Bent functions in the partial spread class generated by linear recurring sequences

Abstract

We present a construction of partial spread bent functions using subspaces generated by linear recurring sequences (LRS). We first show that the kernels of the linear mappings defined by two LRS have a trivial intersection if and only if their feedback polynomials are relatively prime. Then, we characterize the appropriate parameters for a family of pairwise coprime polynomials to generate a partial spread required for the support of a bent function, showing that such families exist if and only if the degrees of the underlying polynomials are either 1 or 2. We then count the resulting sets of polynomials and prove that, for degree 1, our LRS construction coincides with the Desarguesian partial spread. Finally, we perform a computer search of all $\mathcal{PS}\mathcal{}^-$ and $\mathcal{PS}\mathcal{}^+$ bent functions of $n=8$ variables generated by our construction and compute their 2-ranks. The results show that many of these functions defined by polynomials of degree $d=2$ are not EA-equivalent to any Maiorana–McFarland or Desarguesian partial spread function.

1 Introduction

Boolean functions play an essential role in cryptography, coding theory, and combinatorial designs [15]. Among them, bent functions are of particular interest since they lie at the highest possible Hamming distance from the set of all affine functions, or equivalently they reach the highest possible nonlinearity. Even though bent functions are unbalanced, highly nonlinear balanced functions can be derived from them [8]. For this reason, bent functions have been used in the past for designing stream and block ciphers since highly nonlinear Boolean functions are useful to withstand fast-correlation and linear cryptanalysis attacks [4]. Besides cryptography, bent functions are also studied in coding theory, as they are connected to the covering radius of first-order Reed–Muller codes, whose codewords are affine functions.

Over the last decades, many constructions of bent functions have been described in the related literature (see, e.g., [3, 4, 15] for a survey of the main ones). A distinction is usually made between primary and secondary constructions. Primary constructions build sets of bent functions from scratch, usually by leveraging on related combinatorial structures. Some of the most well-known primary constructions for bent functions include the Maiorana–McFarland construction [14], which exploits permutations over $\mathbb {F}_2^{n}$, and Dillon’s construction [7], based on the class of partial spreads $\mathcal{PS}\mathcal{}$. On the contrary, secondary constructions build new bent functions starting from existing ones. For example, the Rothaus’s construction [17] takes three bent functions of n variables whose sum is also bent and yields a bent function of $n+2$ variables.

The search for novel methods to design bent functions is still an interesting and active research area nowadays, for a twofold motivation:

• Discovering new functions Notwithstanding the multitude of existing constructions, they only cover a tiny fraction of the total number of bent functions [15], and the complete enumeration of bent functions remains an open question for $n\ge 10$ variables [16]. Therefore, finding new constructions that yield previously unknown bent functions is still an interesting research avenue to pursue. However, one must remark that this direction is becoming increasingly difficult precisely because many constructions are already in place. This makes the discovery of new bent functions both unlikely and cumbersome since, in principle, one has to check inequivalence against a large number of known classes.

• Finding new constructions for known functions Novel constructions that generate already known bent functions are an interesting research line as well, for several reasons. For example, from an implementation point of view, such constructions could highlight more efficient ways to design the corresponding bent functions other than by classic lookup tables. More generally, a novel construction could provide a new perspective on understanding the structure of a known class of bent functions and spawning new research questions linked both to the construction of new bent functions and other interesting combinatorial objects. As we will argue in the following, we deem our work an example of this approach.

In this paper, we present a new primary construction of bent functions in the partial spread class $\mathcal{PS}\mathcal{}$ by using the subspaces spanned by Linear Recurring Sequences (LRS) over finite fields. The main idea is to define a linear mapping through the feedback polynomial of an LRS and then to use its kernel as a subspace in a partial spread. The main contributions of this paper can be summarized as follows:

• We prove that the kernels of two linear mappings have a trivial intersection if and only if the feedback polynomials of their LRS are pairwise coprime.

• We show that a family of pairwise coprime polynomials large enough to define a partial spread for a bent function exists if and only if the degree of the involved polynomials is either $d=1$ or $d=2$, assuming that all polynomials have a nonzero constant term.

• We prove that for degree $d=1$, the functions given by our LRS construction coincide with the Desarguesian partial spread class.

• We perform a computer search of all bent functions of $n=6,8$ variables generated by our LRS construction, remarking that they always have maximal degree n/2. While for $\mathcal{PS}\mathcal{}^-$ functions this is expected, the reason for $\mathcal{PS}\mathcal{}^+$ functions lies in the fact that the corresponding partial spreads are not maximal.

• We analyze the distribution of the 2-ranks for the LRS bent functions of $n=8$ variables. For degree $d=1$, we independently verify and extend the distribution reported by Weng et al. [19] for functions in the Desarguesian partial spread. For degree $d=2$, we remark that many of the obtained bent functions have a rank higher than 42. Thus, they are not EA-equivalent to any Maiorana–McFarland or Desarguesian partial spread function.

The remainder of this work is structured as follows. Section 2 reviews the background definitions on bent functions and linear recurring sequences. Section 3 defines our LRS construction, proving that the kernels of two LRS linear mappings have a trivial intersection if and only if the associated feedback polynomials are coprime. Section 4 characterizes the families of pairwise coprime polynomials that are required for the LRS construction and provides the corresponding counting result. Section 5 shows that the LRS construction equals the Desarguesian partial spread construction when using polynomials of degree 1. Section 6 discusses the computer search experiments for bent functions of $n=6,8$ variables generated by the LRS construction, reporting the distribution of the 2-ranks. Finally, Sect. 7 summarizes the main results of this paper, points out several avenues for future research, and discusses the connection with the cellular automata approach used in [9].

2 Background

This section covers the necessary background notions used throughout the paper. We begin by introducing the basic definitions and results related to bent Boolean functions, describing the main known primary constructions (namely, the Maiorana–McFarland construction and Dillon’s partial spread class), the extended affine equivalence relation, and a method to check the inequivalence of a bent function against a class of other known functions. We then move to linear recurring sequences and their vector spaces, representing the main combinatorial objects used to define our new construction of bent functions.

2.1 Bent functions

We refer the reader to [4] for a thorough treatment of the results recalled in this section about Boolean functions. In what follows, let $\mathbb {F}_q$ be the finite field with q elements (where $q=p^{\alpha }$ is a power of a prime number) and denote by $\mathbb {F}_q^n$ the n-dimensional vector space over $\mathbb {F}_q$, with ${0}$ being its null vector. For $q=2$, sum and multiplication on $\mathbb {F}_2$ correspond to the XOR and logical AND operations, respectively. Following the literature convention about Boolean functions, we will denote the sum operation over $\mathbb {F}_2$ by $\oplus$, while for a generic finite field $\mathbb {F}_q$ we will adopt the normal sum symbol $+$. On the other hand, we will denote the multiplication operation in all finite fields by concatenation of the operands. A Boolean function of n variables is a mapping $f: \mathbb {F}_2^n \rightarrow \mathbb {F}_2$. The most natural way to uniquely represent a Boolean function f is by means of its truth table, which is the vector $\Omega _f \in \mathbb {F}_2^{2^n}$ that lists the output of f evaluated over all $2^n$ input vectors $x \in \mathbb {F}_2^n$ in lexicographic order. The support of f is the subset of input vectors that map to 1, that is, $supp(f) = \{x \in \mathbb {F}_2^n : f(x) \ne 0\}$, while the Hamming weight of f is defined as $w_H(f) = |supp(f)|$, i.e., the number of ones in the truth table of f. Functions with the Hamming weight equal to $w_H = 2^{n-1}$ are also called balanced since their truth table is composed of an equal number of zeros and ones, and they play an important role in the design of stream and block ciphers [4]. The polarity truth table $\Omega _{\hat{f}}$ of $f: \mathbb {F}_2^n \rightarrow \mathbb {F}_2$ is the truth table of the function $\hat{f}: \mathbb {F}_2^n \rightarrow \{-1,+1\}$ defined as $\hat{f}(x) = (-1)^{f(x)}$ for all $x \in \mathbb {F}_2^n$.

