Gowers U2 Norm As a Measure of Nonlinearity for Boolean Functions and Their Generalizations

Manuscript submitted to doi:10.3934/amc.2019038 AIMS’ Journals Volume 13, Number 4, November 2019 pp. X–XX

GOWERS U2 NORM AS A MEASURE OF NONLINEARITY FOR BOOLEAN FUNCTIONS AND THEIR GENERALIZATIONS

Sugata Gangopadhyay Department of Computer Science and Engineering Indian Institute of Technology Roorkee Roorkee 247667, INDIA Constanza Riera Department of Computing, Mathematics, and Physics Western Norway University of Applied Sciences 5020 Bergen, Norway Pantelimon Stanic˘ a˘∗ Department of Applied Mathematics Naval Postgraduate School Monterey, CA 93943, USA

Abstract. In this paper, we investigate the Gowers U2 norm for generalized Boolean functions, and Z-bent functions. The Gowers U2 norm of a function is a measure of its resistance to affine approximation. Although nonlinearity serves the same purpose for the classical Boolean functions, it does not extend easily to generalized Boolean functions. We first provide a framework for employing the Gowers U2 norm in the context of generalized Boolean functions with cryptographic significance, in particular, we give a recurrence rule for the Gowers U2 norms, and an evaluation of the Gowers U2 norm of functions that are affine over spreads. We also give an introduction to Z-bent functions, as proposed by Dobbertin and Leander [8], to provide a recursive framework to study bent functions. In the second part of the paper, we concentrate on Z-bent functions and their U2 norms. As a consequence of one of our results, we give an alternate proof to a known theorem of Dobbertin and Leander, and also find necessary and sufficient conditions for a function obtained by gluing Z-bent functions to be bent, in terms of the Gowers U2 norms of its components.

1. Introduction. Boolean functions are functions mapping binary strings to 0 or 1. Over the years, several generalizations of Boolean functions have been proposed. In this paper, we consider such a generalization for which the domain set remains the same as for classical Boolean functions but the range is the set of integers modulo a positive integer q ≥ 2. These generalized Boolean functions have evolved to an active area of research [11, 12, 14, 16, 17, 18, 20, 23, 24, 25, 26, 27, 29] due to several possible applications in communications and cryptography. Boolean functions which are maximally resistant to affine approximation have special significance. The idea of nonlinearity is developed and extensively studied for classical Boolean functions. In the case of classical Boolean functions on an even number of variables, the functions with the highest possible nonlinearity are called bent functions [22] (see [3] and references therein, for more recent work on the subject). The concept of nonlinearity does not extend easily to the generalized setup. In the first part of the paper we investigate the Gowers U2

2010 Mathematics Subject Classiﬁcation. Primary: 94C10: Secondary: 06E30. Key words and phrases. Gowers norms; Boolean functions; generalized Boolean functions; bent functions; Z-bent functions. ∗ Corresponding author: Pantelimon St˘anic˘a.

1 2 SUGATA GANGOPADHYAY, CONSTANZA RIERA, PANTELIMON STANIC˘ A˘

norm as a possible alternative to nonlinearity for measuring the resistance to affine approximation. As examples, we provide the expressions of the Gowers U2 norms for the generalized bent functions, plateaued functions, functions that are affine over spreads, and a recurrence rule for the Gowers U2 norms. Characterization of bent Boolean functions is a longstanding open problem. One of the roadblocks faced by the researchers has been the absence of recurrence rules within the set of bent Boolean functions. Dobbertin and Leander [8] introduced the notion of Z-bent functions in order to put bent functions in a recursive framework at the cost of leaving the space of Boolean functions, and replacing it with the one of Z-bent functions of different levels. Here, we further obtain some recurrences of Gowers U2 norms of Z-bent functions, and a necessary and sufficient condition involving Gowers U2 norms of four Z-bent functions of level 1 so that bent functions are always obtained by the “gluing” process proposed by Dobbertin and Leander [8].

2. Preliminaries.

2.1. Generalized Boolean functions. Let F2 be the finite field containing two elements; C, R, Z be the fields of complex numbers, real numbers, and the ring of integers respectively. The n cardinality of a set S is denoted by #S. For any positive integer n, let F2 = {(x1, . . . , xn): xi ∈ F2, 1 ≤ i ≤ n} be a vector space over F2. Let Zq be the ring of integers modulo q, where q is a positive integer. By ‘+’ and ‘−’ we respectively denote addition and subtraction n n modulo q, whereas ‘⊕’ denotes the addition over F2 . Any function from F2 to F2, respectively, Zq, q > 2, is a Boolean, respectively, generalized Boolean function, in n variables, and the set q of all such functions is denoted by Bn, respectively, GBn. The character form of a generalized q n f(x) n Boolean function f ∈ GBn, χf : F2 → C, is defined by χf (x) = ζq , for all x ∈ F2 , where 2π i ζq = e q . The algebraic normal form (ANF) of f ∈ Bn is the polynomial representation M a1 an k f(x) = µax1 . . . xn , where x = (x1, . . . , xn), a = (a1, . . . , an), and µa ∈ F2. If q = 2 for n a∈F2 q some k ≥ 1 we can associate to any f ∈ GBn a unique sequence of Boolean functions ai ∈ Bn, 0 ≤ i < k, such that k−1 n f(x) = a0(x) + 2a1(x) + ··· + 2 ak−1(x), for all x ∈ F2 . n The (Hamming) weight of x ∈ F2 , denoted by wt(x), is the number of nonzero coordinates n in x, and the (Hamming) weight of a Boolean function f is wt(f) = #{x ∈ F2 : f(x) 6= 0}. The (Hamming) distance d(f, g) between two functions f, g is the weight of their sum. The n algebraic degree of f is deg(f) = max{wt(a): a ∈ F2 , µa 6= 0}. The Boolean functions having algebraic degree at most one are affine functions. n For a (generalized) Boolean function f : F2 → Zq we define the (generalized) Walsh- Hadamard transform to be the complex valued function (q) X f(x) u·x Hf (u) = ζq (−1) , n x∈F2 L where u·x = 1≤i≤n uixi For q = 2, we obtain the usual Walsh-Hadamard transform Wf (u) = X f(x) u·x q (q) X f(x)−f(x⊕u) (−1) (−1) . The autocorrelation of f ∈ GBn is defined by Cf (u) = ζq . n n x∈F2 x∈F2 We shall use the identity [26] (q) −n X (q) 2 u·x Cf (u) = 2 |Hf (x)| (−1) . (1) n x∈F2 n (q) n/2 n A function f : F2 → Zq is called generalized bent (gbent) if |Hf (u)| = 2 for all u ∈ F2 . q (q) (n+s)/2 n Further, we say that f ∈ GBn is called s-plateaued if |Hf (u)| ∈ {0, 2 } for all u ∈ F2 , for a fixed integer s depending on f. For simplicity of notation, when q is fixed, we sometimes use GOWERS U2 NORM FOR BOOLEAN FUNCTIONS AND THEIR GENERALIZATIONS 3

(q) (q) ζ, Hf , Cf instead of ζq, Hf , and Cf , respectively. We refer the reader to [11, 16, 15, 20] and references therein for more on generalized bent functions and their characterizations in terms of their components.

