Cryptographic Boolean Functions in Lean

9.6. Rotation-symmetric and Matriochka-symmetric functions🔗

Definition9.6.1
Group: Chapter 9: Symmetric and rotation-symmetric functions (22)
Group member previews
Preview
Definition 9.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
uses 1used by 1L∃∀N

Rotation-symmetric functions (Carlet, p. 146). Let n>0 and let \rho be the cyclic permutation of the n coordinates. A Boolean function f:V_n\to\mathbb F_2 is rotation symmetric, also called idempotent in the cited literature, when f(\rho x)=f(x) for every x\in V_n. Equivalently, its truth table and its algebraic normal form are invariant under every cyclic coordinate shift.

Every symmetric Boolean function is rotation symmetric.

Lean code for Definition9.6.122 declarations
  • defdefined in CryptBoolean/Carlet/Chapter10/RotationSymmetric.lean
    complete
    def CryptBoolean.cyclicCoordinateRotation (n : ) : Equiv.Perm (Fin n)
    def CryptBoolean.cyclicCoordinateRotation
      (n : ) : Equiv.Perm (Fin n)
    The cyclic permutation `0 ↦ 1 ↦ ⋯ ↦ n - 1 ↦ 0` of the coordinates. 
  • defdefined in CryptBoolean/Carlet/Chapter10/RotationSymmetric.lean
    complete
    def CryptBoolean.cyclicRotateInput {n : } (x : FABL.F₂Cube n) :
      FABL.F₂Cube n
    def CryptBoolean.cyclicRotateInput {n : }
      (x : FABL.F₂Cube n) : FABL.F₂Cube n
    Apply one cyclic coordinate rotation to a binary input. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/RotationSymmetric.lean
    complete
    theorem CryptBoolean.cyclicRotateInput_apply {n : } (x : FABL.F₂Cube n)
      (i : Fin n) :
      CryptBoolean.cyclicRotateInput x i =
        x ((CryptBoolean.cyclicCoordinateRotation n) i)
    theorem CryptBoolean.cyclicRotateInput_apply
      {n : } (x : FABL.F₂Cube n)
      (i : Fin n) :
      CryptBoolean.cyclicRotateInput x i =
        x
          ((CryptBoolean.cyclicCoordinateRotation
              n)
            i)
  • defdefined in CryptBoolean/Carlet/Chapter10/RotationSymmetric.lean
    complete
    def CryptBoolean.cyclicShiftInput {n : } (k : ) (x : FABL.F₂Cube n) :
      FABL.F₂Cube n
    def CryptBoolean.cyclicShiftInput {n : }
      (k : ) (x : FABL.F₂Cube n) :
      FABL.F₂Cube n
    Apply `k` successive cyclic coordinate rotations to a binary input. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/RotationSymmetric.lean
    complete
    theorem CryptBoolean.cyclicShiftInput_zero {n : } (x : FABL.F₂Cube n) :
      CryptBoolean.cyclicShiftInput 0 x = x
    theorem CryptBoolean.cyclicShiftInput_zero {n : }
      (x : FABL.F₂Cube n) :
      CryptBoolean.cyclicShiftInput 0 x = x
  • theoremdefined in CryptBoolean/Carlet/Chapter10/RotationSymmetric.lean
    complete
    theorem CryptBoolean.cyclicShiftInput_succ {n : } (k : ) (x : FABL.F₂Cube n) :
      CryptBoolean.cyclicShiftInput (k + 1) x =
        CryptBoolean.cyclicRotateInput (CryptBoolean.cyclicShiftInput k x)
    theorem CryptBoolean.cyclicShiftInput_succ {n : }
      (k : ) (x : FABL.F₂Cube n) :
      CryptBoolean.cyclicShiftInput (k + 1)
          x =
        CryptBoolean.cyclicRotateInput
          (CryptBoolean.cyclicShiftInput k x)
  • defdefined in CryptBoolean/Carlet/Chapter10/RotationSymmetric.lean
    complete
    def CryptBoolean.IsRotationSymmetric {n : }
      (f : CryptBoolean.BooleanFunction n) : Prop
    def CryptBoolean.IsRotationSymmetric {n : }
      (f : CryptBoolean.BooleanFunction n) :
      Prop
    A Boolean function is rotation symmetric when one cyclic coordinate
    rotation leaves its truth table invariant. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/RotationSymmetric.lean
    complete
    theorem CryptBoolean.isRotationSymmetric_iff_truthTable_invariant {n : }
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.IsRotationSymmetric f 
         (x : FABL.F₂Cube n), f (CryptBoolean.cyclicRotateInput x) = f x
    theorem CryptBoolean.isRotationSymmetric_iff_truthTable_invariant
      {n : }
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.IsRotationSymmetric f 
         (x : FABL.F₂Cube n),
          f
              (CryptBoolean.cyclicRotateInput
                x) =
            f x
    Rotation symmetry is precisely invariance of the truth table under the
    cyclic coordinate rotation. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/RotationSymmetric.lean
    complete
    theorem CryptBoolean.isRotationSymmetric_iff_all_cyclicShifts {n : }
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.IsRotationSymmetric f 
         (k : ) (x : FABL.F₂Cube n),
          f (CryptBoolean.cyclicShiftInput k x) = f x
    theorem CryptBoolean.isRotationSymmetric_iff_all_cyclicShifts
      {n : }
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.IsRotationSymmetric f 
         (k : ) (x : FABL.F₂Cube n),
          f
              (CryptBoolean.cyclicShiftInput k
                x) =
            f x
    Invariance under the generating rotation is equivalent to invariance
    under every cyclic coordinate shift. 
