A new almost perfect nonlinear function which is not quadratic

Following an example in [11], we show how to change one coordinate function of an almost perfect nonlinear (APN) function in order to obtain new examples. It turns out that this is a very powerful method to construct new APN functions. In particular, we show that our approach can be used to construct a “non-quadratic” APN function. This new example is in remarkable contrast to all recently constructed functions which have all been quadratic. An equivalent function has been found independently by Brinkmann and Leander [7]. However, they claimed that their function is CCZ equivalent to a quadratic one. In this paper we give several reasons why this new function is not equivalent to a quadratic one


Preliminaries
We consider functions F : F n 2 → F n 2 with "good" differential and linear properties. Motivated by applications in cryptography, a lot of research has been done to construct functions which are "as nonlinear as possible". We discuss two possibilities to define nonlinearity: The first one uses differential properties, the second measures the "distance" to linear functions.
Since we are working in fields of characteristic 2, we may replace the "−" by "+" and write F (x + a) + F (x) instead of F (x + a) − F (x). We say that F is almost perfect nonlinear (APN) if ∆ F (a, b) ∈ {0, 2} for all a, b ∈ F n 2 , a = 0. Note that ∆ F (a, b) ∈ {0, 2 n } if F is linear, hence the condition ∆ F (a, b) ∈ {0, 2} identifies functions which are quite different from linear mappings. In characteristic 2, it is impossible that ∆ F (a, b) = 1: If x is a solution of F (x + a) − F (x) = b, then x + a is another solution, so that all values of ∆ F must be even. In the case of odd characteristic, functions F : F n q → F n q with ∆ F (a, b) = 1 for all a = 0 do exist; they are called perfect nonlinear or planar. In the last few years, many new APN functions have been constructed. The first example of a non-power mapping has been described in [27]. Infinite series are contained in [5,11,12,14,6,17]. Also some new planar functions have been found, see [16,23,37].
There may be a possibility for a unified treatment of (some of) these constructions in the even and odd characteristic case. In particular, we suggest to look more carefully at the underlying design of an APN function, similar to the designs corresponding to planar functions, which are projective planes, see [30].
In this paper, we consider APN functions only. In Section 2, we discuss the problem how to distinguish APN functions up to equivalence. We discuss the concept of affine, extended affine and CCZ equivalence. We also introduce a certain design associated with an APN function, which can be used to distinguish inequivalent functions. In Theorem 2, we obtain a necessary condition for an APN function to be crooked (see Definition 4).
In Section 3, we describe an idea due to Dillon for obtaining new APN functions from known ones by changing a component function. We apply this switching construction to the known examples of APN functions in small dimensions (n ≤ 9). The results are tabulated at the end of the paper. In particular, we construct a new non-quadratic APN function (Theorem 5). We compute several parameters (for instance automorphism groups) which are invariant under CCZ equivalence. Section 4 contains some comments and problems concerning these invariants.
Another approach to nonlinearity is to measure the distance between linear functions h : F n 2 → F 2 and the component functions F g : F n 2 → F 2 : Component functions are defined via F g (x) := g(F (x)) where g is a nonzero linear function F n 2 → F 2 . We denote the set of all linear functions f : F n 2 → F 2 by F n 2 . The Hamming distance d H (f, g) between two Boolean functions f, g : F n 2 → F 2 is simply the number of x such that f (x) = g(x). The Hamming weight w H (f ) of a Boolean function f is the number of x with f (x) = 1.
We say that a function F is highly nonlinear if is large, i.e. the component functions g • F = F g of F are as different as possible from all affine linear functions f and f + 1, where f ∈ F n 2 (here "•" denotes the composition of functions).
Instead of investigating d H (f, F g ) and d H (f +1, F g ), we may equivalently consider the Walsh coefficients W F (f, g) = x∈F n 2 (−1) (g•F )(x)+f (x) (sometimes we omit the subscript F ). We have 2 n − 2d H (f, F g ) = W F (f, g) and 2 n − 2d H (f + 1, F g ) = −W F (f, g). This shows that the distances come in pairs d 1 and d 2 with d 1 + d 2 = 2 n . Instead of maximizing the minimum of the d H (f, F g ), d H (f + 1, F g ) with g = 0, we may equivalently minimize the maximum of |W(f, g)|, g = 0.