The Algebraic Normal Form (ANF) is another useful representation that expresses a Boolean function $f: \mathbb {F}_2^n \rightarrow \mathbb {F}_2$ as a multivariate polynomial over the quotient ring $\mathbb {F}_2[x_1,\ldots ,x_n]/(x_1^2 \oplus x_1, \ldots , x_n^2 \oplus x_n)$:

$$\begin{aligned} P_f(x) = \bigoplus _{I \in \mathcal {P}([n])} a_I \left( \prod _{i \in I} x_i \right) , \end{aligned}$$

(1)

with $\mathcal {P}([n]) = 2^{[n]}$ being the power set of $[n] = \{1,\ldots ,n\}$, and $a_I$ being the coefficient of the monomial defined by the subset $I \in \mathcal {P}([n])$. The algebraic degree of f is defined as the cardinality of the largest subset I such that $a_I \ne 0$. In particular, affine functions are defined as those Boolean functions with degree at most 1. Notice that the ANF is a unique representation of a Boolean function, and in particular, one can retrieve the truth table back from the ANF coefficients through the Möbius transform:

$$\begin{aligned} f(x) = \bigoplus _{I \in \mathcal {P}[n]: I \subseteq supp(x) } a_I , \end{aligned}$$

(2)

A third common method to uniquely represent Boolean functions used in cryptography is the Walsh–Hadamard transform. Formally, the Walsh–Hadamard transform of a Boolean function $f:\mathbb {F}_2^n \rightarrow \mathbb {F}_2$ is the mapping $W_f: \mathbb {F}_2^n \rightarrow \mathbb {Z}$ defined for all $a \in \mathbb {F}_2^n$ as

$$\begin{aligned} W_f(a) = \sum _{x \in \mathbb {F}_2^n} (-1)^{f(x) \oplus a \cdot x} , \end{aligned}$$

(3)

where $a \cdot x = \bigoplus _{i=1}^n a_ix_i$ is the scalar product between a and x. One may easily see that a function f is balanced if and only if its Walsh–Hadamard transform vanishes on the null vector, i.e., if and only if $W_f( {0}) = 0$. In particular, the Walsh–Hadamard coefficient $W_f(a)$ quantifies the correlation between f and the linear function $a\cdot x$. The lower the absolute value of $W_f(a)$, the lower will be the correlation of f from $a\cdot x$ (and from its affine counterpart $1 \oplus a\cdot x$), and thus the higher will be the Hamming distance between the truth tables of the two functions. In particular, the nonlinearity of a Boolean function $f:\mathbb {F}_2^n \rightarrow \mathbb {F}_2$ is defined as the minimum Hamming distance of f from the set of all affine functions, and it can be computed as follows:

$$\begin{aligned} Nl_f = 2^{n-1} - \frac{1}{2}\max _{a \in \mathbb {F}_2^n}\left( |W_f(a)|\right) . \end{aligned}$$

(4)

Therefore, a Boolean function with high nonlinearity must be characterized by a low maximum absolute value among its Walsh–Hadamard coefficients. Parseval’s relation states that the sum of the squared Walsh–Hadamard spectrum is constant for any Boolean function $f: \mathbb {F}_2^n \rightarrow \mathbb {F}_2$, and it equals:

$$\begin{aligned} \sum _{a \in \mathbb {F}_2^n} [W_f(a)]^2 = 2^{2n} . \end{aligned}$$

(5)

From Parseval’s relation, one can remark that the lowest maximum absolute value of the Walsh–Hadamard transform occurs when the constant $2^{2n}$ is uniformly “spread” among all $2^n$ coefficients, that is, when each coefficient in absolute value equals $2^{\frac{n}{2}}$. This observation yields the covering radius bound for the nonlinearity of an n-variable Boolean function:

$$\begin{aligned} Nl_f \le 2^{n-1} - 2^{\frac{n}{2}-1} . \end{aligned}$$

(6)

Functions satisfying with equality Eq. (6)—or equivalently, whose Walsh–Hadamard coefficients all equal $2^{\frac{n}{2}}$ in absolute value – are called bent functions. Such functions exist only when n is even since the Walsh–Hadamard coefficients must be integer numbers. Although achieving the highest possible nonlinearity granted by the covering radius bound, bent functions cannot be employed directly in the design of stream or block ciphers since they are always unbalanced. As a matter of fact, we have $W_f( {0}) = \pm 2^{\frac{n}{2}}$ for any bent function, which means that its Hamming weight is $2^{n-1} \pm 2^{\frac{n}{2}-1}$.

There are several ways to construct bent functions proposed in the literature. Usually, such methods are divided in primary and secondary constructions. Recall that a primary construction builds “from scratch” new bent functions by leveraging other kinds of combinatorial objects. On the other hand, a secondary construction derives new bent functions starting from already existing ones. This paper focuses on the former case.

One of the main primary constructions investigated in the literature is the Maiorana–McFarland construction, which is the set $\mathcal {M}$ of all Boolean functions $f: \mathbb {F}_2^n \rightarrow \mathbb {F}_2$, with $n=2m$, defined as:

$$\begin{aligned} f(x,y) = x \cdot \pi (y) \oplus g(y) , \end{aligned}$$

(7)

for all $x,y \in \mathbb {F}_2^{m}$, where $\pi : \mathbb {F}_2^{m} \rightarrow \mathbb {F}_2^{m}$ is any permutation of $\mathbb {F}_2^{m}$ and g is any Boolean function on $\mathbb {F}_2^m$. Therefore, for any $m \in \mathbb {N}$ there are $(2^m)!\cdot 2^{2^m}$ bent functions of 2m variables in $\mathcal {M}$.

A second well-known primary construction that gives rise to a large number of bent functions was introduced by Dillon in his PhD thesis [7], and it is based on partial spreads. A partial spread of $\mathbb {F}_2^n$, with $n=2m$, is a family P of m-dimensional subspaces $S_1,S_2,\ldots ,S_t \subseteq \mathbb {F}_2^n$ with pairwise trivial intersection (i.e., for all $i\ne j$ one has $S_i \cap S_j = \{ {0}\}$). Further, a partial spread is a spread if the union of its subspaces results in the whole space $\mathbb {F}_2^n$. The main result proved by Dillon is that one can construct a bent function $f: \mathbb {F}_2^n \rightarrow \mathbb {F}_2$, with $n=2m$, from a partial spread P of $\mathbb {F}_2^n$ by defining the support of f as the union of the subspaces in P. Remark that the partial spread must be large enough to reach the Hamming weight required for a bent function. In particular, a bent function $f: \mathbb {F}_2^n \rightarrow \mathbb {F}_2$, $n=2m$, belongs to the class $\mathcal{PS}\mathcal{}^{-}$ if $f(0)=0$ and its support is the union of $t=2^{m-1}$ subspaces of a partial spread P of $\mathbb {F}_2^n$. Functions in the $\mathcal{PS}\mathcal{}^-$ class reach the maximum possible algebraic degree for a bent function of $n=2m$ variables, namely m. Bent functions belonging to the class $\mathcal{PS}\mathcal{}^{+}$ are defined similarly, with $f(0)=1$ and their support being the union of $t = 2^{m-1}+1$ m-dimensional subspaces of a partial spread of $\mathbb {F}_2^n$. The union of $\mathcal{PS}\mathcal{}^-$ and $\mathcal{PS}\mathcal{}^+$ gives the whole partial spread class $\mathcal{PS}\mathcal{}$. We formally summarize this in the following definition:

Definition 1

Let $n=2m$. A bent function $f: \mathbb {F}_2^n \rightarrow \mathbb {F}_2$ is of type $\mathcal{PS}\mathcal{}^-$ (respectively, $\mathcal{PS}\mathcal{}^+$) if its support is defined as:

$$\begin{aligned} supp(f) = \bigcup _{S \in P} (S \setminus \{\underline{0}\}) \left( \text {respectively, } supp(f) = \bigcup _{S \in P} S \right) , \end{aligned}$$

(8)

where P is a partial spread of size $2^{m-1}$ (respectively, $2^{m-1}+1$).

Hence, from a practical point of view, the support of a $\mathcal{PS}\mathcal{}^+$ function is obtained by taking the union of the elements in the partial spread. For a $\mathcal{PS}\mathcal{}^-$ function, the support is also the union, with the exception that the null vector is always discarded from the elements in the partial spread.

Contrarily to $\mathcal{PS}\mathcal{}^-$, functions in $\mathcal{PS}\mathcal{}^+$ can have algebraic degrees other than m. More precisely, this depends on whether a $\mathcal{PS}\mathcal{}^+$ function is defined by a non-maximal partial spread (i.e., a partial spread that can be extended by adjoining another subspace) or not. In the former case, the resulting $\mathcal{PS}\mathcal{}^+$ function also has degree m. In the latter, the degree might be different, and in particular, when m is even, $\mathcal{PS}\mathcal{}^+$ contains the quadratic bent functions. We summarize the relationship between algebraic degree and $\mathcal{PS}\mathcal{}$ bent functions in the result below, whose proof can be found in Dillon’s thesis [7]:

Proposition 1

Let $f: \mathbb {F}_2^n \rightarrow \mathbb {F}_2$, with $n=2m$, be a bent function in the partial spread class $\mathcal{PS}\mathcal{}$. Then, the following hold:

• If $f \in \mathcal{PS}\mathcal{}^-$, then f has algebraic degree m.

• If $f \in \mathcal{PS}\mathcal{}^+$ and its partial spread is not maximal, then f has degree m.