  • defdefined in CryptBoolean/Carlet/Chapter10/RotationSymmetric.lean
    complete
    def CryptBoolean.cyclicRotateANFIndex (n : ) :
      Finset (Fin n)  Finset (Fin n)
    def CryptBoolean.cyclicRotateANFIndex
      (n : ) :
      Finset (Fin n)  Finset (Fin n)
    The cyclic action on coordinate subsets indexing square-free ANF
    monomials. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/RotationSymmetric.lean
    complete
    theorem CryptBoolean.cyclicRotateANFIndex_apply {n : } (S : Finset (Fin n)) :
      (CryptBoolean.cyclicRotateANFIndex n) S =
        Finset.map
          (Equiv.toEmbedding (CryptBoolean.cyclicCoordinateRotation n)) S
    theorem CryptBoolean.cyclicRotateANFIndex_apply
      {n : } (S : Finset (Fin n)) :
      (CryptBoolean.cyclicRotateANFIndex n)
          S =
        Finset.map
          (Equiv.toEmbedding
            (CryptBoolean.cyclicCoordinateRotation
              n))
          S
  • defdefined in CryptBoolean/Carlet/Chapter10/RotationSymmetric.lean
    complete
    def CryptBoolean.cyclicRotateANFCoefficients {n : }
      (c : FABL.ANFCoefficients n) : FABL.ANFCoefficients n
    def CryptBoolean.cyclicRotateANFCoefficients
      {n : } (c : FABL.ANFCoefficients n) :
      FABL.ANFCoefficients n
    Rotate an ANF by replacing every variable with the next cyclic
    coordinate. 
  • defdefined in CryptBoolean/Carlet/Chapter10/RotationSymmetric.lean
    complete
    def CryptBoolean.IsRotationInvariantANF {n : }
      (c : FABL.ANFCoefficients n) : Prop
    def CryptBoolean.IsRotationInvariantANF
      {n : } (c : FABL.ANFCoefficients n) :
      Prop
    A coefficient family is invariant under cyclic rotation of its
    monomial indices. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/RotationSymmetric.lean
    complete
    theorem CryptBoolean.IsRotationInvariantANF.iterate {n : }
      {c : FABL.ANFCoefficients n}
      (hc : CryptBoolean.IsRotationInvariantANF c) (k : )
      (S : Finset (Fin n)) :
      c ((⇑(CryptBoolean.cyclicRotateANFIndex n))^[k] S) = c S
    theorem CryptBoolean.IsRotationInvariantANF.iterate
      {n : } {c : FABL.ANFCoefficients n}
      (hc :
        CryptBoolean.IsRotationInvariantANF c)
      (k : ) (S : Finset (Fin n)) :
      c
          ((⇑(CryptBoolean.cyclicRotateANFIndex
                  n))^[k]
            S) =
        c S
    Invariance under the generating rotation gives invariance under every
    cyclic shift of ANF indices. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/RotationSymmetric.lean
    complete
    theorem CryptBoolean.anfMonomial_cyclicRotateInput {n : } (S : Finset (Fin n))
      (x : FABL.F₂Cube n) :
      FABL.anfMonomial S (CryptBoolean.cyclicRotateInput x) =
        FABL.anfMonomial ((CryptBoolean.cyclicRotateANFIndex n) S) x
    theorem CryptBoolean.anfMonomial_cyclicRotateInput
      {n : } (S : Finset (Fin n))
      (x : FABL.F₂Cube n) :
      FABL.anfMonomial S
          (CryptBoolean.cyclicRotateInput x) =
        FABL.anfMonomial
          ((CryptBoolean.cyclicRotateANFIndex
              n)
            S)
          x
    Cyclically rotating an input cyclically rotates the index of each ANF
    monomial. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/RotationSymmetric.lean
    complete
    theorem CryptBoolean.anfEval_cyclicRotateANFCoefficients {n : }
      (c : FABL.ANFCoefficients n) (x : FABL.F₂Cube n) :
      FABL.anfEval (CryptBoolean.cyclicRotateANFCoefficients c) x =
        FABL.anfEval c (CryptBoolean.cyclicRotateInput x)
    theorem CryptBoolean.anfEval_cyclicRotateANFCoefficients
      {n : } (c : FABL.ANFCoefficients n)
      (x : FABL.F₂Cube n) :
      FABL.anfEval
          (CryptBoolean.cyclicRotateANFCoefficients
            c)
          x =
        FABL.anfEval c
          (CryptBoolean.cyclicRotateInput x)
    Evaluation commutes with cyclic rotation of ANF coefficients and binary
    inputs. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/RotationSymmetric.lean
