Generating Bent Functions and Dynamic Filters: A Novel Equivalence-Based Approach

Abstract

Boolean functions are fundamental building blocks in both discrete mathematics and computer science, with applications spanning from cryptography to coding theory. Bent functions, a subset of Boolean functions with maximal nonlinearity, are particularly valuable in cryptographic applications. This study introduces a novel equivalence relation among all Boolean functions and presents an algorithm to generate bent functions based on this relation. We systematically generated a collection of 10,000 bent functions over eight variables, all originating from the same equivalence class, and analyzed their structural complexity through rank determination. Our findings revealed the presence of at least five distinct affine classes of bent functions within this collection. By employing this construction, we devised an algorithm to generate a filter function capable of combining Boolean functions. This filter function can be dynamically adjusted based on a key, offering potential applications in symmetric cipher design, such as enhancing security or improving efficiency.

1. Introduction

Boolean functions are functions from $GF{\left(2\right)}^n$, an n-dimensional vector space, to the field $GF\left(2\right)$. Boolean functions that possess high nonlinearity and high algebraic degree play a very crucial role in the field of cryptography. Bent functions are Boolean functions with maximum nonlinearity.

There are several methods to construct bent functions, including primary and secondary construction techniques. The process of generating bent functions from the scratch is known as primary construction. However, creating bent functions from pre-existing bent functions is known as secondary construction. Based on the construction method, there are four main classes of bent functions, which are Maiorana–McFarland class, Dillon’s class, partial spread class, and Dobbertin’s class. Each of these methods utilizes different principles and techniques, making them suitable for different applications.

In the early 1970s, Maiorana and McFarland devised a primary construction technique, resulting in the Maiorana–McFarland class of bent functions, or $\mathcal{MM}$ class bent functions. In 1974, John Dillon obtained a class of bent functions called the partial spread class of bent functions. Although the construction is direct, it is difficult to give a concrete example of such a bent function. In [1], the authors have developed an algorithm to construct bent functions in partial spread class and computed the 2-rank. It is also verified that there are many bent functions in the partial spread class that are not affinely equivalent. John Dillon also introduced a family of bent functions called $\mathcal{H}$ class in his thesis [2]. In 1995, Dobbertin proposed a direct construction of bent functions that unifies $\mathcal{MM}$ bent functions and Dillon bent functions as two opposite external cases. But functions constructed through this method coincide with the $\mathcal{MM}$ class of bent functions.

The classification of the primary constructions of bent functions can help the researchers to better understand and utilize the strengths and limitations of different construction methods.

This study introduces a property of Boolean functions called $ND$-relation (Number of Difference sets), then defines $ND$-equivalence and generates functions that are $ND$- equivalent. We have obtained a relationship between bent functions and $ND$, which has aided in the construction of bent functions with degrees six and eight. We have created several six- and eight-variable bent functions and attempted to classify them. By the definition of the 2-rank of a Boolean function, we conclude that one $ND$ equivalent class of bent function has functions from more than five different affine equivalent classes.

In Section 2, we cover the basics. Section 3 explains how we build the algorithm for six and eight variables. In Section 4, we discuss what is needed to expand the algorithm for more variables. The enumeration of functions that were constructed using our algorithm is covered in Section 5.

2. Preliminaries

It is to be noted that the notation $GF\left(2\right)$ is the field with two elements 0 and 1, with addition modulo 2 denoted by ⨁ and multiplication modulo 2 denoted by writing two elements conjointly. $GF{\left(2\right)}^n$ is used for representing the n-dimensional vector space over the field $GF\left(2\right)$ that consists of n-tuples with entries from $GF\left(2\right)$. The elements in $GF{\left(2\right)}^n$ have been denoted using bold letters and 0 is used to denote the vector $(0,0,\dots ,0)$. $GF{\left(2\right)}^n\setminus \left\{\mathbf{0}\right\}$ consists of all elements of $GF{\left(2\right)}^n$ except 0.

For any two vectors $\mathbf{a}=(a_1,a_2,\dots ,a_n)$ and $\mathbf{b}=(b_1,b_2,\dots ,b_n)$, define the following:

• Addition of $\mathbf{a}$ and $\mathbf{b}$ as

  $$\mathbf{a}\oplus \mathbf{b}=(a_1⨁b_1,a_2⨁b_2\cdots a_n⨁b_n);$$
• Scalar product of $\mathbf{a}$ and $\mathbf{b}$ as

  $$\langle \mathbf{a},\mathbf{b}\rangle =a_1{b}_1⨁a_2{b}_2⨁\cdots ⨁a_n{b}_n.$$

Denote $\#A$ as the cardinality of the set A. ${\mathcal{B}}_n$ denotes the set of all Boolean functions in n-variable. For any $\mathbf{c}\in GF{\left(2\right)}^n$ and $d\in GF\left(2\right)$, the affine function is a Boolean function defined as

$$l_{\mathbf{c},d}\left(\mathbf{x}\right)=\langle \mathbf{c},\mathbf{x}\rangle ⨁d.$$

There are many ways of representing Boolean functions. However, in this paper, we use a truth table to represent Boolean functions. The truth table representation of an n-variable Boolean function f is denoted by

$$f\left(y\right)=(f\left({\mathbf{x}}_{\mathbf{1}}\right),f\left({\mathbf{x}}_{\mathbf{2}}\right),\dots ,f\left({\mathbf{x}}_{{\mathbf{2}}^{\mathbf{n}}}\right))$$

where ${\mathbf{x}}_{\mathbf{1}},{\mathbf{x}}_{\mathbf{2}},\dots ,{\mathbf{x}}_{{\mathbf{2}}^{\mathbf{n}}}$ are the elements in $GF{\left(2\right)}^n$ in lexicographical order. Similarly, define $f(y\oplus \mathbf{a})$ as $(f({\mathbf{x}}_{\mathbf{1}}\oplus \mathbf{a}),f({\mathbf{x}}_{\mathbf{2}}\oplus \mathbf{a}),\dots ,f({\mathbf{x}}_{{\mathbf{2}}^{\mathbf{n}}}\oplus \mathbf{a}))$ where $\mathbf{a}\in GF{\left(2\right)}^n$. The algebraic normal form of f at $\mathbf{x}=(x_1,x_2,x_3,\dots ,x_n)$ is given by

$$f\left(\mathbf{x}\right)=\underset{\mathbf{a}\in GF{\left(2\right)}^n}{⨁}{b}_{\mathbf{a}}{x}_1^{a_1}{x}_2^{a_2}{x}_3^{a_3}\cdots x_n^{a_n}$$

