Cryptographic Boolean Functions in Lean

4.2. Quadratic functions🔗

Definition4.2.1
Group: Chapter 4: Classes with Provable Spectra and Weights (30)
Group member previews
Preview
Theorem 4.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 3
Statement dependency previews
Preview
Definition 1.10.1
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
Used by 5
Reverse dependency previews
Preview
Theorem 4.2.2
Loading preview
Reverse dependency preview content is loaded from the rendered-fragment cache.
L∃∀N

Quadratic symplectic form (Carlet, Section 5.2, pp. 68--69). A quadratic Boolean function is an element f\in R(2,n), equivalently a function of algebraic degree at most two. Define \varphi_f(x,y)=f(0)+f(x)+f(y)+f(x+y). Then \varphi_f is bilinear, symmetric, and alternating. Its radical is exactly the linear kernel E_f=\{b\in V_n:D_bf\text{ is constant}\}, and the map b\mapsto D_bf(0)=f(b)+f(0) is linear on E_f.

Lean code for Definition4.2.117 declarations
  • defdefined in CryptBoolean/Carlet/Chapter04/QuadraticPolar.lean
    complete
    def CryptBoolean.quadraticPolarKernel {n : }
      (f : CryptBoolean.BooleanFunction n) (a b : FABL.F₂Cube n) : FABL.𝔽₂
    def CryptBoolean.quadraticPolarKernel {n : }
      (f : CryptBoolean.BooleanFunction n)
      (a b : FABL.F₂Cube n) : FABL.𝔽₂
  • theoremdefined in CryptBoolean/Carlet/Chapter04/QuadraticPolar.lean
    complete
    theorem CryptBoolean.quadraticPolarKernel_eq {n : }
      (f : CryptBoolean.BooleanFunction n) (a b : FABL.F₂Cube n) :
      CryptBoolean.quadraticPolarKernel f a b = f (a + b) + f a + f b + f 0
    theorem CryptBoolean.quadraticPolarKernel_eq
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (a b : FABL.F₂Cube n) :
      CryptBoolean.quadraticPolarKernel f a
          b =
        f (a + b) + f a + f b + f 0
  • theoremdefined in CryptBoolean/Carlet/Chapter04/QuadraticPolar.lean
    complete
    theorem CryptBoolean.quadraticPolarKernel_comm {n : }
      (f : CryptBoolean.BooleanFunction n) (a b : FABL.F₂Cube n) :
      CryptBoolean.quadraticPolarKernel f a b =
        CryptBoolean.quadraticPolarKernel f b a
    theorem CryptBoolean.quadraticPolarKernel_comm
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (a b : FABL.F₂Cube n) :
      CryptBoolean.quadraticPolarKernel f a
          b =
        CryptBoolean.quadraticPolarKernel f b
          a
  • theoremdefined in CryptBoolean/Carlet/Chapter04/QuadraticPolar.lean
    complete
    theorem CryptBoolean.quadraticPolarKernel_eq_dotProduct_of_derivative_eq_affine
      {n : } (f : CryptBoolean.BooleanFunction n) (a b : FABL.F₂Cube n)
      (d : FABL.𝔽₂) (u : FABL.F₂Cube n)
      (hderivative : FABL.booleanDerivative f a = FABL.affineFunction d u) :
      CryptBoolean.quadraticPolarKernel f a b = FABL.f₂DotProduct u b
    theorem CryptBoolean.quadraticPolarKernel_eq_dotProduct_of_derivative_eq_affine
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (a b : FABL.F₂Cube n) (d : FABL.𝔽₂)
      (u : FABL.F₂Cube n)
      (hderivative :
        FABL.booleanDerivative f a =
          FABL.affineFunction d u) :
      CryptBoolean.quadraticPolarKernel f a
          b =
        FABL.f₂DotProduct u b
  • theoremdefined in CryptBoolean/Carlet/Chapter04/QuadraticPolar.lean
    complete
    theorem CryptBoolean.quadraticPolarKernel_add_right {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hdegree : FABL.functionAlgebraicDegree f  2)
      (a b c : FABL.F₂Cube n) :
      CryptBoolean.quadraticPolarKernel f a (b + c) =
        CryptBoolean.quadraticPolarKernel f a b +
          CryptBoolean.quadraticPolarKernel f a c
    theorem CryptBoolean.quadraticPolarKernel_add_right
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hdegree :
        FABL.functionAlgebraicDegree f  2)
      (a b c : FABL.F₂Cube n) :
      CryptBoolean.quadraticPolarKernel f a
          (b + c) =
        CryptBoolean.quadraticPolarKernel f a
            b +
          CryptBoolean.quadraticPolarKernel f
            a c
  • theoremdefined in CryptBoolean/Carlet/Chapter04/QuadraticPolar.lean
    complete
    theorem CryptBoolean.quadraticPolarKernel_smul_right {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hdegree : FABL.functionAlgebraicDegree f  2) (a b : FABL.F₂Cube n)
      (c : FABL.𝔽₂) :
      CryptBoolean.quadraticPolarKernel f a (c  b) =
        c  CryptBoolean.quadraticPolarKernel f a b
    theorem CryptBoolean.quadraticPolarKernel_smul_right
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hdegree :
        FABL.functionAlgebraicDegree f  2)
      (a b : FABL.F₂Cube n) (c : FABL.𝔽₂) :
      CryptBoolean.quadraticPolarKernel f a
          (c  b) =
        c 
          CryptBoolean.quadraticPolarKernel f
            a b
  • theoremdefined in CryptBoolean/Carlet/Chapter04/QuadraticPolar.lean
    complete
    theorem CryptBoolean.quadraticPolarKernel_add_left {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hdegree : FABL.functionAlgebraicDegree f  2)
      (a b c : FABL.F₂Cube n) :
      CryptBoolean.quadraticPolarKernel f (a + b) c =
        CryptBoolean.quadraticPolarKernel f a c +
          CryptBoolean.quadraticPolarKernel f b c
    theorem CryptBoolean.quadraticPolarKernel_add_left
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hdegree :
        FABL.functionAlgebraicDegree f  2)
      (a b c : FABL.F₂Cube n) :
      CryptBoolean.quadraticPolarKernel f
          (a + b) c =
        CryptBoolean.quadraticPolarKernel f a
            c +
          CryptBoolean.quadraticPolarKernel f
            b c
  • theoremdefined in CryptBoolean/Carlet/Chapter04/QuadraticPolar.lean
    complete
    theorem CryptBoolean.quadraticPolarKernel_smul_left {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hdegree : FABL.functionAlgebraicDegree f  2) (a b : FABL.F₂Cube n)
      (c : FABL.𝔽₂) :
      CryptBoolean.quadraticPolarKernel f (c  a) b =
        c  CryptBoolean.quadraticPolarKernel f a b
    theorem CryptBoolean.quadraticPolarKernel_smul_left
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hdegree :
        FABL.functionAlgebraicDegree f  2)
      (a b : FABL.F₂Cube n) (c : FABL.𝔽₂) :
      CryptBoolean.quadraticPolarKernel f
          (c  a) b =
        c 
          CryptBoolean.quadraticPolarKernel f
            a b
  • defdefined in CryptBoolean/Carlet/Chapter04/QuadraticPolar.lean
    complete
    def CryptBoolean.quadraticPolar {n : } (f : CryptBoolean.BooleanFunction n)
      (hdegree : FABL.functionAlgebraicDegree f  2) :
      LinearMap.BilinForm FABL.𝔽₂ (FABL.F₂Cube n)
    def CryptBoolean.quadraticPolar {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hdegree :
        FABL.functionAlgebraicDegree f  2) :
      LinearMap.BilinForm FABL.𝔽₂
        (FABL.F₂Cube n)
  • theoremdefined in CryptBoolean/Carlet/Chapter04/QuadraticPolar.lean
    complete
    theorem CryptBoolean.quadraticPolar_apply {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hdegree : FABL.functionAlgebraicDegree f  2) (a b : FABL.F₂Cube n) :
      ((CryptBoolean.quadraticPolar f hdegree) a) b =
        CryptBoolean.quadraticPolarKernel f a b
    theorem CryptBoolean.quadraticPolar_apply {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hdegree :
        FABL.functionAlgebraicDegree f  2)
      (a b : FABL.F₂Cube n) :
      ((CryptBoolean.quadraticPolar f hdegree)
            a)
          b =
        CryptBoolean.quadraticPolarKernel f a
          b
  • theoremdefined in CryptBoolean/Carlet/Chapter04/QuadraticPolar.lean
    complete
    theorem CryptBoolean.quadraticPolar_isSymm {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hdegree : FABL.functionAlgebraicDegree f  2) :
      (CryptBoolean.quadraticPolar f hdegree).IsSymm
    theorem CryptBoolean.quadraticPolar_isSymm {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hdegree :
        FABL.functionAlgebraicDegree f  2) :
      (CryptBoolean.quadraticPolar f
          hdegree).IsSymm
  • theoremdefined in CryptBoolean/Carlet/Chapter04/QuadraticPolar.lean
    complete
    theorem CryptBoolean.quadraticPolar_isAlt {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hdegree : FABL.functionAlgebraicDegree f  2) :
      (CryptBoolean.quadraticPolar f hdegree).IsAlt
    theorem CryptBoolean.quadraticPolar_isAlt {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hdegree :
        FABL.functionAlgebraicDegree f  2) :
      (CryptBoolean.quadraticPolar f
          hdegree).IsAlt
  • defdefined in CryptBoolean/Carlet/Chapter04/QuadraticPolar.lean
    complete
    def CryptBoolean.quadraticRadical {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hdegree : FABL.functionAlgebraicDegree f  2) :
      Submodule FABL.𝔽₂ (FABL.F₂Cube n)
    def CryptBoolean.quadraticRadical {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hdegree :
        FABL.functionAlgebraicDegree f  2) :
      Submodule FABL.𝔽₂ (FABL.F₂Cube n)
    The radical of the polar form of a quadratic Boolean function. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/QuadraticPolar.lean
    complete
    theorem CryptBoolean.mem_quadraticRadical_iff {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hdegree : FABL.functionAlgebraicDegree f  2) (a : FABL.F₂Cube n) :
      a  CryptBoolean.quadraticRadical f hdegree 
         (b : FABL.F₂Cube n), CryptBoolean.quadraticPolarKernel f a b = 0
    theorem CryptBoolean.mem_quadraticRadical_iff
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hdegree :
        FABL.functionAlgebraicDegree f  2)
      (a : FABL.F₂Cube n) :
      a 
          CryptBoolean.quadraticRadical f
            hdegree 
         (b : FABL.F₂Cube n),
          CryptBoolean.quadraticPolarKernel f
              a b =
            0
  • theoremdefined in CryptBoolean/Carlet/Chapter04/QuadraticPolar.lean
    complete
    theorem CryptBoolean.booleanDerivative_eq_const_of_mem_quadraticRadical {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hdegree : FABL.functionAlgebraicDegree f  2) (a : FABL.F₂Cube n)
      (ha : a  CryptBoolean.quadraticRadical f hdegree) :
      FABL.booleanDerivative f a = fun x => f a + f 0
    theorem CryptBoolean.booleanDerivative_eq_const_of_mem_quadraticRadical
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hdegree :
        FABL.functionAlgebraicDegree f  2)
      (a : FABL.F₂Cube n)
      (ha :
        a 
          CryptBoolean.quadraticRadical f
            hdegree) :
      FABL.booleanDerivative f a = fun x =>
        f a + f 0
  • defdefined in CryptBoolean/Carlet/Chapter04/QuadraticPolar.lean
    complete
    def CryptBoolean.quadraticRadicalSignCharacter {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hdegree : FABL.functionAlgebraicDegree f  2) :
      AddChar (CryptBoolean.quadraticRadical f hdegree) 
    def CryptBoolean.quadraticRadicalSignCharacter
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hdegree :
        FABL.functionAlgebraicDegree f  2) :
      AddChar
        (CryptBoolean.quadraticRadical f
            hdegree)
        