    complete
    theorem CryptBoolean.anfCoeff_comp_cyclicRotateInput {n : }
      (f : CryptBoolean.BooleanFunction n) :
      (FABL.anfCoeff fun x => f (CryptBoolean.cyclicRotateInput x)) =
        CryptBoolean.cyclicRotateANFCoefficients (FABL.anfCoeff f)
    theorem CryptBoolean.anfCoeff_comp_cyclicRotateInput
      {n : }
      (f : CryptBoolean.BooleanFunction n) :
      (FABL.anfCoeff fun x =>
          f
            (CryptBoolean.cyclicRotateInput
              x)) =
        CryptBoolean.cyclicRotateANFCoefficients
          (FABL.anfCoeff f)
    The canonical ANF of a cyclically rotated truth table is the cyclic
    rotation of the canonical ANF. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/RotationSymmetric.lean
    complete
    theorem CryptBoolean.cyclicRotateANFCoefficients_eq_iff {n : }
      (c : FABL.ANFCoefficients n) :
      CryptBoolean.cyclicRotateANFCoefficients c = c 
        CryptBoolean.IsRotationInvariantANF c
    theorem CryptBoolean.cyclicRotateANFCoefficients_eq_iff
      {n : } (c : FABL.ANFCoefficients n) :
      CryptBoolean.cyclicRotateANFCoefficients
            c =
          c 
        CryptBoolean.IsRotationInvariantANF c
    Fixing the rotated coefficient family is equivalent to pointwise
    invariance of ANF coefficients under cyclic rotation of their indices. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/RotationSymmetric.lean
    complete
    theorem CryptBoolean.isRotationSymmetric_iff_anfInvariant {n : }
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.IsRotationSymmetric f 
        CryptBoolean.IsRotationInvariantANF (FABL.anfCoeff f)
    theorem CryptBoolean.isRotationSymmetric_iff_anfInvariant
      {n : }
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.IsRotationSymmetric f 
        CryptBoolean.IsRotationInvariantANF
          (FABL.anfCoeff f)
    Truth-table rotation symmetry is equivalent to invariance of the
    canonical algebraic normal form. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/RotationSymmetric.lean
    complete
    theorem CryptBoolean.IsRotationSymmetric.anfCoeff_cyclicShift {n : }
      {f : CryptBoolean.BooleanFunction n}
      (hf : CryptBoolean.IsRotationSymmetric f) (k : )
      (S : Finset (Fin n)) :
      FABL.anfCoeff f ((⇑(CryptBoolean.cyclicRotateANFIndex n))^[k] S) =
        FABL.anfCoeff f S
    theorem CryptBoolean.IsRotationSymmetric.anfCoeff_cyclicShift
      {n : }
      {f : CryptBoolean.BooleanFunction n}
      (hf :
        CryptBoolean.IsRotationSymmetric f)
      (k : ) (S : Finset (Fin n)) :
      FABL.anfCoeff f
          ((⇑(CryptBoolean.cyclicRotateANFIndex
                  n))^[k]
            S) =
        FABL.anfCoeff f S
    The canonical ANF of a rotation-symmetric function is invariant under
    every cyclic shift of its monomial indices. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/RotationSymmetric.lean
    complete
    theorem CryptBoolean.support_card_cyclicRotateInput {n : }
      (x : FABL.F₂Cube n) :
      (FABL.f₂Support (CryptBoolean.cyclicRotateInput x)).card =
        (FABL.f₂Support x).card
    theorem CryptBoolean.support_card_cyclicRotateInput
      {n : } (x : FABL.F₂Cube n) :
      (FABL.f₂Support
            (CryptBoolean.cyclicRotateInput
              x)).card =
        (FABL.f₂Support x).card
    Cyclic coordinate rotation preserves the binary Hamming weight. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/RotationSymmetric.lean
    complete
    theorem CryptBoolean.IsSymmetricBooleanFunction.isRotationSymmetric {n : }
      {f : CryptBoolean.BooleanFunction n}
      (hf : CryptBoolean.IsSymmetricBooleanFunction f) :
      CryptBoolean.IsRotationSymmetric f
    theorem CryptBoolean.IsSymmetricBooleanFunction.isRotationSymmetric
      {n : }
      {f : CryptBoolean.BooleanFunction n}
      (hf :
        CryptBoolean.IsSymmetricBooleanFunction
          f) :
      CryptBoolean.IsRotationSymmetric f
    Every symmetric Boolean function is rotation symmetric. 
