Cryptographic Boolean Functions in Lean

9.3. Nonlinearity🔗

Theorem9.3.1
Group: Chapter 9: Symmetric and rotation-symmetric functions (22)
Group member previews
Preview
Definition 9.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 2
Statement dependency previews
Preview
Definition 4.4.3
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
used by 0L∃∀N

Even-dimensional middle-layer normality (Carlet, p. 143). Let n>0 be even and define the n/2-dimensional affine flat A=\left\{x\in V_n\ \middle|\ x_{i+n/2}=x_i+1\text{ for }1\le i\le n/2\right\}. Every point of A has Hamming weight n/2. Hence every Boolean function that is constant on the full middle layer \{x\in V_n\mid w_H(x)=n/2\} is constant on A and is n/2-normal. In particular, every symmetric Boolean function on V_n is n/2-normal.

Lean code for Theorem9.3.115 declarations
  • defdefined in CryptBoolean/Carlet/Chapter10/Normality.lean
    complete
    def CryptBoolean.complementaryPairDirectionLinearMap (l r : ) :
      FABL.F₂Cube (l + r) →ₗ[FABL.𝔽₂] FABL.F₂Cube (l + (l + r))
    def CryptBoolean.complementaryPairDirectionLinearMap
      (l r : ) :
      FABL.F₂Cube (l + r) →ₗ[FABL.𝔽₂]
        FABL.F₂Cube (l + (l + r))
    The direction map of the affine flat obtained by pairing `l` coordinates
    with their complements and leaving `r` coordinates free. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Normality.lean
    complete
    theorem CryptBoolean.complementaryPairDirectionLinearMap_apply_append {l r : }
      (u : FABL.F₂Cube l) (y : FABL.F₂Cube r) :
      (CryptBoolean.complementaryPairDirectionLinearMap l r)
          (Fin.append u y) =
        Fin.append u (Fin.append u y)
    theorem CryptBoolean.complementaryPairDirectionLinearMap_apply_append
      {l r : } (u : FABL.F₂Cube l)
      (y : FABL.F₂Cube r) :
      (CryptBoolean.complementaryPairDirectionLinearMap
            l r)
          (Fin.append u y) =
        Fin.append u (Fin.append u y)
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Normality.lean
    complete
    theorem CryptBoolean.complementaryPairDirectionLinearMap_injective (l r : ) :
      Function.Injective
        (CryptBoolean.complementaryPairDirectionLinearMap l r)
    theorem CryptBoolean.complementaryPairDirectionLinearMap_injective
      (l r : ) :
      Function.Injective
        (CryptBoolean.complementaryPairDirectionLinearMap
            l r)
  • defdefined in CryptBoolean/Carlet/Chapter10/Normality.lean
    complete
    def CryptBoolean.complementaryPairDirectionSubspace (l r : ) :
      Submodule FABL.𝔽₂ (FABL.F₂Cube (l + (l + r)))
    def CryptBoolean.complementaryPairDirectionSubspace
      (l r : ) :
      Submodule FABL.𝔽₂
        (FABL.F₂Cube (l + (l + r)))
    The direction subspace of the complementary-pair affine flat. 
  • defdefined in CryptBoolean/Carlet/Chapter10/Normality.lean
    complete
    def CryptBoolean.complementaryPairDirectionLinearEquiv (l r : ) :
      FABL.F₂Cube (l + r) ≃ₗ[FABL.𝔽₂]
        (CryptBoolean.complementaryPairDirectionSubspace l r)
    def CryptBoolean.complementaryPairDirectionLinearEquiv
      (l r : ) :
      FABL.F₂Cube (l + r) ≃ₗ[FABL.𝔽₂]
        (CryptBoolean.complementaryPairDirectionSubspace
            l r)
    Canonical binary coordinates on the complementary-pair direction
    subspace. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Normality.lean
    complete
    theorem CryptBoolean.complementaryPairDirectionLinearEquiv_apply_coe {l r : }
      (z : FABL.F₂Cube (l + r)) :
      ((CryptBoolean.complementaryPairDirectionLinearEquiv l r) z) =
        (CryptBoolean.complementaryPairDirectionLinearMap l r) z
    theorem CryptBoolean.complementaryPairDirectionLinearEquiv_apply_coe
      {l r : } (z : FABL.F₂Cube (l + r)) :
      ((CryptBoolean.complementaryPairDirectionLinearEquiv
              l r)
            z) =
        (CryptBoolean.complementaryPairDirectionLinearMap
            l r)
          z
  • defdefined in CryptBoolean/Carlet/Chapter10/Normality.lean
    complete
    def CryptBoolean.complementaryPairBase (l r : ) : FABL.F₂Cube (l + (l + r))
    def CryptBoolean.complementaryPairBase
      (l r : ) : FABL.F₂Cube (l + (l + r))
    The translate that complements the second coordinate in every paired
    block. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Normality.lean
    complete
    theorem CryptBoolean.complementaryPairPoint_append {l r : } (u : FABL.F₂Cube l)
      (y : FABL.F₂Cube r) :
      (CryptBoolean.complementaryPairDirectionLinearMap l r)
            (Fin.append u y) +
          CryptBoolean.complementaryPairBase l r =
        Fin.append u (Fin.append (u + 1) y)
    theorem CryptBoolean.complementaryPairPoint_append
      {l r : } (u : FABL.F₂Cube l)
      (y : FABL.F₂Cube r) :
      (CryptBoolean.complementaryPairDirectionLinearMap
              l r)
            (Fin.append u y) +
          CryptBoolean.complementaryPairBase l
            r =
        Fin.append u (Fin.append (u + 1) y)
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Normality.lean
    complete
    theorem CryptBoolean.card_f₂Support_complementaryPairPoint {l r : }
      (u : FABL.F₂Cube l) (y : FABL.F₂Cube r) :
      (FABL.f₂Support (Fin.append u (Fin.append (u + 1) y))).card =
        l + (FABL.f₂Support y).card
    theorem CryptBoolean.card_f₂Support_complementaryPairPoint
      {l r : } (u : FABL.F₂Cube l)
      (y : FABL.F₂Cube r) :
      (FABL.f₂Support
            (Fin.append u
              (Fin.append (u + 1) y))).card =
        l + (FABL.f₂Support y).card
    Every complementary pair contributes exactly one to Hamming weight. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Normality.lean
    complete
    theorem CryptBoolean.finrank_complementaryPairDirectionSubspace (l r : ) :
      Module.finrank FABL.𝔽₂
          (CryptBoolean.complementaryPairDirectionSubspace l r) =
        l + r
    theorem CryptBoolean.finrank_complementaryPairDirectionSubspace
      (l r : ) :
      Module.finrank FABL.𝔽₂
          (CryptBoolean.complementaryPairDirectionSubspace
              l r) =
        l + r
    The complementary-pair direction subspace has the expected dimension. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Normality.lean
    complete
    theorem CryptBoolean.isConstantOnAffineFlat_of_coordinateRestriction_eq_const
      {n k : } {f : CryptBoolean.BooleanFunction n}
      {E : Submodule FABL.𝔽₂ (FABL.F₂Cube n)} {a : FABL.F₂Cube n}
      {e : FABL.F₂Cube k ≃ₗ[FABL.𝔽₂] E} {b : FABL.𝔽₂}
      (hrestriction :
        CryptBoolean.coordinateAffineSubspaceRestriction f E a e = fun x =>
          b) :
      CryptBoolean.IsConstantOnAffineFlat f E a
    theorem CryptBoolean.isConstantOnAffineFlat_of_coordinateRestriction_eq_const
      {n k : }
      {f : CryptBoolean.BooleanFunction n}
      {E : Submodule FABL.𝔽₂ (FABL.F₂Cube n)}
      {a : FABL.F₂Cube n}
      {e : FABL.F₂Cube k ≃ₗ[FABL.𝔽₂] E}
      {b : FABL.𝔽₂}
      (hrestriction :
        CryptBoolean.coordinateAffineSubspaceRestriction
            f E a e =
          fun x => b) :
      CryptBoolean.IsConstantOnAffineFlat f E
        a
    A constant coordinate restriction witnesses constancy on the ambient
    affine flat. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Normality.lean
    complete
    theorem CryptBoolean.card_f₂Support_eq_middle_of_mem_complementaryPairAffineFlat
      {m : } (x : FABL.F₂Cube (m + m))
      (hx :
        x 
          FABL.binaryAffineSubspace
            (CryptBoolean.complementaryPairDirectionSubspace m 0)
            (CryptBoolean.complementaryPairBase m 0)) :
      (FABL.f₂Support x).card = m
    theorem CryptBoolean.card_f₂Support_eq_middle_of_mem_complementaryPairAffineFlat
      {m : } (x : FABL.F₂Cube (m + m))
      (hx :
        x 
          FABL.binaryAffineSubspace
            (CryptBoolean.complementaryPairDirectionSubspace
              m 0)
            (CryptBoolean.complementaryPairBase
              m 0)) :
      (FABL.f₂Support x).card = m
    Every point of the even-dimensional complementary-pair flat lies in the
    middle Hamming-weight layer. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Normality.lean
    complete
    theorem CryptBoolean.isKNormal_even_of_constant_on_middleLayer {m : }
      {f : CryptBoolean.BooleanFunction (m + m)} {b : FABL.𝔽₂}
      (hf :
         (x : FABL.F₂Cube (m + m)),
          (FABL.f₂Support x).card = m  f x = b) :
      CryptBoolean.IsKNormal f m
    theorem CryptBoolean.isKNormal_even_of_constant_on_middleLayer
      {m : }
      {f :
        CryptBoolean.BooleanFunction (m + m)}
      {b : FABL.𝔽₂}
      (hf :
         (x : FABL.F₂Cube (m + m)),
          (FABL.f₂Support x).card = m 
            f x = b) :
      CryptBoolean.IsKNormal f m
    In dimension `2m`, every Boolean function that is constant on the middle
    Hamming-weight layer is `m`-normal. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Normality.lean
    complete
    theorem CryptBoolean.IsSymmetricBooleanFunction.isConstantOnComplementaryPairFlat_even
      {m : } {f : CryptBoolean.BooleanFunction (m + m)}
      (hf : CryptBoolean.IsSymmetricBooleanFunction f) :
      CryptBoolean.IsConstantOnAffineFlat f
        (CryptBoolean.complementaryPairDirectionSubspace m 0)
        (CryptBoolean.complementaryPairBase m 0)
    theorem CryptBoolean.IsSymmetricBooleanFunction.isConstantOnComplementaryPairFlat_even
      {m : }
      {f :
        CryptBoolean.BooleanFunction (m + m)}
      (hf :
        CryptBoolean.IsSymmetricBooleanFunction
          f) :
      CryptBoolean.IsConstantOnAffineFlat f
        (CryptBoolean.complementaryPairDirectionSubspace
          m 0)
        (CryptBoolean.complementaryPairBase m
          0)
    The complementary-pair flat in even dimension is a constant flat for
    every symmetric Boolean function. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Normality.lean
    complete
    theorem CryptBoolean.IsSymmetricBooleanFunction.isKNormal_even {m : }
      {f : CryptBoolean.BooleanFunction (m + m)}
      (hf : CryptBoolean.IsSymmetricBooleanFunction f) :
      CryptBoolean.IsKNormal f m
    theorem CryptBoolean.IsSymmetricBooleanFunction.isKNormal_even
      {m : }
      {f :
        CryptBoolean.BooleanFunction (m + m)}
      (hf :
        CryptBoolean.IsSymmetricBooleanFunction
          f) :
      CryptBoolean.IsKNormal f m
    Every symmetric Boolean function in dimension `2m` is `m`-normal. 
Theorem9.3.2
Group: Chapter 9: Symmetric and rotation-symmetric functions (22)
Group member previews
Preview
Definition 9.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 3
Statement dependency previews
Preview
Definition 5.1.1
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
Used by 2
Reverse dependency previews
Preview
Theorem 9.3.7
Loading preview
Reverse dependency preview content is loaded from the rendered-fragment cache.
L∃∀N

