptBoolean.BooleanFunction (9 + 4)
    The initial thirteen-variable direct sum, of nonlinearity `4040`. 
  • defdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    def CryptBoolean.MaitraKavutYucel.flipPointList13 :
      List (FABL.F₂Cube (9 + 4))
    def CryptBoolean.MaitraKavutYucel.flipPointList13 :
      List (FABL.F₂Cube (9 + 4))
    BFCA 2008, p. 114: the eight toggled truth-table positions. 
  • defdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    def CryptBoolean.MaitraKavutYucel.flipPoints13 :
      Finset (FABL.F₂Cube (9 + 4))
    def CryptBoolean.MaitraKavutYucel.flipPoints13 :
      Finset (FABL.F₂Cube (9 + 4))
    The finite set of the eight published toggle positions. 
  • defdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    def CryptBoolean.maitraKavutYucelFunction13 :
      CryptBoolean.BooleanFunction 13
    def CryptBoolean.maitraKavutYucelFunction13 :
      CryptBoolean.BooleanFunction 13
    Maitra--Kavut--Yücel's balanced thirteen-variable function from BFCA 2008:
    the direct sum printed in Section 3, with the eight published positions toggled. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    theorem CryptBoolean.maitraKavutYucelFunction13_walsh_bound
      (frequency : FABL.F₂Cube (9 + 4)) :
      (CryptBoolean.walshTransform CryptBoolean.maitraKavutYucelFunction13
            frequency).natAbs 
        120
    theorem CryptBoolean.maitraKavutYucelFunction13_walsh_bound
      (frequency : FABL.F₂Cube (9 + 4)) :
      (CryptBoolean.walshTransform
            CryptBoolean.maitraKavutYucelFunction13
            frequency).natAbs 
        120
  • theoremdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    theorem CryptBoolean.isBalanced_maitraKavutYucelFunction13 :
      CryptBoolean.IsBalanced CryptBoolean.maitraKavutYucelFunction13
    theorem CryptBoolean.isBalanced_maitraKavutYucelFunction13 :
      CryptBoolean.IsBalanced
        CryptBoolean.maitraKavutYucelFunction13
  • theoremdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    theorem CryptBoolean.maitraKavutYucelFunction13_walsh_witness :
      CryptBoolean.walshTransform CryptBoolean.maitraKavutYucelFunction13
          (CryptBoolean.f₂CubeOfNat 13 1) =
        120
    theorem CryptBoolean.maitraKavutYucelFunction13_walsh_witness :
      CryptBoolean.walshTransform
          CryptBoolean.maitraKavutYucelFunction13
          (CryptBoolean.f₂CubeOfNat 13 1) =
        120
  • theoremdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    theorem CryptBoolean.maxWalshMagnitude_maitraKavutYucelFunction13 :
      CryptBoolean.maxWalshMagnitude
          CryptBoolean.maitraKavutYucelFunction13 =
        120
    theorem CryptBoolean.maxWalshMagnitude_maitraKavutYucelFunction13 :
      CryptBoolean.maxWalshMagnitude
          CryptBoolean.maitraKavutYucelFunction13 =
        120
  • theoremdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    theorem CryptBoolean.nonlinearity_maitraKavutYucelFunction13 :
      CryptBoolean.nonlinearity CryptBoolean.maitraKavutYucelFunction13 =
        4036
    theorem CryptBoolean.nonlinearity_maitraKavutYucelFunction13 :
      CryptBoolean.nonlinearity
          CryptBoolean.maitraKavutYucelFunction13 =
        4036
  • defdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    def CryptBoolean.maitraKavutYucelBentExtension (m : ) :
      CryptBoolean.BooleanFunction (13 + (m + m))
    def CryptBoolean.maitraKavutYucelBentExtension
      (m : ) :
      CryptBoolean.BooleanFunction
        (13 + (m + m))
    Extend the balanced Maitra--Kavut--Yücel seed by a complete bent block. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    theorem CryptBoolean.isBalanced_maitraKavutYucelBentExtension (m : ) :
      CryptBoolean.IsBalanced (CryptBoolean.maitraKavutYucelBentExtension m)
    theorem CryptBoolean.isBalanced_maitraKavutYucelBentExtension
      (m : ) :
      CryptBoolean.IsBalanced
        (CryptBoolean.maitraKavutYucelBentExtension
          m)
    Every complete bent extension of the Maitra--Kavut--Yücel seed is balanced. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    theorem CryptBoolean.maxWalshMagnitude_maitraKavutYucelBentExtension (m : ) :
      CryptBoolean.maxWalshMagnitude
          (CryptBoolean.maitraKavutYucelBentExtension m) =
        120 * 2 ^ m
    theorem CryptBoolean.maxWalshMagnitude_maitraKavutYucelBentExtension
      (m : ) :
      CryptBoolean.maxWalshMagnitude
          (CryptBoolean.maitraKavutYucelBentExtension
            m) =
        120 * 2 ^ m
    The extended balanced family has maximum Walsh magnitude `120 * 2^m`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    theorem CryptBoolean.nonlinearity_maitraKavutYucelBentExtension (m : ) :
      CryptBoolean.nonlinearity
          (CryptBoolean.maitraKavutYucelBentExtension m) =
        2 ^ (12 + (m + m)) - 60 * 2 ^ m
    theorem CryptBoolean.nonlinearity_maitraKavutYucelBentExtension
      (m : ) :
      CryptBoolean.nonlinearity
          (CryptBoolean.maitraKavutYucelBentExtension
            m) =
        2 ^ (12 + (m + m)) - 60 * 2 ^ m
    The extended balanced family has nonlinearity
    `2^(12+2m) - 60 * 2^m`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    theorem CryptBoolean.quadraticBound_lt_nonlinearity_maitraKavutYucelBentExtension
      (m : ) :
      2 ^ (12 + (m + m)) - 2 ^ (6 + m) <
        CryptBoolean.nonlinearity
          (CryptBoolean.maitraKavutYucelBentExtension m)
    theorem CryptBoolean.quadraticBound_lt_nonlinearity_maitraKavutYucelBentExtension
      (m : ) :
      2 ^ (12 + (m + m)) - 2 ^ (6 + m) <
        CryptBoolean.nonlinearity
          (CryptBoolean.maitraKavutYucelBentExtension
            m)
    Every member of the balanced family strictly exceeds the odd-dimensional
    quadratic nonlinearity bound. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    theorem CryptBoolean.exists_isBalanced_nonlinearity_gt_quadraticBound_of_odd
      {n : } (hn : Odd n) (hn13 : 13  n) :
       f,
        CryptBoolean.IsBalanced f 
          2 ^ (n - 1) - 2 ^ ((n - 1) / 2) < CryptBoolean.nonlinearity f
    theorem CryptBoolean.exists_isBalanced_nonlinearity_gt_quadraticBound_of_odd
      {n : } (hn : Odd n) (hn13 : 13  n) :
       f,
        CryptBoolean.IsBalanced f 
          2 ^ (n - 1) - 2 ^ ((n - 1) / 2) <
            CryptBoolean.nonlinearity f
    In every odd dimension at least thirteen, a balanced Boolean function
    strictly exceeds the quadratic nonlinearity bound. 