(1)

where $b_{\mathbf{a}}\in GF\left(2\right)$ and $\mathbf{a}=(a_1,a_2,a_3,\dots ,a_n)$.

The product $f·g$ represents the point-wise multiplication of values of $f\left(x\right)$ and $g\left(x\right)$. The hamming weight (or weight) of a vector, denoted by $wt\left(\mathbf{x}\right)$, is the number of ones in the vector $\mathbf{x}$. The hamming weight of a Boolean function is the weight of its truth table. An n-variable Boolean function f is balanced if $wt\left(f\right)=2^{n-1}$. Hamming distance (or distance) between two functions $f,g:GF{\left(2\right)}^n\to GF\left(2\right)$ denoted by $d(f,g)$ is defined as $d(f,g)=wt(f\oplus g)$. The support of a function f denoted by $Supp\left(f\right)$ is defined as the set $\{\mathbf{x}\in GF{\left(2\right)}^n;f\left(\mathbf{x}\right)=1\}$. The algebraic degree of the function f is defined as

$$\underset{\mathbf{a}\in GF{\left(2\right)}^n;b_{\mathbf{a}}=1}{max}wt\left(\mathbf{a}\right).$$

(2)

Definition 1

(Nonlinearity). The Nonlinearity of f is given by

$$nl\left(f\right)=\underset{\mathbf{a}\in GF{\left(2\right)}^n,c\in GF\left(2\right)}{min}d(f,l_{\mathbf{a},c}).$$

(3)

The classification of Boolean functions based on nonlinearity led to the discovery of affine equivalence and extended affine equivalence.

Definition 2

(Affine equivalence). Two Boolean functions, f and g, are said to be affine equivalent if there exists an $n\times n$ non-singular matrix A and a vector $\mathbf{b}\in GF{\left(2\right)}^n$ with $f(A\mathbf{x}\oplus \mathbf{b})=g\left(\mathbf{x}\right)$$\forall \mathbf{x}\in GF{\left(2\right)}^n$.

Definition 3

(Extended affine equivalence). Two Boolean functions, f and g, are said to be extended affine equivalent if there exists an $n\times n$ non-singular matrix A, vectors $\mathbf{b},\mathbf{c}\in GF{\left(2\right)}^n$ and $d\in GF\left(2\right)$, with

$$f(A\mathbf{x}\oplus \mathbf{b})⨁l_{\mathbf{c},d}\left(\mathbf{x}\right)=g\left(\mathbf{x}\right)\forall \mathbf{x}\in GF{\left(2\right)}^n.$$

Definition 4

(Bent functions). An n-variable Boolean function f with $nl\left(f\right)=2^{n-1}-2^{\frac{n}{2}-1}$ is called a bent function.

It is to be noted that bent functions can be defined only for positive even integers. The weight of a bent function is either $2^{n-1}-2^{\frac{n}{2}-1}$ or $2^{n-1}+2^{\frac{n}{2}-1}$. So, corresponding to each n, we can partition the collection of all bent functions into two equal halves with weights $2^{n-1}-2^{\frac{n}{2}-1}$ and $2^{n-1}+2^{\frac{n}{2}-1}$. If $wt\left(f\right)=k$, then $wt(f+1)$ will be $2^n-k$. Without any loss of generality, throughout this paper, we are considering bent functions with weight $2^{n-1}-2^{\frac{n}{2}-1}$.

There are a good number of papers in the literature discussing the iterative, combinatorial, and exhaustive techniques for constructing bent functions [3,4,5,6,7,8,9,10,11,12,13,14,15,16,17,18,19]. There are two types of bent function constructions: primary and secondary. In the primary construction, the bent functions are constructed with respect to their properties, whereas, in the secondary construction, they are constructed using the known bent functions. Maiorana and McFarland independently came up with a primary construction technique known as Maiorana–McFarland construction. They have also calculated the number of functions that can be constructed using the Maiorana–McFarland construction; for $2m$ variable Boolean functions, it is $\left(2^m\right)!2^{2^m}$, which is still being used as the lower bound for the number of bent functions. The Maiorana-McFarland class is an example of an algebraic method for constructing bent functions. Additionally, bent functions can be generated iteratively by combining existing ones. One such approach involves using the direct sum of two bent functions to produce a new one, making it particularly useful for generating bent functions of higher dimensions from those of lower dimensions. This iterative process is part of the secondary construction method for bent functions. Later, a lot of primary construction techniques were developed. Depending on the techniques, bent functions are categorized into different classes, like Maiorana–McFarland class, partial spread class, class $\mathcal{H}$, etc. [2,20]. The high algebraic degree of Boolean functions is also as important as that of nonlinearity. In 1962, Eliseev and Stepchenkov demonstrated that, if $n\ge 4$, the degree of an n-variable bent function cannot be greater than ${\displaystyle \frac{n}{2}}$. Using this concept, an upper bound for the number of bent functions was derived; for an n-variable Boolean function, the value is $2^{{\sum }_{i=0}^{\frac{n}{2}}\left(\genfrac{}{}{0pt}{}{n}{i}\right)}-2^{n+1}$. This also reveals that the construction of Boolean functions with maximum nonlinearity and high algebraic degree is not possible. In most cases, Boolean functions are represented in algebraic normal form; however, a few papers represent Boolean functions using their support [21]. A Boolean function f is said to be perfect nonlinear if $f\left(x\right)⨁f(x\oplus \mathbf{a})$ is balanced for all non-zero elements $\mathbf{a}$ [22,23]. It is worth noting that all bent functions are perfect nonlinear functions.

