Non Abelian bent functions Laurent Poinsot

25 Pages·2012·0.61 MB·English

Non Abelian bent functions
Laurent Poinsot
Cryptography and Communications
Discrete Structures, Boolean Functions
and Sequences

ISSN 1936-2447
Volume 4
Number 1

Cryptogr. Commun. (2012) 4:1-23
DOI 10.1007/s12095-011-0058-y
1 23
Your article is protected by copyright and
all rights are held exclusively by Springer
Science + Business Media, LLC. This e-offprint
is for personal use only and shall not be self-
archived in electronic repositories. If you
wish to self-archive your work, please use the
accepted author’s version for posting to your
own website or your institution’s repository.
You may further deposit the accepted author’s
version on a funder’s repository at a funder’s
request, provided it is not made publicly
available until 12 months after publication.
1 23
Author's personal copy
Cryptogr.Commun.(2012)4:1–23
DOI10.1007/s12095-011-0058-y
Non Abelian bent functions
LaurentPoinsot
Received:17December2010/Accepted:17October2011/Publishedonline:15November2011
©SpringerScience+BusinessMedia,LLC2011
Abstract Perfect nonlinear functions from a finite group G to another one H are
those functions f :G→ H such that for all nonzero α ∈G, the derivative dαf :
x(cid:4)→ f(αx)f(x)−1 isbalanced.InthecasewherebothGand HareAbeliangroups,
f :G→ H is perfect nonlinear if, and only if, f is bent, i.e., for all nonprincipal
characterχ ofH,the(discrete)Fouriertransformofχ ◦ f hasaconstantmagnitude
equals to |G|. In this paper, using the theory of linear representations, we exhibit
similar bentness-like characterizations in the cases where G and/or H are (finite)
nonAbeliangroups.Thusweextendtheconceptofbentfunctionstotheframework
ofnonAbeliangroups.
Keywords Bentfunctions·Perfectnonlinearity·FinitenonAbeliangroups·
Fouriertransform·Linearrepresentations
MathematicsSubjectClassifications(2010) 11T71·20B05·43A30
1Introduction
Let G and H be two finite groups (in multiplicative representation). Perfect non-
linear functions from G to H are those ideal functions f :G→ H that match the
lesspossiblewiththepatternofgrouphomomorphism,i.e.,suchthatforallnonzero
α ∈Gandforallβ ∈ H,
|G|
|{x∈G|f(αx)f(x)−1 =β}|= . (1)
|H|
L.Poinsot(B)
LIPN-UMRCNRS7030,InstitutGalilée,UniversitéParis-Nord,
99AvenueJean-BaptisteClément,93430Villetaneuse,France
e-mail:[email protected]
Author's personal copy
2 Cryptogr.Commun.(2012)4:1–23
When G and H are both (finite-dimensional) vector spaces over Z ={0,1}, these
2
functions,originallyintroducedbyNyberg[9],exhibitthemaximalresistanceagainst
the differential attack [1]. Also in the Boolean case, this notion is known to be
equivalenttobentfunctions: f :Zm →Znisbentifforallα ∈Zmandforallnonzero
2 2 2
β inZn,
2
(cid:2) (cid:2)
(cid:2)(cid:2)(cid:2)(χ(cid:2)Zβn ◦ f)(α)(cid:2)(cid:2)(cid:2)2 =2m (2)
2
whereχβ :Zn →{±1}isdefinedatyby(−1)β.y(thepointinexponentisthenatural
Zn 2
dot-produ2ctofZn)and
2
(cid:4)
φ(cid:3)(α)= φ(x)(−1)α.x (3)
x∈Zm
2
istheFouriertransformofφ :G→C(thistimeα.xisthedot-productinZm).These
2
functions,introducedbyRothaus[15](seealso[3]),exhibitthemaximalresistance
againstthelinearattack[8].
The equivalence between bentness and perfect nonlinearity has been recently
extendedbyCarletandDing[2]andPott[14]tothegeneralcase: f :G→ H(where
G and H are two finite Abelian groups) is perfect nonlinear if, and only if, for all
α ∈Gandforallnonprincipalcharacterχ of H,
(cid:2) (cid:2)
(cid:2)(cid:2)((cid:2)χ ◦ f)(α)(cid:2)(cid:2)2 =|G| (4)
whereforφ :G→C,φ(cid:3)isitsdiscreteFouriertransform(seeSection3.2).