Bent symmetric functions (Carlet, p. 143). Let n>0 be even, put q_n(x)=\sum_{1\le i<j\le n}x_ix_j, \qquad p_n(x)=x_1+\cdots+x_n, and let f:V_n\to\mathbb F_2 be symmetric. Then f is bent if and only if f=q_n+ap_n+b for some a,b\in\mathbb F_2. Equivalently, the four bent symmetric functions are q_n, q_n+1, q_n+p_n, and q_n+p_n+1. Each has nonlinearity 2^{n-1}-2^{n/2-1}.

Lean code for Theorem9.3.23 theorems
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Propagation.lean
    complete
    theorem CryptBoolean.isBent_completeQuadraticBit_add_affineFunction_smul_fullDirection
      {n : } (hn : Even n) (a b : FABL.𝔽₂) :
      CryptBoolean.IsBent
        (FABL.completeQuadraticBit +
          FABL.affineFunction b (a  CryptBoolean.fullDirection n))
    theorem CryptBoolean.isBent_completeQuadraticBit_add_affineFunction_smul_fullDirection
      {n : } (hn : Even n) (a b : FABL.𝔽₂) :
      CryptBoolean.IsBent
        (FABL.completeQuadraticBit +
          FABL.affineFunction b
            (a 
              CryptBoolean.fullDirection n))
    In even dimension, every affine translate of the complete quadratic
    function is bent. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Propagation.lean
    complete
    theorem CryptBoolean.symmetric_isBent_iff_completeQuadraticBit_add_affineFunction_smul_fullDirection
      {n : } {f : CryptBoolean.BooleanFunction n} (hn : Even n)
      (hnpos : 0 < n) (hsym : CryptBoolean.IsSymmetricBooleanFunction f) :
      CryptBoolean.IsBent f 
         a b,
          f =
            FABL.completeQuadraticBit +
              FABL.affineFunction b (a  CryptBoolean.fullDirection n)
    theorem CryptBoolean.symmetric_isBent_iff_completeQuadraticBit_add_affineFunction_smul_fullDirection
      {n : }
      {f : CryptBoolean.BooleanFunction n}
      (hn : Even n) (hnpos : 0 < n)
      (hsym :
        CryptBoolean.IsSymmetricBooleanFunction
          f) :
      CryptBoolean.IsBent f 
         a b,
          f =
            FABL.completeQuadraticBit +
              FABL.affineFunction b
                (a 
                  CryptBoolean.fullDirection
                    n)
    In positive even dimension, the symmetric bent functions are exactly the
    four symmetric affine translates of the complete quadratic function. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Propagation.lean
    complete
    theorem CryptBoolean.nonlinearity_eq_two_pow_sub_two_pow_half_of_symmetric_isBent
      {n : } {f : CryptBoolean.BooleanFunction n} (hn : Even n)
      (hnpos : 0 < n) (_hsym : CryptBoolean.IsSymmetricBooleanFunction f)
      (hf : CryptBoolean.IsBent f) :
      CryptBoolean.nonlinearity f = 2 ^ (n - 1) - 2 ^ (n / 2 - 1)
    theorem CryptBoolean.nonlinearity_eq_two_pow_sub_two_pow_half_of_symmetric_isBent
      {n : }
      {f : CryptBoolean.BooleanFunction n}
      (hn : Even n) (hnpos : 0 < n)
      (_hsym :
        CryptBoolean.IsSymmetricBooleanFunction
          f)
      (hf : CryptBoolean.IsBent f) :
      CryptBoolean.nonlinearity f =
        2 ^ (n - 1) - 2 ^ (n / 2 - 1)
    Every positive even-dimensional symmetric bent function has the standard
    bent nonlinearity value. 
Theorem9.3.3
Group: Chapter 9: Symmetric and rotation-symmetric functions (22)
Group member previews
Preview
Definition 9.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 3
Statement dependency previews
Preview
Definition 3.5.1
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
used by 1L∃∀N

Theorem 16 (Carlet, pp. 143--144). Let n>0 be even and let f:V_n\to\mathbb F_2 be symmetric. Then f satisfies PC(2) if and only if f=q_n+ap_n+b for some a,b\in\mathbb F_2, where q_n(x)=\sum_{1\le i<j\le n}x_ix_j, \qquad p_n(x)=x_1+\cdots+x_n. Thus the PC(2) symmetric functions are exactly q_n, q_n+1, q_n+p_n, and q_n+p_n+1.