Currently, the structure of the class $\mathcal{PS}\mathcal{}$ is still far from being completely characterized, and several methods have been investigated to define partial spreads that are large enough to obtain $\mathcal{PS}\mathcal{}^-$ and $\mathcal{PS}\mathcal{}^+$ bent functions. Here, we introduce only the Desarguesian spread, which is perhaps the best-known example of spread used to construct $\mathcal{PS}\mathcal{}^-$ bent functions (see, e.g., [6] for a general overview of other partial spreads). Given $n=2m$, one can use the bivariate form to represent the Desarguesian spread [15]. The vector space $\mathbb {F}_2^n$ is identified with the Cartesian product $\mathbb {F}_{2^m} \times \mathbb {F}_{2^m}$, and the Desarguesian spread is defined as:

$$\begin{aligned} DS&= \{E_a \subseteq \mathbb {F}_{2^m} \times \mathbb {F}_{2^m}: \ a \in \mathbb {F}_{2^m}\} \cup E_{\infty } \text {, where}: \nonumber \\ E_a&= \{(x,ax) \in \mathbb {F}_{2^m} \times \mathbb {F}_{2^m}: \ x \in \mathbb {F}_{2^m} \} , \nonumber \\ E_{\infty }&= \{(0,y) \in \mathbb {F}_{2^m} \times \mathbb {F}_{2^m}: \ y \in \mathbb {F}_{2^m}\} . \end{aligned}$$

(9)

Then, any subset of $2^{m-1}$ elements of DS is a partial spread whose union defines the support of a bent function. More in particular, these functions belong to the so-called class $\mathcal{PS}\mathcal{}_{ap}$ (where ap stands for “affine plane”), which is a subset of $\mathcal{PS}\mathcal{}^-$. Besides reaching maximal degree n/2, functions in the $\mathcal{PS}\mathcal{}_{ap}$ class have the additional interesting property of being hyper-bent, as shown, e.g., in [5]. A Boolean function $f: \mathbb {F}_{2^n} \rightarrow \mathbb {F}_2$, n even, is called hyper-bent if the function $f(x^i)$ is bent for all exponent i coprime with $2^n-1$ [20]. As such, hyper-bent functions have the highest possible distance not only from all affine functions (which corresponds to the case $i=1$) but also from all bijective monomial functions.

Given the great variety of primary constructions available in the literature, a crucial question when investigating a new construction is to assess whether the bent functions produced by it are essentially different from those belonging to other known classes. This is accomplished by using equivalence relations. The underlying idea is to classify the bent functions produced by the known constructions up to equivalence and then verify if the bent functions generated by a new construction belong to any of these classes or to different ones. The main equivalence relation used in this context is the extended affine equivalence (EA-equivalence). Two Boolean functions $f,g:\mathbb {F}_2^n \rightarrow \mathbb {F}_2$ are EA-equivalent if there exists a linear permutation $L: \mathbb {F}_2^n \rightarrow \mathbb {F}_2^n$, two vectors $u,v \in \mathbb {F}_2^n$, and an element $c \in \mathbb {F}_2$ such that, for all $x \in \mathbb {F}_2^n$,

$$\begin{aligned} g(x) = f(L(x) \oplus u) \oplus (v\cdot x) \oplus c . \end{aligned}$$

(10)

A bent function $f: \mathbb {F}_2^n \rightarrow \mathbb {F}_2$, with $n=2m$, belongs to the completed Maiorana–McFarland class $\mathcal {M}^{\#}$ if it is EA-equivalent to a function in $\mathcal {M}$.

One possible method to check the EA-inequivalence of a function against other classes resorts to the notion of rank, introduced by Weng et al. [19]. More precisely, the 2-rank of a Boolean function $f:\mathbb {F}_2^n \rightarrow \mathbb {F}_2$ is the rank of the $2^n \times 2^n$ binary matrix $A_f$ whose rows and columns are indexed by the vectors of $\mathbb {F}_2^n$, and which is defined as $A_f(x,y) = f(x \oplus y)$ for all $x,y \in \mathbb {F}_2^n$. In particular, if f is a bent function, then $A_f$ is the incidence matrix of a symmetric 2-design, and it is called the translate design of the difference set, which is the support of f. Weng et al. proved that EA-equivalent bent functions have the same rank. Therefore, one can prove that two bent functions are not equivalent by checking that their ranks differ. The paper by Weng et al. further characterizes the lower and upper bounds for different types of bent functions. In particular, the rank of any Maiorana–McFarland bent function of $n=2m$ variables ranges between $LB_{\mathcal {M}} = 2m+2$ and $UB_{\mathcal {M}} = 2^{m+1}-2$. On the other hand, bent functions defined over the Desarguesian partial spread have ranks between $LB_{DS} = 2^{m+1}-2$ and $UB_{DS} = \sum _{i=0}^m \left( {\begin{array}{c}m\\ i\end{array}}\right) 2^{\min \{i, m-i\}}$. An interesting consequence of the fact that the two intervals overlap only on $2^{m+1}-2$ is that almost all bent functions arising from the Desarguesian partial spread class are inequivalent to any Maiorana–McFarland function. Moreover, one can show that a bent function is inequivalent to all Maiorana–McFarland and Desarguesian spread functions by showing that its rank is higher than $UB_{DS}$.

2.2 Linear recurring sequences

This section covers only the basic notions of linear recurring sequences essential to present our construction. An excellent overview of this topic can be found in the book by Lidl and Niederreiter on finite fields [11].

Let $d \in \mathbb {N}$, and $a, a_0, \ldots , a_{d-1} \in \mathbb {F}_q$. A sequence $\{x_i\}_{i \in \mathbb {N}}$ of elements in $\mathbb {F}_q$ is called a linear recurring sequence (LRS) of order d if it satisfies the following relation:

$$\begin{aligned} a + a_0x_i + a_1x_{i+1} + \cdots + a_{d-1}x_{i+d-1} = x_{i+d} , \end{aligned}$$

(11)

for all $i \in \mathbb {N}$. The first d elements $x_0, \ldots , x_{d-1}$ act as the initial values of the sequence, while all subsequent ones are determined by applying the linear recurrence defined in Eq. (11). In what follows, we will assume that $a=0$, i.e., that the LRS is homogeneous, and that $\mathbb {F}_q$ is a field of characteristic 2. In this case, the feedback polynomial of the LRS (11) can be defined as:

$$\begin{aligned} f(X) = a_0 + a_1X + \cdots a_{d-1}X^{d-1} + X^d , \end{aligned}$$

(12)

that is, f(X) is the monic polynomial in $\mathbb {F}_q[X]$ of degree d whose monomials are defined by the coefficients of the LRS.

It is known that the family S(f(X)) of all sequences $\{x_i\}$ satisfying the linear recurrence with feedback polynomial f(X) as in (12) forms a d-dimensional vector space over $\mathbb {F}_q$ (see Chapter 6, Sect. 5 in [11]). In this work, we consider the projection of such sequences onto their first 2d coordinates. Therefore, we obtain a subspace $S_f \subseteq \mathbb {F}_q^{2d}$ of dimension d which is the kernel of the linear map $F: \mathbb {F}_q^{2d} \rightarrow \mathbb {F}_q^{d}$ defined as:

$$\begin{aligned} F(x_0,\ldots ,x_{2d-1})_i = a_0x_i + a_1x_{i+1} + ... + a_{d-1}x_{i+d-1} + x_{i+d} , \end{aligned}$$

(13)

for all output coordinates $i \in \{0,\ldots ,d-1\}$. Since the map F is linear, we can describe it as $F(x) = M_F \cdot x^\top$, where $M_F$ is the $d \times 2d$ matrix of the form:

$$\begin{aligned} M_F = \begin{pmatrix} a_0 &{} \cdots &{} a_{d-1} &{} 1 &{} 0 &{} \cdots &{} \cdots &{} \cdots &{} \cdots &{} 0 \\ 0 &{} a_0 &{} \cdots &{} a_{d-1} &{} 1 &{} 0 &{} \cdots &{} \cdots &{} \cdots &{} 0 \\ \vdots &{} \vdots &{} \vdots &{} \ddots &{} \vdots &{} \vdots &{} \vdots &{} \ddots &{} \vdots &{} \vdots \\ 0 &{} \cdots &{} \cdots &{} \cdots &{} \cdots &{} 0 &{} a_0 &{} \cdots &{} a_{d-1} &{} 1 \\ \end{pmatrix} , \end{aligned}$$

(14)

Therefore, we can compactly represent the linear map F by the coefficients of the feedback polynomial f, i.e., $f \mapsto M_F$. Notice that $M_F$ has the form of the parity-check matrix of a cyclic code, with f playing the role of the parity check polynomial. However, the code associated with f is not cyclic in general. This happens, in particular, if and only if the generator polynomial (which is defined as the reciprocal of f) divides $X^N-1$, where $N=2d$. On the other hand, evaluating F on a particular vector $x \in \mathbb {F}_q^{2d}$ corresponds to computing the syndrome of x. In what follows, we will also consider the special cases where the feedback polynomial is respectively $X^d$ and 1. The former is still a feedback polynomial of degree d—although not a typical one—and thus, the definition of the $d\times 2d$ matrix in Eq. (14) still holds. In particular, the linear map F is defined by the matrix $M_F = [0|I]$, where I denotes the $d\times d$ identity matrix; the corresponding kernel is the subspace $\{(x_0,\ldots , x_{d-1}, 0, \ldots , 0) : x_i \in \mathbb {F}_q\}$, i.e. all those vectors whose right half is set to 0. On the other hand, the case $f(X)=1$ is different since here we have a polynomial of degree 0. However, we can still define a $d \times 2d$ matrix with $d\ge 1$ of the form (14) as $M_F = [I | 0]$. The function F maps each vector of dimension 2d to its first d coordinates. Therefore, symmetrically to the case of $X^d$, the kernel of the linear map for $f(X)=1$ is the subspace $\{(0, \ldots , 0, x_d, \ldots x_{2d-1}) : x_i \in \mathbb {F}_q\}$, that is, all vectors whose left half is set to 0.