The Walsh coefficients are basically the weights of the following code of length 2 n : Let F : F n 2 → F n 2 be any function. Define a matrix C F ∈ F (2n,2 n ) 2 as follows: The columns are the vectors Then the rows of the matrix x · · · · · · F (x) · · · x∈F n 2 generate a binary code C F whose codewords are the vectors v(f, g) = (f (x) + (g • F )(x)) x∈F n 2 , where f and g are linear functions F n 2 → F 2 . Note that the 2 n linear functions F n 2 → F 2 can be described by the inner products c, x , c ∈ F n 2 . Hence, the vectors v(f, g) are indeed all the linear combinations of the rows of C F .
It is easy to see that the Hamming weight w H (v(f, g)) of the codeword v(f, g) is related to the Walsh coefficient W(f, g) as follows: If the code C F does not contain the vector (1, . . . , 1), we may add this vector as a row to C F . The vector space generated by the rows of this extended matrix is called the extended code C ext F associated to the function F . This construction means that we add the vectors w := v(f + 1, g) to the code C F . If u := v(f, g), we have w H (u) + w H (w) = 2 n and therefore which gives rise to the Walsh coefficients ±W(f, g). We note that the vector (1, . . . 1) is not contained in C F if F is APN, see [9,19], for instance.
The multiset of values W F (f, g) for all linear functions f, g is called the Walsh spectrum of F .
The Walsh coefficients W F (f, 0) are Therefore, the Walsh coefficients W F (f, 0) do not depend on F . For this the reason, the Walsh coefficients with g = 0 are sometimes excluded from the Walsh spectrum. Usually, the Walsh spectrum is defined in terms of the trace function of a finite field. This "finite field definition" is completely equivalent to ours. We have used the vector space definition in order to emphasize that the Walsh spectrum (or the Walsh transformation) is just a property of the additive group of F n 2 . If we identify F n 2 with the additive group of the finite field F 2 n , then the linear mappings f : F n 2 → F 2 are just the mappings f α defined by x → tr(αx), where tr is the usual trace function

Exponents d Conditions Proven in
Gold functions 2 i + 1 gcd(i, n) = 1 [28,36] Kasami functions 2 2i − 2 i + 1 gcd(i, n) = 1 [31,32] Welch function 2 t + 3 n = 2t + 1 [25] Niho function 2 t + 2 t 2 − 1, t even n = 2t + 1 [24] 2 t + 2 Dobbertin function 2 4t + 2 3t + 2 2t + 2 t − 1 n = 5t [26] for all β = 0 are called almost bent (AB). Note that AB functions can exist only if n is odd. It is well known that any almost bent function is also APN (see [20]), but not vice versa, see the comments below. However, any quadratic APN function (see Definition 2) in F n 2 must be AB, see [19]. If a function F with F (0) = 0 is AB, its Walsh spectrum is completely known: (the values in brackets [ ] denote the multiplicities of the Walsh coefficients, and the notation { * * } indicates multisets). Similarly, the Walsh spectra of the Gold APN's (see Table 1) with n even are completely known, too, see [22], for instance: (2 n − 1)(2 n−1 ± 2 (n−2)/2 )] * }. We say that an APN function with F (0) = 0 and spectrum (2) (if n is odd) or (3) (if n is even) has the classical Walsh spectrum. We want to emphasize that the APN property alone does not determine the Walsh spectrum. APN functions may have quite different Walsh spectra. The reader can find the classical spectra in [22], for instance. If F (0) = 0, the distribution of the spectral values may be different, however the distribution of the absolute values does not change, see the comments following Proposition 1.
Throughout this paper, we always use the identification of the additive group of the vector space F n 2 with the additive group of the finite field F 2 n . Most APN and AB functions are defined as polynomial functions over F 2 n , hence the constructions use the multiplicative structure of F 2 n . However, the APN and AB property is just a property of the additive group of F 2 n .
In Table 1, we list all known power APN mappings on F 2 n which are known so far: The Welch and Niho functions are also AB, the Gold and Kasami functions are AB if n is odd. It is known that the inverse function and the Dobbertin function are not AB: The Walsh coefficients of the inverse function have been determined in [34], those of the Dobbertin function in [18], and these do not coincide with the values in (2) and (3). We note that the complete Walsh spectrum, i.e. the Walsh coefficients together with their multiplicities, are still not known for these two functions.
There are two questions which arise quite naturally: Problem. (1.) Is the list of APN power functions in Table 1 complete? (2.) Are all these examples "different"?
We will discuss these questions in the next section.

