Gowers U2 Norm of Boolean Functions and Their Generalizations (Extended Abstract)

Gowers U2 norm of Boolean functions and their generalizations (Extended Abstract)

Sugata Gangopadhyay1, Constanza Riera2, Pantelimon St˘anic˘a3

1 Department of Computer Science and Engineering, Indian Institute of Technology Roorkee, Roorkee 247667, INDIA; [email protected] 2 Department of Computing, Mathematics, and Physics, Western Norway University of Applied Sciences, 5020 Bergen, Norway; [email protected] 3 Department of Applied Mathematics, Naval Postgraduate School, Monterey, CA 93943–5216, USA; [email protected]

Abstract. In this paper we investigate the Gowers U2 norm of order 2 for generalized Boolean functions, and Z-bent functions. The Gowers U2 norm of a function is a measure of its resistance to affine approximation. Although nonlinearity serves the same purpose for the classical Boolean functions, it does not extend easily to generalized Boolean functions. We first provide a framework for employing the Gowers U2 norm in the context of generalized Boolean functions with cryptographic significance, in particular we give a recurrence rule for the Gowers U2 norms, and an evaluation of the Gowers U2 norm of functions that are affine over spreads. We also give an introduction to Z-bent functions, as proposed by Dobbertin and Leander [4], to provide a recursive framework to study bent functions. In the second part of the paper, we concentrate on Z-bent functions and their U2 norms. As a consequence of one of our results, we give an alternative proof to a known theorem of Dobbertin and Leander, and also find necessary and sufficient conditions for a function obtained by gluing Z-bent functions to be bent in terms of the Gowers U2 norms of its components. Keywords: Gowers norms; Boolean functions; generalized Boolean functions; bent functions; Z-bent functions

1 Introduction

Boolean functions are functions mapping binary strings to 0 or 1. Over the years several generalizations of Boolean functions have been proposed. In this paper we consider such a generalization for which the domain set remains the same as for classical Boolean functions but the range is the set of integers modulo a positive integer q ≥ 2. These generalized Boolean functions have evolved to an active area of research [7, 8, 10, 12–15, 18–23] due to several possible applications in communications and cryptography. Boolean functions which are maximally resistant to affine approximation have special significance. The idea of nonlinearity is developed and extensively studied for classical Boolean functions. In the case of classical Boolean functions on an even number of variables, the functions with the highest possible nonlinearity are said to be bent functions [17]. The concept of nonlinearity does not extend easily to the generalized setup. In the first part of the paper we investigate the Gowers U2 norm as a possible alternative to nonlinearity for measuring the resistance to affine approximation. As examples we provide the expressions of the Gowers U2 norms for the generalized bent functions, plateaued functions, functions that are affine over spreads, and a recurrence rule for the Gowers U2 norms. Characterization of bent Boolean functions is a longstanding open problem. One of the roadblocks faced by the researchers has been the absence of recurrence rules within the set of bent Boolean functions. Dobbertin and Leander [4] introduced the notion of Z-bent functions in order to put bent functions in a recursive framework at the cost of leaving the space of Boolean functions, and replacing it with the one of Z-bent functions of different levels. Here, we further obtain some recurrences of Gowers U2 norms of Z-bent functions, and a necessary and sufficient condition involving Gowers U2 norms of four Z-bent functions of level 1 so that bent functions are always obtained by the “gluing” process proposed by Dobbertin and Leander [4].

2 Preliminaries

2.1 Generalized Boolean functions

Let F2 be the finite field containing two elements; C, R, Z be the fields of complex numbers, real numbers, and the ring of integers respectively. The cardinality of a set n S is denoted by #S. For any positive integer n, let F2 = {(x1, . . . , xn): xi ∈ F2, 1 ≤ i ≤ n} be a vector space over F2. Let Zq be the ring of integers modulo q, where q is a positive integer. By ‘+’ and ‘−’ we respectively denote addition and subtraction modulo n n q, whereas ‘⊕’ denotes the addition over F2 . Any function from F2 to F2, respectively, Zq, q > 2, is a Boolean, respectively, generalized Boolean function, in n variables, and the q set of all such functions is denoted by Bn, respectively, GBn. The character form of a q n f(x) generalized Boolean function f ∈ GBn, χf : F2 → C, is defined by χf (x) = ζq , for all 2π i n q x ∈ F2 , where ζq = e . The algebraic normal form (ANF) of f ∈ Bn is the polynomial M a1 an representation f(x) = µax1 . . . xn , where x = (x1, . . . , xn), a = (a1, . . . , an), and n a∈F2 k q µa ∈ F2. If q = 2 for some k ≥ 1 we can associate to any f ∈ GBn a unique sequence of Boolean functions ai ∈ Bn, 0 ≤ i < k, such that k−1 n f(x) = a0(x) + 2a1(x) + ··· + 2 ak−1(x), for all x ∈ F2 . n The (Hamming) weight of x ∈ F2 , denoted by wt(x), is the number of nonzero coordinates n in x, and the (Hamming) weight of a Boolean function f is wt(f) = #{x ∈ F2 : f(x) 6= 0}. The (Hamming) distance d(f, g) between two functions f, g is the weight of their n sum. The algebraic degree of f is deg(f) = max{wt(a): a ∈ F2 , µa 6= 0}. The Boolean functions having algebraic degree at most one are affine functions. n For a (generalized) Boolean function f : F2 → Zq we define the (generalized) Walsh- Hadamard transform to be the complex valued function