Lean code for Theorem9.3.313 theorems
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Propagation.lean
    complete
    theorem CryptBoolean.coordinateDirection_add_eq_f₂CubeOfFinset_pair {n : }
      (i j : Fin n) (hij : i  j) :
      CryptBoolean.coordinateDirection i +
          CryptBoolean.coordinateDirection j =
        FABL.f₂CubeOfFinset {i, j}
    theorem CryptBoolean.coordinateDirection_add_eq_f₂CubeOfFinset_pair
      {n : } (i j : Fin n) (hij : i  j) :
      CryptBoolean.coordinateDirection i +
          CryptBoolean.coordinateDirection j =
        FABL.f₂CubeOfFinset {i, j}
    The sum of two distinct coordinate directions is the indicator of the
    corresponding coordinate pair. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Propagation.lean
    complete
    theorem CryptBoolean.f₂Support_coordinateDirection_add {n : } (i j : Fin n)
      (hij : i  j) :
      FABL.f₂Support
          (CryptBoolean.coordinateDirection i +
            CryptBoolean.coordinateDirection j) =
        {i, j}
    theorem CryptBoolean.f₂Support_coordinateDirection_add
      {n : } (i j : Fin n) (hij : i  j) :
      FABL.f₂Support
          (CryptBoolean.coordinateDirection
              i +
            CryptBoolean.coordinateDirection
              j) =
        {i, j}
    The support of a sum of two distinct coordinate directions is their
    two-element coordinate set. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Propagation.lean
    complete
    theorem CryptBoolean.card_f₂Support_coordinateDirection_add {n : }
      (i j : Fin n) (hij : i  j) :
      (FABL.f₂Support
            (CryptBoolean.coordinateDirection i +
              CryptBoolean.coordinateDirection j)).card =
        2
    theorem CryptBoolean.card_f₂Support_coordinateDirection_add
      {n : } (i j : Fin n) (hij : i  j) :
      (FABL.f₂Support
            (CryptBoolean.coordinateDirection
                i +
              CryptBoolean.coordinateDirection
                j)).card =
        2
    A pair direction has Hamming weight two. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Propagation.lean
    complete
    theorem CryptBoolean.coordinateDirection_add_ne_zero {n : } (i j : Fin n)
      (hij : i  j) :
      CryptBoolean.coordinateDirection i +
          CryptBoolean.coordinateDirection j 
        0
    theorem CryptBoolean.coordinateDirection_add_ne_zero
      {n : } (i j : Fin n) (hij : i  j) :
      CryptBoolean.coordinateDirection i +
          CryptBoolean.coordinateDirection j 
        0
    A pair direction with distinct coordinates is nonzero. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Propagation.lean
    complete
    theorem CryptBoolean.f₂DotProduct_coordinateDirection_add {n : } (i j : Fin n)
      (hij : i  j) (x : FABL.F₂Cube n) :
      FABL.f₂DotProduct
          (CryptBoolean.coordinateDirection i +
            CryptBoolean.coordinateDirection j)
          x =
        x i + x j
    theorem CryptBoolean.f₂DotProduct_coordinateDirection_add
      {n : } (i j : Fin n) (hij : i  j)
      (x : FABL.F₂Cube n) :
      FABL.f₂DotProduct
          (CryptBoolean.coordinateDirection
              i +
            CryptBoolean.coordinateDirection
              j)
          x =
        x i + x j
    Pair-direction dot product is the sum of the two selected coordinates. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Propagation.lean
    complete
    theorem CryptBoolean.isSymmetricBooleanFunction_completeQuadraticBit {n : } :
      CryptBoolean.IsSymmetricBooleanFunction FABL.completeQuadraticBit
    theorem CryptBoolean.isSymmetricBooleanFunction_completeQuadraticBit
      {n : } :
      CryptBoolean.IsSymmetricBooleanFunction
        FABL.completeQuadraticBit
    The complete quadratic Boolean function is symmetric. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Propagation.lean
    complete
    theorem CryptBoolean.booleanDerivative_coordinateDirection_add_eq_affineFunction_of_symmetric_pc_two
      {n : } {f : CryptBoolean.BooleanFunction n}
      (hsym : CryptBoolean.IsSymmetricBooleanFunction f)
      (hpc : CryptBoolean.SatisfiesPropagationCriterion 2 f) (i j : Fin n)
      (hij : i  j) :
      FABL.booleanDerivative f
          (CryptBoolean.coordinateDirection i +
            CryptBoolean.coordinateDirection j) =
        FABL.affineFunction 1
          (CryptBoolean.coordinateDirection i +
            CryptBoolean.coordinateDirection j)
    theorem CryptBoolean.booleanDerivative_coordinateDirection_add_eq_affineFunction_of_symmetric_pc_two
      {n : }
      {f : CryptBoolean.BooleanFunction n}
      (hsym :
        CryptBoolean.IsSymmetricBooleanFunction
          f)
      (hpc :
        CryptBoolean.SatisfiesPropagationCriterion
          2 f)
      (i j : Fin n) (hij : i  j) :
      FABL.booleanDerivative f
          (CryptBoolean.coordinateDirection
              i +
            CryptBoolean.coordinateDirection
              j) =
        FABL.affineFunction 1
          (CryptBoolean.coordinateDirection
              i +
            CryptBoolean.coordinateDirection
              j)
    For a symmetric function satisfying `PC(2)`, differentiation in a pair
    direction gives the affine indicator of equal values in that coordinate pair. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Propagation.lean
    complete
    theorem CryptBoolean.coordinateSecondDerivatives_eq_one_of_symmetric_pc_two
      {n : } {f : CryptBoolean.BooleanFunction n}
      (hsym : CryptBoolean.IsSymmetricBooleanFunction f)
      (hpc : CryptBoolean.SatisfiesPropagationCriterion 2 f) (i j : Fin n) :
      i  j 
        CryptBoolean.secondBooleanDerivative f
            (CryptBoolean.coordinateDirection i)
            (CryptBoolean.coordinateDirection j) =
          1
    theorem CryptBoolean.coordinateSecondDerivatives_eq_one_of_symmetric_pc_two
      {n : }
      {f : CryptBoolean.BooleanFunction n}
      (hsym :
        CryptBoolean.IsSymmetricBooleanFunction
          f)
      (hpc :
        CryptBoolean.SatisfiesPropagationCriterion
          2 f)
      (i j : Fin n) :
      i  j 
        CryptBoolean.secondBooleanDerivative f
            (CryptBoolean.coordinateDirection
              i)
            (CryptBoolean.coordinateDirection
              j) =
          1
    Symmetry and `PC(2)` force every mixed coordinate second derivative to
    be the constant-one function. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Propagation.lean
    complete
    theorem CryptBoolean.f₂DotProduct_smul_fullDirection {n : } (a : FABL.𝔽₂)
      (x : FABL.F₂Cube n) :
      FABL.f₂DotProduct (a  CryptBoolean.fullDirection n) x =
        a * (FABL.f₂Support x).card
    theorem CryptBoolean.f₂DotProduct_smul_fullDirection
      {n : } (a : FABL.𝔽₂)
      (x : FABL.F₂Cube n) :
      FABL.f₂DotProduct
          (a  CryptBoolean.fullDirection n)
          x =
        a * (FABL.f₂Support x).card
    Dot product with a scalar multiple of the all-one direction is the
    scalar multiple of input-weight parity. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Propagation.lean
    complete
    theorem CryptBoolean.isSymmetricBooleanFunction_affineFunction_smul_fullDirection
      {n : } (a b : FABL.𝔽₂) :
      CryptBoolean.IsSymmetricBooleanFunction
        (FABL.affineFunction b (a  CryptBoolean.fullDirection n))
    theorem CryptBoolean.isSymmetricBooleanFunction_affineFunction_smul_fullDirection
      {n : } (a b : FABL.𝔽₂) :
      CryptBoolean.IsSymmetricBooleanFunction
        (FABL.affineFunction b
          (a  CryptBoolean.fullDirection n))
    Every affine function whose frequency is constant across coordinates is
    symmetric. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Propagation.lean
    complete
    theorem CryptBoolean.eq_zero_or_eq_fullDirection_of_isSymmetric_affineFunction
      {n : } (hn : 0 < n) (c : FABL.𝔽₂) (u : FABL.F₂Cube n)
      (hsym :
        CryptBoolean.IsSymmetricBooleanFunction (FABL.affineFunction c u)) :
      u = 0  u = CryptBoolean.fullDirection n
    theorem CryptBoolean.eq_zero_or_eq_fullDirection_of_isSymmetric_affineFunction
      {n : } (hn : 0 < n) (c : FABL.𝔽₂)
      (u : FABL.F₂Cube n)
      (hsym :
        CryptBoolean.IsSymmetricBooleanFunction
          (FABL.affineFunction c u)) :
      u = 0  u = CryptBoolean.fullDirection n
    A symmetric affine Boolean function has either zero or all-one
    frequency. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Propagation.lean
    complete
    theorem CryptBoolean.isSymmetricBooleanFunction_completeQuadraticBit_add_affineFunction_smul_fullDirection
      {n : } (a b : FABL.𝔽₂) :
      CryptBoolean.IsSymmetricBooleanFunction
        (FABL.completeQuadraticBit +
          FABL.affineFunction b (a  CryptBoolean.fullDirection n))
    theorem CryptBoolean.isSymmetricBooleanFunction_completeQuadraticBit_add_affineFunction_smul_fullDirection
      {n : } (a b : FABL.𝔽₂) :
      CryptBoolean.IsSymmetricBooleanFunction
        (FABL.completeQuadraticBit +
          FABL.affineFunction b
            (a 
              CryptBoolean.fullDirection n))
    Every symmetric affine translate of the complete quadratic function is
    symmetric. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Propagation.lean
    complete
    theorem CryptBoolean.symmetric_satisfiesPropagationCriterion_two_iff {n : }
      {f : CryptBoolean.BooleanFunction n} (hn : Even n) (hnpos : 0 < n)
      (hsym : CryptBoolean.IsSymmetricBooleanFunction f) :
      CryptBoolean.SatisfiesPropagationCriterion 2 f 
         a b,
          f =
            FABL.completeQuadraticBit +
              FABL.affineFunction b (a  CryptBoolean.fullDirection n)
    theorem CryptBoolean.symmetric_satisfiesPropagationCriterion_two_iff
      {n : }
      {f : CryptBoolean.BooleanFunction n}
      (hn : Even n) (hnpos : 0 < n)
      (hsym :
        CryptBoolean.IsSymmetricBooleanFunction
          f) :
      CryptBoolean.SatisfiesPropagationCriterion
          2 f 
         a b,
          f =
            FABL.completeQuadraticBit +
              FABL.affineFunction b
                (a 
                  CryptBoolean.fullDirection
                    n)
    Carlet Theorem 16: in positive even dimension, a symmetric Boolean
    function satisfies `PC(2)` exactly when it is the complete quadratic function
    plus a symmetric affine function. 
Theorem9.3.4
Group: Chapter 9: Symmetric and rotation-symmetric functions (22)
Group member previews
Preview
Definition 9.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 3
Statement dependency previews
Preview
Corollary 4.4.2
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
used by 0L∃∀N

Odd-dimensional weak normality and nonlinearity (Carlet, p. 144). Let n>0 be odd and let f:V_n\to\mathbb F_2 be symmetric. Define the affine flat A=\left\{x\in V_n\ \middle|\ x_{i+(n-1)/2}=x_i+1\text{ for }1\le i\le(n-1)/2\right\}, leaving the last coordinate free. The flat A has dimension (n+1)/2, and the restriction of f to A is affine. Consequently f is (n+1)/2-weakly normal and \operatorname{nl}(f)\le2^{n-1}-2^{(n-1)/2}.

Lean code for Theorem9.3.44 theorems
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Normality.lean
    complete
    theorem CryptBoolean.isAffineOnAffineFlat_of_coordinateRestriction_eq_affineFunction
      {n k : } {f : CryptBoolean.BooleanFunction n}
      {E : Submodule FABL.𝔽₂ (FABL.F₂Cube n)} {a : FABL.F₂Cube n}
      {e : FABL.F₂Cube k ≃ₗ[FABL.𝔽₂] E} {b : FABL.𝔽₂} {c : FABL.F₂Cube k}
      (hrestriction :
        CryptBoolean.coordinateAffineSubspaceRestriction f E a e =
          FABL.affineFunction b c) :
      CryptBoolean.IsAffineOnAffineFlat f E a
    theorem CryptBoolean.isAffineOnAffineFlat_of_coordinateRestriction_eq_affineFunction
      {n k : }
      {f : CryptBoolean.BooleanFunction n}
      {E : Submodule FABL.𝔽₂ (FABL.F₂Cube n)}
      {a : FABL.F₂Cube n}
      {e : FABL.F₂Cube k ≃ₗ[FABL.𝔽₂] E}
      {b : FABL.𝔽₂} {c : FABL.F₂Cube k}
      (hrestriction :
        CryptBoolean.coordinateAffineSubspaceRestriction
            f E a e =
          FABL.affineFunction b c) :
      CryptBoolean.IsAffineOnAffineFlat f E a
    An affine coordinate restriction witnesses affinity on the ambient
    affine flat. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Normality.lean
    complete
    theorem CryptBoolean.IsSymmetricBooleanFunction.isAffineOnComplementaryPairFlat_odd
      {m : } {f : CryptBoolean.BooleanFunction (m + (m + 1))}
      (hf : CryptBoolean.IsSymmetricBooleanFunction f) :
      CryptBoolean.IsAffineOnAffineFlat f
        (CryptBoolean.complementaryPairDirectionSubspace m 1)
        (CryptBoolean.complementaryPairBase m 1)
    theorem CryptBoolean.IsSymmetricBooleanFunction.isAffineOnComplementaryPairFlat_odd
      {m : }
      {f :
        CryptBoolean.BooleanFunction
          (m + (m + 1))}
      (hf :
        CryptBoolean.IsSymmetricBooleanFunction
          f) :
      CryptBoolean.IsAffineOnAffineFlat f
        (CryptBoolean.complementaryPairDirectionSubspace
          m 1)
        (CryptBoolean.complementaryPairBase m
          1)
    On the odd-dimensional paired flat, every symmetric Boolean function
    restricts to an affine function of the one unpaired coordinate. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Normality.lean
    complete
    theorem CryptBoolean.IsSymmetricBooleanFunction.isKWeaklyNormal_odd {m : }
      {f : CryptBoolean.BooleanFunction (m + (m + 1))}
      (hf : CryptBoolean.IsSymmetricBooleanFunction f) :
      CryptBoolean.IsKWeaklyNormal f (m + 1)
    theorem CryptBoolean.IsSymmetricBooleanFunction.isKWeaklyNormal_odd
      {m : }
      {f :
        CryptBoolean.BooleanFunction
          (m + (m + 1))}
      (hf :
        CryptBoolean.IsSymmetricBooleanFunction
          f) :
      CryptBoolean.IsKWeaklyNormal f (m + 1)
    Every symmetric Boolean function in dimension `2m+1` is
    `(m+1)`-weakly normal. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Normality.lean
    complete
    theorem CryptBoolean.IsSymmetricBooleanFunction.nonlinearity_le_odd {m : }
      {f : CryptBoolean.BooleanFunction (m + (m + 1))}
      (hf : CryptBoolean.IsSymmetricBooleanFunction f) :
      CryptBoolean.nonlinearity f  2 ^ (m + (m + 1) - 1) - 2 ^ m
    theorem CryptBoolean.IsSymmetricBooleanFunction.nonlinearity_le_odd
      {m : }
      {f :
        CryptBoolean.BooleanFunction
          (m + (m + 1))}
      (hf :
        CryptBoolean.IsSymmetricBooleanFunction
          f) :
      CryptBoolean.nonlinearity f 
        2 ^ (m + (m + 1) - 1) - 2 ^ m
    The affine paired flat gives Carlet's odd-dimensional nonlinearity
    bound for symmetric functions. 
Theorem9.3.5
Group: Chapter 9: Symmetric and rotation-symmetric functions (22)
Group member previews
Preview
Definition 9.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 3
Statement dependency previews
Preview
Theorem 5.15.1
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
Used by 2
Reverse dependency previews
Preview
Theorem 9.3.7
Loading preview
Reverse dependency preview content is loaded from the rendered-fragment cache.
L∃∀N