Equivalence of APN mappings
Let us begin with the second part of the problem above. In order to describe whether two functions F and H are equivalent, we introduce group ring notation. This notion is also quite useful to describe the technique of "switching" an APN function. This is a very powerful tool to construct new APN functions, as we will show in this paper.
Let F be an arbitrary field, and let (G, +) be an additively written abelian group (we are only interested in abelian groups, so we do not care about the general case). The group algebra F[G] consists of all "formal" sums g∈G a g g, a g ∈ F.
We define componentwise addition g∈G a g g + g∈G b g g := g∈G (a g + b g )g, and multiplication by Together with these two operations and the scalar multiplication λ g∈G a g g := g∈G (λa g )g, the set F[G] becomes an algebra, the so called group algebra. The dimension of this algebra as an F-vectorspace is |G|. Given a function F : F n 2 → F n 2 , we associate a group algebra element G F in F[F n 2 × F n 2 ] with it: The coefficients of the group elements in G F are just 0 or 1. More generally, any subset T of a group G can be identified with the element g∈T g, where the coefficients of all elements in T are 1, and the coefficients of elements not in T are 0. Hence, G F is the group algebra element corresponding to the "graph" of the function F , which consists of all pairs (v, F (v)), v ∈ F n 2 . We have the following Lemma: is the number of pairs (x, F (x)) and (y, F (y)) such that (x + y, F (x) + F (y)) = (u, v). This is the number of solutions F (x) + F (y) = v where x + y = u, hence it is the number of solutions of F (x) + F (x + u) = v. This integer is 2 n for (u, v) = (0, 0), otherwise it is 0 or 2 (since F is APN).
In (4), we may replace C by any field of characteristic = 2 if we add for some subset D F ∈ (F n 2 × F n 2 )\{(0, 0)} of size 2 n−1 · (2 n − 1). We emphasize that G is additively written, but this addition is quite different from the addition in the group algebra corresponds to the subset {a + g : a ∈ A}. We call A · g a translate of A. It looks a bit awkward that the product A · g is the set of sums a + g with a ∈ A.
The ideal generated by is called the ∆-rank of F . The Walsh transform of a function F is nothing else than the Discrete Fourier transform of G F , which we describe briefly: If G is a finite abelian group, then there are |G| different homomorphisms χ : G → C, and the set of these homomorphisms (called characters) form a group under multiplication χ 1 χ 2 (g) := χ 1 (g) · χ 2 (g). This group is isomorphic to G. Characters χ may be extended to homomorphisms Let χ be a character of G, and Ψ an automorphism of G. Then the mapping χ Ψ : G → C with χ Ψ (g) := χ(Ψ(g)) is again a character. Moreover, Ψ may be extended to a group algebra automorphism. This shows that the Walsh spectrum of an element D ∈ C[G] is invariant under the application of group automorphisms.
If G = F n 2 × F n 2 , the characters are the mappings χ α,β defined by χ α,β (u, v) := (−1) tr(αu+βv) , where we identify (as usual) the vector space F n 2 with the additive group of the finite field F 2 n . Therefore, the Walsh spectrum is just the multiset of character values of G F . Definition 1 (CCZ and EA equivalence, [15]). Two functions F, H : F n 2 → F n 2 are called CCZ equivalent if there is an automorphism Ψ of the group F n 2 × F n 2 (which is the additive group of the vector space F 2n 2 , hence Ψ is simply a bijective linear mapping on this vector space) and an element ( hence Ψ(G F ) is a translate of G H . If Ψ fixes the subgroup {(0, y) : y ∈ F n 2 } setwise, we say that the functions are EA equivalent (EA = extended affine). If, additionally, Ψ fixes the set {(x, 0) : x ∈ F n 2 }, then F and G are called affine equivalent.
This relation is called CCZ equivalent because it has been introduced (using different notation) by Carlet, Charpin and Zinoviev [19]. Proposition 1. If F is an APN (resp. AB) function, and if H is CCZ equivalent to F , then H is also an APN (resp. AB) function.
and therefore This proposition and its proof have some consequences: The Walsh spectrum is not invariant under CCZ equivalence: The Walsh coefficients χ(G F ) and χ(G F ) · χ(u, v) differ by the factor χ(u, v), hence by ±1. The problem arises from the addition of the element (u, v): The Walsh spectrum is invariant under affine equivalence, but not under EA or CCZ equivalence. The set containing the Walsh spectrum and its negative is called the extended Walsh spectrum, and this is invariant under CCZ equivalence. Sometimes we just speak about the Walsh spectrum, for instance when discussing the tables at the end of this paper. In these cases, we list just one of the two possible Walsh spectra.