2.2. Gowers U2 norm. Let g : V → C be any function on a finite set V and B ⊆ V . Then 1 P Ex∈B[g(x)] := #B x∈B g(x) is the average of f over B. Let f : V → R be any function on 1 P a finite set V and B ⊆ V . Then Ex∈B[f(x)] := #B x∈B f(x) is the average of f over B. n + If f : F2 → R, as in [5, Definition 2.2.1], for every ` ∈ Z , we define the `th-order Gowers uniformity norm (the Gowers U` norm, or simply the U` norm) of f to be

1   ! 2` Y M kfk = n f x ⊕ h . (2) U` Ex,h1,...,h`∈F2  i  S⊆[`] i∈S n If f : F2 → C is a complex-valued function, we define the Gowers norm by 1   ! 2` Y #S M kfk = n C f x ⊕ h U` Ex,h1,h2,...,hm∈F2  i  S⊆[`] i∈S where C is the complex conjugation operator, and [`] = {1, . . . , `}. Since in this paper we shall n be using the Gowers U2 norm for f : F2 → C, we give it explicitly below: 1/4 kfk = n [f(x)f(x ⊕ h ) f(x ⊕ h )f(x ⊕ h ⊕ h )] U2 Ex,h1,h2∈F2 1 2 1 2 1/4 2 = n | n [f(x)f(x ⊕ h )]| . Eh1∈F2 Ex∈F2 1 We want to point out that the sum-of-squares indicator [30] is yet another measure of “nonlinearity” defined for Boolean functions. There is a large body of literature dedicated to this concept (and many others), and one can find such references in [1,2,6, 19]. We want to point out [4], where a nice asymptotic bound has been obtained for the sum-of-squares indicator. Surely, using the Cauchy inequality, one can find an upper bound of the Gowers U2 norm in terms of the sum-of-squares indicator, but it will not achieve the purpose of this paper. n n It is known (cf. [5, pp. 22–24]) that for f : F2 → R, if there is a polynomial P : F2 → {0, 1} P (x) of degree d such that | n f(x)(−1) | ≥ , then kfk ≥ , for any > 0. It is also Ex∈F2 Ud+1 P (x) known that for d = 1 having kfk ≥ implies | n f(x)(−1) | ≥ for some degree 1 Ud+1 Ex∈F2 Boolean polynomial. It is natural to investigate the Gowers U2 norm as a possible measure of “nonlinearity” for generalized Boolean functions as well as Z-bent functions. That is what we aim in this paper.

2.3. Gowers U2 norm for generalized Boolean functions and the Walsh–Hadamard coefficients. In the remaining part of this section, and the next section we assume q = 2k, for n some positive integer k. If f : F2 → Z2k is a generalized Boolean function, we define the Gowers f 2π i/2k norm of f to be the Gowers norm for the character form χf := ζ of f, where ζ = e is a complex root of 1. The first part of our next theorem shown for generalized Boolean functions can be (some- what) adapted from Chen [5, pp. 22–24], to which we refer for a detailed discussion (for the Boolean case).

n f 2π i/2k Theorem 2.1. If k ≥ 1 and f : F2 → Z2k , then (with χf = ζ , where ζ = e is a 2k-complex root of 1)

4 −4n X 4 −2n 2 kχf k = 2 |Hf (x)| ≤ 2 max |Hf (x)| . U2 x∈ n n F2 x∈F2 4 SUGATA GANGOPADHYAY, CONSTANZA RIERA, PANTELIMON STANIC˘ A˘

Moreover, the equality holds if and only if f is a bent (k = 1), respectively, gbent (k > 1) function, and, then, kχ k4 = 2−n. f U2

2k Proof. If f ∈ GBn , using equation (1), we can see that the Gowers U2 norm is 4 X X X X kχ k = 2−3n ζf(x)ζf(x⊕u) ζf(x⊕v)ζf(x⊕u⊕v) f U2 n n n n u∈F2 v∈F2 x∈F2 v∈F2     −3n X X f(x)−f(x⊕u) X −f(y)+f(y⊕u) = 2  ζ   ζ  n n n u∈F2 x∈F2 y∈F2     −5n X X 2 u·x X 2 u·y = 2  |Hf (x)| (−1)   |Hf (y)| (−1)  n n n u∈F2 x∈F2 y∈F2 −5n X X 2 2 X u·(x⊕y) −4n X 4 = 2 |Hf (x)| |Hf (y)| (−1) = 2 |Hf (x)| . (3) n n n n x∈F2 y∈F2 u∈F2 x∈F2 Then, using Parseval’s identity, we get that

4n 4 X 4 2 X 2 2n 2 2 kχf k = |Hf (x)| ≤ max |Hf (x)| |Hf (x)| = 2 max |Hf (x)| . U2 x∈ n x∈ n n F2 n F2 x∈F2 x∈F2 We will now show that the equality holds if and only if f is a bent function (k = 1), or a gbent 2 n n function (k > 1). If f is bent (gbent), then, |Hf (x)| = 2 , for all x ∈ F2 . Using (3), we infer 4 −4n X 4 −4n n 2n −n −2n 2 ||χf ||U = 2 |Hf (x)| = 2 · 2 · 2 = 2 = 2 max |Hf (x)| . 2 x∈ n n F2 x∈F2 Suppose now that the equality holds, but f is not gbent (bent). Then, there exists some 2 2 x such that |H (x )| < max n |H (x)| . Since the equality holds, from (3), we get that 0 f 0 x∈F2 f 4 −4n X 4 −2n 2 X 2 −2n 2 ||χf ||U = 2 |Hf (x)| = 2 max |Hf (x)| |Hf (x)| = 2 max |Hf (x)| . Thus, 2 x∈ n x∈ n n F2 n F2 x∈F2 x∈F2 2 X 2 2n 2 X 4 2n 2 max |Hf (x)| · |Hf (x)| = 2 max |Hf (x)| > |Hf (x)| = 2 max |Hf (x)| , x∈ n x∈ n x∈ n F2 n F2 n F2 x∈F2 x∈F2 yielding a contradiction. The reciprocal is immediate.

q n We say that f, g ∈ GBn are affine equivalent if g(x) = f(Ax ⊕ b), ∀x ∈ F2 , where A is an n n × n nonsingular matrix, and b ∈ F2 . Corollary 1. If f and g are affine equivalent, ||χ ||4 = ||χ ||4 . g U2 f U2 b·x −1 T Proof. If f and g are affine equivalent, Hg(x) = (−1) Hf x(A ) . Then, X X ||χ ||4 = 2−4n |H (x)|4 = 2−4n |H x(A−1)T |4 g U2 g f n n x∈F2 x∈F2 X = 2−4n |H (y)|4 = ||χ ||4 , f f U2 n y∈F2 and the corollary is shown.