Remark 1

Suppose that we have a feedback polynomial g(X) of degree $d\ge 1$ and $f(X) = 1$. Then, the kernels of the linear maps G and F respectively defined by g(X) and f(X) have a trivial intersection. In fact, the rightmost d coordinates of the vectors in the kernel of G are linear functions of the leftmost d ones. The only vector in this kernel that also has its left half equal to 0 is thus the null vector.

As a final note, remark that F may also be regarded as a linear cellular automaton (CA) [13]. The connection between the LRS used here to define bent functions, and the CA approach will be briefly discussed in the conclusions.

3 The LRS construction

The first step of our construction requires characterizing when the kernels of two LRS subspaces have a trivial intersection. The next result shows that this is equivalent to computing the greatest common divisor of the respective feedback polynomials.

Lemma 1

Let $f,g \in \mathbb {F}_q[X]$ be two polynomials over $\mathbb {F}_q$ both of degree $d\ge 1$, respectively defined as:

$$\begin{aligned} f(X)&= a_0 + a_1X + \cdots + a_{d-1}X^{d-1} + X^d , \end{aligned}$$

(15)

$$\begin{aligned} g(X)&= b_0 + b_1X + \cdots + b_{d-1}X^{d-1} + X^d , \end{aligned}$$

(16)

with $a_i,b_i \in \mathbb {F}_q$. Further, let $F,G: \mathbb {F}_q^{2d} \rightarrow \mathbb {F}_q^d$ be the linear maps defined by the polynomials f and g, respectively. Then, the kernels of F and G have trivial intersection if and only if $\gcd (f,g) = 1$, i.e., if and only if f and g are coprime.

Proof

The linear maps F and G are respectively defined as $F(x) = M_F\cdot x^\top$ and $G(x) = M_G \cdot x^\top$ for all $x \in \mathbb {F}_q^{2d}$, where $M_F$ and $M_G$ are the two $d\times 2d$ matrices of the form (14). Define now the linear function $H: \mathbb {F}_q^{2d} \rightarrow \mathbb {F}_q^{2d}$ as $H = M_H \cdot x^\top$ for all $x \in \mathbb {F}_q^{2d}$, where

$$\begin{aligned} M_H = \begin{pmatrix} M_F \\ M_G \end{pmatrix} = \begin{pmatrix} a_0 &{} \cdots &{} a_{d-1} &{} 1 &{} 0 &{} \cdots &{} \cdots &{} \cdots &{} \cdots &{} 0 \\ 0 &{} a_0 &{} \cdots &{} a_{d-1} &{} 1 &{} 0 &{} \cdots &{} \cdots &{} \cdots &{} 0 \\ \vdots &{} \vdots &{} \vdots &{} \ddots &{} \vdots &{} \vdots &{} \vdots &{} \ddots &{} \vdots &{} \vdots \\ 0 &{} \cdots &{} \cdots &{} \cdots &{} \cdots &{} 0 &{} a_0 &{} \cdots &{} a_{d-1} &{} 1 \\ b_0 &{} \cdots &{} b_{d-1} &{} 1 &{} 0 &{} \cdots &{} \cdots &{} \cdots &{} \cdots &{} 0 \\ 0 &{} b_0 &{} \cdots &{} b_{d-1} &{} 1 &{} 0 &{} \cdots &{} \cdots &{} \cdots &{} 0 \\ \vdots &{} \vdots &{} \vdots &{} \ddots &{} \vdots &{} \vdots &{} \vdots &{} \ddots &{} \vdots &{} \vdots \\ 0 &{} \cdots &{} \cdots &{} \cdots &{} \cdots &{} 0 &{} b_0 &{} \cdots &{} b_{d-1} &{} 1 \\ \end{pmatrix} . \end{aligned}$$

(17)

In other words, the matrix $M_H$ is simply the superposition of the two matrices $M_F$ and $M_G$. It is clear that the nullspace of $M_H$ is the intersection of the nullspaces of $M_F$ and $M_G$. Hence, the kernels of F and G have trivial intersection if and only if $M_H$ is invertible. Remark that $M_H$ is also the Sylvester matrix of the polynomials f and g. It is a well-known fact that the determinant of the Sylvester matrix (also called the resultant in this context) is nonzero if and only if f and g do not have a common factor [10]. Therefore, one has that $ker(F) \cap ker(G) = \{\underline{0}\}$ if and only if f and g are coprime. $\square$

Consequently, we need to find a family of pairwise coprime polynomials that is large enough to define a bent function. Following what we recalled in Sect. 2.1, for a $\mathcal{PS}\mathcal{}^-$ function we need $t=2^{m-1}$ coprime polynomials of degree d. To this aim, let us take the finite field $\mathbb {F}_q$ with $q=2^l$, for $l \in \mathbb {N}$. This is because a partial spread for a bent function must be defined over the vector space $\mathbb {F}_2^n$, $n=2m$. In particular, each vector $x \in \mathbb {F}_{2^l}^{2d}$ must also be converted into a corresponding binary vector $x \in \mathbb {F}_2^n$ since the union of the vectors in the partial spread will form the support of the bent function. In other words, we require that $ld = m$. By identifying $\mathbb {F}_{2^l}$ with the vector space $\mathbb {F}_2^l$, a vector x in $\mathbb {F}_{2^l}^{2d}$ is a 2d-tuple whose components are in turn binary l-tuples:

$$\begin{aligned} x = ((x_{0,0}, \ldots , x_{0,l-1}), \ldots , (x_{2d-1,0}, \ldots , x_{2d-1,l-1})) . \end{aligned}$$

(18)

We now associate to each element $x \in \mathbb {F}_{2^l}^{2d}$ an element of $\mathbb {F}_2^{2ld}$ through the flattening operator $\varphi : \mathbb {F}_{2^l}^{2d} \rightarrow \mathbb {F}_2^{2ld}$, which simply drops the parentheses inside the vector representation of x:

$$\begin{aligned} \varphi (x) = (x_{0,0}, \ldots , x_{0,l-1}, \ldots , x_{2d-1,0}, \ldots , x_{2d-1,l-1}) . \end{aligned}$$

(19)

It is then easy to see that $\varphi$ is bijective. We can now characterize the partial spreads arising from our construction:

Theorem 1

Let $m, l, d \in \mathbb {N}$ such that $m = ld$. If there are $t=2^{ld-1}$ (respectively, $t=2^{ld-1}+1$) coprime polynomials of degree $d\ge 1$ over $\mathbb {F}_q$ where $q=2^l$, possibly including the constant polynomial 1 of degree 0, then there exists a partial spread P over $\mathbb {F}_2^n$, $n=2m$, whose union of its subspaces with the null vector discarded (respectively, with the null vector included) defines a bent function in the class $\mathcal{PS}\mathcal{}^-$ (respectively, $\mathcal{PS}\mathcal{}^+$).

Proof

Let us first consider the case where $f_1,\ldots , f_t$ are all coprime polynomials of degree $d\ge 1$ over $\mathbb {F}_q$, and let $F_1,\ldots , F_t: \mathbb {F}_q^{2d} \rightarrow \mathbb {F}_q^d$ be the corresponding linear maps associated to them. Define the following family of subspaces of $\mathbb {F}_2^n$, with $n=2m=2ld$:

$$\begin{aligned} P = \{ \Phi (ker(F_i)) \subseteq \mathbb {F}_2^n: 1 \le i \le t\} , \end{aligned}$$

(20)

where $\Phi (ker(F_i)) = \{y \in \mathbb {F}_2^n: y = \varphi (x), x \in ker(F_i)\}$, for $1 \le i \le t$. In other terms, the subspace $\Phi (ker(F_i))$ is obtained by taking the kernel of $F_i$ and applying the flattening operator to each vector in it. Since the polynomials $f_1,\ldots , f_t$ are pairwise coprime, by Lemma 1, the kernels of the $F_i$ have pairwise trivial intersection. Clearly, the same property holds for the subspaces $\Phi (ker(F_i))$ in P since they are just a different representation of the same kernels through the flattening operator. Therefore, P is a partial spread over $\mathbb {F}_2^n$, and depending on its size ($t=2^{ld-1}$ or $t=2^{ld-1}+1$), it can be used to define the support of a $\mathcal{PS}\mathcal{}^-$ or $\mathcal{PS}\mathcal{}^+$ bent function as per Definition 1.