There is one drawback in the concept of CCZ equivalence: If F is APN (or AB), the group algebra element Ψ(G F ) does not necessarily correspond to a function H, see [15], for instance.
The question about the inequivalence of the power APN functions in Table 1 has been discussed in [13].
It is obvious that the ∆-and Γ-ranks are invariant under CCZ equivalence. Now we discuss the first part of the problem at the end of Section 1: Is the list in Table 1 complete? This has been answered negatively in [27]. One of the examples in [27] has been generalized to an infinite family, and a lot more constructions have been found since. In particular, Dillon [21] presented a list of 12 examples in F 6 2 . This list appears in [10], together with many new examples in the cases F 7 2 and F 8 2 . However, all the new examples that have been constructed so far are "quadratic" in the sense that the derivatives F (x + a) − F (x) are affine mappings. Since the property of being "quadratic" is not invariant under CCZ equivalence (see [15]), we modify the definition as follows: is affine for all a ∈ F n 2 . How can we prove that a function is not CCZ quadratic? For this purpose, we look at the following design or incidence structure associated with an APN function. We refer the reader to the comprehensive book [2] for background from design theory and difference sets: The designs we are going to define here may be viewed as the designs developed from a certain type of difference set.

Definition 3 ([30]
). Let F : F n 2 → F n 2 be an APN function. Then we define two incidence structures (designs) on the point set F n 2 × F n 2 : The first design has blocks i.e. the translates of G F . We call this design the development of G F , denoted by dev(G F ). Similarly, the design whose blocks are the translates We call two designs isomorphic if there is a permutation π on the set of points such that blocks (which in this case are subsets B = {g 1 , . . .} of the point set) are mapped to blocks (i.e. π(B) = {π(g 1 ), . . .} is a block).
Any incidence structure gives rise to an incidence matrix: Rows and columns are indexed by the points and blocks, resp., and the (p, B)-entry is 1 if point p is incident with block B; all other entries are 0. The Γ-rank defined earlier is nothing else than the rank of the incidence matrix of dev(G F ), considered as a matrix with entries in F 2 ; similarly, the ∆-rank is the F 2 -rank of an incidence matrix of dev(D F ). Lemma 2. If F and H are CCZ equivalent APN functions, the designs dev(G F ) and dev(G H ) are isomorphic. Moreover, the designs dev(D F ) and dev(D H ) are isomorphic.
Proof. Straightforward, see also [30]: The group automorphism Ψ with Ψ(G F ) = G H · (u, v) is the permutation on the point set which maps blocks to blocks.
Using MAGMA [4] it is quite easy to determine the automorphism groups of these designs for small values of n. There is another group associated with the designs dev(G F ) (resp. dev(D F )): The sets G F (resp. D F ) are subsets of F 2n 2 . Then there may exist automorphisms ϕ of F 2n These automorphisms form a group contained in the automorphism group of the designs dev(G F ) (resp. dev(D F )). Using notation adopted from the theory of difference sets, we call the group of these automorphisms the multiplier group M(G F ) (resp. M(D F )) of dev(G F ) (resp. dev(D F )). It turns out that M(G F ) is much easier to compute with MAGMA than the full automorphism group of the design dev(G F ).
We denote the group of translations τ a,b : Since the multiplier group normalizes T , we have the following lemma: It is possible to show that M(G F ) is just the automorphism group of the extended code C ext F defined in the introduction, see [10]. In all cases known to us, the "full" automorphism group of the design dev(G F ) is just the multiplier group "times" the translations τ a,b .
We do not know whether this observation that holds for small values is true in general: Problem. Is it possible that the full automorphism group of dev(G F ) (resp. dev(D F )) is larger than |M(G F )| · 2 2n (resp. |M(D F )| · 2 2n )?
It seems that the automorphism group is a good invariant for CCZ equivalence, in particular to distinguish the quadratic from the non-quadratic case: is affine for all a ∈ F n 2 , then the multiplier group M(G F ) contains an elementary abelian group of order 2 n .
