Cubic bent functions outside the completed Maiorana-McFarland class

In this paper we prove that in opposite to the cases of 6 and 8 variables, the Maiorana-McFarland construction does not describe the whole class of cubic bent functions in n variables for all n≥10\documentclass[12pt]{minimal} \usepackage{amsmath} \usepackage{wasysym} \usepackage{amsfonts} \usepackage{amssymb} \usepackage{amsbsy} \usepackage{mathrsfs} \usepackage{upgreek} \setlength{\oddsidemargin}{-69pt} \begin{document}$$n\ge 10$$\end{document}. Moreover, we show that for almost all values of n, these functions can simultaneously be homogeneous and have no affine derivatives.


Introduction
Bent functions, introduced by Rothaus in [35], are Boolean functions having the maximum Hamming distance from the set of all affine functions. Being extremal combinatorial objects, they have been intensively studied in the last four decades, due to their broad applications to cryptography, coding theory and theory of difference sets.
Cubic bent functions, i.e. bent functions of algebraic degree three, attracted a lot of attention from researchers, partly because small algebraic degree of these functions allows to investigate them exhaustively, when the number of variables is not too large. For instance, all cubic bent functions in six and eight variables are well-understood: the classification is given in [3,35], the enumeration was obtained in [23,33], and all these functions belong to the completed Maiorana-McFarland class M # [3,10]. A couple of infinite families of cubic bent functions were constructed recently, however, some of them [5,24] are proved to be the members of M # , while some of them are not analyzed yet [14,28]. Therefore, it is not clear, whether an n-variable cubic bent function can be outside the M # class whenever n ≥ 10. At the same time, cubic bent functions, which are homogeneous or have no affine derivatives, are of a special interest.
A cubic function has no affine derivatives, if all its non-trivial first-order derivatives are quadratic, what makes cryptographic systems with such components more resistant to certain differential attacks. It is well-known that cubic bent functions without affine derivatives exist for all even n ≥ 6, n = 8, as it was shown in in [4,20]. Recently Mandal, Gangopadhyay and Stȃnicȃ in [26] constructed two classes of cubic bent functions without affine derivatives inside M # and proved their mutual inequivalence. They also suggested to find such functions outside the M # class and evaluate their significance for cryptographic applications [26,Sect. 1.6].
A Boolean function is called homogeneous, if all the monomials in its algebraic normal form have the same algebraic degree. Homogeneous cubic bent functions were firstly considered by Qu et al. in [34], motivated by faster evaluation in cryptographic systems. The only known homogeneous bent functions are quadratic and cubic, moreover, it is not known, whether homogeneous bent functions of higher degrees exist. While the characterization of homogeneous quadratic bent functions is well-known [25,Chapter 15], it is in general a difficult task to construct a homogeneous cubic bent function. The only known primary construction was given by Seberry et al. in [36]. They proved, that a proper linear transformation of variables can bring special non-homogeneous cubic bent function from M # to a homogeneous one. Unfortunately, all functions of this type have many affine derivatives. Another approach is based on the concatenation of homogeneous cubic bent functions in a small number of variables via direct sum. The known computational construction methods of such functions include: -The tools from the modular invariant theory, as it was shown by Charnes, Rötteler and Beth in [8]; -The significant reduction of the search space, suggested by Meng et al. in [27].
Using these approaches, the mentioned authors constructed a lot of homogeneous cubic bent functions in a small number of variables 6 ≤ n ≤ 12. However, since all these examples have not been analyzed with respect to being outside the M # class and having no affine derivatives, it is not clear, which properties can the concatenations of these functions have.
The aim of this paper is two-fold. First, we analyze the known homogeneous cubic bent functions in ten and twelve variables from [8,27] and show, that some of these functions do not belong to the the M # class and all of them are different from the primary construction of Seberry, Xia and Pieprzyk [36]. Moreover, some of them have no affine derivatives. Secondly, we extend these results for infinite families, by showing, that proper direct sums of these functions inherit the properties of its summands. Consequently, we prove that for any n ≥ 8 there exist cubic bent functions inside M # , but different from the primary construction [36]. Further, we consider cubic bent functions with respect to the following three properties: outside M # , without affine derivatives, and homogeneous. We show, that n-variable cubic bent functions with at least two of the three mentioned properties exist for all n ≥ n 0 , where n 0 depends on the selected combination of properties. In this way, we prove that in general the whole class of cubic bent functions in n variables is not described by the M # class, whenever n ≥ 10. Finally, we show existence of cubic bent functions without affine derivatives outside M # , thus solving a recent open problem by Mandal et al. [26,Sect. 1.6].
The paper is organized in the following way. In Subsect. 1.1 we introduce some basic notions and background on Boolean functions. Section 2 describes geometric invariants of Boolean functions, which we use in the next section in order to distinguish inequivalent functions. Section 3 deals with the construction of new homogeneous cubic bent functions from old. First, in Subsect. 3.1 we survey the known homogeneous bent functions, provide the classification of known examples and show, that some of them are not in the M # class. In Subsect. 3.2, we show that proper concatenations of homogeneous cubic functions can never be equivalent to the primary construction. Finally, in Subsect. 3.3 we introduce an approach, aimed to produce many homogeneous functions from a single given one without increasing the number of variables, and illustrate its application for homogeneous cubic bent functions in 12 variables. Section 4 deals with the construction of cubic bent functions outside the M # class, using the direct sum. In Subsect. 4.1 we provide a sufficient condition, explaining how one should select bent functions f and g, such that the direct sum f ⊕ g is outside M # . In Subsect. 4.2 we show, that certain cubic bent functions in 6 ≤ n ≤ 12 variables satisfy our new sufficient condition and thus lead to infinitely many cubic bent functions outside the M # class, which are homogeneous or do not have affine derivatives. The paper is concluded in Sect. 5 and cubic bent functions, used in the paper, are given in the Appendix.