Suppose now that one of the t polynomials is $f_i(X)=1$, while all others $f_j(X)$ for $j \ne i$ are pairwise coprime polynomials of degree $d\ge 1$. By Remark 1, the kernel of $F_i$ has trivial intersection with the kernel of $F_j$ for all $j\ne i$. Thus, one can construct a partial spread also in this case using Eq. (20). $\square$

An alternative way of considering the inclusion of the constant polynomial $f(X)=1$ in Theorem 1 is that one can define a variant of the Sylvester resultant for two polynomials of different degrees $e<d$, with $d\ge 1$, such that the corresponding matrix still has size $2d \times 2d$. The idea, explained by Sylvester in [18, pp. 425–426], is to augment the matrix of the linear map related to the polynomial of smaller degree e by postpending $d-e$ ghost terms equal to zero in the first row and then sliding as usual to construct the rows below. Equivalently, in the polynomial notation the additional ghost terms are $0\cdot x^i$ for $e+1 \le i \le d$. This is precisely how we defined the matrix in Sect. 2.2 for $f(X) = 1$, i.e. as $M_F = [I|0]$.

In the remainder of this section, we show two examples of bent functions obtained through our construction.

Example 1

Let $m=2$, $n=2m = 4$, $l=1$, and $d=2$. Since $ld=m$, in this case we need to find $t= 2^{m-1} = 2$ relatively prime polynomials $f_1,f_2 \in \mathbb {F}_2[X]$ of degree $d=2$ to apply our construction. Let $f_1(X) = X^2 + 1$ and $f_2(X) = X^2 + X + 1$. In this case, there is no need to apply the flattening operator since the ground field for the polynomials is already $\mathbb {F}_2$. The two linear maps $F_1,F_2: \mathbb {F}_2^4 \rightarrow \mathbb {F}_2^2$ are respectively defined by the following two matrices:

$$\begin{aligned} M_{F_1} = \begin{pmatrix} 1 &{} 0 &{} 1 &{} 0 \\ 0 &{} 1 &{} 0 &{} 1 \end{pmatrix} , M_{F_2} = \begin{pmatrix} 1 &{} 1 &{} 1 &{} 0 \\ 0 &{} 1 &{} 1 &{} 1 \end{pmatrix} \end{aligned}$$

The kernels of $F_1$ and $F_2$ are the following ones:

$$\begin{aligned} ker(F_1)&= \{0000, 1010, 0101, 1111 \}, \\ ker(F_2)&= \{0000, 1011, 0110, 1101 \}, \end{aligned}$$

which clearly have a trivial intersection. Therefore, the union of $ker(F_1)$ and $ker(F_2)$ (excluding the null vector) defines the support of the Boolean function $g: \mathbb {F}_2^4 \rightarrow \mathbb {F}_2$ with the following truth table:

$$\begin{aligned} \Omega _g = (0, 0, 0, 0, 0, 1, 1, 0, 0, 0, 1, 1, 0, 1, 0, 1) . \end{aligned}$$

The ANF of g is defined as follows:

$$\begin{aligned} g(x_1,x_2,x_3,x_4) = x_1x_3 \oplus x_2x_3 \oplus x_2x_4. \end{aligned}$$

It is possible to verify that this function is bent in a number of ways. For example, by applying the linear transformation $x_4 \leftarrow x_3 \oplus x_4$ the function g is equivalent to the canonical nondegenerate quadratic form $g'(x_1,x_2,x_3,x_4) = x_1x_3 \oplus x_2x_4$, which by Eq. (7) is a Maiorana–McFarland function.

Example 2

The bent function g defined in Example 1 belongs to the $\mathcal{PS}\mathcal{}^-$ class, since its support is the union of $2^{2-1} = 2$ subspaces of dimension 2 with trivial intersection, stripping out the null vector. If we want to obtain a $\mathcal{PS}\mathcal{}^+$ function, we need an additional polynomial of degree $d=2$ that is coprime both to $f_1$ and $f_2$. To this end, we can select for instance $f_3(X) = X^2$. The kernel of the associated linear map $F_3$ is as follows:

$$\begin{aligned} ker(F_3)&= \{0000, 0100, 1000, 1100 \} , \end{aligned}$$

which again has trivial intersection with both $ker(F_1)$ and $ker(F_2)$. Therefore, we can define a $\mathcal{PS}\mathcal{}^+$ bent function $h: \mathbb {F}_2^4 \rightarrow \mathbb {F}_2$ by setting $h(0000) = 1$ and defining the rest of its support as the union of the three kernels minus their trivial intersection. We thus obtain the following truth table:

$$\begin{aligned} \Omega _h = (1, 1, 1, 1, 0, 1, 1, 0, 0, 0, 1, 1, 0, 1, 0, 1) , \end{aligned}$$

with the ANF of h being:

$$\begin{aligned} h(x_1,x_2,x_3,x_4) = x_1x_2 \oplus x_1x_3 \oplus x_2x_3 \oplus x_2x_4 \oplus x_1 \oplus x_2 \oplus 1 . \end{aligned}$$

4 Counting bent functions in the LRS construction

Recall from Theorem 1 that, given $m, l, d \in \mathbb {N}$ such that $m = ld$, one can construct a $\mathcal{PS}\mathcal{}^-$ (respectively, $\mathcal{PS}\mathcal{}^+$) bent function if there are at least $t=2^{ld-1}$ (respectively, $t=2^{ld-1}+1)$) coprime polynomials of degree d over $\mathbb {F}_q$ where $q=2^l$. Thus, the first research question is whether for all even $n \in \mathbb {N}$ there are enough pairwise coprime polynomials to obtain a bent function. In what follows, we focus on the case of monic polynomials with nonzero constant term that are pairwise coprime to exploit the counting results proved in [12]. There, the authors proposed construction for such families of polynomials based on the multiplication of two irreducible polynomials of degree k and $d-k$, respectively. In particular, they showed that the maximum size of the families that can be generated through this construction equals:

$$\begin{aligned} N_d = I_d + \sum _{k=1}^{\lfloor \frac{d}{2} \rfloor } I_k . \end{aligned}$$

(21)

In the formula above, $I_k$ denotes the number of irreducible monic polynomials of degree k and with a nonzero constant term over $\mathbb {F}_q$, which is $I_k=q-1$ for $k=1$, while for $k\ge 2$ it is given by Gauss’s formula:

$$\begin{aligned} I_{k} = \frac{1}{k} \sum _{e|k} \mu (e)\cdot q^{\frac{k}{e}} , \end{aligned}$$

(22)

with $\mu$ denoting the Möbius function. Further, in [12], it is proved that such construction is optimal, meaning that $N_d$ actually corresponds to the maximum size attainable by any family of monic coprime polynomials of degree d with a nonzero constant term over $\mathbb {F}_q$. Thus, one can study Eq. (21) with respect to the parameters l, d, and m to address the existence question for families of polynomials that satisfy the conditions of Theorem 1. We now characterize such families for the case of $\mathcal{PS}\mathcal{}^-$ functions in terms of the degrees of their polynomials:

Theorem 2

Let $l, d, m \in \mathbb {N}$ such that $ld = m$, and let $q=2^l$. Then there exists a family of $t=2^{m-1}$ pairwise coprime polynomials of degree d and nonzero constant term over $\mathbb {F}_q$ if and only if $d \in \{1,2\}$.

Proof

We need to show that $N_d \ge \frac{1}{2}q^d$ if and only if $d \le 2$. We first settle the cases of $d \le 4$ one by one.