Proof. If F is quadratic, then we may assume (after replacing F by a CCZ equivalent function, if necessary) that the mappings L a (x) := F (x + a) + F (x) + F (a) + F (0) are linear. We compute Now we use and to obtain We get This shows that the mappings ψ a defined by ψ a (x, y) = (x, y + L a (x)) are linear, and is a translate of G F , hence the mappings ψ a are automorphisms of dev(G F ). Moreover, ψ a+b = ψ b • ψ a so that the ψ a 's form a group of order 2 n .
With Lemma 3, we get the following Corollary 1. Under the assumptions of Theorem 1, Aut(dev(G F )) and Aut(dev(D F )) both contain an elementary abelian group of order 2 3n . Corollary 2 (Göloglu, Pott [30]). The Kasami power functions x 13 and x 57 on F 2 7 are not CCZ quadratic, hence they are not CCZ equivalent to quadratic functions.
Most people conjecture that the examples in Table 1 are all CCZ inequivalent, except for small n where some of the cases coincide, but as far as we know there is no proof yet. It is known that the Gold power mappings are CCZ inequivalent to the Kasami power mappings, and different Gold exponents are CCZ inequivalent, see [13].
There is another concept related to quadratic APN functions: If F is quadratic, then F (x + a) − F (x) is affine and for some x ∈ F n 2 } is an affine subspace. If a = 0, this subspace has 2 n−1 elements (since F is APN), hence its is an (affine) hyperplane. We say that a function is crooked if the sets in (6) are (affine) hyperplanes for all a = 0. This concept is due to Bending and Fonder-Flaas [1]. "Crooked" is not invariant under CCZ equivalence, hence it would be better to say that a function F is crooked if it is CCZ equivalent to a function for which all the sets H a are hyperplanes: It is obvious that any (CCZ) quadratic function is (CCZ) crooked, and it is conjectured that the converse is also true, see [3,33] for partial results in this direction. However, as long as we do not know whether non-quadratic crooked functions exist, we need to find arguments that a function is not CCZ crooked. The following argument gives an interesting necessary condition for a function to be crooked: Theorem 2. Let F : F n 2 → F n 2 be an APN mapping. If F is CCZ crooked, then the dimension of the ideal generated by D F ∈ F 2 [F n 2 × F n 2 ] is at most 2 n+1 , hence the ∆-rank is at most 2 n+1 (see Lemma 1 for the definition of D F ).
Proof. If F is crooked, there are 2 n − 1 (affine) hyperplanes H a such that x ∈ H a } (replace F by a CCZ equivalent function if necessary). We define J a := {(a, x) : x ∈ F n 2 }. As explained above, these subsets may be also interpreted as elements in F 2 [F n 2 × F n 2 ]. We will show that the ideal generated by D F is contained in the subspace I generated (as a vector space) by the 2 n+1 elements Here we used the notation (x, T ) to denote the set of elements {(x, t) : t ∈ T }. Since H a is a hyperplane, we have H a + y = H a or H a + y is the complement of H a : In group algebra notation, this means for fixed a ∈ F n 2 \{0} (a + u, H a + v) = (a + u, H a ) or (a + u, H a + v) = (a + u, H a ) + J a+u in F 2 [F n 2 × F n 2 ]. In the equation above, we again identify subsets with the corresponding group algebra elements. Adding the element J a+u has the effect of complementing H a in (a + u, H a ). Proof. It is easy to compute the ∆-ranks of x 13 (resp. x 57 ) using MAGMA: The ranks are 338 (resp. 436), see Table 6.
It would be very interesting to determine the ∆-and Γ-ranks of APN functions theoretically.
In the next section (Theorem 5), we will construct a new APN function which, at first glance, seems to be non-quadratic. In order to prove that the function is indeed non-quadratic, we use Theorem 2 to show that the function cannot be CCZ equivalent to a crooked function, hence it cannot be quadratic. We could also use Theorem 1 to show that the function is non-quadratic, since the automorphism group of dev(G F ) is too small for the new function F . We have checked that our function is equivalent to the new example given in [8]. However, in that paper the authors erroneously claimed that their new function is CCZ equivalent to a quadratic one. Moreover, our function was found independently by the search in [8].