Preliminaries
Let F 2 = {0, 1} be the finite field with two elements and let F n 2 be the vector space of dimension n over F 2 . Mappings f : F n 2 → F 2 are called Boolean functions in n variables. A Boolean function on F n 2 can be uniquely expressed as a multivariate polynomial in the ring . This representation is unique and called the algebraic normal form (denoted further as ANF), that is, The complement of a Boolean function f is defined byf := f ⊕ 1. The algebraic degree of a Boolean function f , denoted by deg( f ), is the algebraic degree of its ANF. We call a Boolean function d-homogeneous, if all the monomials in its ANF have the same degree d, and simply homogeneous, if the degree is clear from the context.
With a Boolean function f : F n 2 → F 2 one can associate the mapping , which is called the first-order derivative of a function f in the direction a ∈ F n 2 . Derivatives of higher orders are defined recursively, i.e. the k-th order derivative of a function f is given by The set of fast points FP f forms a vector subspace and its dimension is bounded by dim(FP f ) ≤ n − deg( f ), as it was shown in [15]. A cubic function has no affine derivatives, if dim(FP f ) = 0, i.e. all its non-trivial first-order derivatives are quadratic functions.
The direct sum of two functions f : F n 2 → F 2 and g : F m 2 → F 2 is a function h : F n+m 2 → F 2 , defined by h(x, y) := f (x) ⊕ g(y). We also define the k-fold direct sum k · f : F k·n

Remark 1.2
It is well-known, that bent functions in n variables exist only for n even and have degree at most n/2 (see [35]).
On the set of all Boolean functions one can introduce an equivalence relation in the following way: two functions f , f : F n 2 → F 2 are called equivalent, if there exists a non-degenerate affine transformation A ∈ AG L(n, 2) and an affine function l(x) = a, x n ⊕ b on F n 2 (where x ∈ F n 2 , b ∈ F 2 and ·, · n is a non-degenerate bilinear form on F n 2 ), such that holds for all x ∈ F n 2 . Further we will analyze inequivalence of Boolean functions with the help of incidence structures and linear codes. Recall that an incidence structure is a triple S = (P, B, I), where P = {p 1 , . . . , p v } is a set of elements called points and B = {B 1 , . . . , B b } is a set of elements called lines, and I ⊆ P × B is a binary relation, called incidence relation. The The linear code of S over F 2 is the subspace C(S) of F v 2 , spanned by the row vectors of the incidence matrix M(S). It is clear, that the incidence matrix M(S) and the linear code C(S) depend on the labeling of the points and lines of S, however these objects are essentially unique up to row and column permutations. We refer to [12,13] about incidence structures and their linear codes.
Finally, we will use the following notation for vectors and matrices: j n is the all-one-vector of length n, by I n and J n we denote the identity matrix and the all-one-matrix of order n. The all-zero-matrix of order n and size r × s is denoted by O n and O r ,s respectively.