Theorem9.6.2
Group: Chapter 9: Symmetric and rotation-symmetric functions (22)
Group member previews
Preview
Definition 9.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
Statement uses 4
Statement dependency previews
Preview
Theorem 3.2.14
Loading preview
Statement dependency preview content is loaded from the rendered-fragment cache.
used by 0L∃∀N

A rotation-symmetric function above the quadratic bound (Carlet, pp. 146--147). There exists a rotation-symmetric Boolean function f_9:V_9\to\mathbb F_2 with \operatorname{nl}(f_9)=241>240, where 240 is the nine-variable quadratic bound.

For every m\ge0, the direct sum of f_9 with a complete quadratic bent function on 2m fresh variables has dimension 9+2m and nonlinearity 2^{8+2m}-15\cdot2^m, which is strictly greater than 2^{8+2m}-2^{4+m}. In particular, this gives eleven-variable functions of nonlinearity 994 and thirteen-variable functions of nonlinearity 4036.

Lean code for Theorem9.6.222 declarations
  • inductive(2 constructors, 1 parameter)defined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    inductive CryptBoolean.WalshCertificateTree :   Type
    inductive CryptBoolean.WalshCertificateTree :
        Type
    A complete integer-valued Boolean-cube table, stored recursively by its
    leading coordinate. 
    CryptBoolean.WalshCertificateTree.leaf (value : ) :
      CryptBoolean.WalshCertificateTree 0
    CryptBoolean.WalshCertificateTree.branch {n : }
      (zero one : CryptBoolean.WalshCertificateTree n) :
      CryptBoolean.WalshCertificateTree (n + 1)
  • defdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    def CryptBoolean.WalshCertificateTree.eval {n : } :
      CryptBoolean.WalshCertificateTree n  FABL.F₂Cube n  
    def CryptBoolean.WalshCertificateTree.eval
      {n : } :
      CryptBoolean.WalshCertificateTree n 
        FABL.F₂Cube n  
    Evaluate a recursively stored Boolean-cube table at a cube point. 
  • defdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    def CryptBoolean.WalshCertificateTree.butterfly {n : } :
      CryptBoolean.WalshCertificateTree n 
        CryptBoolean.WalshCertificateTree n 
          CryptBoolean.WalshCertificateTree n ×
            CryptBoolean.WalshCertificateTree n
    def CryptBoolean.WalshCertificateTree.butterfly
      {n : } :
      CryptBoolean.WalshCertificateTree n 
        CryptBoolean.WalshCertificateTree n 
          CryptBoolean.WalshCertificateTree
              n ×
            CryptBoolean.WalshCertificateTree
              n
    Apply one Walsh--Hadamard butterfly to two recursively stored tables. 
  • defdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    def CryptBoolean.WalshCertificateTree.allNatAbsLe (bound : ) {n : } :
      CryptBoolean.WalshCertificateTree n  Bool
    def CryptBoolean.WalshCertificateTree.allNatAbsLe
      (bound : ) {n : } :
      CryptBoolean.WalshCertificateTree n 
        Bool
    Check that every entry of a recursively stored integer table has absolute
    value at most `bound`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    theorem CryptBoolean.WalshCertificateTree.natAbs_eval_le_of_allNatAbsLe
      {n bound : } (tree : CryptBoolean.WalshCertificateTree n)
      (h : CryptBoolean.WalshCertificateTree.allNatAbsLe bound tree = true)
      (a : FABL.F₂Cube n) : (tree.eval a).natAbs  bound
    theorem CryptBoolean.WalshCertificateTree.natAbs_eval_le_of_allNatAbsLe
      {n bound : }
      (tree :
        CryptBoolean.WalshCertificateTree n)
      (h :
        CryptBoolean.WalshCertificateTree.allNatAbsLe
            bound tree =
          true)
      (a : FABL.F₂Cube n) :
      (tree.eval a).natAbs  bound
    A successful recursive absolute-value check bounds every table entry. 
  • defdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    def CryptBoolean.fastWalshCertificateTree (n : ) :
      CryptBoolean.BooleanFunction n  CryptBoolean.WalshCertificateTree n
    def CryptBoolean.fastWalshCertificateTree
      (n : ) :
      CryptBoolean.BooleanFunction n 
        CryptBoolean.WalshCertificateTree n
    Compute the complete raw Walsh spectrum by the recursive
    Walsh--Hadamard transform. 
  • theoremdefined in CryptBoolean/Carlet/Chapter04/OddDimensionBestNonlinearity.lean
    complete
    theorem CryptBoolean.fastWalshCertificateTree_correct (n : )
      (f : CryptBoolean.BooleanFunction n) (a : FABL.F₂Cube n) :
      (CryptBoolean.fastWalshCertificateTree n f).eval a =
        CryptBoolean.walshTransform f a
    theorem CryptBoolean.fastWalshCertificateTree_correct
      (n : )
      (f : CryptBoolean.BooleanFunction n)
      (a : FABL.F₂Cube n) :
      (CryptBoolean.fastWalshCertificateTree n
              f).eval
          a =
        CryptBoolean.walshTransform f a
    The recursive Walsh--Hadamard table evaluates to the raw Walsh transform
    at every frequency. 
  • defdefined in CryptBoolean/Carlet/Chapter10/RotationSymmetric.lean
    complete
    def CryptBoolean.kavutMaitraYucelRotationTruthTable : 
    def CryptBoolean.kavutMaitraYucelRotationTruthTable :
      
    Kavut--Maitra--Sarkar--Yücel, INDOCRYPT 2006, p. 272, first
    512-bit truth table of a rotation-symmetric function of nonlinearity 241. 
  • defdefined in CryptBoolean/Carlet/Chapter10/RotationSymmetric.lean
    complete
    def CryptBoolean.kavutMaitraYucelRotationFunction9 :
      CryptBoolean.BooleanFunction 9
    def CryptBoolean.kavutMaitraYucelRotationFunction9 :
      CryptBoolean.BooleanFunction 9
    The nine-variable rotation-symmetric function printed by
    Kavut--Maitra--Sarkar--Yücel, with source bits read left-to-right. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/RotationSymmetric.lean
    complete
    theorem CryptBoolean.isRotationSymmetric_kavutMaitraYucelRotationFunction9 :
      CryptBoolean.IsRotationSymmetric
        CryptBoolean.kavutMaitraYucelRotationFunction9
    theorem CryptBoolean.isRotationSymmetric_kavutMaitraYucelRotationFunction9 :
      CryptBoolean.IsRotationSymmetric
        CryptBoolean.kavutMaitraYucelRotationFunction9
    The printed nine-variable truth table is invariant under cyclic
    coordinate rotation. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/RotationSymmetric.lean
    complete
    theorem CryptBoolean.kavutMaitraYucelRotationFunction9_walsh_bound
      (a : FABL.F₂Cube 9) :
      (CryptBoolean.walshTransform
            CryptBoolean.kavutMaitraYucelRotationFunction9 a).natAbs 
        30
    theorem CryptBoolean.kavutMaitraYucelRotationFunction9_walsh_bound
      (a : FABL.F₂Cube 9) :
      (CryptBoolean.walshTransform
            CryptBoolean.kavutMaitraYucelRotationFunction9
            a).natAbs 
        30
    Exhaustive kernel-checked Walsh certificate for the published truth
    table. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/RotationSymmetric.lean
    complete
    theorem CryptBoolean.kavutMaitraYucelRotationFunction9_walsh_witness :
      CryptBoolean.walshTransform
          CryptBoolean.kavutMaitraYucelRotationFunction9
          (CryptBoolean.f₂CubeOfNat 9 9) =
        -30
    theorem CryptBoolean.kavutMaitraYucelRotationFunction9_walsh_witness :
      CryptBoolean.walshTransform
          CryptBoolean.kavutMaitraYucelRotationFunction9
          (CryptBoolean.f₂CubeOfNat 9 9) =
        -30
    Frequency nine witnesses that the certified Walsh bound is sharp. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/RotationSymmetric.lean
    complete
    theorem CryptBoolean.maxWalshMagnitude_kavutMaitraYucelRotationFunction9 :
      CryptBoolean.maxWalshMagnitude
          CryptBoolean.kavutMaitraYucelRotationFunction9 =
        30
    theorem CryptBoolean.maxWalshMagnitude_kavutMaitraYucelRotationFunction9 :
      CryptBoolean.maxWalshMagnitude
          CryptBoolean.kavutMaitraYucelRotationFunction9 =
        30
    The published nine-variable truth table has maximum raw Walsh magnitude
    30. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/RotationSymmetric.lean