Maitra--Kavut--Yücel's published thirteen-variable function is reconstructed from its nine-variable seed, linear shift, four-variable bent direct-sum component, and eight toggled positions. A direct evaluation of the 512-point seed and the exact flip formula give balance, \max_a|W_f(a)|=120, and \operatorname{nl}(f)=4036. Complete bent direct sums preserve balance and scale the spectrum, proving the stronger range of every odd n\ge13.

Theorem3.2.18
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 2
Statement dependency previews
Preview
Theorem 3.2.17
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
used by 0L∃∀N

PC(1) functions above the quadratic bound (Carlet, p. 52, footnote 22). For every odd n\ge15, there exists a Boolean function f:V_n\to\mathbb F_2 satisfying \mathrm{PC}(1) such that \operatorname{nl}(f)>2^{n-1}-2^{(n-1)/2}.

Lean code for Theorem3.2.1812 declarations
  • defdefined in CryptBoolean/Carlet/Chapter04/PropagationNonlinearity.lean
    complete
    def CryptBoolean.maitraKavutYucelZeroAutocorrelationBasis :
      Fin 13  FABL.F₂Cube 13
    def CryptBoolean.maitraKavutYucelZeroAutocorrelationBasis :
      Fin 13  FABL.F₂Cube 13
    Thirteen independent zero-autocorrelation directions for the
    Maitra--Kavut--Yücel seed. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/PropagationNonlinearity.lean
    complete
    theorem CryptBoolean.maitraKavutYucelZeroAutocorrelationBasis_independent :
      LinearIndependent FABL.𝔽₂
        CryptBoolean.maitraKavutYucelZeroAutocorrelationBasis
    theorem CryptBoolean.maitraKavutYucelZeroAutocorrelationBasis_independent :
      LinearIndependent FABL.𝔽₂
        CryptBoolean.maitraKavutYucelZeroAutocorrelationBasis
    The thirteen certified directions form a basis of the binary cube. 
  • defdefined in CryptBoolean/Carlet/Chapter04/PropagationNonlinearity.lean
    complete
    def CryptBoolean.maitraKavutYucelPCOneReindex :
      FABL.F₂Cube 13 ≃ₗ[FABL.𝔽₂] FABL.F₂Cube 13
    def CryptBoolean.maitraKavutYucelPCOneReindex :
      FABL.F₂Cube 13 ≃ₗ[FABL.𝔽₂]
        FABL.F₂Cube 13
    The linear input reindexing determined by the certified
    zero-autocorrelation basis. 
  • defdefined in CryptBoolean/Carlet/Chapter04/PropagationNonlinearity.lean
    complete
    def CryptBoolean.maitraKavutYucelPCOneFunction13 :
      CryptBoolean.BooleanFunction 13
    def CryptBoolean.maitraKavutYucelPCOneFunction13 :
      CryptBoolean.BooleanFunction 13
    The reindexed thirteen-variable seed. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/PropagationNonlinearity.lean
    complete
    theorem CryptBoolean.satisfiesPropagationCriterion_one_maitraKavutYucelPCOneFunction13 :
      CryptBoolean.SatisfiesPropagationCriterion 1
        CryptBoolean.maitraKavutYucelPCOneFunction13
    theorem CryptBoolean.satisfiesPropagationCriterion_one_maitraKavutYucelPCOneFunction13 :
      CryptBoolean.SatisfiesPropagationCriterion
        1
        CryptBoolean.maitraKavutYucelPCOneFunction13
    The reindexed thirteen-variable seed satisfies `PC(1)`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/PropagationNonlinearity.lean
    complete
    theorem CryptBoolean.nonlinearity_maitraKavutYucelPCOneFunction13 :
      CryptBoolean.nonlinearity
          CryptBoolean.maitraKavutYucelPCOneFunction13 =
        4036
    theorem CryptBoolean.nonlinearity_maitraKavutYucelPCOneFunction13 :
      CryptBoolean.nonlinearity
          CryptBoolean.maitraKavutYucelPCOneFunction13 =
        4036
    Linear reindexing preserves the seed's nonlinearity. 
  • defdefined in CryptBoolean/Carlet/Chapter04/PropagationNonlinearity.lean
    complete
    def CryptBoolean.maitraKavutYucelPCOneBentExtension (m : ) :
      CryptBoolean.BooleanFunction (13 + (m + m))
    def CryptBoolean.maitraKavutYucelPCOneBentExtension
      (m : ) :
      CryptBoolean.BooleanFunction
        (13 + (m + m))
    The `PC(1)` Maitra--Kavut--Yücel seed completed by `m` inner-product
    bent pairs. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/PropagationNonlinearity.lean
    complete
    theorem CryptBoolean.satisfiesPropagationCriterion_one_maitraKavutYucelPCOneBentExtension
      (m : ) :
      CryptBoolean.SatisfiesPropagationCriterion 1
        (CryptBoolean.maitraKavutYucelPCOneBentExtension m)
    theorem CryptBoolean.satisfiesPropagationCriterion_one_maitraKavutYucelPCOneBentExtension
      (m : ) :
      CryptBoolean.SatisfiesPropagationCriterion
        1
        (CryptBoolean.maitraKavutYucelPCOneBentExtension
          m)
    Every complete bent extension of the reindexed seed satisfies `PC(1)`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/PropagationNonlinearity.lean
    complete
    theorem CryptBoolean.maxWalshMagnitude_maitraKavutYucelPCOneBentExtension
      (m : ) :
      CryptBoolean.maxWalshMagnitude
          (CryptBoolean.maitraKavutYucelPCOneBentExtension m) =
        120 * 2 ^ m
    theorem CryptBoolean.maxWalshMagnitude_maitraKavutYucelPCOneBentExtension
      (m : ) :
      CryptBoolean.maxWalshMagnitude
          (CryptBoolean.maitraKavutYucelPCOneBentExtension
            m) =
        120 * 2 ^ m
    The exact maximum Walsh magnitude of every complete bent extension. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/PropagationNonlinearity.lean
    complete
    theorem CryptBoolean.nonlinearity_maitraKavutYucelPCOneBentExtension (m : ) :
      CryptBoolean.nonlinearity
          (CryptBoolean.maitraKavutYucelPCOneBentExtension m) =
        2 ^ (12 + (m + m)) - 60 * 2 ^ m
    theorem CryptBoolean.nonlinearity_maitraKavutYucelPCOneBentExtension
      (m : ) :
      CryptBoolean.nonlinearity
          (CryptBoolean.maitraKavutYucelPCOneBentExtension
            m) =
        2 ^ (12 + (m + m)) - 60 * 2 ^ m
    The exact nonlinearity of every complete bent extension. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/PropagationNonlinearity.lean
    complete
    theorem CryptBoolean.quadraticBound_lt_nonlinearity_maitraKavutYucelPCOneBentExtension
      (m : ) :
      2 ^ (12 + (m + m)) - 2 ^ (6 + m) <
        CryptBoolean.nonlinearity
          (CryptBoolean.maitraKavutYucelPCOneBentExtension m)
    theorem CryptBoolean.quadraticBound_lt_nonlinearity_maitraKavutYucelPCOneBentExtension
      (m : ) :
      2 ^ (12 + (m + m)) - 2 ^ (6 + m) <
        CryptBoolean.nonlinearity
          (CryptBoolean.maitraKavutYucelPCOneBentExtension
            m)
    The complete bent extensions strictly exceed the odd-dimensional
    quadratic nonlinearity bound. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/PropagationNonlinearity.lean
    complete
    theorem CryptBoolean.exists_pc_one_nonlinearity_gt_quadraticBound_of_odd {n : }
      (hn : Odd n) (hn13 : 13  n) :
       f,
        CryptBoolean.SatisfiesPropagationCriterion 1 f 
          2 ^ (n - 1) - 2 ^ ((n - 1) / 2) < CryptBoolean.nonlinearity f
    theorem CryptBoolean.exists_pc_one_nonlinearity_gt_quadraticBound_of_odd
      {n : } (hn : Odd n) (hn13 : 13  n) :
       f,
        CryptBoolean.SatisfiesPropagationCriterion
            1 f 
          2 ^ (n - 1) - 2 ^ ((n - 1) / 2) <
            CryptBoolean.nonlinearity f
    For every odd dimension at least thirteen, some Boolean function satisfies
    `PC(1)` and has nonlinearity strictly above the quadratic bound. 