Exploring Boolean functions becomes easier when we use alternative representations of them. So, understanding the concept of an incidence matrix becomes important.

Definition 5

(Incidence matrix). Let f be an n-variable Boolean function and S be the support of the function. We define the $2^n\times 2^n$ incidence matrix $A_f$ as

$$A_{f_{i,j}}=\left\{\begin{array}{cc}1\hfill & \mathit{if}i\oplus j\in S\hfill \\ 0\hfill & \mathit{otherwise}\hfill \end{array}\right.$$

Definition 6

(2-Rank of a Boolean function). The rank of the incidence matrix corresponding to the Boolean function is defined as the 2-rank of the Boolean function.

The relationship between bent functions’ rank and affine equivalence is explained in [24]. Bent functions with different ranks will never be affine equivalent; however, all bent functions with the same rank need not be affine equivalent.

Let ${\delta }_f\left(\mathbf{a}\right)$ denote the difference set

$${\delta }_f\left(\mathbf{a}\right)=\{\mathbf{x}\in GF{\left(2\right)}^n;f\left(\mathbf{x}\right)=f(\mathbf{x}\oplus \mathbf{a})=1\}$$

This also implies that $\mathbf{a}$ can be represented as the sum of two elements from the support of f in ${\displaystyle \frac{|{\delta }_f\left(\mathbf{a}\right)|}{2}}$ different ways. The definition of difference set has an important role in our construction.

3. Construction of Bent Function

The following theorem describes the relationship between the weight and nonlinearity of Boolean functions whose support is contained in the support of a bent function.

Theorem 1.

Let f be an n-variable bent function with $wt\left(f\right)=nl\left(f\right)=2^{n-1}-2^{\frac{n}{2}-1}$ and g be an n-variable Boolean function with $g^{-1}\left(1\right)\subset f^{-1}\left(1\right)$. Then, $wt\left(g\right)=nl\left(g\right)$.

Proof. 

Let f be an n-variable bent function with $wt\left(f\right)=nl\left(f\right)=2^{n-1}-2^{\frac{n}{2}-1}$. We have $nl\left(g\right)=min\left\{wt(g+l_{\mathbf{c},d})\right\}$. Hence, $nl\left(g\right)=wt\left(g\right)$ if and only if $wt\left(g\right)\le wt(g+l_{\mathbf{c},d})$ for all $\mathbf{c}\in GF{\left(2\right)}^n$ and $d\in GF\left(2\right)$.

We know that $wt(g+h)=wt\left(g\right)+wt\left(h\right)-2·wt(g·h)$.

$wt\left(l_{\mathbf{c},d}\right)=\left\{\begin{array}{cc}0\hfill & if\mathbf{c}=\mathbf{0},d=0\hfill \\ 2^n\hfill & if\mathbf{c}=\mathbf{0},d=1\hfill \\ 2^{n-1}\hfill & if\mathbf{c}\ne \mathbf{0}\hfill \end{array}\right.$

From our assumption on g, it is clear that $wt(g·l_{\mathbf{c},d})\le wt(f·l_{\mathbf{c},d})$.

Since f is bent, $wt(f·l_{\mathbf{c},d})$ is either 0, $2^{n-2}-2^{\frac{n}{2}-1}$, or $2^{n-2}$.

Therefore, $2·wt(g·l_{\mathbf{c},d})\le 2^{n-1}$.

The case $\mathbf{c}=\mathbf{0}$ is trivial, so, without any loss of generality, we consider $\mathbf{c}\ne \mathbf{0}$.

Then, $wt(g+l_{\mathbf{c},d})=wt\left(g\right)+2^{n-1}-2·wt(g·l_{\mathbf{c},d})$

gives $wt(g+l_{\mathbf{c},d})\ge wt\left(g\right)$. (Since $2·wt(g·l_{\mathbf{c},d})\le 2^{n-1}$, $2^{n-1}-2·wt(g·l_{\mathbf{c},d})>0$.)    □

One method to construct bent functions is by extending a subset X of $GF{\left(2\right)}^n$ such that the Boolean function f with $Supp\left(f\right)=X$ has $nl\left(f\right)=\left|X\right|$ until the $\left|X\right|=2^{n-1}-2^{{\displaystyle \frac{n}{2}}-1}$.

Theorem 2.

(Corollary 3.2 of [25]) Let f be an n-variable Boolean function. If $wt\left(f\right)\le 2^{n-2}$, then $nl\left(f\right)=wt\left(f\right)$.

By Theorem 2, it is possible to choose first $2^{n-2}$ elements randomly. In [26], the authors tried to construct bent functions by extending an empty set to the support of an n-variable bent function.

Theorem 3.

(Lemma 2 of [26]). Let f be an n-variable Boolean function with ${\delta }_f\left(\mathbf{a}\right)\ne \varnothing$ for some $\mathbf{a}\in GF{\left(2\right)}^n\setminus \left\{\mathbf{0}\right\}$. Then,

$$Supp\left(f\right)=\bigcup _{\mathbf{a}\in GF{\left(2\right)}^n\setminus \left\{\mathbf{0}\right\}}{\delta }_f\left(\mathbf{a}\right).$$

(4)

For a bent function, $|{\delta }_f\left(\mathbf{a}\right)|={\displaystyle \frac{2^{n-2}\pm 2^{\frac{n}{2}-1}}{2}}$ for all $\mathbf{a}\in GF{\left(2\right)}^n\setminus \left\{\mathbf{0}\right\}$.