    complete
    theorem CryptBoolean.nonlinearity_kavutMaitraYucelRotationFunction9 :
      CryptBoolean.nonlinearity
          CryptBoolean.kavutMaitraYucelRotationFunction9 =
        241
    theorem CryptBoolean.nonlinearity_kavutMaitraYucelRotationFunction9 :
      CryptBoolean.nonlinearity
          CryptBoolean.kavutMaitraYucelRotationFunction9 =
        241
    The published nine-variable rotation-symmetric function has
    nonlinearity 241. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/RotationSymmetric.lean
    complete
    theorem CryptBoolean.quadraticBound_lt_nonlinearity_kavutMaitraYucelRotationFunction9 :
      240 <
        CryptBoolean.nonlinearity
          CryptBoolean.kavutMaitraYucelRotationFunction9
    theorem CryptBoolean.quadraticBound_lt_nonlinearity_kavutMaitraYucelRotationFunction9 :
      240 <
        CryptBoolean.nonlinearity
          CryptBoolean.kavutMaitraYucelRotationFunction9
    The published seed strictly exceeds the nine-variable quadratic
    nonlinearity bound. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/RotationSymmetric.lean
    complete
    theorem CryptBoolean.exists_rotationSymmetric_nonlinearity_eq_241 :
       f,
        CryptBoolean.IsRotationSymmetric f 
          CryptBoolean.nonlinearity f = 241
    theorem CryptBoolean.exists_rotationSymmetric_nonlinearity_eq_241 :
       f,
        CryptBoolean.IsRotationSymmetric f 
          CryptBoolean.nonlinearity f = 241
    There exists a nine-variable rotation-symmetric Boolean function of
    nonlinearity 241. 
  • defdefined in CryptBoolean/Carlet/Chapter10/RotationSymmetric.lean
    complete
    def CryptBoolean.kavutMaitraYucelRotationBentExtension (m : ) :
      CryptBoolean.BooleanFunction (9 + (m + m))
    def CryptBoolean.kavutMaitraYucelRotationBentExtension
      (m : ) :
      CryptBoolean.BooleanFunction
        (9 + (m + m))
    Extend the nine-variable rotation-symmetric seed by a complete
    `2m`-variable quadratic bent block. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/RotationSymmetric.lean
    complete
    theorem CryptBoolean.maxWalshMagnitude_kavutMaitraYucelRotationBentExtension
      (m : ) :
      CryptBoolean.maxWalshMagnitude
          (CryptBoolean.kavutMaitraYucelRotationBentExtension m) =
        30 * 2 ^ m
    theorem CryptBoolean.maxWalshMagnitude_kavutMaitraYucelRotationBentExtension
      (m : ) :
      CryptBoolean.maxWalshMagnitude
          (CryptBoolean.kavutMaitraYucelRotationBentExtension
            m) =
        30 * 2 ^ m
    The extended family has maximum raw Walsh magnitude `30 * 2^m`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/RotationSymmetric.lean
    complete
    theorem CryptBoolean.nonlinearity_kavutMaitraYucelRotationBentExtension
      (m : ) :
      CryptBoolean.nonlinearity
          (CryptBoolean.kavutMaitraYucelRotationBentExtension m) =
        2 ^ (8 + (m + m)) - 15 * 2 ^ m
    theorem CryptBoolean.nonlinearity_kavutMaitraYucelRotationBentExtension
      (m : ) :
      CryptBoolean.nonlinearity
          (CryptBoolean.kavutMaitraYucelRotationBentExtension
            m) =
        2 ^ (8 + (m + m)) - 15 * 2 ^ m
    The complete bent extension has nonlinearity
    `2^(8+2m) - 15 * 2^m`. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/RotationSymmetric.lean
    complete
    theorem CryptBoolean.quadraticBound_lt_nonlinearity_kavutMaitraYucelRotationBentExtension
      (m : ) :
      2 ^ (8 + (m + m)) - 2 ^ (4 + m) <
        CryptBoolean.nonlinearity
          (CryptBoolean.kavutMaitraYucelRotationBentExtension m)
    theorem CryptBoolean.quadraticBound_lt_nonlinearity_kavutMaitraYucelRotationBentExtension
      (m : ) :
      2 ^ (8 + (m + m)) - 2 ^ (4 + m) <
        CryptBoolean.nonlinearity
          (CryptBoolean.kavutMaitraYucelRotationBentExtension
            m)
    Every member of the extension family strictly exceeds the corresponding
    odd-dimensional quadratic bound. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/RotationSymmetric.lean
    complete
    theorem CryptBoolean.nonlinearity_kavutMaitraYucelRotationBentExtension_one :
      CryptBoolean.nonlinearity