In this paper, we exhibit the same kind of dual characterizations in the case
where at least one of the two finite groups G and H is non Abelian. This gives a
generalequivalencebetweenperfectnonlinearityandbentness.Actuallythenotion
ofbentnessisdefinedtobeequivalenttoperfectnonlinearityinthosenonAbelian
cases.
Outline of the paper Next section contains the general notations used in the
paper. In Section 3 are recalled some of the main results on the duality of finite
groups.Inparticular,wepresentseveralkindofFouriertransformsusedinthenew
characterizations of perfect nonlinearity in the non Abelian cases. The notion of
perfectnonlinearityisexposedinthegeneralframeworkoffinitegroupsinSection4.
Alsointhissectionisgiventhedualcharacterization—i.e.,thenotionofbentness—
of Carlet and Ding [2] and Pott [14] of perfect nonlinear functions in the Abelian
groups setting. Finally our own results of non Abelian bentness are developed in
Section5.
2Notations
|S|is the cardinality of anyfinite set Sandif Sis nonempty (possiblyinfinite), Id
S
denotesitsidentitymap.
In this paper, the capital letters “G” and “H” always denote finite groups in
multiplicativerepresentation,e istheneutralelementandG∗isdefinedasG\{e }
G G
(notethatC∗ =C\{0}).
Author's personal copy
Cryptogr.Commun.(2012)4:1–23 3
The vector spaces considered are always finite-dimensional complex vector
spaces.Fora(complex)vectorspaceV,0V isitszero,dimC(V)isitsdimensionand
GL(V)denotesthelineargroupofVwhichisasubsetofthevectorspaceofalllinear
endomorphismsof V,denotedEnd(V).Now,supposethat V comesequippedwith
an inner-product (cid:7)·,·(cid:8) (so that (V,(cid:7)·,·(cid:8) is an Hermitian space). With respect to
V V
thisHermitianstructure,ifλisanylinearmap,λ∗denotesitsadjointandtheunitary
groupofVisU(V).
By convention, for each known result recalled in this paper, the proof has been
intentionally omitted and a reference—not necessarily the original reference—is
given. On the contrary, our own results are obviously given with their proofs and
withoutanyreference.
3Onthedualityoffinitegroups
3.1Introduction
Thispaperisdedicatedtotheestablishmentofadualcharacterizationoftheconcept
ofperfectnonlinearity—similartotheonegivenbyCarletandDing[2]andPott[14]
concerningAbeliangroups—inthenonAbeliangroupssetting,usingsomeharmonic
analysistechniques.Sointhissection,werecallsomebasicsaboutthedualityoffinite
groups and the Fourier transform. Most of the definitions and results given in this
section are well-known and can be found in any book on finite groups ([4, 10] for
instance).
3.2TheAbeliancase
3.2.1Thetheoryofcharacters
Definition1 Let G be a finite group. A character (also called one-dimensional
representationorlinearcharacter)χ of Gisagrouphomomorphismfrom Gtothe
multiplicativegroupC∗.WedenotebyG(cid:3)thesetofallcharacters,calleddualofG.
(cid:3)
ThesetGisactuallyagroupunderthepoint-wisemultiplicationofcharactersand
itselementsbelongtothegroupofthe|G|thcomplexrootsoftheunity.Inparticular,
∀χ ∈G(cid:3), ∀x∈G, |χ(x)|=1andχ(x−1)=χ(x) (5)
where|z|isthecomplexmodulusandzistheconjugateofz∈C.
(cid:3)
Proposition1 ([5]p.367,[10]p.8)LetGbeafiniteAbeliangroup.ThenGandG
areisomorphic.
Intheremainderofthispaper,whenafiniteAbeliangroup Gisconsidered,we
always implicitly suppose that an isomorphism from G to G∗ has been fixed and
weuseχα todenotetheimageofα underthisisomorphism.Inparticular,∀x∈G,
G
χeG(x)=1(thischaracteriscalledtrivialorprincipal).Finallythecharacterssatisfy
G
thewell-knownorthogonalityproperties.
Author's personal copy
4 Cryptogr.Commun.(2012)4:1–23
Lemma1 ([2]p.214,[10]pp.9–10)Let Gbeafinite Abeliangroup.Forallα ∈G
wehave
(cid:5)
(cid:4)χα(x)= 0 ifα ∈G∗, (6)
G |G|ifα =e .
x∈G G
Forallx∈G,wehave
(cid:5)
(cid:4)χα(x)= 0 ifx∈G∗, (7)
G |G| ifx=e .