By Theorem 3, the authors have tried to add elements in support by filling ${\delta }_f\left(\mathbf{a}\right)$ until it reaches the cardinality $2^{n-2}-2^{\frac{n}{2}-1}$. This method has a limitation that it may not be possible to fill all the sets with the required number of elements. To overcome this issue, we have constructed bent functions using the structure of a known bent function. Corresponding to each subset of $GF{\left(2\right)}^n$, we can define a $2^{n-2}+1$ tuple $ND\left(S\right)$, where S is a subset of $GF{\left(2\right)}^n$. For our convenience, we can also define $NDF\left(f\right)$ for a Boolean function f as $NDF\left(f\right)=ND\left(S\right)$, where S is the support of the Boolean function f. The following definition will help to describe the construction process.

Definition 7.

For an n-variable Boolean function f with support $S\subset GF{\left(2\right)}^n$, we define $ND\left(S\right)=(a_0,a_2,a_4,a_6\dots a_{2^{n-1}})$, where $a_i$ represents the number of $\mathbf{b}\in GF{\left(2\right)}^n\setminus \left\{\mathbf{0}\right\}$ with $|{\delta }_f\left(\mathbf{b}\right)|=i$.

Note that more than one Boolean function may have the same ND. For example, all the n-variable bent functions with weight $2^{n-1}-2^{\frac{n}{2}-1}$ have the tuple

$$(0,0,0,\dots ,0,a_{2^{n-1}-2^{\frac{n}{2}-1}},0,0,\dots ,0)$$

where $a_{2^{n-1}-2^{\frac{n}{2}-1}}=2^n-1$. The term $ND$ refers to the Number of Difference sets.

Definition 8.

Let f and g be two n-variable Boolean functions. f and g are $ND$-related if the support of f and g can be expressed as $A=\{x_1,x_2,\dots ,x_m\}$ and $B=\{y_1,y_2,\dots ,y_m\}$, respectively, with $ND\left(\{x_1,x_2,\dots ,x_i\}\right)=ND\left(\{y_1,y_2,\dots ,y_i\}\right)$ for all $1\le i\le m$.

We will now prove that the $ND$-relation is an equivalence relation.

Theorem 4.

$ND$ relation is an equivalence relation.

Proof. 

We need to prove that the relation is reflexive, symmetric, and transitive.

For an n-variable Boolean function f with $Supp\left(f\right)=\{x_1,x_2,x_3,\dots ,x_k\}$, it is clear that $ND\left(\{x_1,x_2,x_3,\dots ,x_i\}\right)=ND\left(\{x_1,x_2,x_3,\dots ,x_i\}\right)$ for all $1\le i\le k$. Hence, the relation is reflexive.

If any two n-variable Boolean functions f and g with supports A and B, respectively, are $ND$-related, then there are arrangements for the supports A and B as $\{x_1,x_2,x_3,\dots ,x_k\}$ and $\{y_1,y_2,y_3,\dots ,y_k\}$, respectively, with $ND\left(\{x_1,x_2,x_3,\dots ,x_i\}\right)=ND\left(\{y_1,y_2,y_3,\dots ,y_i\}\right)$ for all $1\le i\le k$. Clearly, $ND\left(\{y_1,y_2,y_3,\dots ,y_i\}\right)=ND\left(\{x_1,x_2,x_3,\dots ,x_i\}\right)$ for all $1\le i\le k$. Hence, the relation is symmetric.

Let $f$, g, and h be n-variable Boolean functions with supports A, B, and C, respectively. Suppose that f is $ND$-related with g and g is $ND$-related with h. Then, there are arrangements for the supports A and B as $\{x_1,x_2,x_3,\dots ,x_k\}$ and $\{y_1,y_2,y_3,\dots ,y_k\}$, respectively, with $ND\left(\{x_1,x_2,x_3,\dots ,x_i\}\right)=ND\left(\{y_1,y_2,y_3,\dots ,y_i\}\right)$ for all $1\le i\le k$. Similarly, there are arrangements for the supports B and C as $\{y_1,y_2,y_3,\dots ,y_k\}$ and $\{z_1,z_2,z_3,\dots ,z_k\}$, respectively, with $ND\left(\{y_1,y_2,y_3,\dots ,y_i\}\right)=ND\left(\{z_1,z_2,z_3,\dots ,z_i\}\right)$ for all $1\le i\le k$. Now, it is clear that $ND\left(\{x_1,x_2,x_3,\dots ,x_i\}\right)=ND\left(\{z_1,z_2,z_3,\dots ,z_i\}\right)$ for all $1\le i\le k$. Hence, the relation is transitive.    □

Definition 9

($ND$-equivalence). Let f and g be two n-variable bent functions with supports A and B, respectively. Then, f and g are said to be $ND$-equivalent if the support of f and g can be expressed as $A=\{x_1,x_2,\dots ,x_m\}$ and $B=\{y_1,y_2,\dots ,y_m\}$, respectively, with $ND\left(\{x_1,x_2,\dots ,x_i\}\right)=ND\left(\{y_1,y_2,\dots ,y_i\}\right)$ for all $1\le i\le m$.

It is also possible to represent the inputs of an n-variable Boolean function as integers from 0 to $2^n-1$. We use the integer form of the inputs whenever we use a Boolean function’s support. Here, $0,1,2,\dots ,254$, and 255 are used to represent $(0,0,0,0,0,0,0,0)$, $(0,0,0,0,0,0,0,1)$, $\dots$, $(1,1,1,1,1,1,1,0)$, and $(1,1,1,1,1,1,1,1)$, respectively.

Affine equivalence and $ND$-equivalence are not the same but affine equivalence implies $ND$-equivalence. The following theorem explains it.

Theorem 5.

Let f and g be n-variable affine equivalent Boolean functions; then, f and g are $ND$-equivalent.

Proof. 