(q) X f(x) u·x Hf (u) = ζq (−1) , n x∈F2 L where u · x = 1≤i≤n uixi For q = 2, we obtain the usual Walsh-Hadamard transform X f(x) u·x q (q) Wf (u) = (−1) (−1) . The autocorrelation of f ∈ GBn is deﬁned by Cf (u) = n x∈F2 X f(x)−f(x⊕u) ζq . We shall use the identity [21] n x∈F2

(q) −n X (q) 2 u·x Cf (u) = 2 |Hf (x)| (−1) . (1) n x∈F2

n (q) n/2 A function f : F2 → Zq is called generalized bent (gbent) if |Hf (u)| = 2 for all n q (q) (n+s)/2 u ∈ F2 . Further, we say that f ∈ GBn is called s-plateaued if |Hf (u)| ∈ {0, 2 } n for all u ∈ F2 , for a ﬁxed integer s depending on f. For simplicity of notation, when q (q) (q) is ﬁxed, we sometimes use ζ, Hf , Cf instead of ζq, Hf , and Cf , respectively. We refer the reader to [7, 11, 12, 15] and references therein for more on generalized bent functions and their characterizations in terms of their components. 2.2 Gowers U2 norm

Let g : V → C be any function on a ﬁnite set V and B ⊆ V . Then Ex∈B [g(x)] := 1 P n #B x∈B g(x) is the average of f over B. If f : F2 → C is a complex-valued function, we deﬁne the Gowers U2 norm by 1/4 kfk = n [f(x)f(x ⊕ h ) f(x ⊕ h )f(x ⊕ h ⊕ h )] U2 Ex,h1,h2∈F2 1 2 1 2 1/4 2 = n | n [f(x)f(x ⊕ h )]| . Eh1∈F2 Ex∈F2 1

n n It is known (cf. [1, pp. 22–24]) that for f : F2 → R, if there is a polynomial P : F2 → {0, 1} P (x) of degree d such that | n f(x)(−1) | ≥ , then kfk ≥ , for any > 0. It is Ex∈F2 Ud+1 P (x) also known that for d = 1 having kfk ≥ implies | n f(x)(−1) | ≥ for Ud+1 Ex∈F2 some degree 1 Boolean polynomial. It is natural to investigate the Gowers U2 norm as a possible measure of “nonlinearity” for generalized Boolean functions as well as Z-bent functions. That is what we aim in this paper.

2.3 Gowers U2 norm for generalized Boolean functions and the Walsh–Hadamard coefficients In the remaining part of this section, and the next section we assume q = 2k, for some n positive integer k. If f : F2 → Z2k is a generalized Boolean function, we define the f Gowers norm of f to be the Gowers norm for the character form χf := ζ of f, where k ζ = e2π i/2 is a complex root of 1. The first part of our next theorem shown for generalized Boolean functions can be (some- what) adapted from Chen [1, pp. 22–24], to which we refer for a detailed discussion (for the Boolean case).

n f 2π i/2k Theorem 1 If k ≥ 1 and f : F2 → Z2k , then (with χf = ζ , where ζ = e is a k 4 −4n X 4 −2n 2 2 -complex root of 1) kχf k = 2 |Hf (x)| ≤ 2 max |Hf (x)| . Moreover, the U2 x∈ n n F2 x∈F2 equality holds if and only if f is a bent (k = 1), respectively, gbent (k > 1) function, and, 4 −n then, kχf k = 2 . U2

2k Proof. If f ∈ GBn , using equation (1), we can see that the Gowers U2 norm is

4 −3n X X X f(x) f(x⊕u) X f(x⊕v) f(x⊕u⊕v) kχf k = 2 ζ ζ ζ ζ U2 n n n n u∈F2 v∈F2 x∈F2 v∈F2     −3n X X f(x)−f(x⊕u) X −f(y)+f(y⊕u) = 2  ζ   ζ  n n n u∈F2 x∈F2 y∈F2     −5n X X 2 u·x X 2 u·y = 2  |Hf (x)| (−1)   |Hf (y)| (−1)  n n n u∈F2 x∈F2 y∈F2 −5n X X 2 2 X u·(x⊕y) −4n X 4 = 2 |Hf (x)| |Hf (y)| (−1) = 2 |Hf (x)| . (2) n n n n x∈F2 y∈F2 u∈F2 x∈F2