n Corollary 2. If f : F2 → C is a complex valued function and the Fourier transform of f is −n/2 P u·x 4 −2n X 4 fb(u) = 2 n f(x)(−1) then we have kfk = 2 fb(x) . x∈F2 U2 n x∈F2

We can also obtain the Gowers U2 norm of any plateaued function: GOWERS U2 NORM FOR BOOLEAN FUNCTIONS AND THEIR GENERALIZATIONS 5

q k Proposition 1. If f is an s-plateaued generalized Boolean function in GBn, where q = 2 for some positive integer k, then its Gowers norm is kχ k = 2(−n+s)/4. In particular, the f U2 Gowers U norm of a semibent generalized Boolean function f is kχ k is 2(−n+2)/4 , if n 2 f U2 (−n+1)/4 q is even, and 2 , if n is odd. In general, if f ∈ GBn with |Hf (x)| ∈ {0, λ1, . . . , λt}, of respective multiplicities a, m , . . . , m , the Gowers U norm is kχ k4 = Pt m λ 2−4n. 1 t 2 f U2 j=1 j j

(n+s)/2 Proof. If f is an s-plateaued generalized Boolean function, then by deﬁnition |Hf (x)| ∈ {2 , 0}. P 2 2n n+s n+s By Parseval’s identity, n |Hf (x)| = 2 = a · 2 , where a is the multiplicity of 2 x∈F2 n−s 4 −4n P 4 in |Hf (x)|. Hence, a = 2 . Then, by equation (3), kχf k = 2 n |Hf (x)| = U2 x∈F2 2−4n · a · 22(n+s) = 2−n+s. Therefore, kχ k = 2(−n+s)/4. By similar arguments, we can prove f U2 the last claim. 1 It is well known that the nonlinearity of f ∈ B is nl(f) = 2n−1 − max|W (x)|, which n n f 2 x∈F2 means that if a function has high nonlinearity, then max|H (x)| is small, and therefore kχ k n f f U2 x∈F2 is upper bounded by a relatively small number. One can ask whether is it true that kχ k < kχ k , if f, g ∈ B with nl(f) < nl(g). f U2 g U2 n That is not necessarily true, and we provide an argument below. Let f be a quadratic Boolean function (so k = 1) of rank 2h [21] (under f(0) = 0), then, by Proposition1, kχ k = 2−2h. f U2 Thus, if f1, f2 are two quadratic Boolean functions of ranks 2h1 < 2h2, respectively, then

n−1 n−h1−1 n−1 n−h2−1 nl(f1) = 2 − 2 < 2 − 2 = nl(f2),

4 −2h1 −2h2 4 kχf1 k = 2 > 2 = kχf2 k . We can certainly ﬁnd an inﬁnite class of pairs of Boolean functions (f, g) such that nl(f) < nl(g) and kχ k > kχ k . For example, let n be even, g be any bent Boolean function, f U2 g U2 and so, by Theorem 2.1, nl(g) = 2n−1 − 2n/2−1, kχ k4 = 2−n. Let f now be any semibent g U2 Boolean function (with f(0) = 0) for n even, so, by Proposition1, kχ k = 2(−n+2)/4, which f U2 implies that nl(f) = 2n−1 − 2n/2, kχ k4 = 2−4n max W (x)4 = 2−4n22(n+2)2n−2 = 2−n+2. f U2 n f x∈F2 Thus, nl(f) < nl(g), and kχ k = 2−n/4 < kχ k = 2(−n+2)/4. g U2 f U2

2.4. Gowers U2 norm of functions that are affine over spreads. We found in Theorem 2.1 and Proposition1 the Gowers U2 norm of bent and, more generally, plateaued functions. It turns out we can precisely find the Gowers norm of a class of functions that extend in some direction the well-known class of partial spread bent functions, by allowing the function to be affine, not necessarily constant on the elements of a spread. k n m Let q = 2 . Let n = 2m, and let {E0,...,E2m } be a spread of 2 , that is, Ei’s, 0 ≤ i ≤ 2 , F m n S2 n are m-dimensional subspaces of F2 with trivial intersection. Note that i=0 Ei = F2 [7]. q Theorem 2.1. Let {E0,...,E2m } be a spread, and f ∈ GBn. Then: c , x ∈ E? (i) If f is defined by f(x) = i i with arbitrary c, c ∈ , 1 ≤ i ≤ m, then c, x = 0, i Zq

2m 4 4 4 X kχ k = 2−4n (2n − 1) |ζc − A| + |ζc + (2m − 1)A| , where A := ζci . f U2 i=0 q (ii) If f is deﬁned by f(x) = 2 ai ·x, x ∈ Ei, where {a0,..., a2m } are distinct arbitrary vectors n 4 −2n n in , then kχ k = 2 2 2 + 1 . F2 f U2 6 SUGATA GANGOPADHYAY, CONSTANZA RIERA, PANTELIMON STANIC˘ A˘

Proof. To show (i), we ﬁrst write

2m X f(x) u·x X X ci u·x c Hf (u) = ζ (−1) = ζ (−1) + ζ n ? x∈F2 i=0 x∈Ei 2m 2m X X X 2mA, u = 0 = ζci (−1)u·x + ζc − ζci = ζc − A + 0 , u 6= 0. i=0 x∈Ei i=0 Then 4 X 4 4 kχ k = 2−4n |H (x)|4 = 2−4n (2n − 1) |ζc − A| + |ζc + (2m − 1)A| , and the ﬁrst f U2 f n x∈F2 claim is shown. 2m 2m q X X ai·x u·x X X (ai+u)·x m To show (ii), we write Hf (u) = ζ 2 (−1) = (−1) = 2 , if there

i=0 x∈Ei i=0 x∈Ei 4 X exists i such that u = a , and 0 if u 6= a , ∀i. Therefore, we get kχ k = 2−4n |H (x)|4 = i i f U2 f n x∈F2 −4n 4m m −2n n 2 2 (2 + 1) = 2 2 2 + 1 , and the theorem is shown.

Note that, from the proof of (ii), it is easy to generalize this result to allow for repeated vectors. However, we do not state this result here, as it is notationally cumbersome.