Given that f and g are n-variable affine equivalent Boolean functions, there exist a non-singular $n\times n$ matrix A and a vector $\mathbf{b}$ with $f(A\mathbf{x}\oplus \mathbf{b})=g\left(\mathbf{x}\right)\forall \mathbf{x}\in GF{\left(2\right)}^n$. Let $Supp\left(f\right)=\{x_1,x_2,\dots x_m\}$; then, we can take $Supp\left(g\right)=\{y_1,y_2,\dots y_m\}$ with $y_i=A{x}_i\oplus \mathbf{b}$. Since $A\mathbf{x}\oplus \mathbf{b}$ is a permutation on $GF{\left(2\right)}^n$, both $Supp\left(f\right)$ and $Supp\left(g\right)$ have the same cardinality.

• Claim: $ND\left(\{x_1,x_2,\dots x_i\}\right)=ND\left(\{y_1,y_2,\dots y_i\}\right)\forall 0<i\le m$.
• Let $X=\{x_1,x_2,\dots x_i\}$ and $Y=\{y_1,y_2,\dots y_i\}$.
• $x_k\in {\delta }_{f_X}\left(a_k\right)\Rightarrow (A{x}_k\oplus \mathbf{b})\in {\delta }_{f_Y}\left(A{a}_k\right)$.
• That is, $x_k\in {\delta }_{f_x}\left(a_k\right)\Rightarrow \exists x_j\in X;x_j\oplus x_k=a_k$.
• Let $y_j=A{x}_j\oplus \mathbf{b}$; then, $y_j\oplus y_k=A{x}_j\oplus \mathbf{b}\oplus A{x}_k\oplus \mathbf{b}=A(x_j\oplus x_k)=A{a}_k$.    □

Remark 1.

The extended affine equivalence does not imply $ND$-equivalence.

Theorem 6.

For n-variable Boolean function $l_{\mathbf{a},b}$,

$$NDF\left(l_{\mathbf{a},c}\right)=\left\{\begin{array}{cc}(2^{\mathit{n}}-1,0,0\dots )\hfill & \mathit{if}\mathbf{a}=(0,0,\dots 0),c=0\hfill \\ (0,0,\dots ,a_{2^{n-1}}=2^n-1)\hfill & \mathit{if}\mathbf{a}=(0,0,\dots 0),c=1\hfill \\ (2^{n-1}-1,0,\dots ,a_{2^{n-2}}=2^{n-1})\hfill & \mathit{Otherwise}\hfill \end{array}\right.$$

Proof. 

Case 1: If $\mathbf{a}=(0,0,\dots 0),c=0$, then $l_{\mathbf{a},c}=0$ for all $\mathbf{x}\in GF{\left(2\right)}^n$; hence, the support will be empty, that is, $|{\delta }_f\left(\mathbf{a}\right)|=0$ for all $\mathbf{a}\in GF{\left(2\right)}^n\setminus \left\{\mathbf{0}\right\}$.

• Case 2: If $\mathbf{a}=(0,0,\dots 0)$ and $c=1$, then $l_{\mathbf{a},c}=1$ for all $\mathbf{x}\in GF{\left(2\right)}^n$; hence, the support will be $GF{\left(2\right)}^n$ and all the elements of $GF{\left(2\right)}^n\setminus \left\{\mathbf{0}\right\}$ can be represented as the sum of 2 elements from the support in $2^{n-1}$ different ways, that is, $|{\delta }_f\left(\mathbf{a}\right)|=2^n$ for all $\mathbf{a}\in GF{\left(2\right)}^n\setminus \left\{\mathbf{0}\right\}$.
• Case 3: If $\mathbf{a}\ne (0,0,\dots 0)$, then $l_{\mathbf{a},c}$ will be a non-constant linear function; hence, its support will be a subspace of $GF{\left(2\right)}^n$. Its cardinality will be $2^{n-1}$, and also $2^{n-1}-1$ from the subspace (except zero) can be represented as a sum of 2 elements from the support in $2^{n-2}$ ways, that is, $|{\delta }_f\left(\mathbf{a}\right)|=0$ for $2^{n-1}$ different elements from $GF{\left(2\right)}^n\setminus \left\{\mathbf{0}\right\}$ and $|{\delta }_f\left(\mathbf{a}\right)|=2^{n-1}$ for the remaining $2^{n-1}$ elements.    □

Remark 2.

Since $2\times \left({\displaystyle \genfrac{}{}{0pt}{}{t}{2}}\right)=2\times {\displaystyle \frac{t\times (t-1)}{2}}=t^2-t$ and ${(t-1)}^2<t(t-1)<t^2$, we obtain $t=\mathit{smallest}\mathit{integer}\mathit{greater}\mathit{than}\sqrt{t^2-t}=⌈\sqrt{2\times \left({\displaystyle \genfrac{}{}{0pt}{}{t}{2}}\right)}⌉$.

Theorem 7.

Let f be a Boolean function with $NDF\left(f\right)=(a_0,a_2,a_4,\dots ,a_k)$; then,

$$wt\left(f\right)=\left\{\begin{array}{cc}0\mathit{or}1\hfill & \mathit{if}{a}_0=2^n-1\hfill \\ ⌈\sqrt{a_0\times 0+a_2\times 2+\dots +a_k\times k}⌉\hfill & \mathit{if}{a}_0\ne 2^n-1\hfill \end{array}\right.$$

Proof. 

We are proving this lemma using three different cases.