Optimal symmetric nonlinearity in odd dimension (Carlet, p. 144). Let n>0 be odd and let f:V_n\to\mathbb F_2 be symmetric. Then \operatorname{nl}(f)=2^{n-1}-2^{(n-1)/2} if and only if f=q_n+ap_n+b for some a,b\in\mathbb F_2. Thus the only symmetric functions attaining the odd-dimensional quadratic nonlinearity bound are q_n, q_n+1, q_n+p_n, and q_n+p_n+1.

Lean code for Theorem9.3.512 theorems
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Nonlinearity.lean
    complete
    theorem CryptBoolean.completeQuadraticBit_odd_eq_hyperplaneExtension (m : ) :
      FABL.completeQuadraticBit =
        CryptBoolean.hyperplaneExtension FABL.completeQuadraticBit
          (FABL.completeQuadraticBit + FABL.affineFunction 0 1)
    theorem CryptBoolean.completeQuadraticBit_odd_eq_hyperplaneExtension
      (m : ) :
      FABL.completeQuadraticBit =
        CryptBoolean.hyperplaneExtension
          FABL.completeQuadraticBit
          (FABL.completeQuadraticBit +
            FABL.affineFunction 0 1)
    In odd dimension, the complete quadratic function is the concatenation
    of the even-dimensional complete quadratic function and its full-parity
    translate. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Nonlinearity.lean
    complete
    theorem CryptBoolean.nonlinearity_completeQuadraticBit_odd (m : ) :
      CryptBoolean.nonlinearity FABL.completeQuadraticBit =
        2 ^ (m + (m + 1) - 1) - 2 ^ m
    theorem CryptBoolean.nonlinearity_completeQuadraticBit_odd
      (m : ) :
      CryptBoolean.nonlinearity
          FABL.completeQuadraticBit =
        2 ^ (m + (m + 1) - 1) - 2 ^ m
    In dimension `2m+1`, the complete quadratic function attains the
    odd-dimensional quadratic nonlinearity bound. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Nonlinearity.lean
    complete
    theorem CryptBoolean.symmetricQuadraticNormalForm_eq_completeQuadratic_add_affineFunction
      (n : ) (a b : FABL.𝔽₂) :
      CryptBoolean.symmetricQuadraticNormalForm n a b =
        FABL.completeQuadraticBit +
          FABL.affineFunction b (a  CryptBoolean.fullDirection n)
    theorem CryptBoolean.symmetricQuadraticNormalForm_eq_completeQuadratic_add_affineFunction
      (n : ) (a b : FABL.𝔽₂) :
      CryptBoolean.symmetricQuadraticNormalForm
          n a b =
        FABL.completeQuadraticBit +
          FABL.affineFunction b
            (a  CryptBoolean.fullDirection n)
    The symmetric quadratic normal form is the complete quadratic function
    plus a symmetric affine function. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Nonlinearity.lean
    complete
    theorem CryptBoolean.nonlinearity_symmetricQuadraticNormalForm_odd (m : )
      (a b : FABL.𝔽₂) :
      CryptBoolean.nonlinearity
          (CryptBoolean.symmetricQuadraticNormalForm (m + (m + 1)) a b) =
        2 ^ (m + (m + 1) - 1) - 2 ^ m
    theorem CryptBoolean.nonlinearity_symmetricQuadraticNormalForm_odd
      (m : ) (a b : FABL.𝔽₂) :
      CryptBoolean.nonlinearity
          (CryptBoolean.symmetricQuadraticNormalForm
            (m + (m + 1)) a b) =
        2 ^ (m + (m + 1) - 1) - 2 ^ m
    All four symmetric quadratic normal forms attain the odd-dimensional
    quadratic nonlinearity bound. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Nonlinearity.lean
    complete
    theorem CryptBoolean.nonlinearity_eq_odd_quadraticBound_of_eq_symmetricQuadraticNormalForm
      {m : } {f : CryptBoolean.BooleanFunction (m + (m + 1))}
      (hform :
         a b,
          f = CryptBoolean.symmetricQuadraticNormalForm (m + (m + 1)) a b) :
      CryptBoolean.nonlinearity f = 2 ^ (m + (m + 1) - 1) - 2 ^ m
    theorem CryptBoolean.nonlinearity_eq_odd_quadraticBound_of_eq_symmetricQuadraticNormalForm
      {m : }
      {f :
        CryptBoolean.BooleanFunction
          (m + (m + 1))}
      (hform :
         a b,
          f =
            CryptBoolean.symmetricQuadraticNormalForm
              (m + (m + 1)) a b) :
      CryptBoolean.nonlinearity f =
        2 ^ (m + (m + 1) - 1) - 2 ^ m
    The displayed four-function family gives the forward implication in the
    odd-dimensional optimal-nonlinearity classification. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Nonlinearity.lean
    complete
    theorem CryptBoolean.completeQuadraticPolarFrequency_fullDirection_odd (m : ) :
      CryptBoolean.completeQuadraticPolarFrequency
          (CryptBoolean.fullDirection (m + (m + 1))) =
        0
    theorem CryptBoolean.completeQuadraticPolarFrequency_fullDirection_odd
      (m : ) :
      CryptBoolean.completeQuadraticPolarFrequency
          (CryptBoolean.fullDirection
            (m + (m + 1))) =
        0
    In odd dimension, the full direction is in the polar radical of the
    complete quadratic function. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Nonlinearity.lean
    complete
    theorem CryptBoolean.domainTranslate_completeQuadraticBit_add_affineFunction
      {n : } (b : FABL.𝔽₂) (a t : FABL.F₂Cube n) :
      FABL.domainTranslate
          (FABL.completeQuadraticBit + FABL.affineFunction b a) t =
        FABL.completeQuadraticBit +
          FABL.affineFunction
            (FABL.completeQuadraticBit t + b + FABL.f₂DotProduct a t)
            (CryptBoolean.completeQuadraticPolarFrequency t + a)
    theorem CryptBoolean.domainTranslate_completeQuadraticBit_add_affineFunction
      {n : } (b : FABL.𝔽₂)
      (a t : FABL.F₂Cube n) :
      FABL.domainTranslate
          (FABL.completeQuadraticBit +
            FABL.affineFunction b a)
          t =
        FABL.completeQuadraticBit +
          FABL.affineFunction
            (FABL.completeQuadraticBit t + b +
              FABL.f₂DotProduct a t)
            (CryptBoolean.completeQuadraticPolarFrequency
                t +
              a)
    Translating a complete quadratic function plus an affine function only
    changes its affine summand. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    theorem CryptBoolean.exists_affineFunction_hammingDistance_eq_nonlinearity
      {n : } (f : CryptBoolean.BooleanFunction n) :
       b a,
        CryptBoolean.hammingDistance f (FABL.affineFunction b a) =
          CryptBoolean.nonlinearity f
    theorem CryptBoolean.exists_affineFunction_hammingDistance_eq_nonlinearity
      {n : }
      (f : CryptBoolean.BooleanFunction n) :
       b a,
        CryptBoolean.hammingDistance f
            (FABL.affineFunction b a) =
          CryptBoolean.nonlinearity f
    The affine minimum defining nonlinearity is attained. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Nonlinearity.lean
    complete
    theorem CryptBoolean.exists_completeQuadraticBit_minimumAffineError_one_at_endpoints_odd
      (m : ) (hm : 0 < m) :
       b a,
        CryptBoolean.hammingWeight
              (FABL.completeQuadraticBit + FABL.affineFunction b a) =
            2 ^ (m + (m + 1) - 1) - 2 ^ m 
          (FABL.completeQuadraticBit + FABL.affineFunction b a) 0 = 1 
            (FABL.completeQuadraticBit + FABL.affineFunction b a)
                (CryptBoolean.fullDirection (m + (m + 1))) =
              1
    theorem CryptBoolean.exists_completeQuadraticBit_minimumAffineError_one_at_endpoints_odd
      (m : ) (hm : 0 < m) :
       b a,
        CryptBoolean.hammingWeight
              (FABL.completeQuadraticBit +
                FABL.affineFunction b a) =
            2 ^ (m + (m + 1) - 1) - 2 ^ m 
          (FABL.completeQuadraticBit +
                  FABL.affineFunction b a)
                0 =
              1 
            (FABL.completeQuadraticBit +
                  FABL.affineFunction b a)
                (CryptBoolean.fullDirection
                  (m + (m + 1))) =
              1
    In positive odd dimension, some minimum-weight affine error of the
    complete quadratic function contains both endpoint inputs. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Nonlinearity.lean
    complete
    theorem CryptBoolean.hammingWeight_add_lt_of_support_nonempty_of_subset {n : }
      (e d : CryptBoolean.BooleanFunction n)
      (hd : (CryptBoolean.support d).Nonempty)
      (hde : CryptBoolean.support d  CryptBoolean.support e) :
      CryptBoolean.hammingWeight (e + d) < CryptBoolean.hammingWeight e
    theorem CryptBoolean.hammingWeight_add_lt_of_support_nonempty_of_subset
      {n : }
      (e d : CryptBoolean.BooleanFunction n)
      (hd : (CryptBoolean.support d).Nonempty)
      (hde :
        CryptBoolean.support d 
          CryptBoolean.support e) :
      CryptBoolean.hammingWeight (e + d) <
        CryptBoolean.hammingWeight e
    Removing a nonempty supported subset from a Boolean support strictly
    decreases Hamming weight. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Nonlinearity.lean
    complete
    theorem CryptBoolean.exists_symmetricQuadraticNormalForm_of_odd_optimal_nonlinearity
      (m : ) {f : CryptBoolean.BooleanFunction (m + (m + 1))}
      (hf : CryptBoolean.IsSymmetricBooleanFunction f)
      (hnonlinearity :
        CryptBoolean.nonlinearity f = 2 ^ (m + (m + 1) - 1) - 2 ^ m) :
       a b, f = CryptBoolean.symmetricQuadraticNormalForm (m + (m + 1)) a b
    theorem CryptBoolean.exists_symmetricQuadraticNormalForm_of_odd_optimal_nonlinearity
      (m : )
      {f :
        CryptBoolean.BooleanFunction
          (m + (m + 1))}
      (hf :
        CryptBoolean.IsSymmetricBooleanFunction
          f)
      (hnonlinearity :
        CryptBoolean.nonlinearity f =
          2 ^ (m + (m + 1) - 1) - 2 ^ m) :
       a b,
        f =
          CryptBoolean.symmetricQuadraticNormalForm
            (m + (m + 1)) a b
    Every positive odd-dimensional symmetric function attaining the
    quadratic nonlinearity bound is a symmetric quadratic normal form. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Nonlinearity.lean
    complete
    theorem CryptBoolean.symmetric_odd_optimal_nonlinearity_iff_symmetricQuadraticNormalForm
      (m : ) {f : CryptBoolean.BooleanFunction (m + (m + 1))}
      (hf : CryptBoolean.IsSymmetricBooleanFunction f) :
      CryptBoolean.nonlinearity f = 2 ^ (m + (m + 1) - 1) - 2 ^ m 
         a b,
          f = CryptBoolean.symmetricQuadraticNormalForm (m + (m + 1)) a b
    theorem CryptBoolean.symmetric_odd_optimal_nonlinearity_iff_symmetricQuadraticNormalForm
      (m : )
      {f :
        CryptBoolean.BooleanFunction
          (m + (m + 1))}
      (hf :
        CryptBoolean.IsSymmetricBooleanFunction
          f) :
      CryptBoolean.nonlinearity f =
          2 ^ (m + (m + 1) - 1) - 2 ^ m 
         a b,
          f =
            CryptBoolean.symmetricQuadraticNormalForm
              (m + (m + 1)) a b
    The odd-dimensional optimal-nonlinearity classification. 
Theorem9.3.6
Group: Chapter 9: Symmetric and rotation-symmetric functions (22)
Group member previews
Preview
Definition 9.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 3
Statement dependency previews
Preview
Definition 3.2.1
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
Used by 3
Reverse dependency previews
Preview
Theorem 9.3.5
Loading preview
Reverse dependency preview content is loaded from the rendered-fragment cache.
L∃∀N