The completed generalized Maiorana-McFarland class of Boolean functions
The generalized Maiorana-McFarland class M r ,s of Boolean functions in n = r + s variables [7, p. 354] is the set of Boolean functions of the form   Now we describe a naive algorithm, which one can use to construct the collection MS r ( f ) for a given function f and a fixed r . For a more efficient algorithm we refer to [6, Algorithm 2].

Algorithm 1 Construct the collection MS r ( f ).
Determine subspacesŨ = U ,ũ for allũ / ∈ U , such that for any two-dimensional vector subspace a, b ⊆ U second-order derivatives D a,b f = 0.

5:
Put U ←Ũ for the obtained subspacesŨ . 6: until dim(U ) = r . 7: Output subspaces U of dimension r . 8: end for Remark 1.7 Algorithm 1 can be used to compute the linearity index of a given function f in the following way: ind( f ) is the biggest r , for which MS r ( f ) = ∅.

Remark 1.8 For a given
x ∈ F r 2 and y ∈ F s 2 , in the following way: since the values of x, π(y) r ⊕ φ(y) on the coset F r 2 ⊕ y for y ∈ F s 2 coincide with the values of f on the coset U ⊕ū forū ∈Ū , we can construct A U using the change of basis formula Here GJB(U ) denotes the Gauss-Jordan basis of a vector space U andŪ is the complement of U , i.e. dim(U ) + dim(Ū ) = n and U ∩Ū = {0}, which we compute as in [6,Sect. 4].

Geometric invariants of Boolean functions
In this section we study invariants of Boolean functions, which arise from certain binary matrices. We call these invariants geometric, since any (0, 1)-matrix defines an incidence structure, and hence a finite geometry, and will use them in the next section to distinguish inequivalent homogeneous cubic bent functions.

Incidence structures from Boolean functions
For a subset A of an additive group (G, +) the development dev(A) of A is an incidence structure, whose points are the elements in G, and whose lines are the translates A + g := {a + g : a ∈ A}. For a Boolean function f : F n 2 → F 2 , we will use developments of two types: For the combinatorial properties of supports and graphs of bent functions as well as for their developments we refer to [32,Sect. 3]. We also note the following advantage of dev(G f ) over dev(D f ): equivalent Boolean functions f , f on F n 2 lead to isomorphic incidence structures dev(G f ) and dev(G f ), but at the same time dev(D f ) and dev(D f ) can be non-isomorphic [21,Example 9.3.28]. For this reason we will mostly be interested in combinatorial invariants, like p-ranks [16, p. 787] or Smith normal forms [19, p. 494], of the incidence matrix M(dev(G f )).
Throughout the paper we will use the following geometric invariants of Boolean functions , -ranks( f ) were mostly studied in the context of inequivalence of vectorial mappings [17,18]; -SNF( f ) is the Smith normal form of the incidence matrix M(dev(G f )), given by the multiset and m i is the multiplicity of d i . Finally we emphasize, that -rank( f ) and SNF( f ) are invariants under equivalence for all Boolean functions f :

The relation between geometric invariants
In this subsection we show, that -rank and 2-rank coincide for all non-constant Boolean functions. We also show, how a small modification of the incidence matrix M(dev(D f )) can help to compute the Smith normal form of a Boolean function f in a more efficient way. Finally, we partially specify elementary divisors for bent functions.
First, we will use the following notation for incidence matrices of developments we can write N f without loss of generality as the following block-matrix, where Now we summarize some well-known statements about higher-order derivatives, which we will use to show the connection between geometric invariants of Boolean functions.