3. Recurrences for Gowers U2 norms of generalized Boolean functions. We start this section with a lemma, which will be used to derive a formula for the Gowers U2 norms of concatenations of Boolean functions.

q k Lemma 3.1. Let f1, f2 ∈ GBn, q = 2 , be n-variables generalized Boolean functions and ζ a q-complex root of 1. Then

X 2 2 n X |Hf1 (x)| |Hf2 (x)| = 2 Cf1 (w)Cf2 (w). n n x∈F2 w∈F2 Proof. We compute, using [6, Lemma 2.9], 2 2

X 2 2 X X f1(u) u·x X f2(v) v·x |Hf1 (x)| |Hf2 (x)| = ζ (−1) ζ (−1) n n n n x∈F2 x∈F2 u∈F2 v∈F2 X X X = ζf1(u)−f1(t)(−1)(u⊕t)·x ζf2(v)−f2(s)(−1)(v⊕s)·x n n n x∈F2 u,t∈F2 v,s∈F2 X X = ζf1(u)−f1(t)+f2(v)−f2(s) (−1)x·(u⊕t⊕v⊕s) n n u,t,v,s∈F2 x∈F2 s:=u⊕t⊕v X = 2n ζf1(u)−f1(t)+f2(v)−f2(u⊕t⊕v) n u,t,v∈F2 X X = 2n ζf1(u)−f1(t) ζf2(v)−f2(u⊕t⊕v) n n u,t∈F2 v∈F2

n X f1(u)−f1(t) w:=u⊕t n X f1(u)−f1(u⊕w) = 2 ζ Cf2 (u ⊕ t) = 2 ζ Cf2 (w) n n u,t∈F2 u,w∈F2

n X X f1(u)−f1(u⊕w) n X = 2 Cf2 (w) ζ = 2 Cf1 (w)Cf2 (w), n n n w∈F2 u∈F2 w∈F2 and the lemma follows. GOWERS U2 NORM FOR BOOLEAN FUNCTIONS AND THEIR GENERALIZATIONS 7

We now derive a recurrence for Gowers U2 norms of concatenations of generalized Boolean functions. We use <(a + bi) = a for the real part of the complex argument.

n k Theorem 3.1. Let f : F2 × F2 → Zq, where q = 2 , be the concatenation f = [f1kf2] of two n-variables generalized Boolean functions, f1, f2, that is, f(x1, x) = (1 − x1)f1(x) + x1f2(x). The Gowers U2 norm of f is given recursively by 4 4 4 X 23 kχ k = kχ k + kχ k + 2−4n+1 |H (u)|2|H (u)|2 f U2 f1 U2 f2 U2 f1 f2 n u∈F2 −4n+2 X 2 + 2 < Hf1 (u)Hf2 (u) n u∈F2 4 4 X = kχ k + kχ k + 2−3n+1 C (u)C (u) f1 U2 f2 U2 f1 f2 n u∈F2 −4n+2 X 2 + 2 < Hf1 (u)Hf2 (u) . n u∈F2 2 ¯ 1 + < (ζ) If f2 = f1, then kχf k = kχf k . If f2 = f1, then kχf k = kχf k . U2 1 U2 U2 2 1 U2 n Proof. If f : F2 × F2 → Zq is given by f(x1, x) = (1 − x1)f1(x) + x1f2(x), then, it is known u1 (and easy to show) that Hf (u1, u) = Hf1 (u) + (−1) Hf2 (u). The Gowers norm of f is then (below, we split the sums into u1 = 0, u1 = 1.) 4 X X 4 24(n+1) kχ k = |H (u , u)|4 = |H (u) + (−1)u1 H (u)| f U2 f 1 f1 f2 n n (u1,u)∈F2×F2 (u1,u)∈F2×F2 2 X 2 u1 2 = |Hf1 (u)| + (−1) Hf1 (u)Hf2 (u) + Hf2 (u)Hf1 (u) + |Hf1 (u)| n (u1,u)∈F2×F2 2 X 4 4 = |Hf1 (u)| + Hf1 (u)Hf2 (u) + Hf2 (u)Hf1 (u) + |Hf2 (u)| n (u1,u)∈F2×F2 2 2 u1 2 +2|Hf1 (u)| |Hf2 (u)| + 2(−1) |Hf1 (u)| Hf1 (u)Hf2 (u) + Hf2 (u)Hf1 (u) u1 2 +2(−1) |Hf2 (u)| Hf1 (u)Hf2 (u) + Hf2 (u)Hf1 (u) X = |H (u)|4 + 4(−1)u1 H3 (u)H (u) f1 f1 f2 n (u1,u)∈F2×F2 +6H2 (u)H2 (u) + 4(−1)u1 H (u)H3 (u) + |H (u)|4 f1 f2 f1 f2 f2 X 4 4 2 2 2 = 2 |Hf1 (u)| + |Hf2 (u)| + 2|Hf1 (u)| |Hf2 (u)| + 4< Hf1 (u)Hf2 (u) n u∈F2 = 24n+1 kχ k4 + 24n+1 kχ k4 f1 U2 f2 U2 X 2 2 2 + 4 |Hf1 (u)| |Hf2 (u)| + 2< Hf1 (u)Hf2 (u) , n u∈F2

and by using Lemma 3.1, we infer the ﬁrst claim. The second claim for f2 = f1 is eas- 2 2 2 4 ily obtained, since then |Hf2 (u)| = |Hf1 (u)| , < Hf1 (u)Hf2 (u) = |Hf1 (u)| and, so, X X |H (u)|2|H (u)|2 = <2 H (u)H (u) = 24n kχ k . If f = f¯ , then H = f1 f2 f1 f2 f1 U2 2 1 f2 n n u∈F2 u∈F2 2 4 2 ζHf1 and so, < Hf1 (u)Hf2 (u) = |Hf1 (u)| < (ζ), which, when used above renders the last claim. 8 SUGATA GANGOPADHYAY, CONSTANZA RIERA, PANTELIMON STANIC˘ A˘

n We now look at functions f : F2 → Z4, where f = a0 + 2a1, with a0, a1 ∈ Bn and ﬁnd the Gowers U2 norm of f in terms of those of the components a0, a0 ⊕ a1. Using a decomposition result of [24] we can show the next theorem. 4 Theorem 3.2. Let f ∈ GBn, f = a0 + 2a1, a0, a1 ∈ Bn. Then 4 4 4 X 24 kχ k = kχ k + kχ k + 2−4n+1 W2 (x)W2 (x) f U2 a1 U2 a0⊕a1 U2 a1 a0⊕a1 n x∈F2 4 4 X = kχ k + kχ k + 2−3n+1 C (w)C (w). a1 U2 a0⊕a1 U2 a1 a0⊕a1 n w∈F2

2 1 2 2 4 Proof. We know [24] that in the quartic case |Hf (x)| = W (x) + W (x) , so |Hf (x)| = 2 a1 a0+a1 1 W4 (x) + W4 (x) + 2W2 (x) W2 (x) , which by summation renders 4 a1 a0+a1 a1 a0⊕a1 4 4 4 X 24(n+1) kχ k = 24n kχ k + 24n kχ k + 2 W2 (x)W2 (x). f U2 a1 U2 a0⊕a1 U2 a1 a0⊕a1 n x∈F2 X X Further, by Lemma 3.1, we get W2 (x)W2 (x) = 2n C (w)C (w), and the a1 a0⊕a1 a1 a0⊕a1 n n x∈F2 w∈F2 theorem follows. 2k We can certainly derive an expression for the Gowers U2 norm for a generalized f ∈ GBn . but the result is rather quite complicated, unfortunately. The proof is rather similar to the previous one.