α∈G G
3.2.2The(discrete)Fouriertransform
Definition2 Let GbeafiniteAbeliangroup.TheFouriertransformofφ :G→C
isthemapφ(cid:3):G→Cdefinedforα ∈Gby
(cid:4)
φ(cid:3)(α)= φ(x)χα(x). (8)
G
x∈G
Somewell-knownandusefulresultsaresummarizedbelowforGafiniteAbelian
group.
Proposition2 ([2]p.215,[10]p.15)Letφ :G→C.
1. Wehavetheinversionformula
(cid:4)
φ = 1 φ(cid:3)(α)χα; (9)
|G| G
α∈G
2. WehavetheParseval’sequation
(cid:4) (cid:4)(cid:2) (cid:2)
|φ(x)|2 = 1 (cid:2)φ(cid:3)(α)(cid:2)2; (10)
|G|
x∈G α∈G
3. φ(x)=0∀x∈G∗if,andonlyif,φ(cid:3)isconstant;
4. φ(cid:3)(α)=0∀α ∈G∗if,andonlyif,φisconstant.
Thethirdandfourthpointsarestatedin[2]p.215.
3.2.3Themultidimensional(discrete)Fouriertransform
In Section 5.2 of Section 5, we consider some V-valued functions, where V is a
finite-dimensional vector space, defined on a finite Abelian group G, and we need
to compute their “Fourier transforms” in some natural sense. That is the reason
whywenowintroduceanaturalextensionofthediscreteFouriertransform,called
multidimensionalFouriertransform,todealwith V-valuedfunctionsratherthanC-
valuedones.ThisisastraightforwardextensionoftheusualFouriertransformwhich,
at our knowledge, is not presented in any mathematical textbooks. However more
detailsonthistransformmaybefoundin[12,13].
Author's personal copy
Cryptogr.Commun.(2012)4:1–23 5
Definition3 Let G be a finite Abelian group, V a finite-dimensional vector space
overCandφ :G→C.ThemultidimensionalFouriertransformofφisdefinedas
φ(cid:3)MD : G → (cid:4)V
α (cid:4)→ χα(x)φ(x). (11)
G
x∈G
Letusfixabasis BofV.Foreache∈ B,wedefinethecomponentfunctionφ of
e
φ :G→Vindirectioneasthemap
φ : G → C
e (12)
x (cid:4)→π (φ(x)).
e
whereπe :V →Cistheo(cid:6)rthogonalpr(cid:8)ojectionontoC∼=Cewithrespecttothedirect
(cid:7)
sum decomposition V = Ce(cid:11) ⊕Ce. According to properties of bases, we
e(cid:11)∈B\{e}
have∀x∈G,
(cid:4)
φ(x)= φ (x)e. (13)
e
e∈B
We can easily check that the multidimensional Fourier transform is actually a
component-wise discrete Fourier transform given by the following equation (for
α ∈G)
(cid:4)
φ(cid:3)MD(α)= φ(cid:3)(α)e. (14)
e
e∈B
Indeed,
(cid:4)
φ(cid:3)MD(α)= χα(x)φ(x)
G
x∈G
(cid:4) (cid:4)
= χα(x) φ (x)e
G e
x∈G e∈B
(cid:9) (cid:10)
(cid:4) (cid:4)
= χα(x)φ(x) e
G
e∈B x∈G
(sincebothsumshaveonlyfinitelymanyterms)
(cid:4)
= φ(cid:3)(α)e. (15)
e
e∈B
Notethataccordingtotheuniquenessofthedecompositioninabasis,fromequality
(14), we obtain (φ(cid:3)MD) =φ(cid:3). Note also that whenever V is one-dimensional, we
e e
recovertheusualdefinitionoftheFouriertransform.
Example1
1. Suppose that we have φ: G→Cn. Then for every x∈G, φ(x)=(φ (x),
1
··· ,φ (x)). Therefore, for every α ∈G, φ(cid:3)MD(α)=(φ(cid:3)(α),··· ,φ(cid:3)(α)) which
n 1 n
explainstheterm“component-wiseFouriertransform”usedabove.