4n 4 X 4 2 X 2 2n 2 Then, 2 kχf k = |Hf (x)| ≤ max |Hf (x)| |Hf (x)| = 2 max |Hf (x)| . U2 x∈ n x∈ n n F2 n F2 x∈F2 x∈F2 We will now show that the equality holds if and only if f is a bent function (k = 1), 2 n n or a gbent function (k > 1). If f is bent (gbent), then, |Hf (x)| = 2 , for all x ∈ F2 . Using (2), we infer

4 −4n X 4 −4n n 2n −n −2n 2 ||χf ||U = 2 |Hf (x)| = 2 · 2 · 2 = 2 = 2 max |Hf (x)| . 2 x∈ n n F2 x∈F2 Suppose now that the equality holds, but f is not gbent (bent). Then, there exists some 2 2 x such that |H (x )| < max n |H (x)| . Since the equality holds, from (2), we get 0 f 0 x∈F2 f 4 −4n X 4 −2n 2 that ||χf ||U = 2 |Hf (x)| = 2 max |Hf (x)| . Thus, by Parseval’s identity, 2 x∈ n n F2 x∈F2

2 X 2 2n 2 X 4 2n 2 max |Hf (x)| · |Hf (x)| = 2 max |Hf (x)| > |Hf (x)| = 2 max |Hf (x)| , x∈ n x∈ n x∈ n F2 n F2 n F2 x∈F2 x∈F2 yielding a contradiction. 4 −n 4 We only need to show that, if ||χf ||U2 = 2 , the equality holds. Suppose that ||χf ||U2 = −n 4 −4n X 4 −2n 2 2 n 2 , but ||χf ||U = 2 |Hf (x)| > 2 max |Hf (x)| . Then, max |Hf (x)| < 2 , 2 x∈ n x∈ n n F2 F2 x∈F2 contradicting Parseval’s identity. ut

We can also obtain the Gowers U2 norm of any plateaued function:

q k Proposition 2. If f is an s-plateaued generalized Boolean function in GBn, where q = 2 (−n+s)/4 for some positive integer k, then its Gowers norm is kχf k = 2 . In par- U2 ticular, the Gowers U2 norm of a semibent generalized Boolean function f is kχf k U2 (−n+2)/4 (−n+1)/4 q is 2 , if n is even, and 2 , if n is odd. In general, if f ∈ GBn with |Hf (x)| ∈ {0, λ1, . . . , λt}, of respective multiplicities a, m1, . . . , mt, the Gowers U2 norm 4 Pt −4n is kχf k = mj λj 2 . U2 j=1

Proof. If f is an s-plateaued generalized Boolean function, then by deﬁnition |Hf (x)| ∈ (n+s)/2 P 2 2n n+s {2 , 0}. By Parseval’s identity, n |Hf (x)| = 2 = a · 2 , where a is the x∈F2 n+s n−s 4 multiplicity of 2 in |Hf (x)|. Hence, a = 2 . Then, by equation (2), kχf k = U2 −4n P 4 −4n 2(n+s) −n+s (−n+s)/4 2 n |Hf (x)| = 2 · a · 2 = 2 . Therefore, kχf k = 2 . By x∈F2 U2 similar arguments, we can prove the last claim. ut 1 It is well known that the nonlinearity of f ∈ B is nl(f) = 2n−1 − max|W (x)|, which n n f 2 x∈F2 means that if a function has high nonlinearity, then max|H (x)| is small, and therefore n f x∈F2 kχf k is upper bounded by a relatively small number. U2 One can ask whether is it true that kχf k < kχgk , if f, g ∈ Bn with nl(f) < nl(g). U2 U2 That is not necessarily true, and we provide an argument below. Let f be a quadratic Boolean function (so k = 1) of rank 2h [16] (under f(0) = 0), then, by Proposition 2, −2h kχf k = 2 . Thus, if f1, f2 are two quadratic Boolean functions of ranks 2h1 < 2h2, U2 respectively, then

n−1 n−h1−1 n−1 n−h2−1 4 −2h1 −2h2 4 nl(f1) = 2 − 2 < 2 − 2 = nl(f2), kχf1 k = 2 > 2 = kχf2 k .

We can certainly ﬁnd an inﬁnite class of pairs of Boolean functions (f, g) such that nl(f) < nl(g) and kχf k > kχgk . For example, let n be even, g be any bent Boolean U2 U2 n−1 n/2−1 4 −n function, and so, by Theorem 1, nl(g) = 2 −2 , kχgk = 2 . Let f now be any U2 semibent Boolean function (with f(0) = 0) for n even, so, by Proposition 2, kχf k = U2 (−n+2)/4 n−1 n/2 4 −4n 4 2 , which implies that nl(f) = 2 − 2 , kχf k = 2 max Wf (x) = U2 n x∈F2 −4n 2(n+2) n−2 −n+2 −n/4 2 2 2 = 2 . Thus, nl(f) < nl(g), and kχgk = 2 < kχf k = U2 U2 2(−n+2)/4.