Dillon's switching construction
The following interesting construction of an APN function is contained in [12]: This is a special case of what we call "switching". For this purpose, we consider certain projection homomorphisms on the group algebra F[G]. Let U be a subgroup of G. Then the canonical homomorphism ϕ U : G → G/U defined by ϕ U (g) := g + U can be extended by linearity to a homomorphism ϕ U : is h∈g+U a h (this summation is in F). If D has only coefficients 0 and 1 (so that D corresponds to a set D ⊆ G) then the coefficient of g + U is |D ∩ (g + U )|. In particular, if each coset of U meets D in at most one element, then ϕ U (D) has also only coefficients 0 and 1. This is the case if U ≤ {0} × F n 2 (recall that "≤" denotes "being subgroup"). Definition 5 (switching neighbours). Let F, H : F n 2 → F n 2 be two functions, and let U ≤ F n 2 × F n 2 be a subgroup of F n 2 × F n 2 . We say that F and H switching neighbours with respect to U if ϕ U (G F ) = ϕ U (G H ). We call F and H switching neighbours in the narrow sense if U ≤ {0} × F n 2 and dim(U ) = 1. If F and H are switching neighbours with respect to U , we may obtain H from F by first projecting G F onto ϕ U (G F ), and then lifting this element to G H . We may also try to construct new switching neighbours H of F via such a project and lift procedure such that (hopefully) F and H are CCZ inequivalent. This is promising in particular if the dimension of U is small. The intuitive idea behind this approach is that ϕ U (G F ) is almost an APN function, and so it may be easy to turn this "almost" APN into an APN function.
We describe this approach (and applications) for the case F : F n 2 → F n 2 and U ≤ {0} × F n 2 . This has the advantage that the coefficients of ϕ U (G F ) are 0 and 1 only, since the cosets of {0} × F n 2 (and therefore also the cosets of U ) meet G F no more than once. In this case, ϕ U (G F ) corresponds to a mapping F U : F n (hence U ′ is basically the same as U ).
This shows the first part of the proposition.
The function f is defined via which concludes the proof.
The two functions F (x) = x 3 and H(x) = x 3 + tr(x 9 ) are switching neighbours in the narrow sense: Take the 1-dimensional subspace U generated by (0, 1) ∈ F n 2 ×F n 2 .
Proposition 3 shows that we may obtain all switching neighbours of F in the narrow sense (with respect to a one-dimensional subspace) by adding a Boolean function f times a vector u = 0. Let F be an APN function. The following Theorem gives a necessary and sufficient condition for f to produce another (not necessarily equivalent) APN function: Proof. Since F is APN, the equation Theorem 3 immediately suggests a strategy to find Boolean functions f such that F (v) + f (v)u is APN: Determine all 4-tuples x, y, x + y, y + a such that (8) holds. These 4-tuples give rise to constraints We may view f as a vector of length 2 n (coordinates are indexed by elements v in F n 2 , and the entries of the vector are f (v)). Thus the constraints are linear conditions, and we may find f 's by solving a system of linear equations.
Here is another interpretation: The function F is uniquely determined by its function values. Consider the ndimensional subspace W of F 2 n 2 spanned by the rows of (F (x) : x ∈ F n 2 ). Write F n 2 as a direct sum uF 2 ⊕ U . This "lifts" to a decomposition of W = V ⊕ V : We simply decompose every F (x) ∈ F n 2 according to a decomposition F n 2 = u ⊕ U , where U is any complement of u . Let x, y, x + a, y + a be a 4-tuple which satisfies the condition of Theorem 3. The corresponding indicator function (which is 1 for x, y, x + a, y + a and 0 otherwise) is a vector of weight 4 in V ⊥ . This function is not in W ⊥ since F is APN. LetṼ be the vector space generated by these vectors of weight 4. Note that F (x) + f (x) · u is APN if and only if f ∈Ṽ (Theorem 3). Let R be the vector space of dimension n+1 generated by the all-one-vector (1, . . . , 1) and the rows of (x : x ∈ F n 2 ). Then we have V ⊕R ⊆Ṽ ⊥ . If f, g ∈Ṽ ⊥ are in the same coset of V ⊕R, then F (x)+f (x)u and F (x)+g(x)u are EA equivalent: for some linear mappings A, B : F n 2 → F 2 . In particular: IfṼ ⊥ has dimension 2n, then there is no candidate for a "switching function" f (x)u. Definition 6. The finest equivalence relation on the set of APN functions such that all switching neighbours in the narrow sense and all EA-equivalent functions are equivalent, is called the EA switching equivalence relation. In the same way, we define CCZ switching equivalence.
This "switching idea" is closely related to a comment of John F. Dillon about the construction in [12]. Actually our proof of Theorem 3 is just a slight variation of Dillon's observation: Using the notation of Proposition 3, he considered the case u = 1. Therefore we decided to call this method Dillon's switching construction since he was the first who discussed it.