    On the radical, the translated quadratic function is an additive
    character after applying the binary sign. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/Quadratic.lean
    complete
    theorem CryptBoolean.quadraticRadical_eq_linearKernel {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hdegree : FABL.functionAlgebraicDegree f  2) :
      CryptBoolean.quadraticRadical f hdegree = CryptBoolean.linearKernel f
    theorem CryptBoolean.quadraticRadical_eq_linearKernel
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hdegree :
        FABL.functionAlgebraicDegree f  2) :
      CryptBoolean.quadraticRadical f
          hdegree =
        CryptBoolean.linearKernel f
    For a quadratic Boolean function, the radical of the polar form is its
    linear kernel. 
Theorem4.2.2
Group: Chapter 4: Classes with Provable Spectra and Weights (30)
Group member previews
Preview
Theorem 4.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 3
Statement dependency previews
Preview
Corollary 1.10.4
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
used by 1L∃∀N

Quadratic kernel-sum identity (Carlet, Relation (41), p. 69). For every quadratic f:V_n\to\mathbb F_2 with linear kernel E_f, one has W_f(0)^2=2^n\sum_{b\in E_f}(-1)^{D_bf(0)}. Consequently, this square equals 2^n|E_f| when f is constant on E_f, and it equals 0 otherwise.

Lean code for Theorem4.2.25 theorems
  • theoremdefined in CryptBoolean/Carlet/Chapter05/Quadratic.lean
    complete
    theorem CryptBoolean.walshTransform_zero_sq_eq_two_pow_mul_sum_quadraticRadical
      {n : } (f : CryptBoolean.BooleanFunction n)
      (hdegree : FABL.functionAlgebraicDegree f  2) :
      (CryptBoolean.walshTransform f 0) ^ 2 =
        2 ^ n *  a, FABL.binarySign (FABL.booleanDerivative f (↑a) 0)
    theorem CryptBoolean.walshTransform_zero_sq_eq_two_pow_mul_sum_quadraticRadical
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hdegree :
        FABL.functionAlgebraicDegree f  2) :
      (CryptBoolean.walshTransform f 0) ^ 2 =
        2 ^ n *
           a,
            FABL.binarySign
              (FABL.booleanDerivative f (↑a)
                0)
    Carlet Relation (41), first in the real character form supplied by
    autocorrelation orthogonality. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/Quadratic.lean
    complete
    theorem CryptBoolean.walshTransform_zero_sq_eq_two_pow_mul_sum_linearKernel
      {n : } (f : CryptBoolean.BooleanFunction n)
      (hdegree : FABL.functionAlgebraicDegree f  2) :
      CryptBoolean.walshTransform f 0 ^ 2 =
        2 ^ n *
           a, CryptBoolean.bitSignInt (FABL.booleanDerivative f (↑a) 0)
    theorem CryptBoolean.walshTransform_zero_sq_eq_two_pow_mul_sum_linearKernel
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hdegree :
        FABL.functionAlgebraicDegree f  2) :
      CryptBoolean.walshTransform f 0 ^ 2 =
        2 ^ n *
           a,
            CryptBoolean.bitSignInt
              (FABL.booleanDerivative f (↑a)
                0)
    Carlet Relation (41) with the source's integer raw Walsh transform and
    linear kernel. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/Quadratic.lean
    complete
    theorem CryptBoolean.quadraticRadicalSignCharacter_eq_zero_iff {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hdegree : FABL.functionAlgebraicDegree f  2) :
      CryptBoolean.quadraticRadicalSignCharacter f hdegree = 0 
         (a : (CryptBoolean.quadraticRadical f hdegree)), f a = f 0
    theorem CryptBoolean.quadraticRadicalSignCharacter_eq_zero_iff
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hdegree :
        FABL.functionAlgebraicDegree f  2) :
      CryptBoolean.quadraticRadicalSignCharacter
            f hdegree =
          0 
        
          (a :
            (CryptBoolean.quadraticRadical f
                hdegree)),
          f a = f 0
    The quadratic radical sign character is trivial exactly when the
    quadratic function is constant on its radical. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/Quadratic.lean
    complete
    theorem CryptBoolean.walshTransform_zero_sq_eq_if_constant_on_quadraticRadical
      {n : } (f : CryptBoolean.BooleanFunction n)
      (hdegree : FABL.functionAlgebraicDegree f  2) :
      (CryptBoolean.walshTransform f 0) ^ 2 =
        if
             (a : (CryptBoolean.quadraticRadical f hdegree)),
              f a = f 0 then
          2 ^ n * (Fintype.card (CryptBoolean.quadraticRadical f hdegree))
        else 0
    theorem CryptBoolean.walshTransform_zero_sq_eq_if_constant_on_quadraticRadical
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hdegree :
        FABL.functionAlgebraicDegree f  2) :
      (CryptBoolean.walshTransform f 0) ^ 2 =
        if
            
              (a :
                (CryptBoolean.quadraticRadical
                    f hdegree)),
              f a = f 0 then
          2 ^ n *
            (Fintype.card
                (CryptBoolean.quadraticRadical
                    f hdegree))
        else 0
    Relation (41) is the radical's cardinality term precisely when the
    restriction is constant, and vanishes otherwise. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/Quadratic.lean
    complete
    theorem CryptBoolean.walshTransform_zero_sq_eq_if_constant_on_linearKernel
      {n : } (f : CryptBoolean.BooleanFunction n)
      (hdegree : FABL.functionAlgebraicDegree f  2) :
      (CryptBoolean.walshTransform f 0) ^ 2 =
        if  (a : (CryptBoolean.linearKernel f)), f a = f 0 then
          2 ^ n * (Fintype.card (CryptBoolean.linearKernel f))
        else 0
    theorem CryptBoolean.walshTransform_zero_sq_eq_if_constant_on_linearKernel
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hdegree :
        FABL.functionAlgebraicDegree f  2) :
      (CryptBoolean.walshTransform f 0) ^ 2 =
        if
            
              (a :
                (CryptBoolean.linearKernel
                    f)),
              f a = f 0 then
          2 ^ n *
            (Fintype.card
                (CryptBoolean.linearKernel
                    f))
        else 0
    Relation (41)'s constant/nonconstant alternative on Carlet's linear
    kernel. 
Theorem4.2.3
Group: Chapter 4: Classes with Provable Spectra and Weights (30)
Group member previews
Preview
Theorem 4.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 2
Statement dependency previews
Preview
Theorem 1.7.3
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
Used by 4
Reverse dependency previews
Preview
Corollary 4.2.4
Loading preview
Reverse dependency preview content is loaded from the rendered-fragment cache.
L∃∀N

Quadratic weight theorem (Carlet, Theorem 4, p. 69). Let n>0, let f:V_n\to\mathbb F_2 be quadratic, and let k=\dim(E_f). Then f is balanced if and only if its restriction to E_f is not constant. If f is not balanced, then n+k is even and w_H(f)=2^{n-1}+2^{(n+k)/2-1} \quad\text{or}\quad w_H(f)=2^{n-1}-2^{(n+k)/2-1}.

Lean code for Theorem4.2.36 theorems
  • theoremdefined in CryptBoolean/Carlet/Chapter05/Quadratic.lean
    complete
    theorem CryptBoolean.isBalanced_iff_not_constant_on_linearKernel_of_degree_le_two
      {n : } (f : CryptBoolean.BooleanFunction n)
      (hdegree : FABL.functionAlgebraicDegree f  2) :
      CryptBoolean.IsBalanced f 
        ¬ (a : (CryptBoolean.linearKernel f)), f a = f 0
    theorem CryptBoolean.isBalanced_iff_not_constant_on_linearKernel_of_degree_le_two
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hdegree :
        FABL.functionAlgebraicDegree f  2) :
      CryptBoolean.IsBalanced f 
        ¬
            (a :
              (CryptBoolean.linearKernel f)),
            f a = f 0
    The balancedness part of Carlet Theorem 4: a quadratic function is
    balanced exactly when its restriction to the linear kernel is nonconstant. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticRank.lean
    complete
    theorem CryptBoolean.even_exponent_of_int_sq_eq_two_pow (z : ) (e : )
      (h : z ^ 2 = 2 ^ e) : Even e
    theorem CryptBoolean.even_exponent_of_int_sq_eq_two_pow
      (z : ) (e : ) (h : z ^ 2 = 2 ^ e) :
      Even e
    If an integer square is a power of two, then its exponent is even. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticWeights.lean
    complete
    theorem CryptBoolean.walshTransform_zero_sq_eq_two_pow_add_finrank_of_not_balanced
      {n : } (f : CryptBoolean.BooleanFunction n)
      (hdegree : FABL.functionAlgebraicDegree f  2)
      (hnotBalanced : ¬CryptBoolean.IsBalanced f) :
      CryptBoolean.walshTransform f 0 ^ 2 =
        2 ^ (n + Module.finrank FABL.𝔽₂ (CryptBoolean.linearKernel f))
    theorem CryptBoolean.walshTransform_zero_sq_eq_two_pow_add_finrank_of_not_balanced
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hdegree :
        FABL.functionAlgebraicDegree f  2)
      (hnotBalanced :
        ¬CryptBoolean.IsBalanced f) :
      CryptBoolean.walshTransform f 0 ^ 2 =
        2 ^
          (n +
            Module.finrank FABL.𝔽₂
              (CryptBoolean.linearKernel f))
    A nonbalanced quadratic function has the kernel-determined Walsh square. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticWeights.lean
    complete
    theorem CryptBoolean.even_dimension_add_finrank_linearKernel_of_not_balanced
      {n : } (f : CryptBoolean.BooleanFunction n)
      (hdegree : FABL.functionAlgebraicDegree f  2)
      (hnotBalanced : ¬CryptBoolean.IsBalanced f) :
      Even (n + Module.finrank FABL.𝔽₂ (CryptBoolean.linearKernel f))
    theorem CryptBoolean.even_dimension_add_finrank_linearKernel_of_not_balanced
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hdegree :
        FABL.functionAlgebraicDegree f  2)
      (hnotBalanced :
        ¬CryptBoolean.IsBalanced f) :
      Even
        (n +
          Module.finrank FABL.𝔽₂
            (CryptBoolean.linearKernel f))
    The dimension plus the linear-kernel dimension is even in the
    nonbalanced case of Carlet Theorem 4. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticWeights.lean
    complete
    theorem CryptBoolean.quadratic_weight_eq_two_pow_sub_or_add {n : }
      (f : CryptBoolean.BooleanFunction n) (hn : 0 < n)
      (hdegree : FABL.functionAlgebraicDegree f  2)
      (hnotBalanced : ¬CryptBoolean.IsBalanced f) :
      CryptBoolean.hammingWeight f =
          2 ^ (n - 1) -
            2 ^
              ((n + Module.finrank FABL.𝔽₂ (CryptBoolean.linearKernel f)) /
                  2 -
                1) 
        CryptBoolean.hammingWeight f =
          2 ^ (n - 1) +
            2 ^
              ((n + Module.finrank FABL.𝔽₂ (CryptBoolean.linearKernel f)) /
                  2 -
                1)
    theorem CryptBoolean.quadratic_weight_eq_two_pow_sub_or_add
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hn : 0 < n)
      (hdegree :
        FABL.functionAlgebraicDegree f  2)
      (hnotBalanced :
        ¬CryptBoolean.IsBalanced f) :
      CryptBoolean.hammingWeight f =
          2 ^ (n - 1) -
            2 ^
              ((n +
                    Module.finrank FABL.𝔽₂
                      (CryptBoolean.linearKernel
                          f)) /
                  2 -
                1) 
        CryptBoolean.hammingWeight f =
          2 ^ (n - 1) +
            2 ^
              ((n +
                    Module.finrank FABL.𝔽₂
                      (CryptBoolean.linearKernel
                          f)) /
                  2 -
                1)
    The nonbalanced weights in Carlet Theorem 4. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticWeights.lean
    complete
    theorem CryptBoolean.theorem_4_quadratic_weight {n : }
      (f : CryptBoolean.BooleanFunction n) (hn : 0 < n)
      (hdegree : FABL.functionAlgebraicDegree f  2) :
      (CryptBoolean.IsBalanced f 
          ¬ (a : (CryptBoolean.linearKernel f)), f a = f 0) 
        (¬CryptBoolean.IsBalanced f 
          Even (n + Module.finrank FABL.𝔽₂ (CryptBoolean.linearKernel f)) 
            (CryptBoolean.hammingWeight f =
                2 ^ (n - 1) -
                  2 ^
                    ((n +
                          Module.finrank FABL.𝔽₂
                            (CryptBoolean.linearKernel f)) /
                        2 -
                      1) 
              CryptBoolean.hammingWeight f =
                2 ^ (n - 1) +
                  2 ^
                    ((n +
                          Module.finrank FABL.𝔽₂
                            (CryptBoolean.linearKernel f)) /
                        2 -
                      1)))
    theorem CryptBoolean.theorem_4_quadratic_weight
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hn : 0 < n)
      (hdegree :
        FABL.functionAlgebraicDegree f  2) :
      (CryptBoolean.IsBalanced f 
          ¬
              (a :
                (CryptBoolean.linearKernel
                    f)),
              f a = f 0) 
        (¬CryptBoolean.IsBalanced f 
          Even
              (n +
                Module.finrank FABL.𝔽₂
                  (CryptBoolean.linearKernel
                      f)) 
            (CryptBoolean.hammingWeight f =
                2 ^ (n - 1) -
                  2 ^
                    ((n +
                          Module.finrank
                            FABL.𝔽₂
                            (CryptBoolean.linearKernel
                                f)) /
                        2 -
                      1) 
              CryptBoolean.hammingWeight f =
                2 ^ (n - 1) +
                  2 ^
                    ((n +
                          Module.finrank
                            FABL.𝔽₂
                            (CryptBoolean.linearKernel
                                f)) /
                        2 -
                      1)))
    Carlet Theorem 4, including balancedness, parity, and the two possible
    nonbalanced weights. 