Carlet cites Maitra--Sarkar, reference 264. The construction linearly reindexes the thirteen-variable Maitra--Kavut--Yücel function along a basis of zero-autocorrelation directions and then uses complete bent extensions. This proves the stronger range of every odd n\ge13.

Theorem3.2.19
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 3
Statement dependency previews
Preview
Proposition 2.1.5
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
used by 0L∃∀N

Degree-n-1 functions above the quadratic bound (Carlet, p. 52, footnote 22). For every odd n\ge15, there exists a Boolean function f:V_n\to\mathbb F_2 with \deg_{\mathrm{alg}}(f)=n-1 such that \operatorname{nl}(f)>2^{n-1}-2^{(n-1)/2}.

Lean code for Theorem3.2.193 theorems
  • theoremdefined in CryptBoolean/Carlet/Chapter04/DegreeRepairNonlinearity.lean
    complete
    theorem CryptBoolean.nonlinearity_le_hammingDistance_add_nonlinearity {n : }
      (f g : CryptBoolean.BooleanFunction n) :
      CryptBoolean.nonlinearity f 
        CryptBoolean.hammingDistance f g + CryptBoolean.nonlinearity g
    theorem CryptBoolean.nonlinearity_le_hammingDistance_add_nonlinearity
      {n : }
      (f g : CryptBoolean.BooleanFunction n) :
      CryptBoolean.nonlinearity f 
        CryptBoolean.hammingDistance f g +
          CryptBoolean.nonlinearity g
    Nonlinearity is one-Lipschitz with respect to raw Hamming distance. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/DegreeRepairNonlinearity.lean
    complete
    theorem CryptBoolean.exists_isBalanced_degree_pred_nonlinearity_ge_sub_two
      {n : } (f : CryptBoolean.BooleanFunction n) (hn : 2  n)
      (hf : CryptBoolean.IsBalanced f) :
       g,
        CryptBoolean.IsBalanced g 
          FABL.functionAlgebraicDegree g = n - 1 
            CryptBoolean.nonlinearity f - 2  CryptBoolean.nonlinearity g
    theorem CryptBoolean.exists_isBalanced_degree_pred_nonlinearity_ge_sub_two
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hn : 2  n)
      (hf : CryptBoolean.IsBalanced f) :
       g,
        CryptBoolean.IsBalanced g 
          FABL.functionAlgebraicDegree g =
              n - 1 
            CryptBoolean.nonlinearity f - 2 
              CryptBoolean.nonlinearity g
    Sarkar--Maitra Propositions 2--3: in dimension at least two, a balanced
    Boolean function can be repaired to algebraic degree `n - 1` by changing at
    most two values, with nonlinearity loss at most two. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/DegreeRepairNonlinearity.lean
    complete
    theorem CryptBoolean.exists_isBalanced_degree_pred_nonlinearity_gt_quadraticBound_of_odd
      {n : } (hn : Odd n) (hn15 : 15  n) :
       f,
        CryptBoolean.IsBalanced f 
          FABL.functionAlgebraicDegree f = n - 1 
            2 ^ (n - 1) - 2 ^ ((n - 1) / 2) < CryptBoolean.nonlinearity f
    theorem CryptBoolean.exists_isBalanced_degree_pred_nonlinearity_gt_quadraticBound_of_odd
      {n : } (hn : Odd n) (hn15 : 15  n) :
       f,
        CryptBoolean.IsBalanced f 
          FABL.functionAlgebraicDegree f =
              n - 1 
            2 ^ (n - 1) - 2 ^ ((n - 1) / 2) <
              CryptBoolean.nonlinearity f
    Carlet footnote 22, degree-constrained family: for every odd `n ≥ 15`
    there is a balanced Boolean function of algebraic degree `n - 1` whose
    nonlinearity strictly exceeds the odd-dimensional quadratic bound. 

A balanced function already of degree n-1 is left unchanged. Otherwise, swapping one zero and one one is addition by the indicator of their affine line. Proposition 12 gives that indicator degree n-1 and weight two; the algebraic-degree sum bound forces exact degree, while Hamming-triangle Lipschitzness loses at most two units of nonlinearity. Applied to the balanced family above, the remaining spectral margin is strict for every odd n\ge15. The resulting witnesses are also balanced.