• Case 1: Let $wt\left(f\right)=0$. There is no element in the support. It is not possible to represent elements in $GF{\left(2\right)}^n\setminus \left\{\mathbf{0}\right\}$ as the sum of two elements from the support. That is, $|{\delta }_f\left(\mathbf{b}\right)|=0$ for each $\mathbf{b}\in GF{\left(2\right)}^n\setminus \left\{\mathbf{0}\right\}$. Now, $a_0=2^n-1$.
• Case 2: Let $wt\left(f\right)=1$. There is only one element in the support. It is not possible to represent elements in $GF{\left(2\right)}^n\setminus \left\{\mathbf{0}\right\}$ as the sum of two elements (there is only one element) from the support. That is, $|{\delta }_f\left(\mathbf{b}\right)|=0$ for each $\mathbf{b}\in GF{\left(2\right)}^n\setminus \left\{\mathbf{0}\right\}$. Now, $a_0=2^n-1$.
• If $wt\left(f\right)>1$, then at least one of the $|{\delta }_f\left(\mathbf{b}\right)|\ne 0$, that is $a_0<2^n-1$.
• Case 3: Let $wt\left(f\right)=t$, where $t\ne 0,1$. Then, we can represent $\left(\genfrac{}{}{0pt}{}{t}{2}\right)$ different elements as the sum of two elements from the support. The expression $a_0\times 0+a_2\times 2+\dots +a_k\times k$ will give us the total number of elements represented, which will be $2\times \left(\genfrac{}{}{0pt}{}{t}{2}\right)$. From this, we can compute $t=⌈\sqrt{2\times \left({\displaystyle \genfrac{}{}{0pt}{}{t}{2}}\right)}⌉$.    □

By Theorem 7, it is clear that any two $ND$-equivalent functions have equal weight. It remains to verify whether the nonlinearities coincide for all $ND$-equivalent functions. The following results can be gathered directly from Definition 8:

• If f is an n-variable bent function with $wt\left(f\right)=2^{n-1}-2^{\frac{n}{2}-1}$, then $NDF\left(f\right)$ = $(0,0,\dots ,0,a_{2^{n-2}-2^{\frac{n}{2}-1}}=2^n-1,0,\dots 0)$;
• If f is an n-variable bent function with $wt\left(f\right)=2^{n-1}+2^{\frac{n}{2}-1}$, then $NDF\left(f\right)$ = $(0,0,\dots ,0,a_{2^{n-2}+2^{\frac{n}{2}-1}}=2^n-1,0,\dots 0)$;
• If $wt\left(f\right)$ and $wt\left(g\right)$ are either 0 or 1, then $NDF\left(f\right)=NDF\left(g\right)=(2^n-1,0,\dots ,0)$;
• If $wt\left(f\right)=wt\left(g\right)=k$ with $k\in \{2,3\}$, then $NDF\left(f\right)=NDF\left(g\right)$;
• If $wt\left(f\right)=wt\left(g\right)\le 3$, then f and g are $ND$-equivalent;
• If $wt\left(f\right)=wt\left(g\right)\le 5$ and $NDF\left(f\right)=NDF\left(g\right)$, then f and g are $ND$-equivalent.

Our requirement is to construct the support of a bent function by adding elements to an empty set.

3.1. Construction Using ND-Equivalence

By Definition 9, it is possible to make $ND$-equivalent Boolean functions easily. Steps for constructing an $ND$-equivalent collection of bent functions is mentioned below:

• Take the support of an n-variable bent function (with weight $2^{n-1}-2^{\frac{n}{2}-1}$) as K;
• Let X be an empty set; it will become the support of a bent function by adding elements using Algorithm 1;
• Arrange the elements in K in a specific order (as mentioned in Section 3.2). Let it be $k_0,k_1,k_2,\dots ,k_{2^{n-1}-2^{\frac{n}{2}-1}-1}$. Compute $ND\left(S\right)$ for $S=\left\{k_0\right\}$ and add elements $k_1,k_2,\dots ,k_{2^{n-1}-2^{\frac{n}{2}-1}-1}$ one by one to S. In each step, we need to add elements from the domain $GF{\left(2\right)}^n$ to X such that $ND\left(S\right)=ND\left(X\right)$;
• In this way, a set X with $ND\left(X\right)=ND\left(K\right)$ is constructed, which turns into the support of a bent function.

For constructing a four-variable bent function, arranging elements from its support is not essential.

We have arranged the support of a six-variable bent function to generate many six-variable bent functions. The arrangement is {19, 52, 11, 23, 13, 18, 49, 8, 14, 22, 0, 2, 51, 32, 39, 1, 57, 29, 25, 27, 54, 62, 3, 31, 33, 38, 58, 61}. We are still working on arrangement of other bent functions. We could find the arrangement for a small number of bent functions, namely, four, six, and eight variables. In six and eight variables, we could find one arrangement for the support. It is possible to make four-, six-, and eight-variable $ND$-equivalent bent functions concerning those arrangements. By following secondary construction techniques, it is also possible to construct bent functions on a higher number of variables, but they need not be $ND$-equivalent. We have computed the rank of 10,000 eight-variable bent functions, which is captured in

Table 1. Number of bent functions and corresponding rank.

Rank	Number of Functions
10	1084
12	575
14	794
16	1910
20	5637
Total	10,000

.

Algorithm 1: Construction of n-variable bent functions

The following conclusions are based on the data from Table 1:

• More than five different affine classes of bent functions belong to the same $ND$-equivalent class;
• $ND$-equivalence is different from affine equivalence;
• The number of $ND$-equivalent classes is fewer than that of affine equivalent classes.

The graph in Figure 1 provides a geometric interpretation of the distribution of bent functions with respect to rank in the construction. Two of the functions generated using the algorithm is included in Appendix A.