For $d=1$, we obtain

$$\begin{aligned} N_1 = I_1 = q - 1 \ge \frac{1}{2}q. \end{aligned}$$

For $d=2$, we obtain

$$\begin{aligned} N_2 = I_2 + I_1 = \frac{1}{2}( q^2 - q ) + (q-1) = \frac{1}{2}q^2( 1 + q^{-1} - 2q^{-2} ) \ge \frac{1}{2}q^2. \end{aligned}$$

For $d = 3$, we obtain

$$\begin{aligned} N_3&= I_3 + I_1 = \frac{1}{3} \left( q^3 - q \right) + ( q - 1 )\\&< \frac{1}{3} q^3 \left( 1 + 2 q^{-2} \right) \le \frac{1}{3} q^3 \frac{3}{2}\\&= \frac{1}{2} q^3. \end{aligned}$$

For $d = 4$, we obtain

$$\begin{aligned} N_4&= I_4 + I_2 + I_1 = \frac{1}{4} \left( q^4 - q^2 \right) + \frac{1}{2}(q^2 - q) + ( q - 1 )\\&< \frac{1}{4} q^4 \left( 1 + q^{-2} + 2q^{-3} \right) \le \frac{1}{4} q^4 \frac{3}{2}\\&= \frac{3}{8} q^4. \end{aligned}$$

We now move on to the case where $d \ge 5$. Denoting the smallest nontrivial divisor of d by p, we first get the following upper bound on $I_d$:

$$\begin{aligned} I_d \le \frac{1}{d} \left\{ q^d - q^{d/p} + (q^{d/p - 1} + \cdots + q + 1) \right\} < \frac{1}{d} q^d. \end{aligned}$$

We also obtain the following upper bound:

$$\begin{aligned} \sum _{k=1}^{\lfloor d/2 \rfloor } I_k \le q^{\lfloor d/2 \rfloor + 1} \le q^{d-2} \le \frac{1}{4} q^d . \end{aligned}$$

Combining, we obtain

$$\begin{aligned} N_d = I_d + \sum _{k=1}^{\lfloor d/2 \rfloor } I_k< q^d \left( \frac{1}{d} + \frac{1}{4} \right) < \frac{1}{2} q^d . \end{aligned}$$

$\square$

Hence, bent functions can be obtained from our LRS construction using polynomials with nonzero constant terms for all number of variables $n = 2m$, where $m=l$ when $d=1$, and $m=2l$ when $d=2$. This leads us to the following counting result:

Theorem 3

Let $l, m \in \mathbb {N}$ and $d \in \{1,2\}$ such that $ld = m$, and let $q=2^l$. Then, the number of $\mathcal{PS}\mathcal{}^{-}$ bent functions of $n=2m$ variables that can be obtained by Theorem 1 with polynomials of degree d and nonzero constant term is $\left( {\begin{array}{c}2^{m}-1\\ 2^{m-1}\end{array}}\right)$ when $d=1$ and

$$\begin{aligned} \sum _{A = 0}^{I_2} \left( {\begin{array}{c}I_2\\ A\end{array}}\right) \sum _{B=0}^{2^{m-1} - A} \left( {\begin{array}{c}I_1\\ B\end{array}}\right) \left( {\begin{array}{c}I_1 - B\\ 2 (2^{m-1} - B - A)\end{array}}\right) \frac{ (2(2^{m-1} - B - A))! }{ (2^{m-1} - B - A)! 2^{2^{m-1} - B - A} }, \end{aligned}$$

(23)

where $I_2 = \frac{1}{2}(q^2 - q)$ and $I_1 = q - 1$, when $d=2$.

Proof

By Theorem 2 the only cases we need to address are $d=1$ and $d=2$. Let $d=1$ (and thus $m=l$). Then, by Eq. (21), the largest family $\mathcal {F}_1$ of coprime polynomials of degree 1 with nonzero constant term over $\mathbb {F}_q$ is composed of $N_1 = q-1 = 2^{m}-1$ elements. The number of subsets of $2^{m-1}$ elements of $\mathcal {F}_1$ that can be selected to apply Theorem 1 is $\left( {\begin{array}{c}2^{m}-1\\ 2^{m-1}\end{array}}\right)$. For $d=2$, any family of $t = 2^{m-1}$ coprime polynomials of degree 2 with nonzero constant term over $\mathbb {F}_q$ consists of:

• 1. $A \le I_2$ irreducible polynomials of degree 2;

• 2. $B \le I_1$ polynomials of the form $f^2$, where f is an irreducible polynomial of degree 1;

• 3. $C = t - B - A$ polynomials of the form gh, where g and h are irreducible polynomials of degree 1;

and obviously, the same irreducible polynomial of degree 1 only appears once. There are $\left( {\begin{array}{c}I_2\\ A\end{array}}\right)$ choices for the first part of the family, $\left( {\begin{array}{c}I_1\\ B\end{array}}\right)$ choices for the second part of the family, and

$$\begin{aligned} \frac{1}{ C! } \left( {\begin{array}{c}I_1 - B\\ 2 \end{array}}\right) \left( {\begin{array}{c}I_1 - B - 2\\ 2 \end{array}}\right) \dots \left( {\begin{array}{c}I_1 - B - 2C + 2\\ 2 \end{array}}\right) = \left( {\begin{array}{c}I_1 - B\\ 2C \end{array}}\right) \frac{ (2C)! }{ C! 2^C } \end{aligned}$$

choices for the third part of the family. Combining all three parts, we obtain the formula. $\square$

The results above refer to the number of families of coprime polynomials with a nonzero constant term that is large enough to construct $\mathcal{PS}\mathcal{}^-$ bent functions. Although such functions will be the focus of our computer investigations in the next sections, one could also augment such families with other types of polynomials, as long as they are pairwise coprime with all the others. This could be used, for instance, to construct further $\mathcal{PS}\mathcal{}^-$ functions or $\mathcal{PS}\mathcal{}^+$ functions with polynomials of degree $d=1,2$. Additionally, one could combine these other types of coprime polynomials with families of degrees higher than 2.

One simple idea to achieve this is to augment each family with the constant polynomial 1 and the polynomial $X^d$, which we already treated in Sect. 2.2 and considered in Theorem 1. Although the former is not of degree d while the latter does not have a constant term, it is easy to see that they are coprime both among themselves and to all other polynomials in the families considered in Theorems 2 and 3. This idea spawns from the orthogonal array (OA) characterization of our construction adopted in [9], where the first two columns of the OA correspond to the LRS subspaces defined by 1 and $X^d$. We will elaborate further on this connection in the conclusions section.

We already used in Example 2 the polynomial $X^2$ to construct a $\mathcal{PS}\mathcal{}^+$ function of 4 variables, by adding it to the family $\{X^2+1, X^2 + X + 1\}$. One could also add the constant polynomial 1, thereby obtaining a family of 4 coprime polynomials. Since to define a $\mathcal{PS}\mathcal{}^+$ function of 4 variables with our LRS construction we need $2^{2-1}+1 = 3$ pairwise coprime polynomials, we can build $\left( {\begin{array}{c}4\\ 3\end{array}}\right) = 4$ $\mathcal{PS}\mathcal{}^+$ functions by selecting all subsets of three polynomials in $\{1, X^2, X^2+1, X^2+X+1\}$. Alternatively, one could build $\left( {\begin{array}{c}4\\ 2\end{array}}\right) = 6$ $\mathcal{PS}\mathcal{}^-$ functions since, in this case, we only need a subset of two polynomials.

The next example shows how the two polynomials 1 and $X^d$ can be used to augment a family of coprime polynomials with a nonzero constant term of degree $d>2$ so that we have enough of them to apply our construction.

Example 3

Let $m=3$, and l, d such that $ld=m$. There are only two possibilities, namely $l=3$ and $d=1$, and $l=1$ and $d=3$. The first one is already covered by Theorem 2 since $d=1$. Let us consider the case $l=1$ and $d=3$. From Eq. (21), we have $N_3 = I_3 + I_1 = 2 + 1 = 3$ coprime polynomials of degree 3 over $\mathbb {F}_2$ with nonzero constant term, which are the following ones:

$$\begin{aligned} f_1(X)&= X^3 + X^2 + 1 \\ f_2(X)&= X^3 + X + 1 \\ f_3(X)&= (X+1)(X^2+X+1) = X^3 + X^2 + X + 1 . \end{aligned}$$

To obtain a $\mathcal{PS}\mathcal{}^-$ (respectively, a $\mathcal{PS}\mathcal{}^+$) function we need $2^{3-1} = 4$ (respectively, $2^{3-1}+1 = 5$) coprime polynomials. By adding 1 and $X^3$ to the set $\{f_1,f_2,f_3\}$, we can thus build $\left( {\begin{array}{c}5\\ 4\end{array}}\right) = 5$ $\mathcal{PS}\mathcal{}^{-}$ functions and one $\mathcal{PS}\mathcal{}^+$ function.