The condition n>0 ensures that the exponent (n+k)/2-1 is a natural number.

Corollary4.2.4
Group: Chapter 4: Classes with Provable Spectra and Weights (30)
Group member previews
Preview
Theorem 4.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 2
Statement dependency previews
Preview
Definition 4.2.1
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
used by 0L∃∀N

Balanced quadratic derivative criterion (Carlet, consequence after Theorem 4, p. 69). A quadratic Boolean function f is balanced if and only if there exists b\in V_n such that D_bf=1. Every such direction belongs to E_f and satisfies f(b)\ne f(0).

Lean code for Corollary4.2.44 theorems
  • theoremdefined in CryptBoolean/Carlet/Chapter05/Quadratic.lean
    complete
    theorem CryptBoolean.isBalanced_iff_quadraticRadicalSignCharacter_ne_zero
      {n : } (f : CryptBoolean.BooleanFunction n)
      (hdegree : FABL.functionAlgebraicDegree f  2) :
      CryptBoolean.IsBalanced f 
        CryptBoolean.quadraticRadicalSignCharacter f hdegree  0
    theorem CryptBoolean.isBalanced_iff_quadraticRadicalSignCharacter_ne_zero
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hdegree :
        FABL.functionAlgebraicDegree f  2) :
      CryptBoolean.IsBalanced f 
        CryptBoolean.quadraticRadicalSignCharacter
            f hdegree 
          0
    A quadratic function is balanced exactly when its radical character is
    nontrivial. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/Quadratic.lean
    complete
    theorem CryptBoolean.quadraticRadicalSignCharacter_ne_zero_iff_exists_derivative_one
      {n : } (f : CryptBoolean.BooleanFunction n)
      (hdegree : FABL.functionAlgebraicDegree f  2) :
      CryptBoolean.quadraticRadicalSignCharacter f hdegree  0 
         a, FABL.booleanDerivative f a = 1
    theorem CryptBoolean.quadraticRadicalSignCharacter_ne_zero_iff_exists_derivative_one
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hdegree :
        FABL.functionAlgebraicDegree f  2) :
      CryptBoolean.quadraticRadicalSignCharacter
            f hdegree 
          0 
         a, FABL.booleanDerivative f a = 1
    The radical character is nontrivial exactly when some directional
    derivative is the constant-one function. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/Quadratic.lean
    complete
    theorem CryptBoolean.isBalanced_iff_exists_booleanDerivative_eq_one_of_degree_le_two
      {n : } (f : CryptBoolean.BooleanFunction n)
      (hdegree : FABL.functionAlgebraicDegree f  2) :
      CryptBoolean.IsBalanced f   a, FABL.booleanDerivative f a = 1
    theorem CryptBoolean.isBalanced_iff_exists_booleanDerivative_eq_one_of_degree_le_two
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hdegree :
        FABL.functionAlgebraicDegree f  2) :
      CryptBoolean.IsBalanced f 
         a, FABL.booleanDerivative f a = 1
    A quadratic Boolean function is balanced exactly when one of its
    directional derivatives is the constant-one function. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/Quadratic.lean
    complete
    theorem CryptBoolean.mem_linearKernel_and_ne_zero_value_of_booleanDerivative_eq_one
      {n : } (f : CryptBoolean.BooleanFunction n) (a : FABL.F₂Cube n)
      (hderivative : FABL.booleanDerivative f a = 1) :
      a  CryptBoolean.linearKernel f  f a  f 0
    theorem CryptBoolean.mem_linearKernel_and_ne_zero_value_of_booleanDerivative_eq_one
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (a : FABL.F₂Cube n)
      (hderivative :
        FABL.booleanDerivative f a = 1) :
      a  CryptBoolean.linearKernel f 
        f a  f 0
    A constant-one derivative direction lies in the linear kernel and changes
    the value of the quadratic function from its value at zero. 
Corollary4.2.5
Group: Chapter 4: Classes with Provable Spectra and Weights (30)
Group member previews
Preview
Theorem 4.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 3
Statement dependency previews
Preview
Theorem 1.9.2
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
used by 1L∃∀N

Even symplectic rank (Carlet, consequence after Theorem 4, p. 69). For every quadratic Boolean function f, the codimension of its linear kernel E_f is even. Equivalently, the alternating bilinear form \varphi_f has even rank.

Lean code for Corollary4.2.55 theorems
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticRank.lean
    complete
    theorem CryptBoolean.booleanDerivative_add_affineFunction {n : }
      (f : CryptBoolean.BooleanFunction n) (c : FABL.𝔽₂)
      (u a : FABL.F₂Cube n) :
      FABL.booleanDerivative (fun x => f x + FABL.affineFunction c u x) a =
        fun x => FABL.booleanDerivative f a x + FABL.f₂DotProduct u a
    theorem CryptBoolean.booleanDerivative_add_affineFunction
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (c : FABL.𝔽₂) (u a : FABL.F₂Cube n) :
      FABL.booleanDerivative
          (fun x =>
            f x + FABL.affineFunction c u x)
          a =
        fun x =>
        FABL.booleanDerivative f a x +
          FABL.f₂DotProduct u a
    Adding an affine function changes every directional derivative by a constant. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticRank.lean
    complete
    theorem CryptBoolean.linearKernel_add_affineFunction {n : }
      (f : CryptBoolean.BooleanFunction n) (c : FABL.𝔽₂)
      (u : FABL.F₂Cube n) :
      (CryptBoolean.linearKernel fun x => f x + FABL.affineFunction c u x) =
        CryptBoolean.linearKernel f
    theorem CryptBoolean.linearKernel_add_affineFunction
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (c : FABL.𝔽₂) (u : FABL.F₂Cube n) :
      (CryptBoolean.linearKernel fun x =>
          f x + FABL.affineFunction c u x) =
        CryptBoolean.linearKernel f
    Adding an affine function preserves the linear kernel. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticRank.lean
    complete
    theorem CryptBoolean.walshTransform_add_linearFunction_zero {n : }
      (f : CryptBoolean.BooleanFunction n) (u : FABL.F₂Cube n) :
      CryptBoolean.walshTransform (fun x => f x + FABL.affineFunction 0 u x)
          0 =
        CryptBoolean.walshTransform f u
    theorem CryptBoolean.walshTransform_add_linearFunction_zero
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (u : FABL.F₂Cube n) :
      CryptBoolean.walshTransform
          (fun x =>
            f x + FABL.affineFunction 0 u x)
          0 =
        CryptBoolean.walshTransform f u
    A linear modulation moves a raw Walsh coefficient to frequency zero. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticRank.lean
    complete
    theorem CryptBoolean.even_dimension_add_finrank_linearKernel_of_degree_le_two
      {n : } (f : CryptBoolean.BooleanFunction n)
      (hdegree : FABL.functionAlgebraicDegree f  2) :
      Even (n + Module.finrank FABL.𝔽₂ (CryptBoolean.linearKernel f))
    theorem CryptBoolean.even_dimension_add_finrank_linearKernel_of_degree_le_two
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hdegree :
        FABL.functionAlgebraicDegree f  2) :
      Even
        (n +
          Module.finrank FABL.𝔽₂
            (CryptBoolean.linearKernel f))
    The dimension plus the linear-kernel dimension of a quadratic function is even. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticRank.lean
    complete
    theorem CryptBoolean.even_codimension_linearKernel_of_degree_le_two {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hdegree : FABL.functionAlgebraicDegree f  2) :
      Even (n - Module.finrank FABL.𝔽₂ (CryptBoolean.linearKernel f))
    theorem CryptBoolean.even_codimension_linearKernel_of_degree_le_two
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hdegree :
        FABL.functionAlgebraicDegree f  2) :
      Even
        (n -
          Module.finrank FABL.𝔽₂
            (CryptBoolean.linearKernel f))
    The linear kernel of a quadratic Boolean function has even codimension. 
Theorem4.2.6
Group: Chapter 4: Classes with Provable Spectra and Weights (30)
Group member previews
Preview
Theorem 4.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 4
Statement dependency previews
Preview
Theorem 3.2.3
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
Used by 3
Reverse dependency previews
Preview
Definition 4.2.11
Loading preview
Reverse dependency preview content is loaded from the rendered-fragment cache.
L∃∀N

Quadratic weight and nonlinearity values (Carlet, p. 69). Let n\ge1 and I_n=\{i\in\mathbb N:\lceil n/2\rceil-1\le i\le n-1\}. The set of weights of quadratic n-variable Boolean functions is exactly \{2^{n-1}\}\cup \{2^{n-1}-2^i,\ 2^{n-1}+2^i:i\in I_n\}, and the set of their nonlinearities is exactly \{2^{n-1}-2^i:i\in I_n\}. Moreover, if w_H(f)=2^{n-1}\pm2^i, then for every affine \ell, w_H(f+\ell)\in\{2^{n-1}-2^i,\ 2^{n-1},\ 2^{n-1}+2^i\}.