k−1 n X i Theorem 3.3. Let f : F2 → Z2k given by f = ai2 , ai ∈ Bn. Then, i=0 4(n+k−1) 4 4n X 4 4 2 kχf k = 2 χa ⊕c·a |γc| U2 k−1 U2 k−1 c∈F2 X + W2 (u)W2 (u)γ2γ 2 ak−1⊕c·a ak−1⊕d·a c d k−1 c6=d∈F2 X + Wak−1⊕c·a(u) ·Wak−1⊕d·a(u)Wak−1⊕x·a(u)Wak−1⊕y·a(u)γcγdγxγy, k−1 k−1 (c,d)6=(x,y)∈F2 ×F2 Pk−2 j k−1 X z·v j=0 vj 2 where c = (c0, . . . , ck−2) ∈ F2 , a = (a0, . . . , ak−2), γz = (−1) ζ . k−1 v∈F2

4. Gowers U2 norm and Z-bent functions. 4.1. Z-bent functions. Dobbertin and Leander [8] introduced Z-bent functions to describe bent functions within a recursive framework. They used the normalized Fourier transform to deﬁne these functions. Since in this section we need to refer to many of their results, we choose to use the same convention, and work with the Fourier transform deﬁned as 1 X fb(u) = 2−n/2 f(x)(−1)u·x. The Gowers norm of f given by n x∈F2 4 kfk = n [f(x)f(x ⊕ h )f(x ⊕ h )f(x ⊕ h ⊕ h )] U2 Ex,h1,h2∈F2 1 2 1 2 4 4 −2n P will render kfk = 2 n fb(x) . U2 x∈F2

1We use the normalized Fourier transform here to agree with the notation in [8]. GOWERS U2 NORM FOR BOOLEAN FUNCTIONS AND THEIR GENERALIZATIONS 9

Prompted by the observation that given two bent functions g, h in n = 2k variables, k > 1, the function χ (x) + χ (x) f(x) = g h ∈ {−1, 0, 1}, (4) 2 χg(u) + χh(u) for all x ∈ n will also have its Fourier transform given by fb(u) = b b ∈ {−1, 0, 1}, F2 2 n for all u ∈ F2 , Dobbertin and Leander [8] deﬁned the notion of Z-bent function in the following r−1 r−1 n way. Let W0 = {−1, 1}, Wr = {` ∈ Z : −2 ≤ ` ≤ 2 }, for r ≥ 1. A function f : F2 → n Wr ⊆ Z is a Z-bent function of size k level r if fb(x) ∈ Wr, for all x ∈ F2 . The set of all Z-bent k S k functions of size k level r is denoted by BFr . Any function belonging to r≥0 BFr is said to be a Z-bent function of size k. If a Z-bent function of level 1 can be written as in (4) then it is said to be splitting, otherwise it is said to be non-splitting. As Dobbertin and Leander did in [8], we refer to a ±1 function as bent (when we want to point that out we call it ±1-bent) even though it is the signature of a classical bent Boolean function. k Now, suppose that h ∈ BFr is the concatenation h = [h00kh01kh10kh11], where h12 (x) = n−2 h(1, 2, x), for all (1, 2, x) ∈ F2 × F2 × F2 , that is, h(y, z, x) = (y ⊕ 1)(z ⊕ 1)h00(x) + (y ⊕

1)zh01(x) + y(z ⊕ 1)h10(x) + yzh11(x). We deﬁne the functions f12 by using the following equations: f f 1 1 h h Case 1. For r ≥ 1: 00 10 = 00 10 (5) f01 f11 1 −1 h01 h11 f f 1 1 1 h h Case 2. For r = 0: 00 10 = 00 10 (6) f01 f11 2 1 −1 h01 h11 Dobbertin and Leander [8, Proposition 2] showed that if h is a Z-bent function of size k and level r, then the functions f12 are Z-bent functions of size k − 1 and level r + 1, for all k k−1 1, 2 ∈ F2. In other words, if h ∈ BFr , then f12 ∈ BFr+1 , for all 1, 2 ∈ F2. Conversely, k−1 suppose we have f12 ∈ BFr+1 , for all 1, 2 ∈ F2. If h = [h00kh01kh10kh11], then we say that h is obtained by gluing f12 , where 1, 2 ∈ F2. Although the gluing process in general may not k yield a Boolean function, it is known [8, Proposition 2] that all functions in BFr are obtained by k−1 gluing functions in BFr+1 . We derive the following condition connecting the Z-bent functions of level 1 to (classical) bent functions as a special case of [8, Theorem 3].

Theorem 4.1. Let four Z-bent functions f00, f01, f10 and f11 of level 1 and size k be given such that

f00(x) ≡ f01(x) + 1 (mod 2); f10(x) ≡ f11(x) + 1 (mod 2); (7) fb00(x) ≡ fb10(x) + 1 (mod 2); fb01(x) ≡ fb11(x) + 1 (mod 2). n n Then the function h : F2 × F2 × F2 → {−1, 1} deﬁned by h(y, z, x) = hyz(x) for all x ∈ F2 , where hij, fij, 0 ≤ i, j ≤ 1 satisfy (6), is a ±1-bent function (of level 0). n Due to normalization of the Walsh–Hadamard (Fourier) coeﬃcients of f : F2 → R, Parseval’s P 2 P 2 identity takes the form n fb(x) = n f(x) . x∈F2 x∈F2

4.2. Recurrences for Gowers U2 norms of Z-bent functions. Here, we will obtain some k recurrences for the Gowers U2 norms of Z-bent functions h ∈ BFr in terms of the U2 Gowers k−1 norms of fij ∈ BFr+1 , where h is obtained by gluing fij, 0 ≤ i, j ≤ 1. n Theorem 4.2. Let h : F2 × F2 × F2 → Z be the concatenation h = [h00kh01kh10kh11] of four n-variables integer-valued functions hij (0 ≤ i, j ≤ 1), satisfying equations (5)–(6), for some 1 integer-valued functions fij. Then, with γ = 2 , 1, if r ≥ 1, respectively, r = 0, we have γ−4 khk4 = 2−3 kf k4 + kf k4 + kf k4 + kf k4 U2 00 U2 01 U2 10 U2 11 U2 10 SUGATA GANGOPADHYAY, CONSTANZA RIERA, PANTELIMON STANIC˘ A˘

2 2 2 2 −2(n+1) X + 3 · 2 fc00 (u)fc10 (u) + fc01 (u)fc11 (u) . n u∈F2 Proof. First, observe that, similarly as in Theorem 3.1, the Fourier transform

u2 u1 u1+u2 2 bh(u1, u2, u) = hc00(u) + (−1) hc01(u) + (−1) hc10(u) + (−1) hc11(u).