          (CryptBoolean.kavutMaitraYucelRotationBentExtension 1) =
        994
    theorem CryptBoolean.nonlinearity_kavutMaitraYucelRotationBentExtension_one :
      CryptBoolean.nonlinearity
          (CryptBoolean.kavutMaitraYucelRotationBentExtension
            1) =
        994
    The eleven-variable member of the extension family has nonlinearity
    994. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/RotationSymmetric.lean
    complete
    theorem CryptBoolean.nonlinearity_kavutMaitraYucelRotationBentExtension_two :
      CryptBoolean.nonlinearity
          (CryptBoolean.kavutMaitraYucelRotationBentExtension 2) =
        4036
    theorem CryptBoolean.nonlinearity_kavutMaitraYucelRotationBentExtension_two :
      CryptBoolean.nonlinearity
          (CryptBoolean.kavutMaitraYucelRotationBentExtension
            2) =
        4036
    The thirteen-variable member of the extension family has nonlinearity
    4036. 
Definition9.6.3
Group: Chapter 9: Symmetric and rotation-symmetric functions (22)
Group member previews
Preview
Definition 9.1.1
Loading preview
Group member preview content is loaded from the rendered-fragment cache.
uses 1used by 0L∃∀N

Matriochka-symmetric functions (Carlet, p. 147). Let f:V_n\to\mathbb F_2. The function f is Matriochka symmetric when there are a finite strictly nested chain of coordinate sets S_1\subsetneq S_2\subsetneq\cdots\subsetneq S_t \subseteq\{1,\ldots,n\} and, for each j, a Boolean function g_j on the coordinates S_j that is invariant under every permutation of S_j, such that f(x)=\sum_{j=1}^{t}g_j(x|_{S_j}) in \mathbb F_2 for every x\in V_n. The zero function is represented by the empty sum. Every symmetric function is Matriochka symmetric by taking the one-set chain S_1=\{1,\ldots,n\}.

Lean code for Definition9.6.310 declarations
  • defdefined in CryptBoolean/Carlet/Chapter10/RotationSymmetric.lean
    complete
    def CryptBoolean.restrictedSupportCardIndex {n : } (S : Finset (Fin n))
      (x : FABL.F₂Cube n) : Fin (S.card + 1)
    def CryptBoolean.restrictedSupportCardIndex
      {n : } (S : Finset (Fin n))
      (x : FABL.F₂Cube n) : Fin (S.card + 1)
    The Hamming weight of an input restricted to a coordinate set, indexed
    between zero and the cardinality of that set. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/RotationSymmetric.lean
    complete
    theorem CryptBoolean.restrictedSupportCardIndex_val {n : } (S : Finset (Fin n))
      (x : FABL.F₂Cube n) :
      (CryptBoolean.restrictedSupportCardIndex S x) =
        (FABL.f₂Support x  S).card
    theorem CryptBoolean.restrictedSupportCardIndex_val
      {n : } (S : Finset (Fin n))
      (x : FABL.F₂Cube n) :
      (CryptBoolean.restrictedSupportCardIndex
            S x) =
        (FABL.f₂Support x  S).card
  • defdefined in CryptBoolean/Carlet/Chapter10/RotationSymmetric.lean
    complete
    def CryptBoolean.fullCoordinateProfileIndexEquiv (n : ) :
      Fin (Finset.univ.card + 1)  Fin (n + 1)
    def CryptBoolean.fullCoordinateProfileIndexEquiv
      (n : ) :
      Fin (Finset.univ.card + 1)  Fin (n + 1)
    Identify the restricted-weight index for the full coordinate set with
    the ordinary Hamming-weight index. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/RotationSymmetric.lean
    complete
    theorem CryptBoolean.fullCoordinateProfileIndexEquiv_restrictedSupportCardIndex
      {n : } (x : FABL.F₂Cube n) :
      (CryptBoolean.fullCoordinateProfileIndexEquiv n)
          (CryptBoolean.restrictedSupportCardIndex Finset.univ x) =
        CryptBoolean.supportCardIndex x
    theorem CryptBoolean.fullCoordinateProfileIndexEquiv_restrictedSupportCardIndex
      {n : } (x : FABL.F₂Cube n) :
      (CryptBoolean.fullCoordinateProfileIndexEquiv
            n)
          (CryptBoolean.restrictedSupportCardIndex
            Finset.univ x) =
        CryptBoolean.supportCardIndex x
  • structure(4 fields)defined in CryptBoolean/Carlet/Chapter10/RotationSymmetric.lean
    complete
    structure CryptBoolean.MatriochkaRepresentation (n : ) : Type
    structure CryptBoolean.MatriochkaRepresentation
      (n : ) : Type
    A Matriochka representation consists of symmetric weight profiles on a
    finite strictly nested chain of coordinate sets. 