Result 2.2 [22]
Let f be a Boolean function on F n 2 and a 1 , . . . , a k ∈ F n 2 . 1. If a 1 , . . . , a k are linearly dependent, then D a k D a k−1 . . . D a 1 f = 0. 2. Let now a 1 , . . . , a k be linearly independent. The derivatives of f are independent of the order in which the derivation is taken, i.e. the equality holds for any permutation π on {1, . . . , k}.
In the next theorem we prove that for Boolean functions of degree at least two the -rank and 2-rank coincide and show, that all the information about the SNF( f ) can be recovered from a matrix obtained through a small modification of M f .

Theorem 2.3
Let f be a Boolean function on F n 2 . Then the following hold: then the all-one-vector j 2 n can be expressed as a sum of an even number of vectors from the linear code C(dev(D f )).
It was shown in [37, Lemma 3.1], that j 2 n ∈ C(dev(D f )). We will prove this statement, by expressing j 2 n as a sum of an even number of vectors from the linear code C(dev(D f )). Let d denotes the degree of a function f . First, we observe that the number of slow points of a function f is bounded from below by 2 n − 2 n−d . Thus there exist a sequence of slow points a 1 , . . . , a d , such that the d-th order derivative D a d D a d−1 . . . D a 1 f is the constant one function. Finally since the following equality holds for all x ∈ F n 2 due to one can see, the all-one-vector j 2 n is as a sum of 2 d elements of C(dev(D f )).
2. Assume that the matrix N f is of the form (2.1). Performing elementary row and column operations one can bring the matrix N f to the form Note, that elementary column operations change the linear code C(dev(D f )), however its dimension, which is equal to -rank( f ), remains the same. If deg( f ) < 1, i.e. f is a constant function, clearly -rank( f ) = 2. By the previous statement j 2 n can be expressed as a sum of an even number of rows of M f . Since the matrix M f is symmetric, the vector j T 2 n can be expressed as a sum of an even number of columns of the matrix M f . In this way, the matrix N f can be brought to the form 3. Performing elementary row and column operations, as in the proof of the previous statement, but over the ring Z, one can bring the matrix N f to the form In this way, In the following proposition we partially specify the SNF of a bent function. Proof 1. Let d 1 |d 2 | . . . |d 2 n+1 be elementary divisors and α 1 , α 2 , . . . , α 2 n+1 be eigenvalues of the matrix N f respectively. By [29,Theorem 6], for all 1 ≤ i 1 < · · · < i k ≤ 2 n+1 and k = 1, . . . , 2 n+1 − 1 the following relation between products of elementary divisors and eigenvalues holds: d 1 · · · d k |α i 1 · · · α i k . Since α i 1 · · · α i k |α 2 i 1 · · · α 2 i k it is enough to show, that all nonzero α 2 i are powers of two. Since N f is symmetric, we have N 2 f = N f N T f . By [31,Lemma 1.1.4], the matrix N f N T f has eigenvalue 2 2n (multiplicity 1), 2 n (multiplicity 2 n ) and 0 (multiplicity 2 n − 1). Thus the product of any k nonzero elementary divisors of N f is 2 l for some l, and hence all d i are powers of two. Finally, since the p-rank is the number of elementary divisors, coprime with p and all elementary divisors are powers of two, we conclude that -rank( f ) = m 1 .

Remark 2.5
We computed SNF( f ) for many n-variable bent functions of different degrees on F n 2 with 6 ≤ n ≤ 12. Based on our numerical experiments, we observe the following kind of symmetry in the SNF( f ) of a bent function f on We do not know how to prove this statement in general and we make the following conjecture.

Conjecture 2.6
The SNF( f ) of a bent function f on F n 2 satisfies Remark 2.5.