Lean code for Theorem4.2.634 declarations
  • defdefined in CryptBoolean/Carlet/Chapter05/QuadraticValues.lean
    complete
    def CryptBoolean.IsQuadraticOffsetExponent (n i : ) : Prop
    def CryptBoolean.IsQuadraticOffsetExponent
      (n i : ) : Prop
    The exponent interval in Carlet's exact quadratic weight and nonlinearity sets. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticValues.lean
    complete
    theorem CryptBoolean.isQuadraticOffsetExponent_iff_ceilingHalf {n i : }
      (hn : 0 < n) :
      CryptBoolean.IsQuadraticOffsetExponent n i 
        (n + 1) / 2 - 1  i  i  n - 1
    theorem CryptBoolean.isQuadraticOffsetExponent_iff_ceilingHalf
      {n i : } (hn : 0 < n) :
      CryptBoolean.IsQuadraticOffsetExponent n
          i 
        (n + 1) / 2 - 1  i  i  n - 1
    The natural-number interval is Carlet's `ceil(n/2)-1 ≤ i ≤ n-1`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticValues.lean
    complete
    theorem CryptBoolean.isQuadraticOffsetExponent_iff_ceilDiv {n i : }
      (hn : 0 < n) :
      CryptBoolean.IsQuadraticOffsetExponent n i 
        n ⌈/⌉ 2 - 1  i  i  n - 1
    theorem CryptBoolean.isQuadraticOffsetExponent_iff_ceilDiv
      {n i : } (hn : 0 < n) :
      CryptBoolean.IsQuadraticOffsetExponent n
          i 
        n ⌈/⌉ 2 - 1  i  i  n - 1
    The interval predicate uses the natural ceiling division by two. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticValues.lean
    complete
    theorem CryptBoolean.isQuadraticOffsetExponent_iff_exists_parameters {n i : }
      (hn : 0 < n) :
      CryptBoolean.IsQuadraticOffsetExponent n i 
         d m, n = d + (m + m)  i = d + m - 1
    theorem CryptBoolean.isQuadraticOffsetExponent_iff_exists_parameters
      {n i : } (hn : 0 < n) :
      CryptBoolean.IsQuadraticOffsetExponent n
          i 
         d m, n = d + (m + m)  i = d + m - 1
    The admissible exponent interval is exactly the parameter range obtained
    by adjoining dummy coordinates to an even-dimensional quadratic block. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticValues.lean
    complete
    theorem CryptBoolean.hammingWeight_eq_two_pow_pred_of_isBalanced {n : }
      (f : CryptBoolean.BooleanFunction n) (hn : 0 < n)
      (hf : CryptBoolean.IsBalanced f) :
      CryptBoolean.hammingWeight f = 2 ^ (n - 1)
    theorem CryptBoolean.hammingWeight_eq_two_pow_pred_of_isBalanced
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hn : 0 < n)
      (hf : CryptBoolean.IsBalanced f) :
      CryptBoolean.hammingWeight f =
        2 ^ (n - 1)
    A balanced positive-dimensional Boolean function has weight `2^(n-1)`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticValues.lean
    complete
    theorem CryptBoolean.isBalanced_iff_hammingWeight_eq_two_pow_pred {n : }
      (f : CryptBoolean.BooleanFunction n) (hn : 0 < n) :
      CryptBoolean.IsBalanced f  CryptBoolean.hammingWeight f = 2 ^ (n - 1)
    theorem CryptBoolean.isBalanced_iff_hammingWeight_eq_two_pow_pred
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hn : 0 < n) :
      CryptBoolean.IsBalanced f 
        CryptBoolean.hammingWeight f =
          2 ^ (n - 1)
    In positive dimension, the central weight is equivalent to balancedness. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticValues.lean
    complete
    theorem CryptBoolean.nonlinearity_affineFunction {n : } (b : FABL.𝔽₂)
      (a : FABL.F₂Cube n) :
      CryptBoolean.nonlinearity (FABL.affineFunction b a) = 0
    theorem CryptBoolean.nonlinearity_affineFunction
      {n : } (b : FABL.𝔽₂)
      (a : FABL.F₂Cube n) :
      CryptBoolean.nonlinearity
          (FABL.affineFunction b a) =
        0
    Affine Boolean functions have zero nonlinearity. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticValues.lean
    complete
    theorem CryptBoolean.maxWalshMagnitude_affineFunction {n : } (b : FABL.𝔽₂)
      (a : FABL.F₂Cube n) :
      CryptBoolean.maxWalshMagnitude (FABL.affineFunction b a) = 2 ^ n
    theorem CryptBoolean.maxWalshMagnitude_affineFunction
      {n : } (b : FABL.𝔽₂)
      (a : FABL.F₂Cube n) :
      CryptBoolean.maxWalshMagnitude
          (FABL.affineFunction b a) =
        2 ^ n
    Every affine Boolean function has maximum raw Walsh magnitude `2^n`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticValues.lean
    complete
    theorem CryptBoolean.nonlinearity_add_affineFunction {n : }
      (f : CryptBoolean.BooleanFunction n) (b : FABL.𝔽₂)
      (a : FABL.F₂Cube n) :
      CryptBoolean.nonlinearity (f + FABL.affineFunction b a) =
        CryptBoolean.nonlinearity f
    theorem CryptBoolean.nonlinearity_add_affineFunction
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (b : FABL.𝔽₂) (a : FABL.F₂Cube n) :
      CryptBoolean.nonlinearity
          (f + FABL.affineFunction b a) =
        CryptBoolean.nonlinearity f
    Adding an affine Boolean function preserves nonlinearity. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticValues.lean
    complete
    theorem CryptBoolean.hammingWeight_add_constant_one {n : }
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.hammingWeight (f + FABL.affineFunction 1 0) =
        2 ^ n - CryptBoolean.hammingWeight f
    theorem CryptBoolean.hammingWeight_add_constant_one
      {n : }
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.hammingWeight
          (f + FABL.affineFunction 1 0) =
        2 ^ n - CryptBoolean.hammingWeight f
    Adding the constant one complements the Hamming weight. 
  • defdefined in CryptBoolean/Carlet/Chapter05/QuadraticValues.lean
    complete
    def CryptBoolean.quadraticOffsetWitness (d m : ) :
      CryptBoolean.BooleanFunction (d + (m + m))
    def CryptBoolean.quadraticOffsetWitness
      (d m : ) :
      CryptBoolean.BooleanFunction
        (d + (m + m))
    A complete inner-product block with `d` dummy coordinates. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticValues.lean
    complete
    theorem CryptBoolean.functionAlgebraicDegree_quadraticOffsetWitness_le_two
      (d m : ) :
      FABL.functionAlgebraicDegree
          (CryptBoolean.quadraticOffsetWitness d m) 
        2
    theorem CryptBoolean.functionAlgebraicDegree_quadraticOffsetWitness_le_two
      (d m : ) :
      FABL.functionAlgebraicDegree
          (CryptBoolean.quadraticOffsetWitness
            d m) 
        2
    The dummy-coordinate inner-product witness is quadratic. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticValues.lean
    complete
    theorem CryptBoolean.walshTransform_innerProductModTwoBit_zero (m : ) :
      CryptBoolean.walshTransform FABL.innerProductModTwoBit 0 = 2 ^ m
    theorem CryptBoolean.walshTransform_innerProductModTwoBit_zero
      (m : ) :
      CryptBoolean.walshTransform
          FABL.innerProductModTwoBit 0 =
        2 ^ m
    The zero-frequency raw Walsh value of the complete inner-product block is `2^m`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticValues.lean
    complete
    theorem CryptBoolean.walshTransform_quadraticOffsetWitness_zero (d m : ) :
      CryptBoolean.walshTransform (CryptBoolean.quadraticOffsetWitness d m)
          0 =
        2 ^ (d + m)
    theorem CryptBoolean.walshTransform_quadraticOffsetWitness_zero
      (d m : ) :
      CryptBoolean.walshTransform
          (CryptBoolean.quadraticOffsetWitness
            d m)
          0 =
        2 ^ (d + m)
    The witness has positive zero-frequency Walsh value `2^(d+m)`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticValues.lean
    complete
    theorem CryptBoolean.hammingWeight_quadraticOffsetWitness (d m : )
      (hpositive : 0 < d + m) :
      CryptBoolean.hammingWeight (CryptBoolean.quadraticOffsetWitness d m) =
        2 ^ (d + (m + m) - 1) - 2 ^ (d + m - 1)
    theorem CryptBoolean.hammingWeight_quadraticOffsetWitness
      (d m : ) (hpositive : 0 < d + m) :
      CryptBoolean.hammingWeight
          (CryptBoolean.quadraticOffsetWitness
            d m) =
        2 ^ (d + (m + m) - 1) -
          2 ^ (d + m - 1)
    The witness realizes the lower quadratic weight at offset `d+m-1`. 
  • defdefined in CryptBoolean/Carlet/Chapter05/QuadraticValues.lean
    complete
    def CryptBoolean.quadraticOffsetWitnessComplement (d m : ) :
      CryptBoolean.BooleanFunction (d + (m + m))
    def CryptBoolean.quadraticOffsetWitnessComplement
      (d m : ) :
      CryptBoolean.BooleanFunction
        (d + (m + m))
    The complemented witness realizes the upper quadratic weight. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticValues.lean
    complete
    theorem CryptBoolean.functionAlgebraicDegree_quadraticOffsetWitnessComplement_le_two
      (d m : ) :
      FABL.functionAlgebraicDegree
          (CryptBoolean.quadraticOffsetWitnessComplement d m) 
        2
    theorem CryptBoolean.functionAlgebraicDegree_quadraticOffsetWitnessComplement_le_two
      (d m : ) :
      FABL.functionAlgebraicDegree
          (CryptBoolean.quadraticOffsetWitnessComplement
            d m) 
        2
    Complementing the witness preserves quadratic degree. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticValues.lean
    complete
    theorem CryptBoolean.hammingWeight_quadraticOffsetWitnessComplement (d m : )
      (hpositive : 0 < d + m) :
      CryptBoolean.hammingWeight
          (CryptBoolean.quadraticOffsetWitnessComplement d m) =
        2 ^ (d + (m + m) - 1) + 2 ^ (d + m - 1)
    theorem CryptBoolean.hammingWeight_quadraticOffsetWitnessComplement
      (d m : ) (hpositive : 0 < d + m) :
      CryptBoolean.hammingWeight
          (CryptBoolean.quadraticOffsetWitnessComplement
            d m) =
        2 ^ (d + (m + m) - 1) +
          2 ^ (d + m - 1)
    The complemented witness has the upper quadratic weight at offset `d+m-1`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticValues.lean
    complete
    theorem CryptBoolean.maxWalshMagnitude_quadraticOffsetWitness (d m : ) :
      CryptBoolean.maxWalshMagnitude
          (CryptBoolean.quadraticOffsetWitness d m) =
        2 ^ (d + m)
    theorem CryptBoolean.maxWalshMagnitude_quadraticOffsetWitness
      (d m : ) :
      CryptBoolean.maxWalshMagnitude
          (CryptBoolean.quadraticOffsetWitness
            d m) =
        2 ^ (d + m)
    The witness has maximum raw Walsh magnitude `2^(d+m)`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticValues.lean
    complete
    theorem CryptBoolean.nonlinearity_quadraticOffsetWitness (d m : )
      (hpositive : 0 < d + m) :
      CryptBoolean.nonlinearity (CryptBoolean.quadraticOffsetWitness d m) =
        2 ^ (d + (m + m) - 1) - 2 ^ (d + m - 1)
    theorem CryptBoolean.nonlinearity_quadraticOffsetWitness
      (d m : ) (hpositive : 0 < d + m) :
      CryptBoolean.nonlinearity
          (CryptBoolean.quadraticOffsetWitness
            d m) =
        2 ^ (d + (m + m) - 1) -
          2 ^ (d + m - 1)
    The witness realizes the quadratic nonlinearity at offset `d+m-1`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticValues.lean
    complete
    theorem CryptBoolean.exists_quadratic_hammingWeight_eq_two_pow_pred {n : }
      (hn : 0 < n) :
       f,
        FABL.functionAlgebraicDegree f  2 
          CryptBoolean.hammingWeight f = 2 ^ (n - 1)
    theorem CryptBoolean.exists_quadratic_hammingWeight_eq_two_pow_pred
      {n : } (hn : 0 < n) :
       f,
        FABL.functionAlgebraicDegree f  2 
          CryptBoolean.hammingWeight f =
            2 ^ (n - 1)
    The central balanced weight is realized by a quadratic Boolean function. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticValues.lean
    complete
    theorem CryptBoolean.exists_quadratic_hammingWeight_eq_sub {n i : }
      (hn : 0 < n) (hi : CryptBoolean.IsQuadraticOffsetExponent n i) :
       f,
        FABL.functionAlgebraicDegree f  2 
          CryptBoolean.hammingWeight f = 2 ^ (n - 1) - 2 ^ i
    theorem CryptBoolean.exists_quadratic_hammingWeight_eq_sub
      {n i : } (hn : 0 < n)
      (hi :
        CryptBoolean.IsQuadraticOffsetExponent
          n i) :
       f,