3.2. Bent Function Support Structure

From the definition of bent functions, they are the only non-constant functions that have NDF representation with all zeros except at one position, where the value is $2^n-1$. As mentioned earlier, for our convenience, we can use decimal integers to represent vectors. Suppose we choose the support of 8-variable bent function $x_1{x}_2+x_3{x}_4+x_5{x}_6+x_7{x}_8$ as Y = {127, 191, 63, 223, 239, 207, 247, 87, 151, 23, 103, 167, 39, 71, 135, 7, 251, 91, 155, 27, 107, 171, 43, 75, 139, 11, 243, 83, 147, 19, 99, 163, 35, 67, 131, 3, 253, 93, 157, 29, 109, 173, 45, 77, 141, 13, 117, 181, 53, 213, 229, 197, 121, 185, 57, 217, 233, 201, 113, 177, 49, 209, 225, 193, 254, 94, 158, 30, 110, 174, 46, 78, 142, 14, 118, 182, 54, 214, 230, 198, 122, 186, 58, 218, 234, 202, 114, 178, 50, 210, 226, 194, 252, 92, 156, 28, 108, 172, 44, 76, 140, 12, 116, 180, 52, 212, 228, 196, 120, 184, 56, 216, 232, 200, 112, 176, 48, 208, 224, 192}; we obtain 160, 65, 230, 7, 112, 50, 116, 91, 29, 127 as the first 10 elements, but could not find any further elements. Such situations will happen if we do not arrange the elements from the support. For 8-variable bent functions, we have arranged them as Y = {99, 163, 35, 67, 131, 3, 243, 83, 147, 19, 107, 171, 43, 75, 139, 11, 251, 91, 155, 27, 103, 167, 39, 71, 135, 7, 247, 87, 151, 23, 127, 191, 63, 223, 239, 207, 109, 173, 45, 77, 141, 13, 253, 93, 157, 29, 110, 174, 46, 78, 142, 14, 254, 94, 158, 30, 108, 172, 44, 76, 140, 12, 252, 92, 156, 28, 117, 181, 53, 213, 229, 197, 121, 185, 57, 217, 233, 201, 113, 177, 49, 209, 225, 193, 118, 182, 54, 214, 230, 198, 122, 186, 58, 218, 114, 116, 180, 52, 212, 228, 196, 120, 184, 232, 200, 112, 176, 48, 178, 50, 210, 226, 194, 56, 224, 192, 234, 202, 216, 208}.

We have tried various well-known methods to arrange the support in order to obtain a bent function at each iteration. Among them, we explored the concept of the least squares method by minimizing and maximizing (${\sum }_i{a}_i\times i^2$). Our approach was to add elements to the support in such a way that the maximum difference between the difference sets would be minimized, but we could not find a proper arrangement for constructing bent functions. An 8-variable bent function with weight 120 has $120!$ arrangements to its support, which is a huge number considering the computational capacity of present-day computers. Since it is easy to find four-variable bent functions using the algorithm, we have arranged the domain as cosets of a four-dimensional subspace. Using these four variable cosets, it is possible to find five-dimensional cosets; similarly, six- and seven-dimensional cosets can be generated. This construction is similar to the construction of difference sets in Boolean functions. In previous construction techniques, authors have constructed bent functions in separate difference sets and taken their union, but here we have constructed by adding elements to a set—the support.

• Least squares method: The least squares method is a statistical procedure to find the best fit for a set of data points [27]. The method works by minimizing the sum of the offsets or the residuals of points from the plotted curve. Least squares regression is used to predict the behavior of dependent variables.

In the required scenario, we can try the least squares method. We are adding elements to the support such that the difference between the cardinalities of each ${\delta }_f$ becomes minimum. For this purpose, we can restrict the value of

$$\sum _i{a}_i\times i^2$$

to the minimum for adding each element to the support. The process works until the cardinality of the set becomes 102.

However, restricting the value of ${\sum }_i{a}_i\times i^2$ to its maximum will not yield the desired results.

Still, we are investigating the appropriate arrangement of the elements of the support for the construction.

3.3. Counting

Counting the number of Boolean functions in each specific class is important for explaining the complexity in cryptanalysis [28,29,30,31]. But, in some cases, finding the upper or lower bounds for the number of functions is also important [32]. It is possible to calculate the number of supports that can be constructed using the algorithm in Section 3. However, many of the sets are equal. To overcome this, we need to classify the supports, with respect to set equality. This will help to find the number of equal sets, which will be the cardinality of each class. The division of the total number of sets with the number of sets in each class will give the number of bent functions that can be constructed using Algorithm 1.

• It is required to use the principle of counting to find the number of functions that can be constructed using Algorithm 1.
• Counting principle: Consider a process that consists of r stages. Suppose the following:

  (a)

  There are $n_1$ possible results for the first stage;

  (b)

  For every possible result of the first stage, there are $n_2$ possible results at the second stage;

  (c)

  More generally, for all possible results of the first $i-1$ stages, there are $n_i$ possible results at the $i^{th}$ stage. Then, the total number of possible results of the r-stage process is $n_1{n}_2\cdots n_r$.

Corresponding to the support of each bent function, it is possible to construct $2^n$ different bent functions with the same weight. Furthermore, $f\oplus 1$ is an n-variable bent function if and only if f is an n-variable bent function. Effectively, it is possible to generate $2^{n+1}$ bent functions using each bent function.

We have also generated bent functions in four, six, and eight variables, but we are still investigating the exact number of sets in each class. Using the first counting principle, we have attempted to enumerate the number of distinct bent functions that we could generate in each variable. Estimation process included in

Table 2. Estimation of the number of functions that can be generated.

Number of Variables n	Number of Supports That Could Generate with Weight m ${\mathit{N}}_{\mathit{n},\mathit{m}}$	Number of Supports in Each Class with Weight m ${\mathit{K}}_{\mathit{n},\mathit{m}}$	Number of Distinct Functions with Weight $\mathit{m}\&2^{\mathit{n}}-\mathit{m}$ $\frac{{\mathit{N}}_{\mathit{n},\mathit{m}}}{{\mathit{K}}_{\mathit{n},\mathit{m}}}\times 2$	Actual Number of Functions
4	322,560	720	$448\times 2=896$	896
6	$2^{72.3}$	Unknown	Unknown	$2^{32.3}$
8	$2^{283.56}$	Unknown	Unknown	$2^{106.3}$

. The classification of generated functions into already known classes is not an easy task, but, with the help of 2-rank, it is possible to differentiate functions which are affinely equivalent from functions which are not.