Using the above identity, the U2 Gowers norm of h is then 4 X 22(n+2) khk = h4(u , u , u) U2 b 1 2 2 n (u1,u2,u)∈F2×F2 4 4 4 4 −2 X = 2 hc00 (u) + hc01 (u) + hc10 (u) + hc11 (u) n u∈F2 2 2 2 2 2 2 −1 X + 3 · 2 hc00 (u)hc01 (u) + hc00 (u)hc10 (u) + hc00 (u)hc11 (u) n u∈F2 2 2 2 2 2 2 +hc01 (u)hc10 (u) + hc01 (u)hc11 (u) + hc10 (u)hc11 (u) X + 6 hc00(u)hc01(u)hc10(u)hc11(u) n u∈F2 = 22n−2 kh k4 + kh k4 + kh k4 + kh k4 + 3 · 2−1 A + 6 B, (8) 00 U2 01 U2 10 U2 11 U2 where A and B denote the last two sums in the previous equation. We will go further, and we shall replace these expressions in terms of the U2 Gowers norms of fij and the Fourier coeﬃcients of the fij, 0 ≤ i, j ≤ 1. 1 We treat concurrently equations (5) and (6) by denoting γ = 2 , 1, if r ≥ 1, respectively, r = 0. Thus, h00 = γ(f00 + f01), h10 = γ(f10 + f11), h01 = γ(f00 − f01), h11 = γ(f10 − f11), and so, h00 = γ(fb00 + fb01), bh10 = γ(fb10 + fb11), h01 = γ(fb00 − fb01), bh11 = γ(fb10 − fb11). Using the last equation of (8), expanding and canceling terms (this is a straightforward, albeit cumbersome computation), we obtain

4 X 4 4 4 4 22(n+2) khk = 2γ4 f (u) + f (u) + f (u) + f (u) U2 c00 c01 c10 c11 n u∈F2 2 2 2 2 2 4 X + 3 · 2 γ fc00 (u)fc10 (u) + fc01 (u)fc11 (u) n u∈F2 = 22n+1γ4 kf k4 + kf k4 + kf k4 + kf k4 00 U2 01 U2 10 U2 11 U2 2 2 2 2 2 4 X + 3 · 2 γ fc00 (u)fc10 (u) + fc01 (u)fc11 (u) , n u∈F2 k which gives, in particular, a recurrence between the U2 Gowers norm of h ∈ BFr and the U2 k−1 Gowers norms of fij ∈ BFr+1 . We can easily get a proof for Theorem 4.1 of Dobbertin-Leander [8].

Corollary 3. If fij in the theorem above are Z-bent functions and satisfy also equation (7), then the function h obtained from gluing fij is bent.

Proof. If fij in the theorem above satisfy equation (7) and have level 1 (that is, r = 0), then fij, fcij ∈ {0, ±1}, and, since f00(x) ≡ f01(x) + 1 (mod 2), f10(x) ≡ f11(x) + 1 (mod 2) the function h has values ±1, and is then the signature of a Boolean function. Moreover, since

fc00(u) ≡ fc10(u) + 1 (mod 2), fc01(u) ≡ fc11(u) + 1 (mod 2), GOWERS U2 NORM FOR BOOLEAN FUNCTIONS AND THEIR GENERALIZATIONS 11

and fij, fcij ∈ {0, ±1}, then the second powers also satisfy the same relations and further, 2 2 2 2 fc00 (u) + fc10 (u) = 1, fc01 (u) + fc11 (u) = 1, 4 4 4 4 fc00 (u) + fc10 (u) = 1, fc01 (u) + fc11 (u) = 1. 2 2 2 2 Thus, fc00 (u)fc10 (u) = 0, fc01 (u)fc11 (u) = 0. Using these equations in the first displayed identity of Theorem 4.2 renders (with γ = 1), 22(n+2) khk4 = 2 · 2n+1 + 0 = 2n+2, yielding U2 khk4 = 2−n−2, which implies that h is bent. U2 4.3. An alternative proof and an extension of a theorem by Dobbertin and Leander. In this section, we first give an extension of a result of Dobbertin and Leander [8]. We next give an upper bound for the U2 norm of a Z-bent function of level 1 and under some technical condition of a Z-bent of any level. In Theorem 4.1 of Dobbertin and Leander, sufficient conditions on fij for the bentness of h are proposed. Using the above recurrence we can now easily get necessary and sufficient conditions for the bentness of h. Although, the next result is shown using Theorem 4.2, we shall call it a theorem, due to its importance.

Theorem 4.3. Let hij, fij, 0 ≤ i, j ≤ 1, be as in the theorem above and h obtained from gluing the Z-bent functions fij of level 1. Then h is bent if and only if 2−n+1 = kf k4 + kf k4 + kf k4 + kf k4 00 U2 01 U2 10 U2 11 U2 2 2 2 2 −2n+1 X + 3 · 2 (fc00 (u)fc10 (u) + fc01 (u)fc11 (u)). n u∈F2 Proof. We need to prove that a function f on n variables is ±1-bent if and only if kfk4 = 2−n. U2 4 −2n P 4 −2n n −n If f is ±-bent, then kfk = 2 n fb (x) = 2 · 2 = 2 . Suppose f is not ±1-bent, U2 x∈F2 4 4 X X but kfk = 2−n. Then, kfk = 2−2n f 4(x) = 2−n, and f 4(u) = 2n = f 2(x). Thus, U2 U2 b b b n n x∈F2 x∈F2 4 X X kfk = 2−2n fb4(x) ≤ 2−2n max fb2(x) fb2(x) = 2−n max fb2(x), U2 x∈ n x∈ n n F2 n F2 x∈F2 x∈F2 and the result is shown.

n The next theorem uses a result of Kolomeec and Pavlov [13] who showed that d(g, h) ≥ 2 2 , for any two bent functions in n variables. χ (x) + χ (x) Theorem 4.4. If f is a splitting -bent function of level 1 such that f(x) = g h Z 2 n 2 − d g, h n 4 b b 2 − d(g, h) where g, h are bent functions, the U2 Gowers norm is kfk = = . If U2 22n 22n f is a splitting -bent function of level 1 in n variables and not a bent function then kfk4 ≤ Z U2 n n 2 − 2 2 . 22n χ (x) + χ (x) Proof. Since f(x) = g h ∈ {−1, 0, 1}, for all x ∈ n, we infer that the Fourier 2 F2 χg(u) + χh(u) transform of f is given by fb(u) = b b ∈ {−1, 0, 1}, for all u ∈ n. By Parseval’s 2 F2 X 2 X 2 n n identity we have fb (x) = f (x). Therefore, #{x ∈ F2 : gb(x) = bh(x)} = #{x ∈ F2 : n n x∈F2 x∈F2 g(x) = h(x)}, in other words, d(g,b bh) = d(g, h). 12 SUGATA GANGOPADHYAY, CONSTANZA RIERA, PANTELIMON STANIC˘ A˘