        FABL.functionAlgebraicDegree f  2 
          CryptBoolean.hammingWeight f =
            2 ^ (n - 1) - 2 ^ i
    Every admissible lower quadratic weight is realized. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticValues.lean
    complete
    theorem CryptBoolean.exists_quadratic_hammingWeight_eq_add {n i : }
      (hn : 0 < n) (hi : CryptBoolean.IsQuadraticOffsetExponent n i) :
       f,
        FABL.functionAlgebraicDegree f  2 
          CryptBoolean.hammingWeight f = 2 ^ (n - 1) + 2 ^ i
    theorem CryptBoolean.exists_quadratic_hammingWeight_eq_add
      {n i : } (hn : 0 < n)
      (hi :
        CryptBoolean.IsQuadraticOffsetExponent
          n i) :
       f,
        FABL.functionAlgebraicDegree f  2 
          CryptBoolean.hammingWeight f =
            2 ^ (n - 1) + 2 ^ i
    Every admissible upper quadratic weight is realized. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticValues.lean
    complete
    theorem CryptBoolean.exists_quadratic_nonlinearity_eq_sub {n i : } (hn : 0 < n)
      (hi : CryptBoolean.IsQuadraticOffsetExponent n i) :
       f,
        FABL.functionAlgebraicDegree f  2 
          CryptBoolean.nonlinearity f = 2 ^ (n - 1) - 2 ^ i
    theorem CryptBoolean.exists_quadratic_nonlinearity_eq_sub
      {n i : } (hn : 0 < n)
      (hi :
        CryptBoolean.IsQuadraticOffsetExponent
          n i) :
       f,
        FABL.functionAlgebraicDegree f  2 
          CryptBoolean.nonlinearity f =
            2 ^ (n - 1) - 2 ^ i
    Every admissible quadratic nonlinearity is realized. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticValues.lean
    complete
    theorem CryptBoolean.quadratic_hammingWeight_value_restriction {n : }
      (f : CryptBoolean.BooleanFunction n) (hn : 0 < n)
      (hdegree : FABL.functionAlgebraicDegree f  2) :
      CryptBoolean.hammingWeight f = 2 ^ (n - 1) 
         i,
          CryptBoolean.IsQuadraticOffsetExponent n i 
            (CryptBoolean.hammingWeight f = 2 ^ (n - 1) - 2 ^ i 
              CryptBoolean.hammingWeight f = 2 ^ (n - 1) + 2 ^ i)
    theorem CryptBoolean.quadratic_hammingWeight_value_restriction
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hn : 0 < n)
      (hdegree :
        FABL.functionAlgebraicDegree f  2) :
      CryptBoolean.hammingWeight f =
          2 ^ (n - 1) 
         i,
          CryptBoolean.IsQuadraticOffsetExponent
              n i 
            (CryptBoolean.hammingWeight f =
                2 ^ (n - 1) - 2 ^ i 
              CryptBoolean.hammingWeight f =
                2 ^ (n - 1) + 2 ^ i)
    Every quadratic weight belongs to Carlet's displayed finite value set. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticValues.lean
    complete
    theorem CryptBoolean.not_isBalanced_of_hammingWeight_eq_quadraticOffset
      {n i : } (f : CryptBoolean.BooleanFunction n) (hn : 0 < n)
      (hi : CryptBoolean.IsQuadraticOffsetExponent n i)
      (hweight :
        CryptBoolean.hammingWeight f = 2 ^ (n - 1) - 2 ^ i 
          CryptBoolean.hammingWeight f = 2 ^ (n - 1) + 2 ^ i) :
      ¬CryptBoolean.IsBalanced f
    theorem CryptBoolean.not_isBalanced_of_hammingWeight_eq_quadraticOffset
      {n i : }
      (f : CryptBoolean.BooleanFunction n)
      (hn : 0 < n)
      (hi :
        CryptBoolean.IsQuadraticOffsetExponent
          n i)
      (hweight :
        CryptBoolean.hammingWeight f =
            2 ^ (n - 1) - 2 ^ i 
          CryptBoolean.hammingWeight f =
            2 ^ (n - 1) + 2 ^ i) :
      ¬CryptBoolean.IsBalanced f
    A displayed noncentral quadratic weight is not balanced. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticValues.lean
    complete
    theorem CryptBoolean.quadratic_affine_shift_hammingWeight_trichotomy {n i : }
      (f : CryptBoolean.BooleanFunction n) (hn : 0 < n)
      (hdegree : FABL.functionAlgebraicDegree f  2)
      (hi : CryptBoolean.IsQuadraticOffsetExponent n i)
      (hweight :
        CryptBoolean.hammingWeight f = 2 ^ (n - 1) - 2 ^ i 
          CryptBoolean.hammingWeight f = 2 ^ (n - 1) + 2 ^ i)
      (b : FABL.𝔽₂) (a : FABL.F₂Cube n) :
      CryptBoolean.hammingWeight (f + FABL.affineFunction b a) =
          2 ^ (n - 1) - 2 ^ i 
        CryptBoolean.hammingWeight (f + FABL.affineFunction b a) =
            2 ^ (n - 1) 
          CryptBoolean.hammingWeight (f + FABL.affineFunction b a) =
            2 ^ (n - 1) + 2 ^ i
    theorem CryptBoolean.quadratic_affine_shift_hammingWeight_trichotomy
      {n i : }
      (f : CryptBoolean.BooleanFunction n)
      (hn : 0 < n)
      (hdegree :
        FABL.functionAlgebraicDegree f  2)
      (hi :
        CryptBoolean.IsQuadraticOffsetExponent
          n i)
      (hweight :
        CryptBoolean.hammingWeight f =
            2 ^ (n - 1) - 2 ^ i 
          CryptBoolean.hammingWeight f =
            2 ^ (n - 1) + 2 ^ i)
      (b : FABL.𝔽₂) (a : FABL.F₂Cube n) :
      CryptBoolean.hammingWeight
            (f + FABL.affineFunction b a) =
          2 ^ (n - 1) - 2 ^ i 
        CryptBoolean.hammingWeight
              (f + FABL.affineFunction b a) =
            2 ^ (n - 1) 
          CryptBoolean.hammingWeight
              (f + FABL.affineFunction b a) =
            2 ^ (n - 1) + 2 ^ i
    Every affine shift of a quadratic function with offset exponent `i` has
    one of the same two weights or is balanced. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticValues.lean
    complete
    theorem CryptBoolean.maxWalshMagnitude_eq_natAbs_walshTransform_zero_of_quadratic_notBalanced
      {n : } (f : CryptBoolean.BooleanFunction n)
      (hdegree : FABL.functionAlgebraicDegree f  2)
      (hnotBalanced : ¬CryptBoolean.IsBalanced f) :
      CryptBoolean.maxWalshMagnitude f =
        (CryptBoolean.walshTransform f 0).natAbs
    theorem CryptBoolean.maxWalshMagnitude_eq_natAbs_walshTransform_zero_of_quadratic_notBalanced
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hdegree :
        FABL.functionAlgebraicDegree f  2)
      (hnotBalanced :
        ¬CryptBoolean.IsBalanced f) :
      CryptBoolean.maxWalshMagnitude f =
        (CryptBoolean.walshTransform f
            0).natAbs
    A nonbalanced quadratic function has no Walsh magnitude larger than its
    zero-frequency magnitude. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticValues.lean
    complete
    theorem CryptBoolean.natAbs_walshTransform_zero_eq_two_pow_succ_of_quadratic_weight
      {n i : } (f : CryptBoolean.BooleanFunction n) (hn : 0 < n)
      (hi : CryptBoolean.IsQuadraticOffsetExponent n i)
      (hweight :
        CryptBoolean.hammingWeight f = 2 ^ (n - 1) - 2 ^ i 
          CryptBoolean.hammingWeight f = 2 ^ (n - 1) + 2 ^ i) :
      (CryptBoolean.walshTransform f 0).natAbs = 2 ^ (i + 1)
    theorem CryptBoolean.natAbs_walshTransform_zero_eq_two_pow_succ_of_quadratic_weight
      {n i : }
      (f : CryptBoolean.BooleanFunction n)
      (hn : 0 < n)
      (hi :
        CryptBoolean.IsQuadraticOffsetExponent
          n i)
      (hweight :
        CryptBoolean.hammingWeight f =
            2 ^ (n - 1) - 2 ^ i 
          CryptBoolean.hammingWeight f =
            2 ^ (n - 1) + 2 ^ i) :
      (CryptBoolean.walshTransform f
            0).natAbs =
        2 ^ (i + 1)
    A displayed quadratic weight determines the zero-frequency Walsh magnitude. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticValues.lean
    complete
    theorem CryptBoolean.maxWalshMagnitude_eq_two_pow_succ_of_quadratic_weight
      {n i : } (f : CryptBoolean.BooleanFunction n) (hn : 0 < n)
      (hdegree : FABL.functionAlgebraicDegree f  2)
      (hi : CryptBoolean.IsQuadraticOffsetExponent n i)
      (hweight :
        CryptBoolean.hammingWeight f = 2 ^ (n - 1) - 2 ^ i 
          CryptBoolean.hammingWeight f = 2 ^ (n - 1) + 2 ^ i) :
      CryptBoolean.maxWalshMagnitude f = 2 ^ (i + 1)
    theorem CryptBoolean.maxWalshMagnitude_eq_two_pow_succ_of_quadratic_weight
      {n i : }
      (f : CryptBoolean.BooleanFunction n)
      (hn : 0 < n)
      (hdegree :
        FABL.functionAlgebraicDegree f  2)
      (hi :
        CryptBoolean.IsQuadraticOffsetExponent
          n i)
      (hweight :
        CryptBoolean.hammingWeight f =
            2 ^ (n - 1) - 2 ^ i 
          CryptBoolean.hammingWeight f =
            2 ^ (n - 1) + 2 ^ i) :
      CryptBoolean.maxWalshMagnitude f =
        2 ^ (i + 1)
    A quadratic weight offset determines the maximum Walsh magnitude. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticValues.lean
    complete
    theorem CryptBoolean.quadratic_nonlinearity_eq_sub_of_hammingWeight_offset
      {n i : } (f : CryptBoolean.BooleanFunction n) (hn : 0 < n)
      (hdegree : FABL.functionAlgebraicDegree f  2)
      (hi : CryptBoolean.IsQuadraticOffsetExponent n i)
      (hweight :
        CryptBoolean.hammingWeight f = 2 ^ (n - 1) - 2 ^ i 
          CryptBoolean.hammingWeight f = 2 ^ (n - 1) + 2 ^ i) :
      CryptBoolean.nonlinearity f = 2 ^ (n - 1) - 2 ^ i
    theorem CryptBoolean.quadratic_nonlinearity_eq_sub_of_hammingWeight_offset
      {n i : }
      (f : CryptBoolean.BooleanFunction n)
      (hn : 0 < n)
      (hdegree :
        FABL.functionAlgebraicDegree f  2)
      (hi :
        CryptBoolean.IsQuadraticOffsetExponent
          n i)
      (hweight :
        CryptBoolean.hammingWeight f =
            2 ^ (n - 1) - 2 ^ i 
          CryptBoolean.hammingWeight f =
            2 ^ (n - 1) + 2 ^ i) :
      CryptBoolean.nonlinearity f =
        2 ^ (n - 1) - 2 ^ i
    A quadratic weight offset determines its exact nonlinearity. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticValues.lean
    complete
    theorem CryptBoolean.quadratic_nonlinearity_value_restriction {n : }
      (f : CryptBoolean.BooleanFunction n) (hn : 0 < n)
      (hdegree : FABL.functionAlgebraicDegree f  2) :
       i,
        CryptBoolean.IsQuadraticOffsetExponent n i 
          CryptBoolean.nonlinearity f = 2 ^ (n - 1) - 2 ^ i
    theorem CryptBoolean.quadratic_nonlinearity_value_restriction
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hn : 0 < n)
      (hdegree :
        FABL.functionAlgebraicDegree f  2) :
       i,
        CryptBoolean.IsQuadraticOffsetExponent
            n i 
          CryptBoolean.nonlinearity f =
            2 ^ (n - 1) - 2 ^ i
    Every quadratic nonlinearity belongs to Carlet's displayed value set. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticValues.lean
    complete
    theorem CryptBoolean.exists_quadratic_hammingWeight_eq_iff {n : } (hn : 0 < n)
      (w : ) :
      (∃ f,
          FABL.functionAlgebraicDegree f  2 
            CryptBoolean.hammingWeight f = w) 
        w = 2 ^ (n - 1) 
           i,
            CryptBoolean.IsQuadraticOffsetExponent n i 
              (w = 2 ^ (n - 1) - 2 ^ i  w = 2 ^ (n - 1) + 2 ^ i)
    theorem CryptBoolean.exists_quadratic_hammingWeight_eq_iff
      {n : } (hn : 0 < n) (w : ) :
      (∃ f,
          FABL.functionAlgebraicDegree f  2 
            CryptBoolean.hammingWeight f =
              w) 
        w = 2 ^ (n - 1) 
           i,
            CryptBoolean.IsQuadraticOffsetExponent
                n i 
              (w = 2 ^ (n - 1) - 2 ^ i 
                w = 2 ^ (n - 1) + 2 ^ i)
    The set of quadratic weights is exactly Carlet's displayed set. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticValues.lean
    complete
    theorem CryptBoolean.exists_quadratic_nonlinearity_eq_iff {n : } (hn : 0 < n)
      (v : ) :
      (∃ f,
          FABL.functionAlgebraicDegree f  2 
            CryptBoolean.nonlinearity f = v) 
         i,
          CryptBoolean.IsQuadraticOffsetExponent n i 
            v = 2 ^ (n - 1) - 2 ^ i
    theorem CryptBoolean.exists_quadratic_nonlinearity_eq_iff
      {n : } (hn : 0 < n) (v : ) :
      (∃ f,
          FABL.functionAlgebraicDegree f  2 
            CryptBoolean.nonlinearity f = v) 
         i,
          CryptBoolean.IsQuadraticOffsetExponent
              n i 
            v = 2 ^ (n - 1) - 2 ^ i
    The set of quadratic nonlinearities is exactly Carlet's displayed set. 