Theorem3.2.20
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 2
Statement dependency previews
Preview
Definition 2.1.2
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
used by 1L∃∀N

Corrected distances of unions of first-order Reed--Muller cosets (Carlet, p. 52). Let \mathcal F be a finite family with at least two members and suppose that distinct members represent distinct cosets of R(1,n). Then d_{\min}\!\left(\bigcup_{f\in\mathcal F}(f+R(1,n))\right) =\min_{\substack{f,g\in\mathcal F\\f\ne g}} \operatorname{nl}(f+g). In particular, if f\notin R(1,n), then d_{\min}\bigl(R(1,n)\cup(f+R(1,n))\bigr)=\operatorname{nl}(f).

Lean code for Theorem3.2.2025 declarations
  • defdefined in CryptBoolean/Carlet/Chapter04/ReedMullerCosetDistance.lean
    complete
    def CryptBoolean.minimumHammingDistance {n : }
      (C : Finset (CryptBoolean.BooleanFunction n)) : 
    def CryptBoolean.minimumHammingDistance
      {n : }
      (C :
        Finset
          (CryptBoolean.BooleanFunction n)) :
      
    The minimum Hamming distance between distinct functions in a finite code,
    with value zero for a code having fewer than two words. 
  • defdefined in CryptBoolean/Carlet/Chapter04/ReedMullerCosetDistance.lean
    complete
    def CryptBoolean.firstOrderCosetUnion {n : }
      (F : Finset (CryptBoolean.BooleanFunction n)) :
      Finset (CryptBoolean.BooleanFunction n)
    def CryptBoolean.firstOrderCosetUnion {n : }
      (F :
        Finset
          (CryptBoolean.BooleanFunction n)) :
      Finset (CryptBoolean.BooleanFunction n)
    The union of the first-order Reed--Muller cosets represented by `F`. 
  • defdefined in CryptBoolean/Carlet/Chapter04/ReedMullerCosetDistance.lean
    complete
    def CryptBoolean.firstOrderReedMullerCoset {n : }
      (f : CryptBoolean.BooleanFunction n) :
      Finset (CryptBoolean.BooleanFunction n)
    def CryptBoolean.firstOrderReedMullerCoset
      {n : }
      (f : CryptBoolean.BooleanFunction n) :
      Finset (CryptBoolean.BooleanFunction n)
    The first-order Reed--Muller coset represented by `f`, as a finite code. 
  • defdefined in CryptBoolean/Carlet/Chapter04/ReedMullerCosetDistance.lean
    complete
    def CryptBoolean.HasDistinctFirstOrderCosets {n : }
      (F : Finset (CryptBoolean.BooleanFunction n)) : Prop
    def CryptBoolean.HasDistinctFirstOrderCosets
      {n : }
      (F :
        Finset
          (CryptBoolean.BooleanFunction n)) :
      Prop
    Distinct members of `F` represent distinct first-order Reed--Muller cosets. 
  • defdefined in CryptBoolean/Carlet/Chapter04/ReedMullerCosetDistance.lean
    complete
    def CryptBoolean.minimumPairNonlinearity {n : }
      (F : Finset (CryptBoolean.BooleanFunction n)) : 
    def CryptBoolean.minimumPairNonlinearity
      {n : }
      (F :
        Finset
          (CryptBoolean.BooleanFunction n)) :
      
    The minimum nonlinearity of a sum of two distinct representatives, with
    value zero for a family having fewer than two representatives. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/ReedMullerCosetDistance.lean
    complete
    theorem CryptBoolean.mem_firstOrderCosetUnion_iff {n : }
      {F : Finset (CryptBoolean.BooleanFunction n)}
      {c : CryptBoolean.BooleanFunction n} :
      c  CryptBoolean.firstOrderCosetUnion F 
         f  F, c + f  CryptBoolean.reedMuller 1 n
    theorem CryptBoolean.mem_firstOrderCosetUnion_iff
      {n : }
      {F :
        Finset
          (CryptBoolean.BooleanFunction n)}
      {c : CryptBoolean.BooleanFunction n} :
      c 
          CryptBoolean.firstOrderCosetUnion
            F 
         f  F,
          c + f  CryptBoolean.reedMuller 1 n
  • theoremdefined in CryptBoolean/Carlet/Chapter04/ReedMullerCosetDistance.lean
    complete
    theorem CryptBoolean.mem_firstOrderReedMullerCoset_iff {n : }
      {f c : CryptBoolean.BooleanFunction n} :
      c  CryptBoolean.firstOrderReedMullerCoset f 
        c + f  CryptBoolean.reedMuller 1 n
    theorem CryptBoolean.mem_firstOrderReedMullerCoset_iff
      {n : }
      {f c : CryptBoolean.BooleanFunction n} :
      c 
          CryptBoolean.firstOrderReedMullerCoset
            f 
        c + f  CryptBoolean.reedMuller 1 n
  • theoremdefined in CryptBoolean/Carlet/Chapter04/ReedMullerCosetDistance.lean
    complete
    theorem CryptBoolean.firstOrderCosetUnion_pair {n : }
      (f g : CryptBoolean.BooleanFunction n) :
      CryptBoolean.firstOrderCosetUnion {f, g} =
        CryptBoolean.firstOrderReedMullerCoset f 
          CryptBoolean.firstOrderReedMullerCoset g
    theorem CryptBoolean.firstOrderCosetUnion_pair
      {n : }
      (f g : CryptBoolean.BooleanFunction n) :
      CryptBoolean.firstOrderCosetUnion
          {f, g} =
        CryptBoolean.firstOrderReedMullerCoset
            f 
          CryptBoolean.firstOrderReedMullerCoset
            g
    A two-representative union is the union of the corresponding two cosets. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/ReedMullerCosetDistance.lean
    complete
    theorem CryptBoolean.minimumHammingDistance_le {n : }
      {C : Finset (CryptBoolean.BooleanFunction n)}
      (hC : C.offDiag.Nonempty) {f g : CryptBoolean.BooleanFunction n}
      (hf : f  C) (hg : g  C) (hfg : f  g) :
      CryptBoolean.minimumHammingDistance C 
        CryptBoolean.hammingDistance f g
    theorem CryptBoolean.minimumHammingDistance_le
      {n : }
      {C :
        Finset
          (CryptBoolean.BooleanFunction n)}
      (hC : C.offDiag.Nonempty)
      {f g : CryptBoolean.BooleanFunction n}
      (hf : f  C) (hg : g  C)
      (hfg : f  g) :
      CryptBoolean.minimumHammingDistance C 
        CryptBoolean.hammingDistance f g
  • theoremdefined in CryptBoolean/Carlet/Chapter04/ReedMullerCosetDistance.lean
    complete
    theorem CryptBoolean.le_minimumHammingDistance {n : }
      {C : Finset (CryptBoolean.BooleanFunction n)}
      (hC : C.offDiag.Nonempty) {d : }
      (h :
         f : CryptBoolean.BooleanFunction n⦄,
          f  C 
             g : CryptBoolean.BooleanFunction n⦄,
              g  C  f  g  d  CryptBoolean.hammingDistance f g) :
      d  CryptBoolean.minimumHammingDistance C
    theorem CryptBoolean.le_minimumHammingDistance
      {n : }
      {C :
        Finset
          (CryptBoolean.BooleanFunction n)}
      (hC : C.offDiag.Nonempty) {d : }
      (h :
        