Theorem 17 (Carlet, p. 144). Let n>0, let f:V_n\to\mathbb F_2 be symmetric, and let \ell be an integer with 0<\ell and 2\ell\le n. Define the symmetric function h_\ell:V_{n-2\ell}\to\mathbb F_2 by h_\ell(y_1,\ldots,y_{n-2\ell}) =f(x_1,\ldots,x_\ell,x_1+1,\ldots,x_\ell+1, y_1,\ldots,y_{n-2\ell}), where x_1,\ldots,x_\ell are arbitrary. Equivalently, h_\ell^\#(r)=f^\#(r+\ell) \qquad(0\le r\le n-2\ell). This definition is independent of the arbitrary x_i, and \operatorname{nl}(f) \le2^{n-1}-2^{n-\ell-1}+2^\ell\operatorname{nl}(h_\ell).

Lean code for Theorem9.3.66 declarations
  • defdefined in CryptBoolean/Carlet/Chapter10/Normality.lean
    complete
    def CryptBoolean.complementaryPairRestriction {l r : }
      (f : CryptBoolean.BooleanFunction (l + (l + r))) :
      CryptBoolean.BooleanFunction r
    def CryptBoolean.complementaryPairRestriction
      {l r : }
      (f :
        CryptBoolean.BooleanFunction
          (l + (l + r))) :
      CryptBoolean.BooleanFunction r
    Carlet's `h_l`, obtained by deleting `l` complementary coordinate
    pairs from a Boolean function. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Normality.lean
    complete
    theorem CryptBoolean.IsSymmetricBooleanFunction.eq_complementaryPairRestriction
      {l r : } {f : CryptBoolean.BooleanFunction (l + (l + r))}
      (hf : CryptBoolean.IsSymmetricBooleanFunction f) (u : FABL.F₂Cube l)
      (y : FABL.F₂Cube r) :
      f (Fin.append u (Fin.append (u + 1) y)) =
        CryptBoolean.complementaryPairRestriction f y
    theorem CryptBoolean.IsSymmetricBooleanFunction.eq_complementaryPairRestriction
      {l r : }
      {f :
        CryptBoolean.BooleanFunction
          (l + (l + r))}
      (hf :
        CryptBoolean.IsSymmetricBooleanFunction
          f)
      (u : FABL.F₂Cube l)
      (y : FABL.F₂Cube r) :
      f
          (Fin.append u
            (Fin.append (u + 1) y)) =
        CryptBoolean.complementaryPairRestriction
          f y
    For a symmetric function, the complementary-pair restriction is
    independent of the arbitrary values assigned to the first member of each
    pair. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Normality.lean
    complete
    theorem CryptBoolean.IsSymmetricBooleanFunction.isSymmetric_complementaryPairRestriction
      {l r : } {f : CryptBoolean.BooleanFunction (l + (l + r))}
      (hf : CryptBoolean.IsSymmetricBooleanFunction f) :
      CryptBoolean.IsSymmetricBooleanFunction
        (CryptBoolean.complementaryPairRestriction f)
    theorem CryptBoolean.IsSymmetricBooleanFunction.isSymmetric_complementaryPairRestriction
      {l r : }
      {f :
        CryptBoolean.BooleanFunction
          (l + (l + r))}
      (hf :
        CryptBoolean.IsSymmetricBooleanFunction
          f) :
      CryptBoolean.IsSymmetricBooleanFunction
        (CryptBoolean.complementaryPairRestriction
          f)
    Deleting complementary coordinate pairs preserves symmetry. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Nonlinearity.lean
    complete
    theorem CryptBoolean.symmetricWeightProfileNat_complementaryPairRestriction
      {l r : } {f : CryptBoolean.BooleanFunction (l + (l + r))}
      (hf : CryptBoolean.IsSymmetricBooleanFunction f) {s : }
      (hs : s  r) :
      CryptBoolean.symmetricWeightProfileNat
          (CryptBoolean.complementaryPairRestriction f) s =
        CryptBoolean.symmetricWeightProfileNat f (l + s)
    theorem CryptBoolean.symmetricWeightProfileNat_complementaryPairRestriction
      {l r : }
      {f :
        CryptBoolean.BooleanFunction
          (l + (l + r))}
      (hf :
        CryptBoolean.IsSymmetricBooleanFunction
          f)
      {s : } (hs : s  r) :
      CryptBoolean.symmetricWeightProfileNat
          (CryptBoolean.complementaryPairRestriction
            f)
          s =
        CryptBoolean.symmetricWeightProfileNat
          f (l + s)
    Deleting `l` complementary pairs shifts the weight profile by `l`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Normality.lean
    complete
    theorem CryptBoolean.coordinateAffineSubspaceRestriction_complementaryPair_eq_directSum
      {l r : } {f : CryptBoolean.BooleanFunction (l + (l + r))}
      (hf : CryptBoolean.IsSymmetricBooleanFunction f) :
      CryptBoolean.coordinateAffineSubspaceRestriction f
          (CryptBoolean.complementaryPairDirectionSubspace l r)
          (CryptBoolean.complementaryPairBase l r)
          (CryptBoolean.complementaryPairDirectionLinearEquiv l r) =
        CryptBoolean.booleanDirectSum 0
          (CryptBoolean.complementaryPairRestriction f)
    theorem CryptBoolean.coordinateAffineSubspaceRestriction_complementaryPair_eq_directSum
      {l r : }
      {f :
        CryptBoolean.BooleanFunction
          (l + (l + r))}
      (hf :
        CryptBoolean.IsSymmetricBooleanFunction
          f) :
      CryptBoolean.coordinateAffineSubspaceRestriction
          f
          (CryptBoolean.complementaryPairDirectionSubspace
            l r)
          (CryptBoolean.complementaryPairBase
            l r)
          (CryptBoolean.complementaryPairDirectionLinearEquiv
            l r) =
        CryptBoolean.booleanDirectSum 0
          (CryptBoolean.complementaryPairRestriction
            f)
    In canonical coordinates, restriction to the full paired affine flat is
    the direct sum of a zero function on the arbitrary pair values and `h_l`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Normality.lean
    complete
    theorem CryptBoolean.theorem_17_nonlinearity_complementaryPairRestriction
      {l r : } {f : CryptBoolean.BooleanFunction (l + (l + r))}
      (hf : CryptBoolean.IsSymmetricBooleanFunction f) (hl : 0 < l) :
      CryptBoolean.nonlinearity f 
        2 ^ (l + (l + r) - 1) - 2 ^ (l + r - 1) +
          2 ^ l *
            CryptBoolean.nonlinearity
              (CryptBoolean.complementaryPairRestriction f)
    theorem CryptBoolean.theorem_17_nonlinearity_complementaryPairRestriction
      {l r : }
      {f :
        CryptBoolean.BooleanFunction
          (l + (l + r))}
      (hf :
        CryptBoolean.IsSymmetricBooleanFunction
          f)
      (hl : 0 < l) :
      CryptBoolean.nonlinearity f 
        2 ^ (l + (l + r) - 1) -
            2 ^ (l + r - 1) +
          2 ^ l *
            CryptBoolean.nonlinearity
              (CryptBoolean.complementaryPairRestriction
                f)
    Carlet Theorem 17: deleting `l` complementary pairs bounds the
    nonlinearity of a symmetric function by the scaled nonlinearity of `h_l`. 
Theorem9.3.7
Group: Chapter 9: Symmetric and rotation-symmetric functions (22)
Group member previews
Preview
Definition 9.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 4
Statement dependency previews
Preview
Theorem 9.1.5
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
used by 0L∃∀N