Complete inner-product blocks, extended by unused coordinates, realize every displayed value.

Theorem4.2.7
Group: Chapter 4: Classes with Provable Spectra and Weights (30)
Group member previews
Preview
Theorem 4.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 3
Statement dependency previews
Preview
Theorem 1.4.6
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
Used by 2
Reverse dependency previews
Preview
Theorem 4.2.10
Loading preview
Reverse dependency preview content is loaded from the rendered-fragment cache.
L∃∀N

Quadratic affine normal form (Carlet, Theorem 5, p. 70). Put Q_\ell=x_1x_2+x_3x_4+\cdots+x_{2\ell-1}x_{2\ell}. Every non-affine quadratic f:V_n\to\mathbb F_2 is affinely equivalent to Q_\ell+x_{2\ell+1} for some 1\le\ell\le(n-1)/2 when f is balanced; to Q_\ell for some 1\le\ell\le n/2 when w_H(f)<2^{n-1}; and to Q_\ell+1 for some 1\le\ell\le n/2 when w_H(f)>2^{n-1}.

Lean code for Theorem4.2.77 declarations
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticNormalForm.lean
    complete
    theorem CryptBoolean.exists_affineFunction_of_quadraticPolarKernel_eq_zero
      {n : } (f : CryptBoolean.BooleanFunction n)
      (hpolar :
         (x y : FABL.F₂Cube n),
          CryptBoolean.quadraticPolarKernel f x y = 0) :
       c a, f = FABL.affineFunction c a
    theorem CryptBoolean.exists_affineFunction_of_quadraticPolarKernel_eq_zero
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hpolar :
         (x y : FABL.F₂Cube n),
          CryptBoolean.quadraticPolarKernel f
              x y =
            0) :
       c a, f = FABL.affineFunction c a
    A Boolean function with identically zero quadratic polar kernel is affine. 
  • defdefined in CryptBoolean/Carlet/Chapter05/QuadraticNormalForm.lean
    complete
    def CryptBoolean.quadraticNormalFormSplitLinearEquiv (m p : ) :
      FABL.F₂Cube (m + p) ≃ₗ[FABL.𝔽₂] FABL.F₂Cube m × FABL.F₂Cube p
    def CryptBoolean.quadraticNormalFormSplitLinearEquiv
      (m p : ) :
      FABL.F₂Cube (m + p) ≃ₗ[FABL.𝔽₂]
        FABL.F₂Cube m × FABL.F₂Cube p
    Splits an initial block of Boolean-cube coordinates from the remaining block. 
  • defdefined in CryptBoolean/Carlet/Chapter05/QuadraticNormalForm.lean
    complete
    def CryptBoolean.quadraticNormalFormDimension :     
    def CryptBoolean.quadraticNormalFormDimension :
          
    The dimension of `Q_l` with `r` unused coordinates. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticNormalForm.lean
    complete
    theorem CryptBoolean.quadraticNormalFormDimension_eq (l r : ) :
      CryptBoolean.quadraticNormalFormDimension l r = 2 * l + r
    theorem CryptBoolean.quadraticNormalFormDimension_eq
      (l r : ) :
      CryptBoolean.quadraticNormalFormDimension
          l r =
        2 * l + r
    The normal form `Q_l` with `r` unused coordinates has dimension `2*l+r`. 
  • defdefined in CryptBoolean/Carlet/Chapter05/QuadraticNormalForm.lean
    complete
    def CryptBoolean.quadraticNormalForm (l r : ) :
      FABL.F₂Cube (CryptBoolean.quadraticNormalFormDimension l r)  FABL.𝔽₂
    def CryptBoolean.quadraticNormalForm
      (l r : ) :
      FABL.F₂Cube
          (CryptBoolean.quadraticNormalFormDimension
            l r) 
        FABL.𝔽₂
    Carlet's `Q_l = x_1x_2 + ⋯ + x_(2l-1)x_(2l)`, with `r` unused coordinates. 
  • defdefined in CryptBoolean/Carlet/Chapter05/QuadraticNormalForm.lean
    complete
    def CryptBoolean.quadraticNormalFormFirstFreeCoordinate (l r : ) :
      0 < r 
        FABL.F₂Cube (CryptBoolean.quadraticNormalFormDimension l r) 
          FABL.𝔽₂
    def CryptBoolean.quadraticNormalFormFirstFreeCoordinate
      (l r : ) :
      0 < r 
        FABL.F₂Cube
            (CryptBoolean.quadraticNormalFormDimension
              l r) 
          FABL.𝔽₂
    The coordinate `x_(2l+1)` immediately following the paired variables of `Q_l`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticNormalForm.lean
    complete
    theorem CryptBoolean.quadratic_affine_normal_form {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hdegree : FABL.functionAlgebraicDegree f  2)
      (hnonaffine : ¬ c a, f = FABL.affineFunction c a) :
      (CryptBoolean.IsBalanced f 
           l r,
            1  l 
              l  (n - 1) / 2 
                n = 2 * l + r 
                   (hr : 0 < r),
                     e,
                      
                        (x :
                          FABL.F₂Cube
                            (CryptBoolean.quadraticNormalFormDimension l
                              r)),
                        f (e x) =
                          CryptBoolean.quadraticNormalForm l r x +
                            CryptBoolean.quadraticNormalFormFirstFreeCoordinate
                              l r hr x) 
        (CryptBoolean.hammingWeight f < 2 ^ (n - 1) 
             l r,
              1  l 
                l  n / 2 
                  n = 2 * l + r 
                     e,
                      
                        (x :
                          FABL.F₂Cube
                            (CryptBoolean.quadraticNormalFormDimension l
                              r)),
                        f (e x) = CryptBoolean.quadraticNormalForm l r x) 
          (2 ^ (n - 1) < CryptBoolean.hammingWeight f 
             l r,
              1  l 
                l  n / 2 
                  n = 2 * l + r 
                     e,
                      