          f :
            CryptBoolean.BooleanFunction n⦄,
          f  C 
            
              g :
                CryptBoolean.BooleanFunction
                  n⦄,
              g  C 
                f  g 
                  d 
                    CryptBoolean.hammingDistance
                      f g) :
      d 
        CryptBoolean.minimumHammingDistance C
  • theoremdefined in CryptBoolean/Carlet/Chapter04/ReedMullerCosetDistance.lean
    complete
    theorem CryptBoolean.minimumPairNonlinearity_le {n : }
      {F : Finset (CryptBoolean.BooleanFunction n)}
      (hF : F.offDiag.Nonempty) {f g : CryptBoolean.BooleanFunction n}
      (hf : f  F) (hg : g  F) (hfg : f  g) :
      CryptBoolean.minimumPairNonlinearity F 
        CryptBoolean.nonlinearity (f + g)
    theorem CryptBoolean.minimumPairNonlinearity_le
      {n : }
      {F :
        Finset
          (CryptBoolean.BooleanFunction n)}
      (hF : F.offDiag.Nonempty)
      {f g : CryptBoolean.BooleanFunction n}
      (hf : f  F) (hg : g  F)
      (hfg : f  g) :
      CryptBoolean.minimumPairNonlinearity F 
        CryptBoolean.nonlinearity (f + g)
  • theoremdefined in CryptBoolean/Carlet/Chapter04/ReedMullerCosetDistance.lean
    complete
    theorem CryptBoolean.le_minimumPairNonlinearity {n : }
      {F : Finset (CryptBoolean.BooleanFunction n)}
      (hF : F.offDiag.Nonempty) {d : }
      (h :
         f : CryptBoolean.BooleanFunction n⦄,
          f  F 
             g : CryptBoolean.BooleanFunction n⦄,
              g  F  f  g  d  CryptBoolean.nonlinearity (f + g)) :
      d  CryptBoolean.minimumPairNonlinearity F
    theorem CryptBoolean.le_minimumPairNonlinearity
      {n : }
      {F :
        Finset
          (CryptBoolean.BooleanFunction n)}
      (hF : F.offDiag.Nonempty) {d : }
      (h :
        