Author's personal copy
6 Cryptogr.Commun.(2012)4:1–23
2. Supposethatwehaveφ: G→C2×2,where,foranynon-negativeintegersm,n,
(cid:6)Cm×n denotes t(cid:8)he vector space of m by n matri(cid:6)ces. For every(cid:8)x∈G, φ(x)=
φφ12,,11((xx))φφ12,,22((xx)) andforeveryα ∈G,φ(cid:3)MD(α)= φφ(cid:11)(cid:11)12,,11((αα))φφ(cid:11)(cid:11)12,,22((αα)) .
Notethat,despiteequality(14),themultidimensionalFouriertransformisinde-
pendent of the choice of the basis B as showed by its definition. Using the equa-
tion (14), we can establish an inversion formula for the multidimensional Fourier
transform.Letx∈ X.
(cid:4)
φ(x)= φ (x)e
e
e∈B
(cid:9) (cid:10)
(cid:4) (cid:4)
= 1 φ(cid:3)(α)χα(x) e
|G| e G
e∈E α∈G
(bytheinversionformulaappliedonφ )
e
(cid:9) (cid:10)
(cid:4) (cid:4)
= 1 χα(x) φ(cid:3)(α)e
|G| G e
α∈G e∈B
(cid:4)
= 1 χα(x)φ(cid:3)MD(α). (16)
|G| G
α∈G
This inversion formula is also independent of the choice of the basis. Finally this
transformsatisfiesaresultsimilartothethirdpointofProposition2.
Proposition3 Let G be a finite Abelian group, V a finite-dimensional vector space
overCandφ :G→V.Wehaveφ(x)=0 forall x∈G∗ if,andonlyif,φ(cid:3)MD(α)=
V
φ(e )forallα ∈G.
G
Proof
⇒) S(cid:12)uppose that for all x∈G∗, φ(x)=0V. Then we have ∀α ∈G, φ(cid:3)MD(α)=
χα(x)φ(x)=φ(e ).
G G
x∈G
⇐) Suppose that φ(cid:3)MD(α)=φ(eG) for a(cid:6)ll α ∈G. U(cid:8)sing the (cid:5)inversion formula
(16),wegetthatforx∈G,φ(x)= 1 (cid:12) χα(x) φ(e )= 0V ifx∈G∗,
|G| G G φ(e )ifx=e ,
α∈G G G
accordingtotheorthogonalityrelations(Lemma1). (cid:15)(cid:16)
3.3ThenonAbeliancase
3.3.1Thetheoryoflinearrepresentations
In this subsection are recalled some basics on the theory of linear representations.
The definitions and results may be found in any textbooks on the subject (see for
instance[6,16]).
Definition4 LetV beafinite-dimensionalcomplexvectorspace.Alinearrepresen-
tationofafinitegroupGonVisagrouphomomorphismfromGtoGL(V).
Author's personal copy
Cryptogr.Commun.(2012)4:1–23 7
Foreachlinearrepresentationρ :G→GL(V),itispossibletofindabasisof V
inwhichforallx∈G,ρ(x)isaunitaryoperatorofV,i.e.,ρ :G→U(V).Indeed,we
cancheckthatforalinearrepresentationρ of Gon V,foreach x∈G,ρ(x)leaves
invariantthefollowinginner-productinV
(cid:4)
(cid:7)u,v(cid:8)G,ρ,V = (cid:7)ρ(x)(u),ρ(x)(v)(cid:8)V (17)
x∈G
where (u,v)∈V2 and (cid:7).,.(cid:8) denotes any inner-product of V (linear in the first
V
variable and anti-linear in the second). Then in the remainder, without loss of
generality, we only consider unitary representations and we denote by (cid:7)·,·(cid:8)G,ρ,V a
fixedinner-productonVwhichiskeptinvariantunderρ.
The linear representations of G on C can be identified with the characters of G
sinceC∗andGL(C)areisomorphicgroups.
Definition5 A linear representation ρ of a finite group G on V is said to be
irreducibleifthereisnosubspaceW ⊂V,otherthan{0 }andV,suchthat∀x∈G,
V
∀w∈W,ρ(x)(w)∈W.
Actually if G is a finite Abelian group then the notion of irreducible linear
representationgivesnothingnewbecauseitisequivalenttothenotionofcharacter
(bythetrace).