                        (x :
                          FABL.F₂Cube
                            (CryptBoolean.quadraticNormalFormDimension l
                              r)),
                        f (e x) =
                          CryptBoolean.quadraticNormalForm l r x + 1)
    theorem CryptBoolean.quadratic_affine_normal_form
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hdegree :
        FABL.functionAlgebraicDegree f  2)
      (hnonaffine :
        ¬ c a, f = FABL.affineFunction c a) :
      (CryptBoolean.IsBalanced f 
           l r,
            1  l 
              l  (n - 1) / 2 
                n = 2 * l + r 
                   (hr : 0 < r),
                     e,
                      
                        (x :
                          FABL.F₂Cube
                            (CryptBoolean.quadraticNormalFormDimension
                              l r)),
                        f (e x) =
                          CryptBoolean.quadraticNormalForm
                              l r x +
                            CryptBoolean.quadraticNormalFormFirstFreeCoordinate
                              l r hr x) 
        (CryptBoolean.hammingWeight f <
              2 ^ (n - 1) 
             l r,
              1  l 
                l  n / 2 
                  n = 2 * l + r 
                     e,
                      
                        (x :
                          FABL.F₂Cube
                            (CryptBoolean.quadraticNormalFormDimension
                              l r)),
                        f (e x) =
                          CryptBoolean.quadraticNormalForm
                            l r x) 
          (2 ^ (n - 1) <
              CryptBoolean.hammingWeight f 
             l r,
              1  l 
                l  n / 2 
                  n = 2 * l + r 
                     e,
                      
                        (x :
                          FABL.F₂Cube
                            (CryptBoolean.quadraticNormalFormDimension
                              l r)),
                        f (e x) =
                          CryptBoolean.quadraticNormalForm
                              l r x +
                            1)
    Carlet's quadratic affine normal form, split by balancedness and weight. 
Lemma4.2.8
Group: Chapter 4: Classes with Provable Spectra and Weights (30)
Group member previews
Preview
Theorem 4.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
uses 1used by 1L∃∀N

Quadraticization step (Carlet, Remark after Theorem 5, p. 70). Let f_1,f_2,f_3:V_n\to\mathbb F_2, set g(x)=f_1(x)f_2(x)+f_3(x), and define F(x,y_1,y_2)=y_1y_2+y_1f_1(x)+y_2f_2(x)+f_3(x). Then W_F(0)=2W_g(0). Thus one product f_1f_2 may be replaced by a quadratic term in two fresh variables together with terms linear in those variables, while doubling the zero-frequency Walsh value.

Lean code for Lemma4.2.83 declarations
  • defdefined in CryptBoolean/Carlet/Chapter05/WalshLifts.lean
    complete
    def CryptBoolean.quadraticizationLift {n : }
      (f₁ f₂ f₃ : CryptBoolean.BooleanFunction n) :
      CryptBoolean.BooleanFunction (n + 2)
    def CryptBoolean.quadraticizationLift {n : }
      (f₁ f₂ f₃ :
        CryptBoolean.BooleanFunction n) :
      CryptBoolean.BooleanFunction (n + 2)
    Replace one product of Boolean functions by a quadratic term in two fresh variables. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/WalshLifts.lean
    complete
    theorem CryptBoolean.quadraticizationLift_append {n : }
      (f₁ f₂ f₃ : CryptBoolean.BooleanFunction n) (x : FABL.F₂Cube n)
      (y₁ y₂ : FABL.𝔽₂) :
      CryptBoolean.quadraticizationLift f₁ f₂ f₃ (Fin.append x ![y₁, y₂]) =
        y₁ * y₂ + y₁ * f₁ x + y₂ * f₂ x + f₃ x
    theorem CryptBoolean.quadraticizationLift_append
      {n : }
      (f₁ f₂ f₃ :
        CryptBoolean.BooleanFunction n)
      (x : FABL.F₂Cube n) (y₁ y₂ : FABL.𝔽₂) :
      CryptBoolean.quadraticizationLift f₁ f₂
          f₃ (Fin.append x ![y₁, y₂]) =
        y₁ * y₂ + y₁ * f₁ x + y₂ * f₂ x + f₃ x
  • theoremdefined in CryptBoolean/Carlet/Chapter05/WalshLifts.lean
    complete
    theorem CryptBoolean.walshTransform_quadraticizationLift_zero {n : }
      (f₁ f₂ f₃ : CryptBoolean.BooleanFunction n) :
      CryptBoolean.walshTransform
          (CryptBoolean.quadraticizationLift f₁ f₂ f₃) 0 =
        2 * CryptBoolean.walshTransform (fun x => f₁ x * f₂ x + f₃ x) 0
    theorem CryptBoolean.walshTransform_quadraticizationLift_zero
      {n : }
      (f₁ f₂ f₃ :
        CryptBoolean.BooleanFunction n) :
      CryptBoolean.walshTransform
          (CryptBoolean.quadraticizationLift
            f₁ f₂ f₃)
          0 =
        2 *
          CryptBoolean.walshTransform
            (fun x => f₁ x * f₂ x + f₃ x) 0
    One quadraticization step doubles the zero-frequency raw Walsh coefficient. 
Corollary4.2.9
Group: Chapter 4: Classes with Provable Spectra and Weights (30)
Group member previews
Preview
Theorem 4.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 3
Statement dependency previews
Preview
Theorem 1.3.1
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
used by 0L∃∀N

Degree-three Walsh lift (Carlet, iterated consequence of the Remark, p. 70). For every Boolean function g:V_n\to\mathbb F_2, there exist m\in\mathbb N and a Boolean function F:V_{n+2m}\to\mathbb F_2 of algebraic degree at most three such that W_F(0)=2^mW_g(0).

Lean code for Corollary4.2.91 theorem
  • theoremdefined in CryptBoolean/Carlet/Chapter05/WalshLifts.lean
    complete
    theorem CryptBoolean.exists_degree_le_three_walshTransform_zero_lift {n : }
      (g : CryptBoolean.BooleanFunction n) :
       m F,
        FABL.functionAlgebraicDegree F  3 
          CryptBoolean.walshTransform F 0 =
            2 ^ m * CryptBoolean.walshTransform g 0
    theorem CryptBoolean.exists_degree_le_three_walshTransform_zero_lift
      {n : }
      (g : CryptBoolean.BooleanFunction n) :
       m F,
        FABL.functionAlgebraicDegree F  3 
          CryptBoolean.walshTransform F 0 =
            2 ^ m *
              CryptBoolean.walshTransform g 0
    Every Boolean zero-frequency Walsh coefficient is, up to a power of two,
    realized by a Boolean function of algebraic degree at most three. 

Iterating the one-product construction over the ANF support proves the result: each step adds two variables, doubles the zero-frequency Walsh coefficient, and decreases the total excess of monomial degrees above three.

Theorem4.2.10
Group: Chapter 4: Classes with Provable Spectra and Weights (30)
Group member previews
Preview
Theorem 4.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 5
Statement dependency previews
Preview
Definition 1.5.1
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
Used by 3
Reverse dependency previews
Preview
Definition 4.2.11
Loading preview
Reverse dependency preview content is loaded from the rendered-fragment cache.
L∃∀N

Quadratic trace representation (Carlet, pp. 70--71). Put K_j=\operatorname{GF}(2^j). If \theta:V_{2m+1}\simeq_{\mathbb F_2}K_{2m+1}, then a Boolean function f:V_{2m+1}\to\mathbb F_2 is quadratic if and only if there exist \beta_\varnothing,\beta_i\in K_{2m+1} such that f(x)=\operatorname{Tr}_{2m+1}\!\left( \beta_\varnothing+ \sum_{i=0}^{m}\beta_i\theta(x)^{2^i+1} \right). If m>0 and \theta:V_{2m}\simeq_{\mathbb F_2}K_{2m}, then a Boolean function f:V_{2m}\to\mathbb F_2 is quadratic if and only if there exist an \mathbb F_2-algebra embedding \iota:K_m\hookrightarrow K_{2m}, \beta_\varnothing,\beta_i\in K_{2m}, and \gamma\in K_m such that f(x)=\operatorname{Tr}_{2m}\!\left( \beta_\varnothing+ \sum_{i=0}^{m-1}\beta_i\theta(x)^{2^i+1} \right) +\operatorname{Tr}_m\!\left(\gamma N_\iota(\theta(x))\right), where N_\iota:K_{2m}\to K_m is the relative norm and \iota(N_\iota(z))=z^{2^m+1}.