Homogeneous cubic bent functions
In this section we first survey the known homogeneous cubic bent functions. We also classify the known examples in 10 and 12 variables, constructed in [8,27] by using sophisticated computational approaches, and show that: -Some of them are not covered by the Maiorana-McFarland construction; -All of them are not equivalent to the only one known analytic construction (for this reason we will call it later "the primary construction") of Seberry, Xia and Pieprzyk, given in [36].
Subsequently, we extend the latter result to an arbitrary number of variables, by proving, that proper concatenations of homogeneous cubic bent functions in a small number of variables can never be equivalent to the primary construction. Finally we provide a construction method, aimed to generate a lot of homogeneous bent functions from a single given example. Using this approach we construct many new homogeneous cubic bent functions in 12 variables and show, that some of them are not equivalent to all the previously known ones.

The known examples and constructions
The existence of homogeneous cubic bent functions on F n 2 for all n ≥ 6 was shown in two independent ways. Seberry, Xia and Pieprzyk in [36,Theorem 8] proved that one can construct such functions on F n 2 for all even n = 8, from special Maiorana-McFarland functions by a proper change of basis. We will call their construction primary and denote any n-variable function of this type by h n pr . .  ((x, y)T ) is a homogeneous cubic bent function. Another approach, suggested by Charnes et al. in [8], consists of two steps. First, they constructed homogeneous cubic bent functions in a small number of variables using the tools from modular invariant theory, and second, they extended these examples to an arbitrary number of variables, using the direct sum construction.

Homogeneous cubic bent functions, different from the primary construction
Using the facts about 2-ranks and the relation between -rank and 2-rank, obtained in the previous section, we derive the following corollary.

Corollary 3.4 Let f and g be Boolean functions on F n
2 and F m 2 , respectively, with deg( f ) ≥ 1 and deg(g) ≥ 1. Proof The first and the second claims hold, since the statements (3.1) and (3.2) were proven in [37,38] for 2-ranks, and by Theorem 2.3 we know, that 2-ranks and -ranks coincide for all non-constant Boolean functions. Finally, the third claim follows from (3.2) and the definition of the primary construction.

Let h be a Boolean function on F n 2 × F m 2 defined as the direct sum of functions f and g, then
Now we proof the existence of homogeneous cubic bent functions, different from the primary construction.

Theorem 3.5 There exist homogeneous cubic bent functions on F n 2 , inequivalent to the primary construction h n
pr . , whenever n ≥ 8.

Proof
We construct a homogeneous cubic bent function h n in n = 6i + 8 j + 10k + 12l variables with j + k + l = 0 as the following concatenation: where h 6 * and h 8 * are arbitrary homogeneous cubic bent functions in 6 and 8 variables respectively, and h 10 * , h 12 * are arbitrary homogeneous cubic bent functions in 10 and 12 variables from Table 1. Since any homogeneous cubic bent function in 6 variables is equivalent to the primary construction h 6 pr . , we have -rank(h 6 * ) = 8. One can check that for any cubic bent function h 8 * in 8 variables we have -rank(h 8 * ) ∈ {14, 16}. By Proposition 2.4 one can see, that -ranks of functions h 10 * and h 12 * are multiplicities of the entry one in Table 1. Finally, comparing the lower bound of the -rank(h n ) with -rank(h n pr . ), one can see immediately that and hence the function h n is never equivalent to h n pr . for all n ≥ 8.

Constructing new homogeneous functions from old, without increasing the number of variables
In this subsection we show, that in some cases one can use the power of the Maiorana-McFarland construction to produce a lot of homogeneous bent functions, provided that a single one, member of the M # class, is given. Our approach is based on a generalization of the following observation.
where π : F 6 2 → F 6 2 is a permutation and φ, ψ : F 6 2 → F 2 are Boolean functions. In this way, one can construct homogeneous function g from the function f as follows: Let h π,φ : F n 2 → F 2 be a bent function from the M # r ,s class, which is equivalent to a dhomogeneous one, i.e. there exist an invertible matrix T of order n, such that h π,φ ((x, y)T ) is d-homogeneous. We will denote by Ω T (h π,φ ) the set This is the set of all Boolean functions ω on F s 2 , which preserve d-homogeneity and bentness of the function h π,φ⊕ω with respect to the linear transformation T .