The Gowers U2 norm of f is then 4 X kfk = 2−2n f 4(x) = 2−2n#{x ∈ n : g(x) = h(x)} U2 b F2 b b n x∈F2 2n − d(g, bh) 2n − d(g, h) = 2−2n 2n − #{x ∈ n : g(x) 6= bh(x)} = b = . F2 b 22n 22n n Kolomeec and Pavlov [13] have proved that d(g, h) ≥ 2 2 for any two bent functions in n variables. Therefore, if f is a splitting Z-bent function of level 1 and not a bent function then n n 2 − 2 2 kfk4 ≤ , and the theorem is shown. U2 22n

While we were able to compute the U2 Gowers norm of any bent function in Theorem 2.1 and give some necessary conditions for splitting Z-bents in Theorem 4.4, it is a natural question about the norm of a Z-bent of any level. In our next result, we are able to compute the Gowers norms of Z-bent functions of any level, under some technical conditions. In particular, we note that the next theorem implies that the norm of two types of Z-bent functions of level 1 is not a function of n only, as it was the case for level 0. Two Boolean functions g, h ∈ Bn are called disjoint spectra functions if χcg(u) · χch(u) = 0, n for any u ∈ F2 . Equivalently, χbg(u) = 0 if and only if χbh(u) 6= 0, since if n is odd then for any semibent, its Fourier spectrum has 2n−1 nonzero coeﬃcients. In Theorem 3.2 of [10], it is claimed that a Z-bent function of level 1 constructed by using two disjoint spectra semibent functions in n variables, where n is even, is non-splitting. The proof of this theorem contains a serious ﬂaw, and therefore proving the existence of non-splitting Z-bent functions of level 1 is still an open problem. We shall be using Theorem 3.5 of [10], which states: Let n be even, and f1, f2 ∈ Bn be s1-, respectively, s2-plateaued functions that are neither bent nor both 1+ri si semibent, and so, Spec(χfi ) = {0, ±2 }, ri := 2 − 1 ≥ 0 (i = 1, 2). Let α, β be arbitrary nonzero integers with α ≡ β (mod 2). If r1 = 0, r2 = 1, α = ±1 (or r2 = 0, r1 = 1, β = ±1), we assume 2β2 + α1 ∈/ {−1, 1} (respectively, 2α1 + β2 ∈/ {−1, 1}), where i ∈ {0, ±1}, for at least one value of x ∈ n (recall that χ (x) = 2si/2); if r > 0, r > 0, we assume that F2 cfi i 1 2 αχ (x)+βχ (x) αχ (x) + βχ (x) ∈/ {0, ±2}, for at least one value x ∈ n. Then, f(x) = f1 f2 is df1 df2 F2 2 a -bent function of level l := dlog Me, where M = max n {|αχ (u) + βχ (u)|}, which Z 2 u∈F2 df1 df2 cannot be split into two bent functions.

αχg (x)+βχh(x) Theorem 4.5. Let f be a Z-bent function of level r, and write f(x) = 2 . (i) If g, h are disjoint spectra functions that fulﬁll the conditions of [10, Theorem 3.5], then 4 kfk = 2−n−4(α42s1 + β42s2 ). U2 (ii) In general, if g, h are not necessarily disjoint spectra functions, then 4 kfk = 2−n−4(α42s1 + β42s2 ) + 2−2n−2αβ(α22s1 + β22s2 )(2n − 2d(g, h)) U2 −2n−3 2 2 s1+s2 + 2 α β 2 |{x : χbg(x) · χbh(x) 6= 0}|. Proof. If g, h are not necessarily disjoint spectra functions, we obtain 4 4 X X αχg(u) + βχh(u) X kfk = 2−2n f 4(x) = 2−2n b b = 2−2n−4 (α4χ4(x) U2 b bg n n 2 n x∈F2 x∈F2 x∈F2 3 3 2 2 2 2 3 3 4 4 + 4α βχbg(x)χbh(x) + 6α β χbg(x)χbh(x) + 4αβ χbg(x)χbh(x) + βb χbh(x)). Let

s1 s2 s1 s2 n 2 2 n 2 2 A = #({u ∈ F2 : χbg(u) = 2 , χbh(u) = 2 } ∪ {u ∈ F2 : χbg(u) = −2 , χbh(u) = −2 }), s1 s2 s1 s2 n 2 2 n 2 2 B = #({u ∈ F2 : χbg(u) = 2 , χbh(u) = −2 } ∪ {u ∈ F2 : χbg(u) = −2 , χbh(u) = 2 }). GOWERS U2 NORM FOR BOOLEAN FUNCTIONS AND THEIR GENERALIZATIONS 13

By Parseval’s identity, X 2 −2 X 2 2 fb (x) = 2 (χbg(x) + 2χbg(x)χbh(x) + χbh(x)) n n x∈F2 x∈F2 X 2 −2 X 2 2 = f (x) = 2 (χg(x) + 2χg(x)χh(x) + χh(x)). n n x∈F2 x∈F2 P 2 P 2 P 2 P 2 Further, n χg(x) = n χg(x), and n χ (x) = n χ (x), which implies that x∈F2 b x∈F2 x∈F2 bh x∈F2 h X s1+s2 X n χbg(x)χbh(x) = 2 2 (A − B) = χg(x)χh(x) = 2 − 2d(g, h), n n x∈F2 x∈F2 − s1+s2 n so A − B = 2 2 (2 − 2d(g, h)). Notice that C := A + B is the number of positions where both χbg and χbh are nonzero. Then, X 3s1 s2 3 2 2 s1 n χbg(x)χbh(x) = 2 2 (A − B) = 2 (2 − 2d(g, h)), n x∈F2 X s1 3s2 3 2 2 s2 n χbg(x)χbh(x) = 2 2 (A − B) = 2 (2 − 2d(g, h)). n x∈F2

X 2 2 s1+s2 s1+s2 Finally, χbg(x)χbh(x) = 2 (A + B) = C2 . Then, n x∈F2 4 4 4 kfk = 2−2n−4(α422n kgk +β422n khk +4(α3β2s1 +αβ32s1 )·(2n−2d(g, h))+6α2β2C2s1+s2 = U2 U2 U2 2−n−4(α42s1 + β42s2 ) + 2−2n−2αβ(α22s1 + β22s2 )(2n − 2d(g, h)) + 2−2n−3α2β22s1+s2 C, where C = |{x : χbg(x) · χbh(x) 6= 0}|. The second claim is similar. n Corollary 4. If h : F2 × F2 × F2 → Z is the concatenation h = [h00kh01kh10kh11] of four n-variables integer-valued functions hij (0 ≤ i, j ≤ 1), satisfying equations (5)–(6), for some integer-valued -bent functions f of level r + 1 ≥ 2 of constant norm, say kf k4 = K, such Z ij ij U2 that both pairs f00, f10, respectively, f01, f11 have disjoint spectra, then the U2 Gowers norm of the -bent function h of level r is khk4 = 2−5K. Z U2 2 2 2 2 Proof. From the recurrence of Theorem 4.2, since fc00 (u)fc10 (u) = fc01 (u)fc11 (u) = 0, then khk4 = 2−3γ4 kf k4 + kf k4 + kf k4 + kf k4 = 2−7 · 22 · K = 2−5K, which shows U2 00 U2 01 U2 10 U2 11 U2 the corollary. Acknowledgments. We would like to express our sincere appreciation for the anonymous reviewers, and the associate editor’s careful reading, beneﬁcial comments and constructive suggestions. Many thanks to the organizers of the 2017 workshop on Boolean Functions and their Applications in Solstrand, Os, Norway, for bringing the authors together, which started this collaboration.