In the next section, we determine the CCZ switching equivalence classes of all known CCZ inequivalent APN functions on F n 2 , n ≤ 7, and all EA switching equivalence classes of all known CCZ inequivalent APN functions if n = 8 and n = 9. Several of the new constructions in the literature are switching equivalent. It seems that the switching idea is quite powerful to construct new APN functions, since many of the new APN functions listed by Dillon in [10] are within just one switching class. In the case n = 8, the EA switching class of the Gold function x 3 contains 17 CCZ inequivalent functions!

Computational results and open problems
There is, up to equivalence, just one APN mapping F n 2 → F n 2 for n ≤ 4, hence no interesting things happen in these cases. In the case n = 5, a complete classification of APN functions (up to CCZ equivalence) is contained in [7]. We summarize our computational results in the following tables. We also include some interesting CCZ invariants: • ∆-and Γ-Rank.
• Orders of automorphism groups of dev(D F ), dev(G F ) and M(G F ).
• Walsh spectrum (see the comments following Proposition 1 about the CCZ invariance of the Walsh spectrum). If all these invariants are the same, we use a direct test to check that the examples are CCZ inequivalent, hence the reader can be sure that all the examples in the following tables are CCZ inequivalent. However, we do not claim that our tables are complete in the sense that they contain all possible CCZ equivalence classes of APN functions with n = 6, 7, 8 and 9.
We list the Walsh spectrum only if it is different from the Walsh spectrum of x 3 . The Walsh spectrum of x 3 is called classical.
We number the examples as 1. 1, 1.2, ..., 2.1, 2.2, ... etc. The first number describes the EA (CCZ) switching class, and the second number the CCZ inequivalent examples within this class. Our search was complete in the sense that, starting from the known APN functions, we searched through the entire EA (CCZ) switching class. Hence any new APN function must be a member of a new switching class. We used the examples in [21] and [10] as the starting cases.
In the case n ≤ 7, we searched through the entire CCZ switching class, in the case n = 8, 9 through the EA switching class only.
Each switching class (no matter whether it is the EA switching or the CCZ switching class) may contain several CCZ inequivalent functions. In our tables, we list all CCZ inequivalent examples within one switching class.
Some comments about the sizes of the automorphism groups are in order: The automorphism groups contain the 2 2n translations τ a,b , see Theorem 1, therefore we divided the group sizes in our tables by 2 2n . We were not able to determine the sizes of these groups if n ≥ 8. However, it was possible to determine the multiplier group M(G F ) of dev(G F ): Using MAGMA, we determined the automorphism groups of the associated extended codes C ext F . In the cases n ≤ 7, the automorphism groups of dev(G F ) have been always the groups generated by the multipliers plus the translations; therefore, it may be possible that the group sizes in Table 10 describe actually the sizes of the full automorphism groups. We did not determine the multiplier groups M(D F ).
It is quite interesting to look at the automorphism groups of the designs dev(G F ) because they give some information about F : (1) If F (x) is CCZ quadratic, then 2 n divides v.
(2) If F is CCZ equivalent to a power mapping, then n · (2 n − 1) divides v.
(3) If F is CCZ equivalent to a polynomial in F 2 [x], then n divides v.
Proof. The first statement is simply Theorem 1. If F (x) ∈ F 2 [x], then the linear mapping F 2 n × F 2 n → F 2 n × F 2 n defined by (x, y) → (x 2 , y 2 ) has order n, and it fixes the set G F . This shows (3). If F (x) = γ · x d , then the 2 n − 1 mappings defined by (x, y) → (αx, α d · y), α ∈ F 2 n , fix the set G F . Moreover, we may assume that γ = 1, otherwise we replace F by the CCZ equivalent function 1 γ F , which shows (2).
We did mention already that quadratic functions are crooked. The following question is of interest: Problem. Are all crooked functions quadratic?
A function defined by i,j α i,j x 2 i +2 j is quadratic. Therefore, Theorems 4 and 2 show the following: Remark 2. The only non-quadratic functions in Tables 3, 5 and 7 are the function no. 2.1 in Table 3, the function no. 2.12 in Table 5, the functions no. 5.1, 6.1 and 7.1 in Table 7 and the functions no. 4.1, 5.1, 6.1 and 7.1 in Table 11. Moreover, none of these functions is crooked.
Our new function 14.3 in Table 7 is inequivalent to all polynomials with coefficients in F 2 (Theorem 4).