Proposition 3.7 Let h π,φ be a Maiorana-McFarland bent function on F 2m 2 , which is equivalent to a d-homogeneous bent function, i.e. there exist an invertible matrix T , such that h π,φ ((x, y)T ) is d-homogeneous bent. Then the set Ω T (h π,φ ) is a vector space over F 2 .
Proof Let ω 1 , ω 2 ∈ Ω T (h π,φ ) with ω 1 = ω 2 and ω := ω 1 ⊕ ω 2 . We will show that ω ∈ Ω T (h π,φ ). Let the invertible matrix T be of the form T = A B C D with all the submatrices of order m. First, we observe that 0 ∈ Ω T (h π,φ ) and for any ω i ∈ Ω T (h π,φ ) we have from what follows, that ω i (xB ⊕ yD) is either d-homogeneous or constant zero function, since h π , φ ((x, y)T ) is d-homogeneous. Thus ω ∈ Ω T (h π,φ ), since bentness of h π , φ⊕ω is independent on the choice of a function ω on F m 2 and ω(xB ⊕ yD) is a d-homogeneous function.
Note that for a homogeneous bent function h π,φ ∈ M # r ,s the set Ω T (h π,φ ) is not a vector space in general. Nevertheless, for a given homogeneous bent function h ∈ M # r ,s one can still construct the set Ω T (h π,φ ), in order to get more, possibly inequivalent, homogeneous functions. We will summarize these ideas in the form of an algorithm below.  ((x, y)T ) : ω ∈ Ω T (h π,φ )}, where T := A −1 U . 5: end for Remark 3.8 Using Algorithm 2 and the mapping T , defined in (3.5), one can construct 2 ( 6 3 ) new homogeneous cubic bent functions from any of functions h 12 3 and h 12 5 , members of the M # class. Such a big number of new functions can be explained in the following way. Let h ∈ {h 12 3 , h 12 5 }. First, we observe that the image of y after the linear transformation y → y = xB ⊕ yD is given by: (3.6) Since any two coordinates of the vector y do not contain common variables x i and y j , the linear transformation, defined in (3.6), is homogeneity-preserving. Thus, Ω T (h π,φ ) is generated by monomials ω : F 6 2 → F 2 of degree 3, and hence |Ω T (h π,φ )| = 2 ( 6 3 ) . Finally, we note that some of the constructed homogeneous cubic bent functions are not equivalent to any of the known one, since their Smith normal forms, listed in Table 2, are different from those given in Table 1.

Theorem 3.9
There are at least 7 pairwise inequivalent homogeneous cubic bent functions on F 12 2 , inequivalent to h 12 pr . .
Finally we want to emphasize the fundamental difference between the primary construction h n pr . and functions, constructed in Remark 3.8. For the primary construction of homogeneous cubic bent function h n pr . one needs to find a special Boolean function φ of degree 3, such that the non-homogeneous cubic Maiorana-McFarland function f id,φ is homogeneous after the change of coordinates. In some sense, the identity permutation id has a "defect", which makes f id,0 never equivalent to a homogeneous cubic function. But the specific choice of a cubic function φ helps to repair it. Since the functions constructed in Remark 3.8 are in that sense "defect free", it is essential to construct such functions systematically.
Open Problem 3.10 Are there infinite families of permutations π : F m 2 → F m 2 , such that for some non-degenerate linear transformation T the function, defined by (x, y) → f π,ψ ((x, y)T ), is homogeneous cubic bent for all homogeneous cubic functions ψ : F m 2 → F 2 ?

Bent functions outside the M # class via direct sum construction
In this section we show how one can choose bent functions f and g, such that the direct sum f ⊕ g is not a member of the completed Maiorana-McFarland class M # . The idea of the approach is based on the following observation: if one can measure the maximum dimension of relaxed M-subspaces (which we introduce below) of the components f and g, then one can provide an upper bound for the linearity index ind( f ⊕ g) and if it small enough, then f ⊕ g / ∈ M # . Finally, using this recursive approach, we prove the series of results about the existence of cubic bent functions outside the M # class, which can simultaneously be homogeneous and have no affine derivatives.