5 Equivalence to DS functions for degree $d=1$

We now show that our LRS construction coincides with the Desarguesian partial spread class when considering polynomials of degree $d=1$. In this case, to generate a bent function $f: \mathbb {F}_2^n \rightarrow \mathbb {F}_2$ of $n = 2m$ variables, by Theorem 1 we need to find a set of $t = 2^{m-1}$ irreducible polynomials of degree 1 over $\mathbb {F}_{2^m}$. This basically amounts to choosing a subset of cardinality t from the family:

$$\begin{aligned} \mathcal {I}_1 = \{a + X \in \mathbb {F}_{2^m}[X]: a \in \mathbb {F}_{2^m}^* \} . \end{aligned}$$

(24)

Thus, let $P = \{f_1(X), \ldots , f_t(X)\}$ be a subset of $\mathcal {I}_1$. Recall that each polynomial is used as an abstract representation for the coefficients of an LRS of order $d=1$, used to define the corresponding linear map. In particular, for $f_i(X) = a_i + X$, we have that $F_i$ equals:

$$\begin{aligned} F_i(x_0,x_1) = a_ix_0 + x_1 , \end{aligned}$$

(25)

for all pairs $(x_0,x_1) \in \mathbb {F}_{2^m} \times \mathbb {F}_{2^m}$. By Theorem 1, the kernels of $F_i \equiv f_i$ for $i \in \{1,\ldots ,t\}$ form a partial spread, and each of them is obtained by taking all pairs $(x_0,x_1) \in \mathbb {F}_{2^m} \times \mathbb {F}_{2^m}$ such that $x_1 = a_ix_0$, since $\mathbb {F}_{2^m}$ is a field of characteristic 2. We have that:

$$\begin{aligned} \nonumber ker(F_i)&= \{(x_0,x_1) \in \mathbb {F}_{2^m} \times \mathbb {F}_{2^m}: x_1 = a_ix_0\} \\&= \{(x, a_ix) \in \mathbb {F}_{2^m} \times \mathbb {F}_{2^m}: x \in \mathbb {F}_{2^m}\} = E_{a_i} , \end{aligned}$$

(26)

where $E_{a_i}$ is a member of the Desarguesian spread as defined by Eq. (9) in bivariate form. We have thus obtained the following result:

Lemma 2

Let $f: \mathbb {F}_2^n \rightarrow \mathbb {F}_2$, $n=2m$, be a bent function defined as in Theorem 1 with degree $d=1$. Then, $f \in \mathcal{PS}\mathcal{}_{ap}$.

Therefore, when considering the family $\mathcal {I}_1$ of $2^{l}-1$ irreducible polynomials of degree 1 over $\mathbb {F}_{2^l}$ with a nonzero constant term, our LRS construction is a particular case of the partial spread induced by the Desarguesian spread. Further, the two classes coincide if one adds the polynomials 1 and X to the family $\mathcal {I}_1$ since in that case, one can construct $\left( {\begin{array}{c}2^l + 1\\ 2^{l-1}\end{array}}\right)$ $\mathcal{PS}\mathcal{}_{ap}$ functions.

However, the above reasoning on the Desarguesian spread does not hold for degree 2. In this case, the LRS is defined by three coefficients instead of two, with the input vector of the linear map consisting of 4 coordinates. Consequently, the LRS is evaluated over three variables $x_0,x_1,x_2$, and there does not seem to be a straightforward way to express the kernel of the linear map as a set of pairs of the type (x, ax). To the best of our knowledge, there are no other constructions in the literature that represent partial spreads in a way analogous to our construction with degree $d=2$.

6 Computational results on ranks and EA-equivalence for $n=8$

To investigate more in detail the bent functions induced by our LRS construction, we performed a computer search for $n=6$ and $n=8$ variables, with polynomials of degrees $d=1,2$, generating only $\mathcal{PS}\mathcal{}^-$ functions for $d=1$ and both $\mathcal{PS}\mathcal{}^-$ and $\mathcal{PS}\mathcal{}^+$ functions for $d=2$. This is due to the fact that for degree $d=1$ the $\mathcal{PS}\mathcal{}^+$ functions are the complements of $\mathcal{PS}\mathcal{}^-$ functions. For degree $d=2$, we noticed that all $\mathcal{PS}\mathcal{}^+$ functions also have degree n/2. This is because the partial spreads which define these functions are not maximal, and therefore by Proposition 1, they must have the same algebraic degree of $\mathcal{PS}\mathcal{}^-$ functions. Moreover, it is known that up to $n=6$ variables, all bent functions belong to the completed Maiorana–McFarland class [17]. Therefore, the smallest interesting case to consider is $n=8$ variables.

As a first assessment, we generated all $\mathcal{PS}\mathcal{}^-$ functions by using families of coprime polynomials of degree $d=1$. Although by Lemma 2, we know that all such functions are in $\mathcal{PS}\mathcal{}_{ap}$ and coincide with the Desarguesian spread class, we computed their ranks to independently verify the count reported by Weng et al. [19]. In this case, we have $m=l=4$ and $t=2^{m-1}=8$. Hence, to construct a function from the Desarguesian spread, we need 8 coprime polynomials. Since there are 16 irreducible polynomials of degree $d=1$ with coefficients over $\mathbb {F}_{2^4}$ and the constant polynomial 1, one can obtain $\left( {\begin{array}{c}17\\ 8\end{array}}\right) = 24310$ $\mathcal{PS}\mathcal{}_{ap}$ functions with our construction. Table 1 reports the distribution of the 2-ranks for all such functions.

Table 1 Distribution of 2-ranks for bent functions of $n=8$ variables in the Desarguesian spread, obtained through the LRS construction with irreducible polynomials of degree $d=1$ over $\mathbb {F}_{2^4}$

The upper bound on the rank of a Maiorana–McFarland function of $n=8$ variables given in [19] is $2^{m+1}-2 = 30$. Hence, one can see from Table 1 that most of the functions in the Desarguesian spread are inequivalent to Maiorana–McFarland functions. Remark also that the numbers in Table 1 are higher than those reported by Weng et al. in [19] because we are actually considering more functions. As a matter of fact, Weng et al. computed the $\left( {\begin{array}{c}16\\ 8\end{array}}\right) = 12870$ bent functions in the class $\mathcal{PS}\mathcal{}^-$ arising from the Desarguesian spread components $x_1 = a x_0$, with $a \in \mathbb {F}_{2^4}$. This corresponds to our LRS construction when considering only the $2^{4}-1$ irreducible polynomials of degree 1 over $\mathbb {F}_{2^4}$ with nonzero constant term and the polynomial X. On the other hand, here, as mentioned above, we also consider the polynomial 1, which is coprime with all such polynomials, although it does not have degree 1. This allows us to construct $\left( {\begin{array}{c}16\\ 7\end{array}}\right) = 11,440$ additional functions. Therefore, the distribution reported in Table 1 independently verifies and extends Weng et al.’s result in [19]. Moreover, since the functions of $\mathcal{PS}\mathcal{}^+$ type are the complements of those of type $\mathcal{PS}\mathcal{}^-$, Table 1 actually gives a complete account of the rank distribution of all $\mathcal{PS}\mathcal{}_{ap}$ functions in 8 variables.

Next, we focused our attention on coprime polynomials of degree $d=2$. As we discussed in Sect. 5, this case is not directly amenable to the Desarguesian spread, and it is, therefore, an interesting candidate to find potentially new $\mathcal{PS}\mathcal{}^-$ and $\mathcal{PS}\mathcal{}^+$ functions. By Theorem 2, we have $m=4$, $t=8$, and $l=2$. Consequently, a $\mathcal{PS}\mathcal{}^-$ bent function is obtained by finding a set of eight pairwise coprime polynomials over $\mathbb {F}_{4}$ of degree 2. Let $\mathbb {F}_4 = \{0,1, \alpha , \alpha ^2\}$, where $\alpha$ is a root of a primitive polynomial $p(X) \in \mathbb {F}_2[X]$ of degree 2. Then, by Gauss’s formula, there are six irreducible polynomials of degree 2 over $\mathbb {F}_4$:

$$\begin{aligned} p_1(X)&= X^2 + \alpha ^2 X + \alpha ^2 ,\\ p_2(X)&= X^2 + \alpha ^2 X + 1 ,\\ p_3(X)&= X^2 + \alpha X + \alpha ,\\ p_4(X)&= X^2 + X + \alpha ^2 ,\\ p_5(X)&= X^2 + \alpha X + 1 ,\\ p_6(X)&= X^2 + X + \alpha . \end{aligned}$$

These polynomials are, of course, pairwise coprime since they are irreducible. Let us denote them by $\mathcal {I}_2 = \{p_1,p_2,p_3,p_4,p_5,p_6\}$. Further, there are three irreducible polynomials of degree 1 and nonzero constant term over $\mathbb {F}_4$ that can be squared to obtain polynomials of degree 2 that are coprime among themselves and with those in $\mathcal {I}_2$:

$$\begin{aligned} p_7(X)&= (X+1)^2 = X^2 + 1 ,\\ p_8(X)&= (X+\alpha )^2 = X^2 + \alpha ^2 ,\\ p_9(X)&= (X+\alpha ^2)^2 = X^2 + \alpha . \end{aligned}$$

Analogously, we denote by $\mathcal {I}_1^2$ the set $\{p_7,p_8,p_9\}$. Moreover, we can augment our set with the polynomials 1 and $X^2$. Although the former is not of degree 2 and the latter does not have a constant term, they are coprime with all polynomials in $\mathcal {I}_2 \cup \mathcal {I}_1^2$. Finally, we can take the $\left( {\begin{array}{c}3\\ 2\end{array}}\right) = 3$ pairs of $\mathcal {I}_1$ and multiply the polynomials in them, obtaining:

$$\begin{aligned} p_{10}(X)&= (X+1)(X+\alpha ^2) = X^2 + \alpha X + \alpha ^2 ,\\ p_{11}(X)&= (X+1)(X+\alpha ) = X^2 + \alpha ^2 X + \alpha ,\\ p_{12}(X)&= (X+\alpha )(X+\alpha ^2) = X^2 + X + 1 , \end{aligned}$$

with $\mathcal {I}_{1,1} = \{p_{10},p_{11},p_{12}\}$. These three polynomials are not pairwise coprime among themselves, but each of them is relatively prime to all polynomials in $\mathcal {I}_2 \cup \{1,X^2\}$, and to exactly one polynomial in $\mathcal {I}_1^2$. Summarizing, for the $\mathcal{PS}\mathcal{}^-$ case, we can construct 273 functions with the following families of $t=8$ pairwise coprime polynomials:

• $\left( {\begin{array}{c}11\\ 8\end{array}}\right) = 165$ subsets of 8 elements in the union $\mathcal {I}_2 \cup \mathcal {I}_1^2 \cup \{1, X^2\}$.