One $ND$-equivalent class of bent function has functions from more than five different affine equivalent classes. Together with the Theorem 5, we can conclude that each $ND$-equivalent class has cardinality greater than that of the affine equivalent class. Further study on $ND$-equivalence will help us to find the count of bent functions.

4. Key Dependent Filter Function with Improved Cryptographic Properties

A filter function is a component that combines multiple linear or nonlinear shift registers [33]. The strength of a cipher depends on its resistance to cryptanalysis. Historically, filter functions have been primary targets for attacks due to their vulnerabilities. To address these weaknesses, we developed a construction algorithm that produces filter functions with enhanced nonlinearity, correlation immunity, and balancedness. Notably, the resulting filter function is dependent on the encryption key.

Our construction algorithm, Algorithm 2, takes as input an 8-variable bent function and an 80-bit string, which serves as the encryption key. The algorithm generates an additional eight-variable bent function, leveraging the input function and key. This output function, denoted as $f(x_0,x_1,x_2,\dots ,x_7)$, is the foundation for constructing the filter function.

Algorithm 2 does not directly generate the filter function as its output. Instead, the filter function is derived from the eight-variable bent function f that is produced by Algorithm 2.

The 13-variable Boolean function $g(x_0,x_1,\dots ,x_{12})=f\oplus x_8\oplus x_9\oplus x_{10}\oplus x_{11}\oplus x_{12}$ can be considered a filter function. By varying the 80-bit string input to Algorithm 2, we can generate numerous 13-variable filter functions from a single 8-variable bent function. Similarly, we can obtain 12-, 11-, 10-, and 9-variable filter functions by adjusting the 80-bit string input. Table 3 provides examples of these variations. The outlines of the construction algorithm is given as follows. Let $P=(p_0,p_1,\cdots p_{79})$ be an 80-bit key. Derive 120 different 8-bit words $t_i$ from P as follows:

• $t_0=p_0{p}_1{p}_2\cdots p_7$
  $t_1=p_1{p}_2{p}_3\cdots p_8$
    ⋮
  $t_{72}=p_{72}{p}_{73}{p}_{74}\cdots p_{79}$
  $t_{73}=p_{73}{p}_{74}{p}_{75}\cdots p_0$
    ⋮
  $t_{79}=p_{79}{p}_0{p}_1\cdots p_6$
  $t_{80}=p_0{p}_2{p}_4\cdots p_{14}$
  $t_{81}=p_1{p}_3{p}_5\cdots p_{15}$
    ⋮
  $t_{119}=p_{39}{p}_{41}{p}_{43}\cdots p_{53}$.

Table 3. Filter functions and their properties.

Filter Functions	Number of Variables	Maximum Nonlinearity	Nonlinearity of $\mathit{g}\left(\mathit{x}\right)$	Correlation Immunity
$f\left(x\right)$	8	120	120	0
$f\left(x\right)\oplus x_8$	9	≥242	240	1
$f\left(x\right)\oplus x_8\oplus x_9$	10	496	480	2
$f\left(x\right)\oplus x_8\oplus x_9\oplus x_{10}$	11	≥992	960	3
$f\left(x\right)\oplus x_8\oplus x_9\oplus x_{10}\oplus x_{11}$	12	2016	1920	4
$f\left(x\right)\oplus x_8\oplus x_9\oplus x_{10}\oplus x_{11}\oplus x_{12}$	13	≥4032	3840	5

Table 3. Filter functions and their properties.

Filter Functions	Number of Variables	Maximum Nonlinearity	Nonlinearity of $\mathit{g}\left(\mathit{x}\right)$	Correlation Immunity
$f\left(x\right)$	8	120	120	0
$f\left(x\right)\oplus x_8$	9	≥242	240	1
$f\left(x\right)\oplus x_8\oplus x_9$	10	496	480	2
$f\left(x\right)\oplus x_8\oplus x_9\oplus x_{10}$	11	≥992	960	3
$f\left(x\right)\oplus x_8\oplus x_9\oplus x_{10}\oplus x_{11}$	12	2016	1920	4
$f\left(x\right)\oplus x_8\oplus x_9\oplus x_{10}\oplus x_{11}\oplus x_{12}$	13	≥4032	3840	5

Using these values $t_i$, we generate an 8-variable bent function f and then add a selected function to derive a 13-variable balanced Boolean function with nonlinearity 2840 and correlation immunity 4 [Theorem 8]. The Table 3 provides a detailed overview of the properties of the functions constructed.

Algorithm 2: Construction of 8-variable bent functions

Theorem 8

([20]). Let $f\left(x\right)$ be an n-variable Boolean function. Then, the $n+1$-variable Boolean function $g\left(x\right|\left|y\right)=f\left(x\right)\oplus y$ with $x\in GF{\left(2\right)}^n\&y\in GF\left(2\right)$ has nonlinearity twice the nonlinearity of f.

5. Discussion

We introduced a novel equivalence relation, ND-equivalence, and developed an algorithm to systematically construct bent functions. Building upon this foundation, we designed a key-dependent dynamic filter function for potential use in stream ciphers. Following the construction of bent functions, we computed the 2-rank for each function produced, resulting in varying ranks of 10, 12, 14, 16, and 20. This indicates the possibility of creating new bent functions by employing an existing bent function that does not necessarily share the same affine properties as the original function. Our analysis of the generated bent functions revealed the existence of multiple affine classes within a single ND-equivalent class, suggesting a richer structure than previously understood. These findings contribute to the understanding of Boolean function properties and open new avenues for exploring their applications in cryptography and other fields.

Further research is required to calculate the number of equivalence classes in the collection of bent functions and the number of functions in each equivalence class. This will help the research community to better understand the relationship between the count of bent functions and the number of variables.