2.4 Gowers U2 norm of functions that are aﬃne over spreads

We found in Theorem 1 and Proposition 2 the Gowers U2 norm of bent and, more generally, plateaued functions. It turns out we can precisely find the Gowers norm of a class of functions that extend in some direction the well-known class of partial spread bent functions, by allowing the function to be affine, not necessarily constant on the elements of a spread. k n m Let q = 2 . Let n = 2m, and let {E0,...,E2m } be a spread of F2 , that is, Ei’s, 0 ≤ i ≤ 2 , n S2m n are m-dimensional subspaces of F2 with trivial intersection. Note that i=0 Ei = F2 [3]. q Theorem 3. Let {E0,...,E2m } be a spread, and f ∈ GBn. Then: c , x ∈ E? (i) If f is defined by f(x) = i i with arbitrary c, c ∈ , 1 ≤ i ≤ m, then c, x = 0, i Zq

2m 4 −4n n c 4 c m 4 X ci kχf k = 2 (2 − 1) |ζ − A| + |ζ + (2 − 1)A| , where A := ζ . U2 i=0 q m (ii) If f is deﬁned by f(x) = 2 ai · x, x ∈ Ei, where {a0,..., a2 } are distinct arbitrary n 4 −2n n vectors in , then kχf k = 2 2 2 + 1 . F2 U2 Proof. To show (i), we ﬁrst write

2m X f(x) u·x X X ci u·x c Hf (u) = ζ (−1) = ζ (−1) + ζ n i=0 ? x∈F2 x∈Ei m m 2 2 m X c X u·x c X c c 2 A, u = 0 = ζ i (−1) + ζ − ζ i = ζ − A + 0 , u 6= 0. i=0 x∈Ei i=0 Then 4 −4n X 4 −4n n c 4 c m 4 kχf k = 2 |Hf (x)| = 2 (2 − 1) |ζ − A| + |ζ + (2 − 1)A| , and the U2 n x∈F2 ﬁrst claim is shown. 2m 2m q X X ai·x u·x X X (ai+u)·x m To show (ii), we write Hf (u) = ζ 2 (−1) = (−1) = 2 ,

i=0 x∈Ei i=0 x∈Ei 4 if there exists i such that u = ai, and 0 if u 6= ai, ∀i. Therefore, we get kχf k = U2 −4n X 4 −4n 4m m −2n n 2 |Hf (x)| = 2 2 (2 + 1) = 2 2 2 + 1 , and the theorem is shown. ut n x∈F2 Note that, from the proof of (ii), it is easy to generalize this result to allow for repeated vectors. However, we do not state this result here, as it is notationally cumbersome.

3 Recurrences for Gowers U2 norms of generalized Boolean functions

We start this section with a lemma, which will be used to derive a formula for the Gowers U2 norms of concatenations of Boolean functions. Its proof is not shown here due to space restrictions, and will be available in the full paper.

q k Lemma 4. Let f1, f2 ∈ GBn, q = 2 , be n-variables generalized Boolean functions and X 2 2 n X ζ a q-complex root of 1. Then |Hf1 (x)| |Hf2 (x)| = 2 Cf1 (w)Cf2 (w). n n x∈F2 w∈F2

We now derive a recurrence for Gowers U2 norms of concatenations of generalized Boolean functions. We use <(a + bi) = a for the real part of the complex argument.

n k Theorem 5 Let f : F2 × F2 → Zq, where q = 2 , be the concatenation f = [f1kf2] of two n-variables generalized Boolean functions, f1, f2, that is, f(x1, x) = (1 − x1)f1(x) + x1f2(x). The Gowers U2 norm of f is given recursively by

3 4 2 kχf k U2 4 4 −4n+1 X 2 2 −4n+2 X 2 = kχf k + kχf k + 2 |Hf (u)| |Hf (u)| + 2 < Hf (u)Hf (u) 1 U2 2 U2 1 2 1 2 n n u∈F2 u∈F2 4 4 −3n+1 X −4n+2 X 2 = kχf k + kχf k + 2 Cf (u)Cf (u) + 2 < Hf (u)Hf (u) . 1 U2 2 U2 1 2 1 2 n n u∈F2 u∈F2 1 + <2(ζ) If f2 = f1, then kχf k = kχf k . If f2 = f¯1, then kχf k = kχf k . U2 1 U2 U2 2 1 U2

n Proof. If f : F2 × F2 → Zq is given by f(x1, x) = (1 − x1)f1(x) + x1f2(x), then, it is u1 known (and easy to show) that Hf (u1, u) = Hf1 (u) + (−1) Hf2 (u). The Gowers norm of f is then (below, we split the sums into u1 = 0, u1 = 1.)