REFERENCES

[1] L. Budaghyan, Construction and Analysis of Cryptographic Functions, Springer–Verlag, 2014. [2] C. Carlet, Boolean functions for cryptography and error correcting codes, In: Y. Crama, P. Hammer (eds.), Boolean Methods and Models, Cambridge Univ. Press, Cambridge, pp. 257–397, 2010. [3] C. Carlet, S. Mesnager, Four decades of research on bent functions, Des. Codes Cryptogr. 78:1 (2016), 5–50. [4] F. Caullery, F. Rodier, Distribution of the absolute indicator of random Boolean functions, hal-01679358f, 2018; available at https://hal.archives-ouvertes.fr/hal-01679358/document. [5] V. Y.-W. Chen, The Gowers’ norm in the testing of Boolean functions, Ph.D. Thesis, Massachusetts Institute of Technology, June 2009. [6] T. W. Cusick, P. St˘anic˘a,Cryptographic Boolean Functions and Applications, 2nd Ed. (Academic Press, San Diego, CA, 2017); 1st Ed., 2009. 14 SUGATA GANGOPADHYAY, CONSTANZA RIERA, PANTELIMON STANIC˘ A˘

[7] J. F. Dillon, Elementary Hadamard difference sets, In: Proceedings of the Sixth S.E. Conference of Com- binatorics, Graph Theory, and Computing, Congressus Numerantium No. XIV, Utilitas Math., Winnipeg, pp. 237–249 (1975). [8] H. Dobbertin and G. Leander, Bent functions embedded into the recursive framework of Z-bent functions, Des. Codes Cryptogr. 49 (2008), 3–22. [9] S. Gangopadhyay, B. Mandal, P. St˘anic˘a, Gowers U3 norm of some classes of bent Boolean functions, Des. Codes Cryptogr. 86 (2018), 1131–1148. [10] S. Gangopadhyay, E. Pasalic, P. St˘anic˘a, S. Datta, A note on non-splitting Z-functions, Inf. Proc. Letters 121 (2017), 1–5. [11] S. Hodˇzić,W. Meidl, E. Pasalic, Full characterization of generalized bent functions as (semi)-bent spaces, their dual and the Gray image, IEEE Trans. Inf. Theory 64:7 (2018), 5432–5440. [12] S. Hod˘zić,E. Pasalic, Generalized bent functions – Some general construction methods and related necessary and sufficient conditions, Cryptogr. Commun. 7 (2015), 469–483. [13] N. Kolomeec, A. Pavlov, Bent functions on the minimal distance, IEEE Region 8 SIBIRCON-2010, Irkutsk Listvyanka, Russia, July 11–15, 2010. [14] P. V. Kumar, R. A. Scholtz, L. R. Welch, Generalized bent functions and their properties, J. Combin Theory – Ser. A 40 (1985), 90–107. [15] T. Martinsen, W. Meidl, S. Mesnager, P. St˘anic˘a, Decomposing generalized bent and hyperbent functions, IEEE Trans. Inf. Theory 63:12 (2017), 7804–7812. [16] T. Martinsen, W. Meidl, A. Pott, P. St˘anic˘a, On symmetry and differential properties of generalized Boolean functions, Proc. WAIFI 2018: Arithm. of Finite Fields, pp. 207–223 (2018). [17] T. Martinsen, W. Meidl, P. St˘anic˘a, Generalized bent functions and their Gray images, Proc. WAIFI 2016: Arithm. Finite Fields, LNCS 10064 (2017), 160–173. [18] T. Martinsen, W. Meidl, P. St˘anic˘a, Partial Spread and Vectorial Generalized Bent Functions, Des. Codes Cryptogr. 85:1 (2017), 1–13. [19] S. Mesnager, Bent functions. Fundamentals and Results, Springer–Verlag, 2016. [20] S. Mesnager, C. Tang, Y. Qi, L. Wang, B. Wu, and K. Feng, Further Results on Generalized Bent Functions and Their Complete Characterization, IEEE Trans. Inform. Theory 64:7 (2018), 5441–5452. [21] B. Preneel, R. Govaerts, J. Vandewalle, Cryptographic properties of quadratic Boolean functions, Int. Symp. Finite Fields and Appl., 1991. [22] O. S. Rothaus, On bent functions, J. Combin. Theory – Ser. A 20 (1976), 300–305. [23] K. U. Schmidt, Quaternary constant-amplitude codes for multicode CDMA, IEEE Trans. Inf. Theory 55:4 (2009), 1824–1832. [24] P. Solé,N. Tokareva, Connections between Quaternary and Binary Bent Functions, Prikl. Diskr. Mat. 1 (2009), 16–18, (see also, http://eprint.iacr.org/2009/544.pdf). [25] P. St˘anic˘a, Weak and strong 2k-bent functions, IEEE Trans. Inf. Theory 62:5 (2016), 2827–2835. [26] P. St˘anic˘a,T. Martinsen, S. Gangopadhyay, B. K. Singh, Bent and generalized bent Boolean functions, Des. Codes Cryptogr. 69 (2013), 77–94. [27] C. Tang, C. Xiang, Y. Qi, K. Feng, Complete characterization of generalized bent and 2k-bent Boolean functions, IEEE Trans. Inf. Theory 63:7 (2017), 4668–4674. [28] N. Tokareva, Bent Functions. Results and Applications to Cryptography, Academic Press, San Diego, CA, 2015. [29] F. Zhang, S. Xia, P. St˘anic˘a,Y. Zhou, Further results on constructions of generalized bent Boolean functions, Inf. Sciences - China. 59 (2016), 1–3. [30] X.-M. Zhang, Y. Zheng, GAC–the criterion for global avalanche characteristics of cryptographic functions, In: Maurer H., Calude C., Salomaa A. (eds.), JUCS – Journal of Universal Computer Science, Springer, pp. 320–337 (1996). E-mail address: [email protected] E-mail address: [email protected] E-mail address: [email protected]