here - Sites personnels de TELECOM ParisTech - Télécom ParisTech

96 Chapter 3. Bent functions and algebraic curvesIn Chapter 1 we emphasized the fact that a cryptographic Boolean function should verify severalcontradictory properties. Constructing satisfying functions is therefore a difficult task, andtrade-offs between the different criteria have to be made. In the present part, our approach willbe slightly different: we solely focus on one criterion — non-linearity — and more precisely onfunctions achieving maximum non-linearity: bent functions. Recall that the significance of thisaspect has again been demonstrated by the recent development of linear cryptanalysis initiatedby Matsui [189, 188]. It is therefore especially important when Boolean functions are used aspart of S-boxes in symmetric cryptosystems.Bent functions were introduced by Rothaus [222] in 1976. They turned out to be rathercomplicated combinatorial objects and a concrete description of all bent functions is elusive. Theclass of bent functions contains a subclass of functions introduced by Youssef and Gong [285]in 2001: the so-called hyper-bent functions. In fact, the first definition of hyper-bent functionswas based on a property of the extended Walsh–Hadamard transform of Boolean functionsintroduced by Golomb and Gong [118]. Golomb and Gong proposed that S-boxes should notbe approximated by a bijective monomial, providing a new criterion for S-box design. Theclassification of (hyper-)bent functions and many related problems remain open. In particular, itseems difficult to define precisely an infinite class of hyper-bent functions, as indicated by thenumber of open problems proposed by Charpin and Gong [46].The purpose of this chapter is to provide the mathematical background needed in Chapter 4where actual characterizations of such functions and efficient algorithms to generate them will bepresented. In Section 3.1, an alternative representation of Boolean functions is introduced, namelythe polynomial form, as well as exponential sums and polynomials classically related to it. It isindeed under that form that (hyper-)bent functions will be characterized in Chapter 4. Section 3.2covers a completely different and at first sight unrelated topic: (hyper)elliptic curves with anemphasis on point counting and efficient algorithms addressing this problem. The main pointthat we need in Chapter 4 is that it is possible to count points on such curves in a very efficientmanner. This introduction can also serve the reader who is not acquainted with the theory ofalgebraic curves and abelian varieties as an introduction to Part III. Therefore, Section 3.2 canalso be seen as the beginning of the transition towards Part III which will definitely depart fromthe study of Boolean functions and dive into that of abelian varieties with complex multiplication.3.1 Bent functions3.1.1 Boolean functions in polynomial formLet n be a positive integer. Recall that a Boolean function f in n variables is an F 2 -valuedfunction on F n 2 . The field F 2 n is (non-canonically) isomorphic to the vector space F n 2 , so that aBoolean function can also be seen as a function f : F 2 n → F 2 . Recall also that the Hammingweight of f, denoted by w H (f), is the Hamming weight of the image vector of f, that is thecardinality of its support supp(f) = {x ∈ F 2 n | f(x) = 1}.We now define another classical representation of Boolean functions involving the trace functionfrom F 2 k to F 2 r.Definition 3.1.1 (Field trace). For any positive integer k, and r dividing k, the trace function