2 2 u1 2 +2|Hf1 (u)| |Hf2 (u)| + 2(−1) |Hf1 (u)| Hf1 (u)Hf2 (u) + Hf2 (u)Hf1 (u)

u1 2 +2(−1) |Hf2 (u)| Hf1 (u)Hf2 (u) + Hf2 (u)Hf1 (u)

X 4 u1 3 = |Hf1 (u)| + 4(−1) Hf1 (u)Hf2 (u) n (u1,u)∈F2×F2 2 2 u1 3 4 +6Hf1 (u)Hf2 (u) + 4(−1) Hf1 (u)Hf2 (u) + |Hf2 (u)| X 4 4 2 2 2 = 2 |Hf1 (u)| + |Hf2 (u)| + 2|Hf1 (u)| |Hf2 (u)| + 4< Hf1 (u)Hf2 (u) n u∈F2 4n+1 4 4n+1 4 X 2 2 2 = 2 kχf k + 2 kχf k + 4 |Hf (u)| |Hf (u)| + 2< Hf (u)Hf (u) , 1 U2 2 U2 1 2 1 2 n u∈F2 and by using Lemma 4, we infer the ﬁrst claim. The second claim for f2 = f1 is easily 2 2 2 4 obtained, since then |Hf2 (u)| = |Hf1 (u)| , < Hf1 (u)Hf2 (u) = |Hf1 (u)| and, so, X 2 2 X 2 4n |Hf (u)| |Hf (u)| = < Hf (u)Hf (u) = 2 kχf k . If f2 = f¯1, then 1 2 1 2 1 U2 n n u∈F2 u∈F2 2 4 2 Hf2 = ζHf1 and so, < Hf1 (u)Hf2 (u) = |Hf1 (u)| < (ζ), which, when used above renders the last claim. ut

n We now look at functions f : F2 → Z4, where f = a0 + 2a1, with a0, a1 ∈ Bn and ﬁnd the Gowers U2 norm of f in terms of those of the components a0, a0 ⊕ a1. Using a decomposition result of [19] we can show the next theorem.

4 Theorem 6 Let f ∈ GBn, f = a0 + 2a1, a0, a1 ∈ Bn. Then

4 4 4 4 −4n+1 X 2 2 2 kχf k = kχa k + kχa ⊕a k + 2 W (x)W (x) U2 1 U2 0 1 U2 a1 a0⊕a1 n x∈F2 4 4 −3n+1 X = kχa k + kχa ⊕a k + 2 Ca (w)Ca ⊕a (w). 1 U2 0 1 U2 1 0 1 n w∈F2

2k We can certainly derive an expression for the Gowers U2 norm for a generalized f ∈ GBn . but the result is rather quite complicated, unfortunately. We will reserve it for the full paper. 4 Gowers U2 norm and Z-bent functions

4.1 Z-bent functions In this section, if f is an integer valued function, we will work with the Fourier transform −n/2 X u·x fb(u) = 2 f(x)(−1) . The Gowers norm of f given by n x∈F2

4 kfk = x,h ,h ∈ n [f(x)f(x ⊕ h1)f(x ⊕ h2)f(x ⊕ h1 ⊕ h2)] U2 E 1 2 F2

4 −2n P 4 will render kfk = 2 n fb(x) . U2 x∈F2 Prompted by the observation that given two bent functions g, h in n = 2k variables, k > 1, the function χ (x) + χ (x) f(x) = g h ∈ {−1, 0, 1}, (3) 2 n χbg(u) + χbh(u) for all x ∈ 2 will also have its Fourier transform given by fb(u) = ∈ F 2 n {−1, 0, 1}, for all u ∈ F2 , Dobbertin and Leander [4] deﬁned the notion of Z-bent function r−1 r−1 in the following way. Let W0 = {−1, 1}, Wr = {` ∈ Z : −2 ≤ ` ≤ 2 }, for r ≥ 1.A n function f : F2 → Wr ⊆ Z is a Z-bent function of size k level r if fb(x) ∈ Wr, for all n k x ∈ F2 . The set of all Z-bent functions of size k level r is denoted by BFr . Any function S k belonging to r≥0 BFr is said to be a Z-bent function of size k. If a Z-bent function of level 1 can be written as in (3) then it is said to be splitting, otherwise it is said to be non-splitting. As Dobbertin and Leander did in [4], we refer to a ±1 function as bent (when we want to point that out we call it ±1-bent) even though it is the signature of a classical bent Boolean function. k Now, suppose that h ∈ BFr is the concatenation h = [h00kh01kh10kh11], where h12 (x) = n−2 h(1, 2, x), for all (1, 2, x) ∈ F2 × F2 × F2 , that is, h(y, z, x) = (y ⊕ 1)(z ⊕ 1)h00(x) +

(y ⊕ 1)zh01(x) + y(z ⊕ 1)h10(x) + yzh11(x). We deﬁne the functions f12 by using the following equations: f f 1 1 h h Case 1. For r ≥ 1: 00 10 = 00 10 (4) f01 f11 1 −1 h01 h11 f f 1 1 1 h h Case 2. For r = 0: 00 10 = 00 10 (5) f01 f11 2 1 −1 h01 h11

Dobbertin and Leander [4, Proposition 2] showed that if h is a Z-bent function of size k and level r, then the functions f12 are Z-bent functions of size k − 1 and level r + 1, k k−1 for all 1, 2 ∈ F2. In other words, if h ∈ BFr , then f12 ∈ BFr+1 , for all 1, 2 ∈ F2. k−1 Conversely, suppose we have f12 ∈ BFr+1 , for all 1, 2 ∈ F2. If h = [h00kh01kh10kh11], then we say that h is obtained by gluing f12 , where 1, 2 ∈ F2. Although the gluing process in general may not yield a Boolean function, it is known [4, Proposition 2] that k k−1 all functions in BFr are obtained by gluing functions in BFr+1 . We derive the following condition connecting the Z-bent functions of level 1 to (classical) bent functions as a special case of [4, Theorem 3].