Lean code for Theorem4.2.1012 declarations
  • defdefined in CryptBoolean/Carlet/Chapter05/QuadraticTraceRepresentation.lean
    complete
    def CryptBoolean.binaryFrobeniusLinear (n i : ) :
      CryptBoolean.BinaryGaloisField n →ₗ[FABL.𝔽₂]
        CryptBoolean.BinaryGaloisField n
    def CryptBoolean.binaryFrobeniusLinear
      (n i : ) :
      CryptBoolean.BinaryGaloisField
          n →ₗ[FABL.𝔽₂]
        CryptBoolean.BinaryGaloisField n
    The `i`th binary Frobenius power as a linear endomorphism. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticTraceRepresentation.lean
    complete
    theorem CryptBoolean.binaryFrobeniusLinear_apply (n i : )
      (x : CryptBoolean.BinaryGaloisField n) :
      (CryptBoolean.binaryFrobeniusLinear n i) x = x ^ 2 ^ i
    theorem CryptBoolean.binaryFrobeniusLinear_apply
      (n i : )
      (x : CryptBoolean.BinaryGaloisField n) :
      (CryptBoolean.binaryFrobeniusLinear n i)
          x =
        x ^ 2 ^ i
    Evaluation of the linear Frobenius endomorphism is the corresponding
    binary power. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticTraceRepresentation.lean
    complete
    theorem CryptBoolean.absoluteTrace_mul_frobeniusPow (n i : ) (hn : n  0)
      (hi : i  n) (a y : CryptBoolean.BinaryGaloisField n) :
      (CryptBoolean.absoluteTrace n) (a * y ^ 2 ^ i) =
        (CryptBoolean.absoluteTrace n) (a ^ 2 ^ (n - i) * y)
    theorem CryptBoolean.absoluteTrace_mul_frobeniusPow
      (n i : ) (hn : n  0) (hi : i  n)
      (a y :
        CryptBoolean.BinaryGaloisField n) :
      (CryptBoolean.absoluteTrace n)
          (a * y ^ 2 ^ i) =
        (CryptBoolean.absoluteTrace n)
          (a ^ 2 ^ (n - i) * y)
    The adjoint of the `i`th binary Frobenius power under the absolute-trace
    pairing is the complementary Frobenius power. 
  • defdefined in CryptBoolean/Carlet/Chapter05/QuadraticTraceRepresentation.lean
    complete
    def CryptBoolean.oddQuadraticTracePart (m : )
      (beta : Fin m  CryptBoolean.BinaryGaloisField (2 * m + 1)) :
      CryptBoolean.FieldBooleanFunction (2 * m + 1)
    def CryptBoolean.oddQuadraticTracePart (m : )
      (beta :
        Fin m 
          CryptBoolean.BinaryGaloisField
            (2 * m + 1)) :
      CryptBoolean.FieldBooleanFunction
        (2 * m + 1)
    The homogeneous quadratic part in Carlet's odd-dimensional trace
    representation. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticTraceRepresentation.lean
    complete
    theorem CryptBoolean.oddQuadraticTracePart_polar_eq_sum (m : )
      (beta : Fin m  CryptBoolean.BinaryGaloisField (2 * m + 1))
      (x y : CryptBoolean.BinaryGaloisField (2 * m + 1)) :
      CryptBoolean.oddQuadraticTracePart m beta (x + y) +
              CryptBoolean.oddQuadraticTracePart m beta x +
            CryptBoolean.oddQuadraticTracePart m beta y +
          CryptBoolean.oddQuadraticTracePart m beta 0 =
         i,
          (CryptBoolean.absoluteTrace (2 * m + 1))
            (beta i * (x ^ 2 ^ (i + 1) * y + x * y ^ 2 ^ (i + 1)))
    theorem CryptBoolean.oddQuadraticTracePart_polar_eq_sum
      (m : )
      (beta :
        Fin m 
          CryptBoolean.BinaryGaloisField
            (2 * m + 1))
      (x y :
        CryptBoolean.BinaryGaloisField
          (2 * m + 1)) :
      CryptBoolean.oddQuadraticTracePart m
                beta (x + y) +
              CryptBoolean.oddQuadraticTracePart
                m beta x +
            CryptBoolean.oddQuadraticTracePart
              m beta y +
          CryptBoolean.oddQuadraticTracePart m
            beta 0 =
         i,
          (CryptBoolean.absoluteTrace
              (2 * m + 1))
            (beta i *
              (x ^ 2 ^ (i + 1) * y +
                x * y ^ 2 ^ (i + 1)))
    The polar form of the odd-dimensional quadratic trace part, written as
    the explicit sum of paired Frobenius monomials. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticTraceRepresentation.lean
    complete
    theorem CryptBoolean.functionAlgebraicDegree_traceMonomial_two_pow_add_one_le_two
      {n i : } (hn : 0 < n) (hk : 2 ^ i + 1 < 2 ^ n - 1)
      (theta : FABL.F₂Cube n ≃ₗ[FABL.𝔽₂] CryptBoolean.BinaryGaloisField n)
      (a : CryptBoolean.BinaryGaloisField n) :
      (FABL.functionAlgebraicDegree fun x =>
          (CryptBoolean.absoluteTrace n) (a * theta x ^ (2 ^ i + 1))) 
        2
    theorem CryptBoolean.functionAlgebraicDegree_traceMonomial_two_pow_add_one_le_two
      {n i : } (hn : 0 < n)
      (hk : 2 ^ i + 1 < 2 ^ n - 1)
      (theta :
        FABL.F₂Cube n ≃ₗ[FABL.𝔽₂]
          CryptBoolean.BinaryGaloisField n)
      (a : CryptBoolean.BinaryGaloisField n) :
      (FABL.functionAlgebraicDegree fun x =>
          (CryptBoolean.absoluteTrace n)
            (a * theta x ^ (2 ^ i + 1))) 
        2
    A binary trace monomial with exponent `2^i + 1` has algebraic degree at
    most two whenever the exponent lies below the field modulus. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticTraceRepresentation.lean
    complete
    theorem CryptBoolean.two_pow_add_one_lt_odd_modulus (m : ) (hm : 0 < m)
      (i : Fin (m + 1)) : 2 ^ i + 1 < 2 ^ (2 * m + 1) - 1
    theorem CryptBoolean.two_pow_add_one_lt_odd_modulus
      (m : ) (hm : 0 < m) (i : Fin (m + 1)) :
      2 ^ i + 1 < 2 ^ (2 * m + 1) - 1
    The quadratic exponents in the odd-dimensional trace representation lie
    strictly below the multiplicative field modulus. 
  • defdefined in CryptBoolean/Carlet/Chapter05/QuadraticTraceRepresentation.lean
    complete
    def CryptBoolean.quadraticTraceMiddleNorm {m : }
      (iota :
        CryptBoolean.BinaryGaloisField m →ₐ[FABL.𝔽₂]
          CryptBoolean.BinaryGaloisField (2 * m))
      (x : CryptBoolean.BinaryGaloisField (2 * m)) :
      CryptBoolean.BinaryGaloisField m
    def CryptBoolean.quadraticTraceMiddleNorm
      {m : }
      (iota :
        CryptBoolean.BinaryGaloisField
            m →ₐ[FABL.𝔽₂]
          CryptBoolean.BinaryGaloisField
            (2 * m))
      (x :
        CryptBoolean.BinaryGaloisField
          (2 * m)) :
      CryptBoolean.BinaryGaloisField m
    The relative norm determined by an explicitly supplied copy of `GF(2^m)` inside
    `GF(2^(2m))`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticTraceRepresentation.lean
    complete
    theorem CryptBoolean.quadraticTraceMiddle_finrank {m : } (hm : m  0)
      (iota :
        CryptBoolean.BinaryGaloisField m →ₐ[FABL.𝔽₂]
          CryptBoolean.BinaryGaloisField (2 * m)) :
      Module.finrank (CryptBoolean.BinaryGaloisField m)
          (CryptBoolean.BinaryGaloisField (2 * m)) =
        2
    theorem CryptBoolean.quadraticTraceMiddle_finrank
      {m : } (hm : m  0)
      (iota :
        CryptBoolean.BinaryGaloisField
            m →ₐ[FABL.𝔽₂]
          CryptBoolean.BinaryGaloisField
            (2 * m)) :
      Module.finrank
          (CryptBoolean.BinaryGaloisField m)
          (CryptBoolean.BinaryGaloisField
            (2 * m)) =
        2
    The explicitly embedded middle field has relative degree two in the
    quadratic binary extension. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticTraceRepresentation.lean
    complete
    theorem CryptBoolean.quadraticTraceMiddleNorm_map_eq_pow {m : } (hm : m  0)
      (iota :
        CryptBoolean.BinaryGaloisField m →ₐ[FABL.𝔽₂]
          CryptBoolean.BinaryGaloisField (2 * m))
      (x : CryptBoolean.BinaryGaloisField (2 * m)) :
      iota (CryptBoolean.quadraticTraceMiddleNorm iota x) = x ^ (2 ^ m + 1)
    theorem CryptBoolean.quadraticTraceMiddleNorm_map_eq_pow
      {m : } (hm : m  0)
      (iota :
        CryptBoolean.BinaryGaloisField
            m →ₐ[FABL.𝔽₂]
          CryptBoolean.BinaryGaloisField
            (2 * m))
      (x :
        CryptBoolean.BinaryGaloisField
          (2 * m)) :
      iota
          (CryptBoolean.quadraticTraceMiddleNorm
            iota x) =
        x ^ (2 ^ m + 1)
    Re-embedding the relative norm gives the middle Frobenius monomial. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticTraceRepresentation.lean
    complete
    theorem CryptBoolean.functionAlgebraicDegree_le_two_iff_exists_odd_quadraticTraceRepresentation
      (m : )
      (theta :
        FABL.F₂Cube (2 * m + 1) ≃ₗ[FABL.𝔽₂]
          CryptBoolean.BinaryGaloisField (2 * m + 1))
      (f : CryptBoolean.BooleanFunction (2 * m + 1)) :
      FABL.functionAlgebraicDegree f  2 
         betaEmpty beta,
           (x : FABL.F₂Cube (2 * m + 1)),
            f x =
              (CryptBoolean.absoluteTrace (2 * m + 1))
                (betaEmpty +  i, beta i * theta x ^ (2 ^ i + 1))
    theorem CryptBoolean.functionAlgebraicDegree_le_two_iff_exists_odd_quadraticTraceRepresentation
      (m : )
      (theta :
        FABL.F₂Cube (2 * m + 1) ≃ₗ[FABL.𝔽₂]
          CryptBoolean.BinaryGaloisField
            (2 * m + 1))
      (f :
        CryptBoolean.BooleanFunction
          (2 * m + 1)) :
      FABL.functionAlgebraicDegree f  2 
         betaEmpty beta,
           (x : FABL.F₂Cube (2 * m + 1)),
            f x =
              (CryptBoolean.absoluteTrace
                  (2 * m + 1))
                (betaEmpty +
                   i,
                    beta i *
                      theta x ^ (2 ^ i + 1))
    Carlet's finite-field trace representation of odd-dimensional quadratic Boolean functions. 
  • theoremdefined in CryptBoolean/Carlet/Chapter05/QuadraticTraceRepresentation.lean
    complete
    theorem CryptBoolean.functionAlgebraicDegree_le_two_iff_exists_even_quadraticTraceRepresentation
      (m : ) (hm : m  0)
      (theta :
        FABL.F₂Cube (2 * m) ≃ₗ[FABL.𝔽₂]
          CryptBoolean.BinaryGaloisField (2 * m))
      (f : CryptBoolean.BooleanFunction (2 * m)) :
      FABL.functionAlgebraicDegree f  2 
         iota betaEmpty beta gamma,
           (x : FABL.F₂Cube (2 * m)),
            f x =
              (CryptBoolean.absoluteTrace (2 * m))
                  (betaEmpty +  i, beta i * theta x ^ (2 ^ i + 1)) +
                (CryptBoolean.absoluteTrace m)
                  (gamma *
                    CryptBoolean.quadraticTraceMiddleNorm iota (theta x))
    theorem CryptBoolean.functionAlgebraicDegree_le_two_iff_exists_even_quadraticTraceRepresentation
      (m : ) (hm : m  0)
      (theta :
        FABL.F₂Cube (2 * m) ≃ₗ[FABL.𝔽₂]
          CryptBoolean.BinaryGaloisField
            (2 * m))
      (f :
        CryptBoolean.BooleanFunction
          (2 * m)) :
      FABL.functionAlgebraicDegree f  2 
         iota betaEmpty beta gamma,
           (x : FABL.F₂Cube (2 * m)),
            f x =
              (CryptBoolean.absoluteTrace
                    (2 * m))
                  (betaEmpty +
                     i,
                      beta i *
                        theta x ^
                          (2 ^ i + 1)) +
                (CryptBoolean.absoluteTrace m)
                  (gamma *
                    CryptBoolean.quadraticTraceMiddleNorm
                      iota (theta x))
    Carlet's finite-field trace representation of even-dimensional quadratic Boolean
    functions, with the middle coefficient taken in an explicitly embedded half-degree subfield. 

The coordinate map is stated explicitly. In even dimension, the chosen embedding identifies the half-degree subfield inside K_{2m}, and the relative norm satisfies the printed power formula.

Definition4.2.11
Group: Chapter 4: Classes with Provable Spectra and Weights (30)
Group member previews
Preview
Theorem 4.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 2
Statement dependency previews
Preview
Theorem 4.2.6
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
used by 0L∃∀N

Quadratic semi-bent functions (Carlet, Section 5.2, p. 71). For odd n, a quadratic Boolean function is called semi-bent in this section when \operatorname{nl}(f)=2^{n-1}-2^{(n-1)/2}. The cited trace-form studies concern functions \operatorname{Tr}_n\!\left( \sum_{i=1}^{(n-1)/2}c_i x^{2^i+1} \right) that satisfy this condition.

Lean code for Definition4.2.111 definition
  • defdefined in CryptBoolean/Carlet/Chapter05/Quadratic.lean
    complete
    def CryptBoolean.IsQuadraticSemiBent {n : }
      (f : CryptBoolean.BooleanFunction n) : Prop
    def CryptBoolean.IsQuadraticSemiBent {n : }
      (f : CryptBoolean.BooleanFunction n) :
      Prop
    For odd arity, a quadratic semi-bent function has the extremal
    nonlinearity displayed in Carlet Section 5.2. 

The displayed nonlinearity is part of the definition. The trace expression describes the family under study, whose coefficients must satisfy that condition.