          f :
            CryptBoolean.BooleanFunction n⦄,
          f  F 
            
              g :
                CryptBoolean.BooleanFunction
                  n⦄,
              g  F 
                f  g 
                  d 
                    CryptBoolean.nonlinearity
                      (f + g)) :
      d 
        CryptBoolean.minimumPairNonlinearity F
  • theoremdefined in CryptBoolean/Carlet/Chapter04/ReedMullerCosetDistance.lean
    complete
    theorem CryptBoolean.hammingDistance_add_right {n : }
      (f g h : CryptBoolean.BooleanFunction n) :
      CryptBoolean.hammingDistance (f + h) (g + h) =
        CryptBoolean.hammingDistance f g
    theorem CryptBoolean.hammingDistance_add_right
      {n : }
      (f g h :
        CryptBoolean.BooleanFunction n) :
      CryptBoolean.hammingDistance (f + h)
          (g + h) =
        CryptBoolean.hammingDistance f g
    Adding the same Boolean function to both endpoints preserves Hamming distance. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/ReedMullerCosetDistance.lean
    complete
    theorem CryptBoolean.hammingDistance_eq_cosetDifference {n : }
      (c d f g : CryptBoolean.BooleanFunction n) :
      CryptBoolean.hammingDistance c d =
        CryptBoolean.hammingDistance (f + g) (c + f + (d + g))
    theorem CryptBoolean.hammingDistance_eq_cosetDifference
      {n : }
      (c d f g :
        CryptBoolean.BooleanFunction n) :
      CryptBoolean.hammingDistance c d =
        CryptBoolean.hammingDistance (f + g)
          (c + f + (d + g))
    Distances between two coset words are distances from the sum of their
    representatives to a first-order Reed--Muller word. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/ReedMullerCosetDistance.lean
    complete
    theorem CryptBoolean.nonlinearity_le_hammingDistance_of_mem_cosets {n : }
      {c d f g : CryptBoolean.BooleanFunction n}
      (hc : c + f  CryptBoolean.reedMuller 1 n)
      (hd : d + g  CryptBoolean.reedMuller 1 n) :
      CryptBoolean.nonlinearity (f + g)  CryptBoolean.hammingDistance c d
    theorem CryptBoolean.nonlinearity_le_hammingDistance_of_mem_cosets
      {n : }
      {c d f g :
        CryptBoolean.BooleanFunction n}
      (hc :
        c + f  CryptBoolean.reedMuller 1 n)
      (hd :
        d + g  CryptBoolean.reedMuller 1 n) :
      CryptBoolean.nonlinearity (f + g) 
        CryptBoolean.hammingDistance c d
    The representative-sum nonlinearity lower-bounds every distance between
    the corresponding first-order Reed--Muller cosets. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/ReedMullerCosetDistance.lean
    complete
    theorem CryptBoolean.nonlinearity_le_two_pow_sub_one {n : } (hn : 0 < n)
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.nonlinearity f  2 ^ (n - 1)
    theorem CryptBoolean.nonlinearity_le_two_pow_sub_one
      {n : } (hn : 0 < n)
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.nonlinearity f 
        2 ^ (n - 1)
    Ordinary nonlinearity never exceeds half the cube size in positive dimension. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/ReedMullerCosetDistance.lean
    complete
    theorem CryptBoolean.exists_pair_nonlinearity_eq_minimumPairNonlinearity {n : }
      {F : Finset (CryptBoolean.BooleanFunction n)}
      (hF : F.offDiag.Nonempty) :
       f  F,
         g  F,
          f  g 
            CryptBoolean.nonlinearity (f + g) =
              CryptBoolean.minimumPairNonlinearity F
    theorem CryptBoolean.exists_pair_nonlinearity_eq_minimumPairNonlinearity
      {n : }
      {F :
        Finset
          (CryptBoolean.BooleanFunction n)}
      (hF : F.offDiag.Nonempty) :
       f  F,
         g  F,
          f  g 
            CryptBoolean.nonlinearity
                (f + g) =
              CryptBoolean.minimumPairNonlinearity
                F
    A nontrivial finite representative family has a pair attaining its minimum
    pair nonlinearity. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/ReedMullerCosetDistance.lean
    complete
    theorem CryptBoolean.firstOrderCosetUnion_offDiag_nonempty {n : }
      {F : Finset (CryptBoolean.BooleanFunction n)}
      (hF : F.offDiag.Nonempty) :
      (CryptBoolean.firstOrderCosetUnion F).offDiag.Nonempty
    theorem CryptBoolean.firstOrderCosetUnion_offDiag_nonempty
      {n : }
      {F :
        Finset
          (CryptBoolean.BooleanFunction n)}
      (hF : F.offDiag.Nonempty) :
      (CryptBoolean.firstOrderCosetUnion
            F).offDiag.Nonempty
    A nontrivial family of representatives yields at least two words in its
    union of first-order Reed--Muller cosets. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/ReedMullerCosetDistance.lean
    complete
    theorem CryptBoolean.dimension_pos_of_hasDistinctFirstOrderCosets {n : }
      {F : Finset (CryptBoolean.BooleanFunction n)}
      (hF : F.offDiag.Nonempty)
      (hcosets : CryptBoolean.HasDistinctFirstOrderCosets F) : 0 < n
    theorem CryptBoolean.dimension_pos_of_hasDistinctFirstOrderCosets
      {n : }
      {F :
        Finset
          (CryptBoolean.BooleanFunction n)}
      (hF : F.offDiag.Nonempty)
      (hcosets :
        CryptBoolean.HasDistinctFirstOrderCosets
          F) :
      0 < n
    Distinct first-order Reed--Muller cosets cannot occur in dimension zero. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/ReedMullerCosetDistance.lean
    complete
    theorem CryptBoolean.two_pow_sub_one_le_hammingDistance_of_mem_same_coset
      {n : } {c d f : CryptBoolean.BooleanFunction n}
      (hc : c + f  CryptBoolean.reedMuller 1 n)
      (hd : d + f  CryptBoolean.reedMuller 1 n) (hcd : c  d) :
      2 ^ (n - 1)  CryptBoolean.hammingDistance c d
    theorem CryptBoolean.two_pow_sub_one_le_hammingDistance_of_mem_same_coset
      {n : }
      {c d f : CryptBoolean.BooleanFunction n}
      (hc :
        c + f  CryptBoolean.reedMuller 1 n)
      (hd :
        d + f  CryptBoolean.reedMuller 1 n)
      (hcd : c  d) :
      2 ^ (n - 1) 
        CryptBoolean.hammingDistance c d
    Distinct words in the same first-order Reed--Muller coset have distance at
    least half the cube size. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/ReedMullerCosetDistance.lean
    complete
    theorem CryptBoolean.minimumPairNonlinearity_le_two_pow_sub_one {n : }
      {F : Finset (CryptBoolean.BooleanFunction n)}
      (hF : F.offDiag.Nonempty) (hn : 0 < n) :
      CryptBoolean.minimumPairNonlinearity F  2 ^ (n - 1)
    theorem CryptBoolean.minimumPairNonlinearity_le_two_pow_sub_one
      {n : }
      {F :
        Finset
          (CryptBoolean.BooleanFunction n)}
      (hF : F.offDiag.Nonempty) (hn : 0 < n) :
      CryptBoolean.minimumPairNonlinearity F 
        2 ^ (n - 1)
    The minimum pair nonlinearity of distinct coset representatives is at
    most half the cube size. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/ReedMullerCosetDistance.lean
    complete
    theorem CryptBoolean.minimumHammingDistance_firstOrderCosetUnion {n : }
      {F : Finset (CryptBoolean.BooleanFunction n)}
      (hF : F.offDiag.Nonempty)
      (hcosets : CryptBoolean.HasDistinctFirstOrderCosets F) :
      CryptBoolean.minimumHammingDistance
          (CryptBoolean.firstOrderCosetUnion F) =
        CryptBoolean.minimumPairNonlinearity F
    theorem CryptBoolean.minimumHammingDistance_firstOrderCosetUnion
      {n : }
      {F :
        Finset
          (CryptBoolean.BooleanFunction n)}
      (hF : F.offDiag.Nonempty)
      (hcosets :
        CryptBoolean.HasDistinctFirstOrderCosets
          F) :
      CryptBoolean.minimumHammingDistance
          (CryptBoolean.firstOrderCosetUnion
            F) =
        CryptBoolean.minimumPairNonlinearity F
    The corrected finite-family form of Carlet's Reed--Muller coset identity:
    the cosets represented by distinct members of `F` must themselves be distinct. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/ReedMullerCosetDistance.lean
    complete
    theorem CryptBoolean.hasDistinctFirstOrderCosets_pair_zero {n : }
      {f : CryptBoolean.BooleanFunction n}
      (hf : f  CryptBoolean.reedMuller 1 n) :
      CryptBoolean.HasDistinctFirstOrderCosets {0, f}
    theorem CryptBoolean.hasDistinctFirstOrderCosets_pair_zero
      {n : }
      {f : CryptBoolean.BooleanFunction n}
      (hf : f  CryptBoolean.reedMuller 1 n) :
      CryptBoolean.HasDistinctFirstOrderCosets
        {0, f}
    The pair `{0,f}` represents distinct first-order Reed--Muller cosets
    exactly when `f` is not affine. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/ReedMullerCosetDistance.lean
    complete
    theorem CryptBoolean.minimumPairNonlinearity_pair_zero {n : }
      {f : CryptBoolean.BooleanFunction n}
      (hf : f  CryptBoolean.reedMuller 1 n) :
      CryptBoolean.minimumPairNonlinearity {0, f} =
        CryptBoolean.nonlinearity f
    theorem CryptBoolean.minimumPairNonlinearity_pair_zero
      {n : }
      {f : CryptBoolean.BooleanFunction n}
      (hf : f  CryptBoolean.reedMuller 1 n) :
      CryptBoolean.minimumPairNonlinearity
          {0, f} =
        CryptBoolean.nonlinearity f
    For a non-affine `f`, the only representative-pair nonlinearity of
    `{0,f}` is the nonlinearity of `f`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/ReedMullerCosetDistance.lean
    complete
    theorem CryptBoolean.minimumHammingDistance_two_firstOrderReedMullerCosets
      {n : } {f : CryptBoolean.BooleanFunction n}
      (hf : f  CryptBoolean.reedMuller 1 n) :
      CryptBoolean.minimumHammingDistance
          (CryptBoolean.firstOrderReedMullerCoset 0 
            CryptBoolean.firstOrderReedMullerCoset f) =
        CryptBoolean.nonlinearity f
    theorem CryptBoolean.minimumHammingDistance_two_firstOrderReedMullerCosets
      {n : }
      {f : CryptBoolean.BooleanFunction n}
      (hf : f  CryptBoolean.reedMuller 1 n) :
      CryptBoolean.minimumHammingDistance
          (CryptBoolean.firstOrderReedMullerCoset
              0 
            CryptBoolean.firstOrderReedMullerCoset
              f) =
        CryptBoolean.nonlinearity f
    Corrected two-coset identity: if `f` is non-affine, its nonlinearity is
    the minimum distance of `R(1,n) ∪ (f + R(1,n))`. 