Theorem 7 Let four Z-bent functions f00, f01, f10 and f11 of level 1 and size k be given such that

f00(x) ≡ f01(x) + 1 (mod 2); f10(x) ≡ f11(x) + 1 (mod 2); (6) fb00(x) ≡ fb10(x) + 1 (mod 2); fb01(x) ≡ fb11(x) + 1 (mod 2). n n Then the function h : F2×F2×F2 → {−1, 1} deﬁned by h(y, z, x) = hyz(x) for all x ∈ F2 , where hij , fij , 0 ≤ i, j ≤ 1 satisfy (5), is a ±1-bent function (of level 0).

n Due to normalization of the Walsh–Hadamard (Fourier) coeﬃcients of f : F2 → R, P 2 P 2 Parseval’s identity takes the form n fb(x) = n f(x) . x∈F2 x∈F2 4.2 Recurrences for Gowers U2 norms of Z-bent functions

Here, we will obtain some recurrences for the Gowers U2 norms of Z-bent functions k k−1 h ∈ BFr in terms of the U2 Gowers norms of fij ∈ BFr+1 , where h is obtained by gluing fij , 0 ≤ i, j ≤ 1. Due to space restrictions, we state it without a proof, which will be available in the full paper.

n Theorem 8 Let h : F2 × F2 × F2 → Z be the concatenation h = [h00kh01kh10kh11] of four n-variables integer valued functions hij (0 ≤ i, j ≤ 1), satisfying equations (4)–(5), 1 for some integer valued functions fij . Then, with γ = 2 , 1, if r ≥ 1, respectively, r = 0, we have

−4 4 −3 4 4 4 4 γ khk = 2 kf00k + kf01k + kf10k + kf11k U2 U2 U2 U2 U2

−2(n+1) X 2 2 2 2 + 3 · 2 fc00 (u)fc10 (u) + fc01 (u)fc11 (u) . n u∈F2

We can easily get a proof for Theorem 7 of Dobbertin-Leander [4].

Corollary 9. If fij in the theorem above are Z-bent functions and satisfy also equation (6), then the function h obtained from gluing fij is bent.

4.3 An alternative proof of a theorem by Dobbertin and Leander

In Dobbertin-Leander Theorem 7, suﬃcient conditions on fij for the bentness of h are proposed. Using the above recurrence we can now easily get necessary and suﬃcient conditions for the bentness of h. Although, the next result is shown using Theorem 8, we shall call it a theorem, due to its importance.

Theorem 10 Let hij , fij , 0 ≤ i, j ≤ 1, be as in the theorem above and h obtained from 4 4 gluing the -bent functions fij of level 1. Then h is bent if and only if kf00k +kf01k + Z U2 U2 4 4 −2n+1 X 2 2 2 2 −n+1 kf10k + kf11k + 3 · 2 (f00 (u)f10 (u) + f01 (u)f11 (u)) = 2 . U2 U2 c c c c n u∈F2

n The next theorem uses a result of Kolomeec and Pavlov [9] who showed that d(g, h) ≥ 2 2 , for any two bent functions in n variables.

χg (x)+χh(x) Theorem 11 If f is a splitting Z-bent function of level 1 such that f(x) = 2 n n 4 2 −d(g,b hb) 2 −d(g,h) where g, h are bent functions, the U2 Gowers norm is kfk = = . U2 22n 22n If f is a splitting -bent function of level 1 in n variables and not a bent function then n Z n kfk4 ≤ 2 −2 2 . U2 22n