Definition6 Twolinearrepresentationsρandρ(cid:11)ofafinitegroupGonrespectively
V and V(cid:11) areisomorphicifthereexistsalinearisomorphism(cid:9):V →V(cid:11) suchthat
forallx∈G,
(cid:9)◦ρ(x)=ρ(cid:11)(x)◦(cid:9). (18)
(Alinearmapthatsatisfiesequality(18)iscalledequivariantmapandiseasilyseen
tobeamorphismfromVtoV(cid:11)seenasleftG-modules,see[6,16].)
Thenotionofisomorphismisanequivalencerelationforlinearrepresentations.1
(cid:13)
Definition7 For a finite group G, the dual of G, denoted G, is a set that contains
exactly one and only one representative of each equivalence class of isomorphic
irreduciblerepresentationsofG.
By definition, if (ρ,ρ(cid:11))∈G(cid:13)2 are distinct, then ρ and ρ(cid:11) are nonisomorphic irre-
duciblerepresentationsofG.Intheremainder,thenotation
ρ =ρ ∈G(cid:13) (19)
V
meansthatρ :G→U(V)isanirreduciblerepresentationofG.
(cid:13) (cid:3)
If GisafiniteAbeliangroup,then Gisequalto G(uptoagroupisomorphism
from GL(C) to C∗). If G is a finite non Abelian group, the two notions of duality
1Evenifthecollectionofalllinearrepresentationsofagivenfinitegroupdoesnotformasetbut
ratheraproperclass,itisaneasyexercisetocheckthatthecollectionofrepresentativesofeachof
theisomorphismclassesoflinearrepresentationsreallydoesformaset.
Author's personal copy
8 Cryptogr.Commun.(2012)4:1–23
becomedistinct(inparticular,G(cid:13)isnotagroup).Byabuseofnotation,G(cid:13)∗isdefined
asthesetG(cid:13)\{ρ }whereρ isthetrivialorprincipalrepresentationofG,i.e.,∀x∈G,
0 0
ρ0(x)=IdC.
Whendealingwithlinearrepresentations,amajorresult,knowasSchur’slemma
(seeforinstancechapter9of[6]),shouldbekeptinmind.
Lemma2 ([6,10],[7]p.25)LetGbeafinitegroup.Letρ =ρ ∈G(cid:13)andλ∈End(V).
V
If ∀x∈G,λ◦ρ(x)=ρ(x)◦λthenλisamultipleoftheidentity,i.e.,thereexistsk∈C
suchthatλ=kId .
V
As direct consequences of the Schur’s lemma, we can state the two following
results that will be use in the sequel. (The first one is also given in [16] p. 18 as
Corollary2.)
Lemma3 ([10])LetGbeafinitegroup.Forx∈G∗,
(cid:4)
dimC(V)tr(ρV(x))=0 (20)
ρV∈G(cid:13)
where“tr”denotestheusualtraceofendomorphisms.
Lemma4 LetGbeafinitegroup.Letρ =ρ ∈G(cid:13)∗.Then
V
(cid:4)
ρ(x)=0End(V). (21)
x∈G
(cid:4)
Proof Letλ∈End(V)definedasλ= ρ(x).Letx ∈G.Wehave
0
x∈G
(cid:4) (cid:4) (cid:4)
λ= ρ(x)= ρ(x x)=ρ(x )◦ ρ(x)=ρ(x )◦λ
0 0 0
x∈G x∈G x∈G
butalso
(cid:9) (cid:10)
(cid:4) (cid:4) (cid:4)
λ= ρ(x)= ρ(xx )= ρ(x) ◦ρ(x )=λ◦ρ(x ).
0 0 0
x∈G x∈G x∈G
Inparticularλ◦ρ(x )=ρ(x )◦λ.Asitistrueforany x ∈G,λcommuteswithall
0 0 0
ρ(x).BySchur’slemma,λisamultipleoftheidentity:thereexistsk∈Csuchthat
λ=kIdV. Now suppose λ(cid:18)=0End(V), then k∈C∗. Using the first part of the proof,
weknowthatλ=ρ(x)◦λ(foreachx∈G).Then(IdV−ρ(x))◦λ=0End(V).Asλ=
kIdV, we have (IdV−ρ(x))◦(kIdV)=0End(V). Since k(cid:18)=0, we have IdV−ρ(x)=
0End(V)oralsoρ(x)=IdV whichisacontradictionwiththeassumptionthatρ isnon
trivial. (cid:15)(cid:16)
Example2 It is a good exercice to show that the symmetric group S of degree 3
3
hastwoone-dimensionalrepresentations(obviouslyirreducible),namelythetrivial