• $\left( {\begin{array}{c}3\\ 1\end{array}}\right) \left( {\begin{array}{c}9\\ 7\end{array}}\right) = 108$ families obtained by choosing one element p from $\mathcal {I}_{1,1}$ and adjoining to it 7 polynomials from $\mathcal {I}_2 \cup \{1,X^2\} \cup \{p_1'\}$, where $p_1'$ is the one element in $\mathcal {I}_1^2$ which is coprime to p.

Similarly, we can obtain 82 $\mathcal{PS}\mathcal{}^+$ functions by the following families of $t=9$ pairwise coprime polynomials:

• $\left( {\begin{array}{c}11\\ 9\end{array}}\right) = 55$ subsets of 9 elements in the union $\mathcal {I}_2 \cup \mathcal {I}_1^2 \cup \{1, X^2\}$.

• $\left( {\begin{array}{c}3\\ 1\end{array}}\right) \left( {\begin{array}{c}9\\ 8\end{array}}\right) = 108$ families obtained by choosing one element p from $\mathcal {I}_{1,1}$ and adjoining to it 8 polynomials from $\mathcal {I}_2 \cup \{1,X^2\} \cup \{p_1'\}$, where $p_1'$ is again the one element in $\mathcal {I}_1^2$ that is coprime to p.

Table 2 reports the distribution of the ranks for the $\mathcal{PS}\mathcal{}^-$ and $\mathcal{PS}\mathcal{}^+$ functions obtained from the families of polynomials described above.

Table 2 Distribution of 2-ranks for $\mathcal{PS}\mathcal{}^-$ and $\mathcal{PS}\mathcal{}^-$ bent functions of $n=8$ variables obtained through the LRS construction with coprime polynomials of degree $d=2$ over $\mathbb {F}_{4}$

The first significant observation that can be drawn from the table is that none of these bent functions is equivalent to a Maiorana–McFarland function, since the smallest rank is 36. It is even more interesting to observe that many functions are inequivalent to the ones induced by the Desarguesian spread, namely those reaching a rank higher than 42. In particular, of the 355 $\mathcal{PS}\mathcal{}$ bent functions given by our construction, 238 have a rank greater than 42, so they are not equivalent to either Maiorana–McFarland or Desarguesian spread functions. While this is not sufficient to conclude that we found a class of previously unknown bent functions, we consider it the first step toward that goal. Hopefully, our results will motivate further research in this direction.

7 Conclusions and perspectives

This paper described a method to construct bent functions from linear recurring sequences. The construction leverages on the subspaces spanned by linear mappings defined by a family of LRS. In particular, we proved that if the polynomials defining the linear recurrence equations are pairwise coprime, the kernels of the corresponding linear mappings have a pairwise trivial intersection. This result depends on the observation that the superposition of two LRS mappings is the Sylvester matrix associated with their polynomials, which is invertible if and only if the polynomials are coprime. Consequently, the kernels induced by a family of LRS subspaces whose polynomials are pairwise coprime form a partial spread, and thus a bent function in the class $\mathcal{PS}\mathcal{}$.

The key question concerning our LRS construction is to determine when a large enough family of LRS kernels exists, depending on the number of variables of the function, the degree of the polynomials, and the extension field of their coefficients. Assuming that all polynomials have a nonzero constant term, we showed that such families exist if and only if the degree of the polynomials is either 1 or 2, and we derived the counting formulas for both cases. We then remarked that at least two other polynomials can always be added to these families, namely $X^d$ and 1. This allows one to obtain also $\mathcal{PS}\mathcal{}^+$ functions and, in certain situations, to employ families of polynomials with degrees larger than 2. We then proved that our LRS construction coincides with the Desarguesian partial spread when the degree of the involved polynomials is $d=1$, and thus the functions obtained in this case all belong to the class $\mathcal{PS}\mathcal{}_{ap}$. Therefore, candidates for potentially new bent functions generated by our construction should be sought with polynomials of degree $d=2$.

After remarking that the bent functions of $n=6,8$ variables given by our LRS construction always have maximal degree n/2 even for the $\mathcal{PS}\mathcal{}^+$ case (which is explained by the non-maximality of the related partial spreads), we performed a computational analysis of the 2-ranks of the functions for the $n=8$ case, to determine the rank distributions. In particular, for degree $d=1$, we verified and extended the rank distribution reported by Weng et al. [19] for bent functions in the Desarguesian spread, remarking that most of them are not EA-equivalent to any Maiorana–McFarland function. For degree $d=2$, we generated both $\mathcal{PS}\mathcal{}^-$ and $\mathcal{PS}\mathcal{}^+$ types of functions and remarked that many of them have a rank greater than 42, which means that they are not EA-equivalent to functions in the Desarguesian spread either. Hence, such bent functions are the most promising candidates to be potentially novel.

There are several open questions for future research on this LRS construction. The first interesting direction is to investigate more in detail the functions obtained by polynomials of degree $d=2$. Indeed, although we showed that many of them are inequivalent to both Maiorana–McFarland and Desarguesian spread functions, it could still be the case that they are EA-equivalent to some other known classes. To this end, it would be interesting to compare our functions to those generated by other partial spread-based constructions, a list of which can be found in [15]. Besides computing the 2-rank, employing more discriminating invariants would also be interesting. These include, for instance, the Smith normal form of the development of the graph $G_f$ of a Boolean function f, which is used by Polujan and Pott in [16] to classify homogeneous cubic bent functions. The goal here would be to find a complete invariant that allows one to give a complete classification of the equivalence classes arising from our construction of bent functions.

We conclude by discussing the connection of our LRS construction with the cellular automata (CA) approach that we adopted in [9]. Our initial idea was to start from a recent construction of Mutually Orthogonal Latin Squares (MOLS) based on linear CA that we set forth in [12]. A cellular automaton can be defined as a shift-invariant vectorial transformation, where the same local rule is applied at all sites (or cells) of the input array. If the local rule is linear, then the CA global function is defined by a transition matrix with the same form of the matrix in Eq. (14). In particular, the CA global function may be regarded as the linear map induced by an LRS kernel, with Eq. (13) representing the application of the local rule on the ith cell of the input.

In [12], we first showed that such a linear CA $F: \mathbb {F}_q^{2d} \rightarrow \mathbb {F}_q^{d}$ defines a Latin square of order $q^{d}$ if and only if the leftmost and rightmost coefficients $a_0,a_{d-1}$ of its local rule are not null. Further, they proved that the Latin squares generated by two such CA are orthogonal if and only if the polynomials associated with their local rules are relatively prime. Thus, determining the maximum size of a family of pairwise coprime polynomials of degree d and the nonzero constant term is equivalent to finding the size of the largest family of MOLS of order $q^{d}$ induced by linear CA.¹

The connection between MOLS generated by linear CA and bent functions traces back to a theorem proved by Bush [2], where he showed that a large enough orthogonal array (OA, which is equivalent to a set of MOLS) could be used to define a Hadamard matrix. It is well known that a Boolean function is bent if and only if the polar form of its translate design is a Hadamard matrix. What we proved in [9] is that the Hadamard matrix defined by the MOLS of a family of linear CA indeed has the translate design structure required for a bent function. This result is the “CA version” of Theorem 1 proved here.

The characterization through kernels of LRS is clearly a much more compact way to describe our construction than the CA approach, and it is also more general. Indeed, in this paper, we focused on the assumption that the feedback polynomials of the LRS have a nonzero constant term to leverage on the counting results proved in [12] for CA-based MOLS. However, Lemma 1 does not need this hypothesis to characterize LRS kernels with a trivial intersection, which is what matters in the end to construct a partial spread. In particular, one can use any family of pairwise coprime polynomials with degree d, regardless of their constant term. This is enough to guarantee that the associated Sylvester matrix is invertible. We implicitly dropped this assumption by augmenting our families with the polynomials $X^d$ and 1 since they are easily seen to be coprime with all other polynomials. However, besides those analyzed here, several other families of coprime polynomials can be considered. We plan to investigate this issue in future research, as we suspect that this would simplify the counting results reported in Sect. 4 by using the q-to-1 relationship between non-coprime and coprime pairs of polynomials over $\mathbb {F}_q$ proved in [1].