The sufficient condition in terms of relaxed M-subspaces
In this way, any vector v ∈ F n+m   which hold for any y ∈ F m 2 due to (4.1). Adding Eqs. (4.2)-(4.3), one gets D u 1 ,u 2 f (x 1 , y) = D u 1 ,u 2 f (x 2 , y) since g depends on the variable x "fictively". Now, since f depends on the variable y "fictively", we get that for all v 1 holds for all x 1 , x 2 ∈ F n 2 and hence D v 1 ,v 2 f = c v 1 ,v 2 (one can think about v 1 and v 2 as (u 1 ) x and (u 2 ) x , respectively). Thus we have shown, that V ∈ RMS( f ). Since f and g are interchangeable, we get W ∈ RMS(g). Clearly, U ⊆ V × W and by the previous statement we have V × W ∈ RMS(h).
3. Let U ∈ RMS(h) and dim(U ) = r-ind(h). By the previous statement there exist V ∈ RMS( f ) and W ∈ RMS(g), such that U ⊆ V × W . Now, using the following series of inequalities we complete the proof.
The next corollary provides a sufficient condition on bent functions f and g for f ⊕ g being not in the M # class in terms of their relaxed M-subspaces.
Corollary 4.6 Let f : F n 2 → F 2 and g : F m 2 → F 2 be two Boolean bent functions. If f and g satisfy r-ind( f ) < n/2 and r-ind Remark 4.7 Throughout the paper we will call a Boolean function f on F n 2 strongly extendable, if r-ind( f ) < n/2 and weakly extendable, if r-ind( f ) = n/2. In this way, if one wants to extend a strongly extendable function f with Corollary 4.6, it is enough to take a weakly extendable function g, while for the extension of a weakly extendable function g one has to take a strongly extendable function f .

Remark 4.8
For a given function f one can compute the relaxed linearity index r-ind( f ) in the same way as the linearity index ind( f ), but with only one change. Instead of the second-order derivative D a,b f , given by its ANF where coefficients c v depend on a and b, one considers the "relaxed" second-order derivative 0 (a, b) and use it as the input of Algorithm 1 in the way already described in Remark 1.7.

Application to homogeneous cubic bent functions without affine derivatives
In order to use Corollary 4.6 for the construction of cubic bent functions outside M # , which can be homogeneous or have no affine derivatives, we need to find first such functions in a small number of variables and check, whether they are weakly or strongly extendable.
First we check, whether the equivalence classes of cubic bent functions in six [35, p. 303] and eight [3, p. 102] variables, contain functions with the mentioned properties. Since all cubic bent functions in 6 and 8 variables are members of the M # class, as it was shown in [10, p. 37] and [3, p. 103] respectively, the best what one expects to find is a weakly extendable cubic bent function. In this way:  [20]. Now we analyze homogeneous cubic bent functions in 10 and 12 variables.
-An example of a strongly extendable cubic bent function in 10 variables is represented by the function h 10 4 , which is simultaneously homogeneous and has no affine derivatives. -Since all the mentioned functions in 12 variables belong to the M # class, they can not be strongly extendable. Nevertheless, among them we found a weakly extendable homogeneous function h 12 5 without affine derivatives.
We summarize these data in Table 3 and list all the used functions in the Appendix. Now we proceed to the proof of our main theorem: the series of existence results about cubic bent functions with nice cryptographic properties. Here Q k := f id,0 is the quadratic bent function in k variables, defined by the "standard" inner product on F k 2 . Since for the quadratic bent function Q k its relaxed linearity index r-ind(Q k ) = k, we can not use Corollary 4.6. However, by the second part of Theorem 4.5, one can verify, that h n / ∈ M # , by showing, that none of the vector subspaces U of the form is an M-subspace of the function h n .