First high-nonlinearity profile consequence (Carlet, p. 145). Let f:V_n\to\mathbb F_2 be symmetric and let 0\le\ell<\lfloor(n-1)/2\rfloor. Define h_\ell by deleting \ell complementary coordinate pairs, with h_0=f. If, as an inequality of integers, \operatorname{nl}(f)> 2^{n-1}-2^{\lfloor(n-1)/2\rfloor}-2^\ell, then h_\ell has algebraic degree exactly two. Equivalently, f^\#(r+2)=f^\#(r)+1 for every \ell\le r\le n-\ell-2.

Lean code for Theorem9.3.714 theorems
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Nonlinearity.lean
    complete
    theorem CryptBoolean.relation_36_even_eq_quadraticBound {m : } (hm : 1  m) :
      2 ^ ((m + m) - 1) - 2 ^ ((m + m) / 2 - 1) =
        (2 ^ (m + m - 1) - 2 ^ (m - 1))
    theorem CryptBoolean.relation_36_even_eq_quadraticBound
      {m : } (hm : 1  m) :
      2 ^ ((m + m) - 1) -
          2 ^ ((m + m) / 2 - 1) =
        (2 ^ (m + m - 1) - 2 ^ (m - 1))
    In positive even dimension, Relation (36) is the integral quadratic
    bound. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Nonlinearity.lean
    complete
    theorem CryptBoolean.nonlinearity_le_even_quadraticBound {m : }
      (f : CryptBoolean.BooleanFunction (m + m)) (hm : 1  m) :
      CryptBoolean.nonlinearity f  2 ^ (m + m - 1) - 2 ^ (m - 1)
    theorem CryptBoolean.nonlinearity_le_even_quadraticBound
      {m : }
      (f :
        CryptBoolean.BooleanFunction (m + m))
      (hm : 1  m) :
      CryptBoolean.nonlinearity f 
        2 ^ (m + m - 1) - 2 ^ (m - 1)
    Every Boolean function in positive even dimension satisfies the integral
    quadratic nonlinearity bound. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Nonlinearity.lean
    complete
    theorem CryptBoolean.isBent_of_nonlinearity_gt_even_quadraticBound_sub_one
      {m : } {f : CryptBoolean.BooleanFunction (m + m)} (hm : 1  m)
      (hlarge :
        CryptBoolean.nonlinearity f > 2 ^ (m + m - 1) - 2 ^ (m - 1) - 1) :
      CryptBoolean.IsBent f
    theorem CryptBoolean.isBent_of_nonlinearity_gt_even_quadraticBound_sub_one
      {m : }
      {f :
        CryptBoolean.BooleanFunction (m + m)}
      (hm : 1  m)
      (hlarge :
        CryptBoolean.nonlinearity f >
          2 ^ (m + m - 1) - 2 ^ (m - 1) - 1) :
      CryptBoolean.IsBent f
    Exceeding the even-dimensional quadratic bound by less than one forces
    bentness. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Nonlinearity.lean
    complete
    theorem CryptBoolean.functionAlgebraicDegree_eq_two_of_symmetric_even_nonlinearity_gt
      {n : } {f : CryptBoolean.BooleanFunction n}
      (hf : CryptBoolean.IsSymmetricBooleanFunction f) (hnEven : Even n)
      (hnTwo : 2  n)
      (hlarge :
        CryptBoolean.nonlinearity f > 2 ^ (n - 1) - 2 ^ (n / 2 - 1) - 1) :
      FABL.functionAlgebraicDegree f = 2
    theorem CryptBoolean.functionAlgebraicDegree_eq_two_of_symmetric_even_nonlinearity_gt
      {n : }
      {f : CryptBoolean.BooleanFunction n}
      (hf :
        CryptBoolean.IsSymmetricBooleanFunction
          f)
      (hnEven : Even n) (hnTwo : 2  n)
      (hlarge :
        CryptBoolean.nonlinearity f >
          2 ^ (n - 1) - 2 ^ (n / 2 - 1) - 1) :
      FABL.functionAlgebraicDegree f = 2
    In positive even dimension, a symmetric function above the
    quadratic-bound-minus-one threshold has degree exactly two. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Nonlinearity.lean
    complete
    theorem CryptBoolean.nonlinearity_eq_odd_quadraticBound_of_symmetric_gt {n : }
      {f : CryptBoolean.BooleanFunction n}
      (hf : CryptBoolean.IsSymmetricBooleanFunction f) (hnOdd : Odd n)
      (hnpos : 0 < n)
      (hlarge :
        CryptBoolean.nonlinearity f > 2 ^ (n - 1) - 2 ^ ((n - 1) / 2) - 1) :
      CryptBoolean.nonlinearity f = 2 ^ (n - 1) - 2 ^ ((n - 1) / 2)
    theorem CryptBoolean.nonlinearity_eq_odd_quadraticBound_of_symmetric_gt
      {n : }
      {f : CryptBoolean.BooleanFunction n}
      (hf :
        CryptBoolean.IsSymmetricBooleanFunction
          f)
      (hnOdd : Odd n) (hnpos : 0 < n)
      (hlarge :
        CryptBoolean.nonlinearity f >
          2 ^ (n - 1) - 2 ^ ((n - 1) / 2) -
            1) :
      CryptBoolean.nonlinearity f =
        2 ^ (n - 1) - 2 ^ ((n - 1) / 2)
    In positive odd dimension, crossing the quadratic-bound-minus-one
    threshold forces equality in the symmetric odd-dimensional bound. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Nonlinearity.lean
    complete
    theorem CryptBoolean.functionAlgebraicDegree_eq_two_of_symmetric_odd_nonlinearity_gt
      {n : } {f : CryptBoolean.BooleanFunction n}
      (hf : CryptBoolean.IsSymmetricBooleanFunction f) (hnOdd : Odd n)
      (hnThree : 3  n)
      (hlarge :
        CryptBoolean.nonlinearity f > 2 ^ (n - 1) - 2 ^ ((n - 1) / 2) - 1) :
      FABL.functionAlgebraicDegree f = 2
    theorem CryptBoolean.functionAlgebraicDegree_eq_two_of_symmetric_odd_nonlinearity_gt
      {n : }
      {f : CryptBoolean.BooleanFunction n}
      (hf :
        CryptBoolean.IsSymmetricBooleanFunction
          f)
      (hnOdd : Odd n) (hnThree : 3  n)
      (hlarge :
        CryptBoolean.nonlinearity f >
          2 ^ (n - 1) - 2 ^ ((n - 1) / 2) -
            1) :
      FABL.functionAlgebraicDegree f = 2
    In odd dimension at least three, crossing the
    quadratic-bound-minus-one threshold forces degree exactly two. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Nonlinearity.lean
    complete
    theorem CryptBoolean.nonlinearity_le_complementaryPairRestriction_of_residual_pos
      {l r : } {f : CryptBoolean.BooleanFunction (l + (l + r))}
      (hf : CryptBoolean.IsSymmetricBooleanFunction f)
      (hpositive : 1  l + r) :
      CryptBoolean.nonlinearity f 
        2 ^ (l + (l + r) - 1) - 2 ^ (l + r - 1) +
          2 ^ l *
            CryptBoolean.nonlinearity
              (CryptBoolean.complementaryPairRestriction f)
    theorem CryptBoolean.nonlinearity_le_complementaryPairRestriction_of_residual_pos
      {l r : }
      {f :
        CryptBoolean.BooleanFunction
          (l + (l + r))}
      (hf :
        CryptBoolean.IsSymmetricBooleanFunction
          f)
      (hpositive : 1  l + r) :
      CryptBoolean.nonlinearity f 
        2 ^ (l + (l + r) - 1) -
            2 ^ (l + r - 1) +
          2 ^ l *
            CryptBoolean.nonlinearity
              (CryptBoolean.complementaryPairRestriction
                f)
    The restriction inequality underlying Theorem 17 only needs the
    paired flat to have positive dimension. This form also covers `l = 0`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Nonlinearity.lean
    complete
    theorem CryptBoolean.profile_add_two_on_window_of_complementaryPairRestriction_degree_two
      {l r : } {f : CryptBoolean.BooleanFunction (l + (l + r))}
      (hf : CryptBoolean.IsSymmetricBooleanFunction f) (hr : 2  r)
      (hdegree :
        FABL.functionAlgebraicDegree
            (CryptBoolean.complementaryPairRestriction f) =
          2)
      (s : ) :
      l  s 
        s + 2  l + r 
          CryptBoolean.symmetricWeightProfileNat f (s + 2) =
            CryptBoolean.symmetricWeightProfileNat f s + 1
    theorem CryptBoolean.profile_add_two_on_window_of_complementaryPairRestriction_degree_two
      {l r : }
      {f :
        CryptBoolean.BooleanFunction
          (l + (l + r))}
      (hf :
        CryptBoolean.IsSymmetricBooleanFunction
          f)
      (hr : 2  r)
      (hdegree :
        FABL.functionAlgebraicDegree
            (CryptBoolean.complementaryPairRestriction
              f) =
          2)
      (s : ) :
      l  s 
        s + 2  l + r 
          CryptBoolean.symmetricWeightProfileNat
              f (s + 2) =
            CryptBoolean.symmetricWeightProfileNat
                f s +
              1
    A quadratic complementary-pair restriction gives Carlet's two-step
    profile recurrence on the corresponding central window. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Nonlinearity.lean
    complete
    theorem CryptBoolean.highNonlinearityThreshold_cast_eq (l r c : ) (hr : 3  r)
      (hc : c  2 ^ ((r - 1) / 2)) :
      (2 ^ (l + (l + r) - 1) - 2 ^ (l + r - 1) +
            2 ^ l * (2 ^ (r - 1) - 2 ^ ((r - 1) / 2) - c)) =
        (2 ^ (l + (l + r) - 1)) - (2 ^ ((l + (l + r) - 1) / 2)) -