    depth : 
    Number of coordinate sets in the chain. 
    coordinateSet : Fin self.depth  Finset (Fin n)
    The coordinate set of each summand. 
    strictlyNested :  {i j : Fin self.depth}, i < j  self.coordinateSet i  self.coordinateSet j
    Earlier coordinate sets are proper subsets of later ones. 
    profile : (j : Fin self.depth)  Fin ((self.coordinateSet j).card + 1)  FABL.𝔽₂
    The symmetric weight profile of each summand. 
  • defdefined in CryptBoolean/Carlet/Chapter10/RotationSymmetric.lean
    complete
    def CryptBoolean.MatriochkaRepresentation.eval {n : }
      (r : CryptBoolean.MatriochkaRepresentation n) :
      CryptBoolean.BooleanFunction n
    def CryptBoolean.MatriochkaRepresentation.eval
      {n : }
      (r :
        CryptBoolean.MatriochkaRepresentation
          n) :
      CryptBoolean.BooleanFunction n
    Evaluate the sum of the nested symmetric profiles represented by `r`. 
  • defdefined in CryptBoolean/Carlet/Chapter10/RotationSymmetric.lean
    complete
    def CryptBoolean.IsMatriochkaSymmetric {n : }
      (f : CryptBoolean.BooleanFunction n) : Prop
    def CryptBoolean.IsMatriochkaSymmetric {n : }
      (f : CryptBoolean.BooleanFunction n) :
      Prop
    A Boolean function is Matriochka symmetric when it is a sum of symmetric
    functions on a finite strictly nested chain of coordinate sets. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/RotationSymmetric.lean
    complete
    theorem CryptBoolean.isMatriochkaSymmetric_iff_exists_nestedProfile {n : }
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.IsMatriochkaSymmetric f 
         r,
           (x : FABL.F₂Cube n),
            f x =
               j,
                r.profile j
                  (CryptBoolean.restrictedSupportCardIndex
                    (r.coordinateSet j) x)
    theorem CryptBoolean.isMatriochkaSymmetric_iff_exists_nestedProfile
      {n : }
      (f : CryptBoolean.BooleanFunction n) :
      CryptBoolean.IsMatriochkaSymmetric f 
         r,
           (x : FABL.F₂Cube n),
            f x =
               j,
                r.profile j
                  (CryptBoolean.restrictedSupportCardIndex
                    (r.coordinateSet j) x)
    Matriochka symmetry is equivalent to the displayed nested-profile
    representation. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/RotationSymmetric.lean
    complete
    theorem CryptBoolean.isMatriochkaSymmetric_zero {n : } :
      CryptBoolean.IsMatriochkaSymmetric 0
    theorem CryptBoolean.isMatriochkaSymmetric_zero
      {n : } :
      CryptBoolean.IsMatriochkaSymmetric 0
    The zero Boolean function has the empty Matriochka representation. 
  • theoremdefined in CryptBoolean/Carlet/Chapter10/RotationSymmetric.lean
    complete
    theorem CryptBoolean.IsSymmetricBooleanFunction.isMatriochkaSymmetric {n : }
      {f : CryptBoolean.BooleanFunction n}
      (hf : CryptBoolean.IsSymmetricBooleanFunction f) :
      CryptBoolean.IsMatriochkaSymmetric f
    theorem CryptBoolean.IsSymmetricBooleanFunction.isMatriochkaSymmetric
      {n : }
      {f : CryptBoolean.BooleanFunction n}
      (hf :
        CryptBoolean.IsSymmetricBooleanFunction
          f) :
      CryptBoolean.IsMatriochkaSymmetric f
    Every symmetric Boolean function is Matriochka symmetric, using the
    single coordinate set containing all variables.