The source omits the distinct-coset hypothesis. Without it the displayed equality is false: for affine f, the two listed cosets coincide. The theorem above includes the necessary hypothesis explicitly.

Theorem3.2.21
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 4
Statement dependency previews
Preview
Definition 1.10.1
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
used by 0L∃∀N

Derivative bounds for nonlinearity (Carlet, Relation (37), pp. 52--53). For \Delta_f(e)=\sum_x(-1)^{D_ef(x)}, one has \operatorname{nl}(f) \le2^{n-1}-\frac12 \sqrt{2^n+\max_{e\ne0}|\Delta_f(e)|} and \operatorname{nl}(f) \ge2^{n-2}-\frac14\min_{e\ne0}|\Delta_f(e)|.

Lean code for Theorem3.2.216 declarations
  • defdefined in CryptBoolean/Carlet/Chapter04/DerivativeNonlinearity.lean
    complete
    def CryptBoolean.minimumAutocorrelationMagnitude {n : }
      (f : CryptBoolean.BooleanFunction n) : 
    def CryptBoolean.minimumAutocorrelationMagnitude
      {n : }
      (f : CryptBoolean.BooleanFunction n) : 
    The least absolute autocorrelation at a nonzero direction. In dimension zero the empty
    family is assigned the value zero. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/DerivativeNonlinearity.lean
    complete
    theorem CryptBoolean.autocorrelation_add_of_isLinearStructure {n : }
      (f g : CryptBoolean.BooleanFunction n) {e : FABL.F₂Cube n}
      {ε : FABL.𝔽₂}
      (hg :  (x : FABL.F₂Cube n), FABL.booleanDerivative g e x = ε) :
      CryptBoolean.autocorrelation (f + g) e =
        (CryptBoolean.bitSignInt ε) * CryptBoolean.autocorrelation f e
    theorem CryptBoolean.autocorrelation_add_of_isLinearStructure
      {n : }
      (f g : CryptBoolean.BooleanFunction n)
      {e : FABL.F₂Cube n} {ε : FABL.𝔽₂}
      (hg :
         (x : FABL.F₂Cube n),
          FABL.booleanDerivative g e x = ε) :
      CryptBoolean.autocorrelation (f + g) e =
        (CryptBoolean.bitSignInt ε) *
          CryptBoolean.autocorrelation f e
    Adding a function with constant derivative changes autocorrelation in that direction only by
    the sign of the derivative constant. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/DerivativeNonlinearity.lean
    complete
    theorem CryptBoolean.abs_autocorrelation_add_of_isLinearStructure {n : }
      (f g : CryptBoolean.BooleanFunction n) {e : FABL.F₂Cube n}
      {ε : FABL.𝔽₂}
      (hg :  (x : FABL.F₂Cube n), FABL.booleanDerivative g e x = ε) :
      |CryptBoolean.autocorrelation (f + g) e| =
        |CryptBoolean.autocorrelation f e|
    theorem CryptBoolean.abs_autocorrelation_add_of_isLinearStructure
      {n : }
      (f g : CryptBoolean.BooleanFunction n)
      {e : FABL.F₂Cube n} {ε : FABL.𝔽₂}
      (hg :
         (x : FABL.F₂Cube n),
          FABL.booleanDerivative g e x = ε) :
      |CryptBoolean.autocorrelation (f + g)
            e| =
        |CryptBoolean.autocorrelation f e|
    Adding a function with constant derivative preserves the autocorrelation magnitude in that
    direction. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/DerivativeNonlinearity.lean
    complete
    theorem CryptBoolean.exists_abs_autocorrelation_eq_absoluteIndicator {n : }
      (hn : 0 < n) (f : CryptBoolean.BooleanFunction n) :
       e,
        e  0 
          |CryptBoolean.autocorrelation f e| =
            CryptBoolean.absoluteIndicator f
    theorem CryptBoolean.exists_abs_autocorrelation_eq_absoluteIndicator
      {n : } (hn : 0 < n)
      (f : CryptBoolean.BooleanFunction n) :
       e,
        e  0 
          |CryptBoolean.autocorrelation f e| =
            CryptBoolean.absoluteIndicator f
    In positive dimension Carlet's absolute indicator is attained at a nonzero direction. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/DerivativeNonlinearity.lean
    complete
    theorem CryptBoolean.nonlinearity_cast_le_autocorrelation_upper_bound {n : }
      (f : CryptBoolean.BooleanFunction n) (hn : 0 < n) :
      (CryptBoolean.nonlinearity f) 
        2 ^ (n - 1) - (2 ^ n + CryptBoolean.absoluteIndicator f) / 2
    theorem CryptBoolean.nonlinearity_cast_le_autocorrelation_upper_bound
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hn : 0 < n) :
      (CryptBoolean.nonlinearity f) 
        2 ^ (n - 1) -
          (2 ^ n +
                CryptBoolean.absoluteIndicator
                  f) /
            2
    Carlet's upper derivative bound: the largest nonzero autocorrelation magnitude improves the
    universal upper bound on raw nonlinearity. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/DerivativeNonlinearity.lean
    complete
    theorem CryptBoolean.relation_37_nonlinearity_lower_bound {n : }
      (f : CryptBoolean.BooleanFunction n) (hn : 0 < n) :
      2 ^ (n - 2) - CryptBoolean.minimumAutocorrelationMagnitude f / 4 
        (CryptBoolean.nonlinearity f)
    theorem CryptBoolean.relation_37_nonlinearity_lower_bound
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hn : 0 < n) :
      2 ^ (n - 2) -
          CryptBoolean.minimumAutocorrelationMagnitude
              f /
            4 
        (CryptBoolean.nonlinearity f)
    Carlet Relation (37): the least nonzero autocorrelation magnitude gives a lower bound on raw
    nonlinearity. The real exponent preserves the printed power in every positive dimension. 
Corollary3.2.22
Group: Chapter 3: Boolean functions and cryptography (72)
Group member previews
Preview
Theorem 3.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
uses 1used by 0L∃∀N

Odd-weighting subspace bound (Carlet, p. 53). If f admits a maximal odd-weighting subspace E of dimension d\ge2, then \operatorname{nl}(f)\ge2^{n-d}.