          (2 ^ l) * c
    theorem CryptBoolean.highNonlinearityThreshold_cast_eq
      (l r c : ) (hr : 3  r)
      (hc : c  2 ^ ((r - 1) / 2)) :
      (2 ^ (l + (l + r) - 1) -
              2 ^ (l + r - 1) +
            2 ^ l *
              (2 ^ (r - 1) -
                  2 ^ ((r - 1) / 2) -
                c)) =
        (2 ^ (l + (l + r) - 1)) -
            (2 ^ ((l + (l + r) - 1) / 2)) -
          (2 ^ l) * c
    The threshold obtained from Theorem 17 is Carlet's simplified integer
    threshold. The parameter `c` is one or two in the two applications below. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Nonlinearity.lean
    complete
    theorem CryptBoolean.complementaryPairRestriction_nonlinearity_gt_quadraticBound_sub_one
      {l r : } {f : CryptBoolean.BooleanFunction (l + (l + r))}
      (hf : CryptBoolean.IsSymmetricBooleanFunction f) (hr : 3  r)
      (hlarge :
        CryptBoolean.nonlinearity f >
          2 ^ (l + (l + r) - 1) - 2 ^ (l + r - 1) +
            2 ^ l * (2 ^ (r - 1) - 2 ^ ((r - 1) / 2) - 1)) :
      CryptBoolean.nonlinearity
          (CryptBoolean.complementaryPairRestriction f) >
        2 ^ (r - 1) - 2 ^ ((r - 1) / 2) - 1
    theorem CryptBoolean.complementaryPairRestriction_nonlinearity_gt_quadraticBound_sub_one
      {l r : }
      {f :
        CryptBoolean.BooleanFunction
          (l + (l + r))}
      (hf :
        CryptBoolean.IsSymmetricBooleanFunction
          f)
      (hr : 3  r)
      (hlarge :
        CryptBoolean.nonlinearity f >
          2 ^ (l + (l + r) - 1) -
              2 ^ (l + r - 1) +
            2 ^ l *
              (2 ^ (r - 1) -
                  2 ^ ((r - 1) / 2) -
                1)) :
      CryptBoolean.nonlinearity
          (CryptBoolean.complementaryPairRestriction
            f) >
        2 ^ (r - 1) - 2 ^ ((r - 1) / 2) - 1
    Theorem 17 transfers a strict high-nonlinearity hypothesis to the
    complementary-pair restriction. The residual dimension hypothesis `3 ≤ r`
    is equivalent to Carlet's range `l < ⌊(n-1)/2⌋` for `n = 2l+r`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Nonlinearity.lean
    complete
    theorem CryptBoolean.complementaryPairRestriction_degree_eq_two_of_nonlinearity_gt
      {l r : } {f : CryptBoolean.BooleanFunction (l + (l + r))}
      (hf : CryptBoolean.IsSymmetricBooleanFunction f) (hr : 3  r)
      (hlarge :
        CryptBoolean.nonlinearity f >
          2 ^ (l + (l + r) - 1) - 2 ^ (l + r - 1) +
            2 ^ l * (2 ^ (r - 1) - 2 ^ ((r - 1) / 2) - 1)) :
      FABL.functionAlgebraicDegree
          (CryptBoolean.complementaryPairRestriction f) =
        2
    theorem CryptBoolean.complementaryPairRestriction_degree_eq_two_of_nonlinearity_gt
      {l r : }
      {f :
        CryptBoolean.BooleanFunction
          (l + (l + r))}
      (hf :
        CryptBoolean.IsSymmetricBooleanFunction
          f)
      (hr : 3  r)
      (hlarge :
        CryptBoolean.nonlinearity f >
          2 ^ (l + (l + r) - 1) -
              2 ^ (l + r - 1) +
            2 ^ l *
              (2 ^ (r - 1) -
                  2 ^ ((r - 1) / 2) -
                1)) :
      FABL.functionAlgebraicDegree
          (CryptBoolean.complementaryPairRestriction
            f) =
        2
    The first high-nonlinearity window forces the complementary-pair
    restriction to have algebraic degree exactly two. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Nonlinearity.lean
    complete
    theorem CryptBoolean.profile_add_two_on_window_of_nonlinearity_gt {l r : }
      {f : CryptBoolean.BooleanFunction (l + (l + r))}
      (hf : CryptBoolean.IsSymmetricBooleanFunction f) (hr : 3  r)
      (hlarge :
        CryptBoolean.nonlinearity f >
          2 ^ (l + (l + r) - 1) - 2 ^ (l + r - 1) +
            2 ^ l * (2 ^ (r - 1) - 2 ^ ((r - 1) / 2) - 1))
      (s : ) :
      l  s 
        s + 2  l + r 
          CryptBoolean.symmetricWeightProfileNat f (s + 2) =
            CryptBoolean.symmetricWeightProfileNat f s + 1
    theorem CryptBoolean.profile_add_two_on_window_of_nonlinearity_gt
      {l r : }
      {f :
        CryptBoolean.BooleanFunction
          (l + (l + r))}
      (hf :
        CryptBoolean.IsSymmetricBooleanFunction
          f)
      (hr : 3  r)
      (hlarge :
        CryptBoolean.nonlinearity f >
          2 ^ (l + (l + r) - 1) -
              2 ^ (l + r - 1) +
            2 ^ l *
              (2 ^ (r - 1) -
                  2 ^ ((r - 1) / 2) -
                1))
      (s : ) :
      l  s 
        s + 2  l + r 
          CryptBoolean.symmetricWeightProfileNat
              f (s + 2) =
            CryptBoolean.symmetricWeightProfileNat
                f s +
              1
    Under the first high-nonlinearity window, the original symmetric profile
    satisfies the quadratic two-step recurrence on the central window. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Nonlinearity.lean
    complete
    theorem CryptBoolean.complementaryPairRestriction_degree_eq_two_of_integer_nonlinearity_gt
      {l r : } {f : CryptBoolean.BooleanFunction (l + (l + r))}
      (hf : CryptBoolean.IsSymmetricBooleanFunction f) (hr : 3  r)
      (hlarge :
        (CryptBoolean.nonlinearity f) >
          (2 ^ (l + (l + r) - 1)) - (2 ^ ((l + (l + r) - 1) / 2)) -
            (2 ^ l)) :
      FABL.functionAlgebraicDegree
          (CryptBoolean.complementaryPairRestriction f) =
        2
    theorem CryptBoolean.complementaryPairRestriction_degree_eq_two_of_integer_nonlinearity_gt
      {l r : }
      {f :
        CryptBoolean.BooleanFunction
          (l + (l + r))}
      (hf :
        CryptBoolean.IsSymmetricBooleanFunction
          f)
      (hr : 3  r)
      (hlarge :
        (CryptBoolean.nonlinearity f) >
          (2 ^ (l + (l + r) - 1)) -
              (2 ^ ((l + (l + r) - 1) / 2)) -
            (2 ^ l)) :
      FABL.functionAlgebraicDegree
          (CryptBoolean.complementaryPairRestriction
            f) =
        2
    Carlet's first high-nonlinearity window, stated with the printed
    subtraction interpreted in the integers. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Nonlinearity.lean
    complete
    theorem CryptBoolean.profile_add_two_on_window_of_integer_nonlinearity_gt
      {l r : } {f : CryptBoolean.BooleanFunction (l + (l + r))}
      (hf : CryptBoolean.IsSymmetricBooleanFunction f) (hr : 3  r)
      (hlarge :
        (CryptBoolean.nonlinearity f) >
          (2 ^ (l + (l + r) - 1)) - (2 ^ ((l + (l + r) - 1) / 2)) -
            (2 ^ l))
      (s : ) :
      l  s 
        s + 2  l + r 
          CryptBoolean.symmetricWeightProfileNat f (s + 2) =
            CryptBoolean.symmetricWeightProfileNat f s + 1
    theorem CryptBoolean.profile_add_two_on_window_of_integer_nonlinearity_gt
      {l r : }
      {f :
        CryptBoolean.BooleanFunction
          (l + (l + r))}
      (hf :
        CryptBoolean.IsSymmetricBooleanFunction
          f)
      (hr : 3  r)
      (hlarge :
        (CryptBoolean.nonlinearity f) >
          (2 ^ (l + (l + r) - 1)) -
              (2 ^ ((l + (l + r) - 1) / 2)) -
            (2 ^ l))
      (s : ) :
      l  s 
        s + 2  l + r 
          CryptBoolean.symmetricWeightProfileNat
              f (s + 2) =
            CryptBoolean.symmetricWeightProfileNat
                f s +
              1
    Under Carlet's integer-valued first window, the original symmetric
    profile satisfies the quadratic two-step recurrence on the central window. 
Theorem9.3.8
Group: Chapter 9: Symmetric and rotation-symmetric functions (22)
Group member previews
Preview
Definition 9.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 4
Statement dependency previews
Preview
Definition 1.1.2
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
used by 0L∃∀N

Second high-nonlinearity profile consequence (Carlet, p. 145). Let f:V_n\to\mathbb F_2 be symmetric and let 0\le\ell<\lfloor(n-1)/2\rfloor. Define h_\ell by deleting \ell complementary coordinate pairs, with h_0=f. If, as an inequality of integers, \operatorname{nl}(f)> 2^{n-1}-2^{\lfloor(n-1)/2\rfloor}-2^{\ell+1}, then either h_\ell has algebraic degree exactly two or its Hamming weight is odd. In the first case, f^\#(r+2)=f^\#(r)+1 for every \ell\le r\le n-\ell-2.