Conclusion
In this paper we proved the existence of cubic bent functions outside the completed Maiorana-McFarland class M # on F n 2 for all n ≥ 10 and showed that for almost all values of n these functions can simultaneously be homogeneous and have no affine derivatives. The reason, why some values of n are not covered by our proof is explained by the non-existence of examples with desired properties in 6 and 8 variables, which are necessary for the used recursive framework.
In general, we expect that homogeneous cubic bent functions without affine derivatives outside M # exist for all even n ≥ 10 and we leave this as an open problem. Since our proof technique is based on the direct sum construction of functions, some of them being members of M # , the functions constructed in such a way will presumably have bad cryptographic primitives (see [7, p. 330]). Thus, we suggest the following problem.
Open Problem 5.1 Construct homogeneous cubic bent functions without affine derivatives outside the M # class without the use of the direct sum.
The next problem, which we would like to address, is related to the normality of cubic bent functions. Recall that a Boolean function f on F n 2 is said to be normal (weakly normal), when it is constant (affine, but not constant) respectively, on some affine subspace U of F n 2 of dimension n/2 . In this case f is said to be normal (weakly normal) with respect to the flat U . It is well-known that all quadratic bent functions are normal. Moreover, one can also construct non-normal as well as non-weakly normal bent functions of all degrees d ≥ 4, as it follows from [6,Fact 22]. At the same time all cubic bent functions in n = 6 variables are normal or weakly-normal, while for n = 8 they are proved to be normal [9].
Since the functions h 10 3 and h 10 4 do not belong to the completed Maiorana-McFarland class, they are good candidates to be checked for the normality. Based on our parallel implementation of [6,Algorithm 1] in Mathematica [39] we observe, that the function h 10 3 is normal on the flat 48 ⊕ g3, 8p, 4q, 2m, 1j and the function h 10 4 is normal on the flat 5 ⊕ i5, 8h, 6n, 1g, f . Here we describe each binary vector of a flat by 32-base representation, using the following alphabet 0 → 0, . . . , f → 15, g → 16, . . . , v → 31. (5.1) In this way, since one still has no examples of non-weakly normal cubic bent functions, it is reasonable to ask the following question.

Open Problem 5.2 Do non-weakly normal cubic bent functions exist?
Finally we list all the homogeneous cubic bent functions used in the paper.
Acknowledgements The authors would like to thank Pantelimon Stȃnicȃ for providing homogeneous cubic bent functions from [8, p. 149] and anonymous referees for their detailed comments that largely improved the quality of the manuscript.
Open Access This article is licensed under a Creative Commons Attribution 4.0 International License, which permits use, sharing, adaptation, distribution and reproduction in any medium or format, as long as you give appropriate credit to the original author(s) and the source, provide a link to the Creative Commons licence, and indicate if changes were made. The images or other third party material in this article are included in the article's Creative Commons licence, unless indicated otherwise in a credit line to the material. If material is not included in the article's Creative Commons licence and your intended use is not permitted by statutory regulation or exceeds the permitted use, you will need to obtain permission directly from the copyright holder.

Appendix. Known inequivalent homogeneous cubic bent functions
We represent each homogeneous cubic bent function h n i in n variables by its binary characteristic vector v 2 (h n i ) in the following way. We denote by H n,3 (x) the list, containing all the monomials of degree 3 in n variables, ordered lexicographically, i.e. Due to the space limitations, we list in Table 4 the 32-base representations v 32 (h n i ) of binary characteristic vectors v 2 (h n i ), using the alphabet (5.1).

Example 5.3
The ANF of the homogeneous cubic bent function h 6 1 can be reconstructed from its 32-base characteristic vector v 32 (h 6 1 ) in the following way. First, one converts 32-base characteristic vector v 32 (h 6 1 ) to the binary v 2 (h 6 1 ) v 32 (h 6 1 ) = tffu ←→ v 2 (h 6 1 ) = (1, 1, 1, 0, 1, 0, 1, 1, 1, 1, 0, 1, 1, 1, 1, 1, 1, 1, 1, 0) and according to (5.2) the ANF of h 6 1 is given by: For each homogeneous cubic bent function h n i ∈ M # on F n 2 we list the collection M n/2 (h n i ) as a |M n/2 (h n i )| × n/2 matrix in the following way. Each row of M n/2 (h n i ) describes the Gauss-Jordan basis of an M-subspace of h n i . Each element of a basis is given by 32-base number, which can be converted to the binary vector of length n in the same way as in Example 5.3. For instance, the first row of the matrix MS 6 (h 12 3 ) describes the GJB(U ) of the M-subspace U , given in (3.4). -