While we were able to compute the U2 Gowers norm of any bent function in Theorem 1 and give some necessary conditions for splitting Z-bents in Theorem 11, it is a natural question about the norm of a Z-bent of any level. In our next result, we are able to compute the Gowers norms of Z-bent functions of any level, under some technical conditions. In particular, we note that the next theorem implies that the norm of two types of Z-bent functions of level 1 is not a function of n only, as it was the case for level 0. Two Boolean functions g, h ∈ Bn are called disjoint spectra functions if χg(u)·χh(u) = 0, n c c for any u ∈ F2 . Equivalently, χbg(u) = 0 if and only if χbh(u) 6= 0, since if n is odd then for any semibent, its Fourier spectrum has 2n−1 nonzero coeﬃcients. In Theorem 3.2 of [6] it is claimed that a Z-bent function of level 1 constructed by using two disjoint spectra semibent functions in n variables, where n is even, is non-splitting. The proof of this theorem contains a serious ﬂaw, and therefore proving the existence of non-splitting Z-bent functions of level 1 is still an open problem. We shall be using below Theorem 3.5 of [6] below, which states: Let n be even, and f1, f2 ∈ Bn be s1-, respectively, s2-plateaued functions that are neither bent nor both semibent, and so, Spec(χfi ) = 1+ri si {0, ±2 }, ri := 2 − 1 ≥ 0 (i = 1, 2). Let α, β be arbitrary nonzero integers with α ≡ β (mod 2). If r1 = 0, r2 = 1, α = ±1 (or r2 = 0, r1 = 1, β = ±1), we assume n 2β2 +α1 ∈/ {−1, 1} (respectively, 2α1 +β2 ∈/ {−1, 1}), for at least one value of x ∈ F2 ; if r > 0, r > 0, we assume that αχ (x) + βχ (x) ∈/ {0, ±2}, for at least one value 1 2 df1 df2 αχ (x)+βχ (x) n f1 f2 x ∈ F2 . Then, f(x) = 2 is a Z-bent function of level l := dlog2 Me, where M = maxu∈ n {|αχf (u) + βχf (u)|}, which cannot be split into two bent functions. F2 d1 d2

αχg (x)+βχh(x) Theorem 12 Let f be a Z-bent function of level r, and write f(x) = 2 . (i) If g, h are disjoint spectra functions that fulﬁll the conditions of [6, Theorem 3.5], then kfk4 = 2−n−4(α42s1 + β42s2 ). U2 (ii) In general, if g, h are not necessarily disjoint spectra functions, then

kfk4 = 2−n−4(α42s1 + β42s2 ) + 2−2n−2αβ(α22s1 + β22s2 )(2n − 2d(g, h)) U2 −2n−3 2 2 s1+s2 + 2 α β 2 |{x : χbg(x) · χbh(x) 6= 0}|.

Proof. If g, h are not necessarily disjoint spectra functions, we obtain

4 4 −2n X 4 −2n X αχg(u) + βχh(u) −2n−4 X 4 4 kfk = 2 f (x) = 2 b b = 2 (α χ (x) U2 b bg n n 2 n x∈F2 x∈F2 x∈F2 3 3 2 2 2 2 3 3 4 4 + 4α βχbg(x)χbh(x) + 6α β χbg(x)χbh(x) + 4αβ χbg(x)χbh(x) + βb χbh(x)).

s s s n 1 2 n 1 Let A = #({u ∈ F2 : χg(u) = 2 2 , χh(u) = 2 2 } ∪ {u ∈ F2 : χg(u) = −2 2 , χh(u) = s b b s s b b 2 n 1 2 n −2 2 }), B = #({u ∈ F2 : χg(u) = 2 2 , χh(u) = −2 2 } ∪ {u ∈ F2 : χg(u) = s1 s2 b b b −2 2 , χbh(u) = 2 2 }). X 2 −2 X 2 2 X 2 By Parseval’s identity, fb (x) = 2 (χbg(x)+2χbg(x)χbh(x)+χbh(x)) = f (x) = n n n x∈F2 x∈F2 x∈F2 −2 X 2 2 P 2 P 2 2 (χg(x) + 2χg(x)χh(x) + χh(x)). Further, n χg(x) = n χg(x), and x∈F2 b x∈F2 n x∈F2 s1+s2 P 2 P 2 X 2 n χh(x) = n χh(x), which implies that χg(x)χh(x) = 2 (A − B) = x∈F2 b x∈F2 b b n x∈F2 s +s X n − 1 2 n χg(x)χh(x) = 2 − 2d(g, h), so A − B = 2 2 (2 − 2d(g, h)). Notice that n x∈F2 C := A + B is the number of positions where both χbg and χbh are nonzero. Then,

3s1 s2 X 3 2 2 s1 n χbg(x)χbh(x) = 2 2 (A − B) = 2 (2 − 2d(g, h)), n x∈F2 s1 3s2 X 3 2 2 s2 n χbg(x)χbh(x) = 2 2 (A − B) = 2 (2 − 2d(g, h)). n x∈F2

X 2 2 s +s s +s 4 −2n−4 4 2n 4 Finally, χ (x)χ (x) = 2 1 2 (A+B) = C2 1 2 . Then, kfk = 2 (α 2 kgk + bg bh U2 U2 n x∈F2 β422n khk4 + 4(α3β2s1 + αβ32s1 ) · (2n − 2d(g, h)) + 6α2β2C2s1+s2 = 2−n−4(α42s1 + U2 β42s2 ) + 2−2n−2αβ(α22s1 + β22s2 )(2n − 2d(g, h)) + 2−2n−3α2β22s1+s2 C, where C = |{x : χbg(x) · χbh(x) 6= 0}|. The second claim is similar. ut n Corollary 13. If h : F2 × F2 × F2 → Z is the concatenation h = [h00kh01kh10kh11] of four n-variables integer valued functions hij (0 ≤ i, j ≤ 1), satisfying equations (4)–(5), for some integer valued Z-bent functions fij of level r + 1 ≥ 2 of constant norm, say 4 kfij k = K, such that both pairs f00, f10, respectively, f01, f11 have disjoint spectra, U2 4 −5 then the U2 Gowers norm of the -bent function h of level r is khk = 2 K. Z U2