Lean code for Theorem9.3.87 theorems
  • theoremdefined in CryptBoolean/Carlet/Chapter04/OddWeightingNonlinearity.lean
    complete
    theorem CryptBoolean.even_hammingWeight_affineFunction {m : } (hm : 2  m)
      (b : FABL.𝔽₂) (c : FABL.F₂Cube m) :
      Even (CryptBoolean.hammingWeight (FABL.affineFunction b c))
    theorem CryptBoolean.even_hammingWeight_affineFunction
      {m : } (hm : 2  m) (b : FABL.𝔽₂)
      (c : FABL.F₂Cube m) :
      Even
        (CryptBoolean.hammingWeight
          (FABL.affineFunction b c))
    Every affine Boolean function in dimension at least two has even
    Hamming weight. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Nonlinearity.lean
    complete
    theorem CryptBoolean.complementaryPairRestriction_nonlinearity_gt_quadraticBound_sub_two
      {l r : } {f : CryptBoolean.BooleanFunction (l + (l + r))}
      (hf : CryptBoolean.IsSymmetricBooleanFunction f) (hr : 3  r)
      (hlarge :
        CryptBoolean.nonlinearity f >
          2 ^ (l + (l + r) - 1) - 2 ^ (l + r - 1) +
            2 ^ l * (2 ^ (r - 1) - 2 ^ ((r - 1) / 2) - 2)) :
      CryptBoolean.nonlinearity
          (CryptBoolean.complementaryPairRestriction f) >
        2 ^ (r - 1) - 2 ^ ((r - 1) / 2) - 2
    theorem CryptBoolean.complementaryPairRestriction_nonlinearity_gt_quadraticBound_sub_two
      {l r : }
      {f :
        CryptBoolean.BooleanFunction
          (l + (l + r))}
      (hf :
        CryptBoolean.IsSymmetricBooleanFunction
          f)
      (hr : 3  r)
      (hlarge :
        CryptBoolean.nonlinearity f >
          2 ^ (l + (l + r) - 1) -
              2 ^ (l + r - 1) +
            2 ^ l *
              (2 ^ (r - 1) -
                  2 ^ ((r - 1) / 2) -
                2)) :
      CryptBoolean.nonlinearity
          (CryptBoolean.complementaryPairRestriction
            f) >
        2 ^ (r - 1) - 2 ^ ((r - 1) / 2) - 2
    The analogous transfer for the second high-nonlinearity window. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Nonlinearity.lean
    complete
    theorem CryptBoolean.even_nonlinearity_iff_even_hammingWeight {n : }
      (f : CryptBoolean.BooleanFunction n) (hn : 2  n) :
      Even (CryptBoolean.nonlinearity f) 
        Even (CryptBoolean.hammingWeight f)
    theorem CryptBoolean.even_nonlinearity_iff_even_hammingWeight
      {n : }
      (f : CryptBoolean.BooleanFunction n)
      (hn : 2  n) :
      Even (CryptBoolean.nonlinearity f) 
        Even (CryptBoolean.hammingWeight f)
    In dimension at least two, nonlinearity and Hamming weight have the
    same parity. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Nonlinearity.lean
    complete
    theorem CryptBoolean.functionAlgebraicDegree_eq_two_of_symmetric_nonlinearity_gt_sub_two_of_even_weight
      {n : } {f : CryptBoolean.BooleanFunction n}
      (hf : CryptBoolean.IsSymmetricBooleanFunction f) (hn : 3  n)
      (hlarge :
        CryptBoolean.nonlinearity f > 2 ^ (n - 1) - 2 ^ ((n - 1) / 2) - 2)
      (hweight : Even (CryptBoolean.hammingWeight f)) :
      FABL.functionAlgebraicDegree f = 2
    theorem CryptBoolean.functionAlgebraicDegree_eq_two_of_symmetric_nonlinearity_gt_sub_two_of_even_weight
      {n : }
      {f : CryptBoolean.BooleanFunction n}
      (hf :
        CryptBoolean.IsSymmetricBooleanFunction
          f)
      (hn : 3  n)
      (hlarge :
        CryptBoolean.nonlinearity f >
          2 ^ (n - 1) - 2 ^ ((n - 1) / 2) - 2)
      (hweight :
        Even (CryptBoolean.hammingWeight f)) :
      FABL.functionAlgebraicDegree f = 2
    A symmetric function within two of the quadratic bound has degree two
    whenever its Hamming weight is even. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Nonlinearity.lean
    complete
    theorem CryptBoolean.complementaryPairRestriction_degree_eq_two_or_hammingWeight_odd_of_nonlinearity_gt
      {l r : } {f : CryptBoolean.BooleanFunction (l + (l + r))}
      (hf : CryptBoolean.IsSymmetricBooleanFunction f) (hr : 3  r)
      (hlarge :
        CryptBoolean.nonlinearity f >
          2 ^ (l + (l + r) - 1) - 2 ^ (l + r - 1) +
            2 ^ l * (2 ^ (r - 1) - 2 ^ ((r - 1) / 2) - 2)) :
      FABL.functionAlgebraicDegree
            (CryptBoolean.complementaryPairRestriction f) =
          2 
        Odd
          (CryptBoolean.hammingWeight
            (CryptBoolean.complementaryPairRestriction f))
    theorem CryptBoolean.complementaryPairRestriction_degree_eq_two_or_hammingWeight_odd_of_nonlinearity_gt
      {l r : }
      {f :
        CryptBoolean.BooleanFunction
          (l + (l + r))}
      (hf :
        CryptBoolean.IsSymmetricBooleanFunction
          f)
      (hr : 3  r)
      (hlarge :
        CryptBoolean.nonlinearity f >
          2 ^ (l + (l + r) - 1) -
              2 ^ (l + r - 1) +
            2 ^ l *
              (2 ^ (r - 1) -
                  2 ^ ((r - 1) / 2) -
                2)) :
      FABL.functionAlgebraicDegree
            (CryptBoolean.complementaryPairRestriction
              f) =
          2 
        Odd
          (CryptBoolean.hammingWeight
            (CryptBoolean.complementaryPairRestriction
              f))
    In the second high-nonlinearity window, the complementary-pair
    restriction is quadratic unless its Hamming weight is odd. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Nonlinearity.lean
    complete
    theorem CryptBoolean.complementaryPairRestriction_degree_eq_two_or_hammingWeight_odd_of_integer_nonlinearity_gt
      {l r : } {f : CryptBoolean.BooleanFunction (l + (l + r))}
      (hf : CryptBoolean.IsSymmetricBooleanFunction f) (hr : 3  r)
      (hlarge :
        (CryptBoolean.nonlinearity f) >
          (2 ^ (l + (l + r) - 1)) - (2 ^ ((l + (l + r) - 1) / 2)) -
            (2 ^ (l + 1))) :
      FABL.functionAlgebraicDegree
            (CryptBoolean.complementaryPairRestriction f) =
          2 
        Odd
          (CryptBoolean.hammingWeight
            (CryptBoolean.complementaryPairRestriction f))
    theorem CryptBoolean.complementaryPairRestriction_degree_eq_two_or_hammingWeight_odd_of_integer_nonlinearity_gt
      {l r : }
      {f :
        CryptBoolean.BooleanFunction
          (l + (l + r))}
      (hf :
        CryptBoolean.IsSymmetricBooleanFunction
          f)
      (hr : 3  r)
      (hlarge :
        (CryptBoolean.nonlinearity f) >
          (2 ^ (l + (l + r) - 1)) -
              (2 ^ ((l + (l + r) - 1) / 2)) -
            (2 ^ (l + 1))) :
      FABL.functionAlgebraicDegree
            (CryptBoolean.complementaryPairRestriction
              f) =
          2 
        Odd
          (CryptBoolean.hammingWeight
            (CryptBoolean.complementaryPairRestriction
              f))
    Carlet's second high-nonlinearity window, with the displayed subtraction
    interpreted in the integers. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/Nonlinearity.lean
    complete
    theorem CryptBoolean.profile_add_two_on_window_or_hammingWeight_odd_of_integer_nonlinearity_gt
      {l r : } {f : CryptBoolean.BooleanFunction (l + (l + r))}
      (hf : CryptBoolean.IsSymmetricBooleanFunction f) (hr : 3  r)
      (hlarge :
        (CryptBoolean.nonlinearity f) >
          (2 ^ (l + (l + r) - 1)) - (2 ^ ((l + (l + r) - 1) / 2)) -
            (2 ^ (l + 1))) :
      (∀ (s : ),
          l  s 
            s + 2  l + r 
              CryptBoolean.symmetricWeightProfileNat f (s + 2) =
                CryptBoolean.symmetricWeightProfileNat f s + 1) 
        Odd
          (CryptBoolean.hammingWeight
            (CryptBoolean.complementaryPairRestriction f))
    theorem CryptBoolean.profile_add_two_on_window_or_hammingWeight_odd_of_integer_nonlinearity_gt
      {l r : }
      {f :
        CryptBoolean.BooleanFunction
          (l + (l + r))}
      (hf :
        CryptBoolean.IsSymmetricBooleanFunction
          f)
      (hr : 3  r)
      (hlarge :
        (CryptBoolean.nonlinearity f) >
          (2 ^ (l + (l + r) - 1)) -
              (2 ^ ((l + (l + r) - 1) / 2)) -
            (2 ^ (l + 1))) :
      (∀ (s : ),
          l  s 
            s + 2  l + r 
              CryptBoolean.symmetricWeightProfileNat
                  f (s + 2) =
                CryptBoolean.symmetricWeightProfileNat
                    f s +
                  1) 
        Odd
          (CryptBoolean.hammingWeight
            (CryptBoolean.complementaryPairRestriction
              f))
    In the quadratic branch of Carlet's second integer-valued window, the
    original profile satisfies the two-step recurrence on the central window.