We note that Table 3 contains, up to CCZ-equivalence, all APN functions on F 5 2 . In Tables 5 and 7, we determined the CCZ switching classes, starting from the known CCZ inequivalent APN functions. In Tables 9 and 11, we did not apply the switching construction to all the members of the CCZ equivalence classes. In other words, we started with the functions listed in the tables below and determined the EA switching classes, not the CCZ switching classes.
In Table 5, the Example 2.12 is new (see Theorem 5), and in Table 7, the Example 14.3 is new.
In our opinion, the most interesting function is the following non-quadratic example, see also [8]: Theorem 5. Let F 2 6 be the finite field which is constructed as the splitting field of . Let u be a root of this polynomial in F 2 6 . Then the function F : (entry 2.11 in Table 5) is an APN function which is a switching neighbour of Function 2.4 in Table 5. Here tr 8/2 and tr 4/2 denote the relative trace F 8 → F 2 and F 4 → F 2 . The function cannot be CCZ equivalent to a crooked function. Moreover, it is CCZ inequivalent to a power mapping.
Proof. It is quite easy to check that the function is APN and that it is a switching neighbour of x 3 + u 17 (x 17 + x 18 + x 20 + x 24 ). Note that the ∆-rank 152 > 2 7 of this function is too big for a crooked function, see Theorem 2. Similarly, the function is inequivalent to a power mapping since the order of the multiplier group is not divisible by 2 6 − 1, see Theorem 4.
Two APN functions which are switching equivalent in the narrow sense are quite "similar", they are "almost" equal (see Proposition 3). Therefore, the following question seems natural: Problem. Is there a property which distinguishes switching equivalent functions from those which are not switching equivalent?
Our computational results are quite pessimistic regarding this question. It seems that there is no property of an APN function which is preserved under switching. Also the sizes of the equivalence classes seem to behave "strange": In the n = 8 case, there is one large switching class, but in the case n = 7 there are only small classes.
It seems that many inequivalent APN functions exist. So, in our opinion, the main question about APN functions is to determine at least a lower bound for the number of inequivalent ones. Let APN(n) denote the number of CCZ inequivalent APN functions F n 2 → F n 2 . We ask: Problem. Does the function APN(n) grow exponentially?
This paper contains a new non-quadratic APN function. We think that it is worth to search for more examples: Problem. Find more non-quadratic APN functions.
We described the switching construction in quite a general form, and then specialized to the case of 1-dimensional subspaces U ≤ {0} × F n 2 . In this case, it was (rather) easy to find switching neighbours. But of course it is also possible to use higher-dimensional subspaces, or even subspaces not contained in {0} × F n 2 . These cases are more difficult to handle, but we do not think it is impossible. If U becomes larger, the projections are further away from being APN, therefore the "lifting" will become more difficult. On the other hand, if we are using higher-dimensional subspaces U , we obtain more freedom for the lifting. But if U is too big, the approach will most likely become useless: If, in the extreme case, U = {0} × F n 2 , then all APN functions F project onto the same set ϕ U (G F ).
A generalization of the switching idea to functions between fields of odd characteristic is obvious. Therefore, this approach could also be applied to PN functions: Problem. Try to use the switching idea for other subspaces U or for PN functions.
Finally, we come back to the original motivation for studying APN functions: APN's are used in cryptography because they are highly nonlinear. Moreover, functions used in cryptography should quite often have large algebraic degree. Therefore, quadratic functions are usually "weak" regarding applications. But our paper shows that functions of large degree can be quite similar to quadratic (i.e. weak) functions via our projection idea. Therefore, it may be worth to see whether "switching" can be used for cryptanalysis.
In the following tables, it is important to know the primitive element that was used to construct the finite fields. In Table 2, we list these polynomials p(x). The primitive element u used later in the tables is a root of p(x) in F 2 [x]/(p(x)), see [35] for more information about finite field extensions. In the following tables, the notation (No x.y) + f (x) means that you take the function which is listed in No x.y and add f (x) to it. This notation has the advantage that you see immediately why the functions are switching equivalent. In some cases, we gave a second representative from the respective CCZ class (denoted by ∼), which is the representative from [10].   Table 4. Invariants of switching classes in Table 3 n = 6 No. No. in [10] F (x)    Table 11. Known switching classes of APN's in F 9 2 n = 9 No. Γ-rank ∆-rank |M(GF ))| Walsh spectrum