References

1. V. Y.-W. Chen, The Gowers’ norm in the testing of Boolean functions, Ph.D. Thesis, Massachusetts Institute of Technology, June 2009. 2. T. W. Cusick, P. St˘anic˘a,Cryptographic Boolean Functions and Applications, 2nd Ed. (Academic Press, San Diego, CA, 2017); 1st Ed., 2009. 3. J. F. Dillon, Elementary Hadamard difference sets, In: Proceedings of the Sixth S.E. Conference of Combinatorics, Graph Theory, and Computing, Congressus Numer- antium No. XIV, Utilitas Math., Winnipeg, pp. 237–249 (1975). 4. H. Dobbertin and G. Leander, Bent functions embedded into the recursive framework of Z-bent functions, Des. Codes Cryptogr. 49 (2008), 3–22. 5. S. Gangopadhyay, B. Mandal, P. St˘anic˘a, Gowers U3 norm of some classes of bent Boolean functions, Des. Codes Cryptogr. 86 (2018), 1131–1148. 6. S. Gangopadhyay, E. Pasalic, P. St˘anic˘a,S. Datta, A note on non-splitting Z- functions, Inf. Proc. Letters 121 (2017), 1–5. 7. S. Hodˇzić,W. Meidl, E. Pasalic, Full characterization of generalized bent functions as (semi)-bent spaces, their dual and the Gray image, IEEE Trans. Inf. Theory 64:7 (2018), 5432–5440. 8. S. Hod˘zić,E. Pasalic, Generalized bent functions – Some general construction meth- ods and related necessary and sufficient conditions, Cryptogr. Commun. 7 (2015), 469–483. 9. N. Kolomeec, A. Pavlov, Bent functions on the minimal distance, IEEE Region 8 SIBIRCON-2010, Irkutsk Listvyanka, Russia, July 11–15, 2010. 10. P. V. Kumar, R. A. Scholtz, L. R. Welch, Generalized bent functions and their properties, J. Combin Theory – Ser. A 40 (1985), 90–107. 11. T. Martinsen, W. Meidl, S. Mesnager, P. St˘anic˘a, Decomposing generalized bent and hyperbent functions, IEEE Trans. Inf. Theory 63:12 (2017), 7804–7812. 12. T. Martinsen, W. Meidl, A. Pott, P. St˘anic˘a, On symmetry and differential properties of generalized Boolean functions, Proc. WAIFI 2018: Arithm. of Finite Fields, 2018. 13. T. Martinsen, W. Meidl, P. St˘anic˘a, Generalized bent functions and their Gray im- ages, Proc. WAIFI 2016: Arithm. Finite Fields, LNCS 10064 (2017), 160–173. 14. T. Martinsen, W. Meidl, P. St˘anic˘a, Partial Spread and Vectorial Generalized Bent Functions, Des. Codes Cryptogr. 85:1 (2017), 1–13. 15. S. Mesnager, C. Tang, Y. Qi, L. Wang, B. Wu, and K. Feng, Further Results on Gen- eralized Bent Functions and Their Complete Characterization, IEEE Trans. Inform. Theory 64:7 (2018), 5441–5452. 16. B. Preneel, R. Govaerts, J. Vandewalle, Cryptographic properties of quadratic boolean functions, Int. Symp. Finite Fields and Appl., 1991. 17. O. S. Rothaus, On bent functions, J. Combin. Theory – Ser. A 20 (1976), 300–305. 18. K. U. Schmidt, Quaternary constant-amplitude codes for multicode CDMA, IEEE Trans. Inf. Theory 55:4 (2009), 1824–1832. 19. P. Solé,N. Tokareva, Connections between Quaternary and Binary Bent Functions, Prikl. Diskr. Mat. 1 (2009), 16–18, (see also, http://eprint.iacr.org/2009/544.pdf). 20. P. St˘anic˘a, Weak and strong 2k-bent functions, IEEE Trans. Inf. Theory 62:5 (2016), 2827–2835. 21. P. St˘anic˘a,T. Martinsen, S. Gangopadhyay, B. K. Singh, Bent and generalized bent Boolean functions, Des. Codes Cryptogr. 69 (2013), 77–94. 22. C. Tang, C. Xiang, Y. Qi, K. Feng, Complete characterization of generalized bent and 2k-bent Boolean functions, IEEE Trans. Inf. Theory 63:7 (2017), 4668–4674. 23. F. Zhang, S. Xia, P. St˘anic˘a,Y. Zhou, Further results on constructions of generalized bent Boolean functions, Inf. Sciences - China. 59 (2016), 1–3.