Lean code for Corollary3.2.226 declarations
  • defdefined in CryptBoolean/Carlet/Chapter04/OddWeightingNonlinearity.lean
    complete
    def CryptBoolean.subspaceCosetWeight {n : }
      (f : CryptBoolean.BooleanFunction n)
      (E : Submodule FABL.𝔽₂ (FABL.F₂Cube n)) (a : FABL.F₂Cube n) : 
    def CryptBoolean.subspaceCosetWeight {n : }
      (f : CryptBoolean.BooleanFunction n)
      (E : Submodule FABL.𝔽₂ (FABL.F₂Cube n))
      (a : FABL.F₂Cube n) : 
    The weight of the restriction of `f` to the affine coset `a + E`, parameterized by `E`. 
  • defdefined in CryptBoolean/Carlet/Chapter04/OddWeightingNonlinearity.lean
    complete
    def CryptBoolean.IsMaximalOddWeightingSubspace {n : }
      (f : CryptBoolean.BooleanFunction n)
      (E : Submodule FABL.𝔽₂ (FABL.F₂Cube n)) : Prop
    def CryptBoolean.IsMaximalOddWeightingSubspace
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (E :
        Submodule FABL.𝔽₂ (FABL.F₂Cube n)) :
      Prop
    A maximal odd-weighting subspace in Carlet's equivalent all-cosets formulation. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/OddWeightingNonlinearity.lean
    complete
    theorem CryptBoolean.hammingWeight_lower_bound_of_isMaximalOddWeightingSubspace
      {n : } (f : CryptBoolean.BooleanFunction n)
      (E : Submodule FABL.𝔽₂ (FABL.F₂Cube n))
      (hE : CryptBoolean.IsMaximalOddWeightingSubspace f E) :
      2 ^ (n - Module.finrank FABL.𝔽₂ E)  CryptBoolean.hammingWeight f
    theorem CryptBoolean.hammingWeight_lower_bound_of_isMaximalOddWeightingSubspace
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (E : Submodule FABL.𝔽₂ (FABL.F₂Cube n))
      (hE :
        CryptBoolean.IsMaximalOddWeightingSubspace
          f E) :
      2 ^ (n - Module.finrank FABL.𝔽₂ E) 
        CryptBoolean.hammingWeight f
    Carlet Chapter 3, Remark 2: a maximal odd-weighting subspace forces a weight lower bound. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/OddWeightingNonlinearity.lean
    complete
    theorem CryptBoolean.isMaximalOddWeightingSubspace_add_affineFunction {n : }
      (f : CryptBoolean.BooleanFunction n)
      (E : Submodule FABL.𝔽₂ (FABL.F₂Cube n))
      (hfinrank : 2  Module.finrank FABL.𝔽₂ E)
      (hE : CryptBoolean.IsMaximalOddWeightingSubspace f E) (b : FABL.𝔽₂)
      (c : FABL.F₂Cube n) :
      CryptBoolean.IsMaximalOddWeightingSubspace
        (f + FABL.affineFunction b c) E
    theorem CryptBoolean.isMaximalOddWeightingSubspace_add_affineFunction
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (E : Submodule FABL.𝔽₂ (FABL.F₂Cube n))
      (hfinrank :
        2  Module.finrank FABL.𝔽₂ E)
      (hE :
        CryptBoolean.IsMaximalOddWeightingSubspace
          f E)
      (b : FABL.𝔽₂) (c : FABL.F₂Cube n) :
      CryptBoolean.IsMaximalOddWeightingSubspace
        (f + FABL.affineFunction b c) E
    Adding an affine function preserves a maximal odd-weighting subspace of dimension at least
    two. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/OddWeightingNonlinearity.lean
    complete
    theorem CryptBoolean.hammingWeight_lower_bound_of_maximalOddWeightingSubspace
      {n d : } (f : CryptBoolean.BooleanFunction n)
      (E : Submodule FABL.𝔽₂ (FABL.F₂Cube n))
      (hdim : Module.finrank FABL.𝔽₂ E = d)
      (hE : CryptBoolean.IsMaximalOddWeightingSubspace f E) :
      2 ^ (n - d)  CryptBoolean.hammingWeight f
    theorem CryptBoolean.hammingWeight_lower_bound_of_maximalOddWeightingSubspace
      {n d : }
      (f : CryptBoolean.BooleanFunction n)
      (E : Submodule FABL.𝔽₂ (FABL.F₂Cube n))
      (hdim : Module.finrank FABL.𝔽₂ E = d)
      (hE :
        CryptBoolean.IsMaximalOddWeightingSubspace
          f E) :
      2 ^ (n - d) 
        CryptBoolean.hammingWeight f
    The dimension-indexed form of Carlet Chapter 3, Remark 2. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/OddWeightingNonlinearity.lean
    complete
    theorem CryptBoolean.nonlinearity_lower_bound_of_maximalOddWeightingSubspace
      {n d : } (f : CryptBoolean.BooleanFunction n)
      (E : Submodule FABL.𝔽₂ (FABL.F₂Cube n))
      (hdim : Module.finrank FABL.𝔽₂ E = d) (hd : 2  d)
      (hE : CryptBoolean.IsMaximalOddWeightingSubspace f E) :
      2 ^ (n - d)  CryptBoolean.nonlinearity f
    theorem CryptBoolean.nonlinearity_lower_bound_of_maximalOddWeightingSubspace
      {n d : }
      (f : CryptBoolean.BooleanFunction n)
      (E : Submodule FABL.𝔽₂ (FABL.F₂Cube n))
      (hdim : Module.finrank FABL.𝔽₂ E = d)
      (hd : 2  d)
      (hE :
        CryptBoolean.IsMaximalOddWeightingSubspace
          f E) :
      2 ^ (n - d) 
        CryptBoolean.nonlinearity f
    Carlet Chapter 4: a `d`-dimensional maximal odd-weighting subspace with `d ≥ 2`
    forces nonlinearity at least `2^(n-d)`.