here - Sites personnels de TELECOM ParisTech - Télécom ParisTech

114 Chapter 4. Efficient characterizations for bentness4.2 Reformulation in terms of cardinalities of curves4.2.1 Kloosterman sums and elliptic curvesThe idea to connect Kloosterman sums and elliptic curves goes back to the works of Lachaud andWolfmann [156], and Katz and Livné [144]. We recall a simple proof of their main result in asimpler and less general formulation here. Indeed, its generalizations which will be covered in thenext subsection can be proved in a very similar manner.Theorem 4.2.1 ([156, 144]). Let m ≥ 3 be any positive integer, a ∈ F ∗ 2 and E m a the projectiveelliptic curve defined over F 2 m whose affine part is given by the equationE a : y 2 + xy = x 3 + a .ThenProof. Indeedand∑χ ( Tr m 1x∈F ∗ 2 m#E a = 2 m + K m (a) .K m (a) = 1 + ∑χ ( Tr m (1 x −1 + ax )) ,x∈F ∗ 2 m(x −1 + ax )) = ∑ ( (1 − 2 Trm1 x −1 + ax ))x∈F ∗ 2 m= 2 m − 1 − 2# { x ∈ F ∗ 2 | ( m Trm 1 x −1 + ax ) = 1 }= −2 m + 1 + 2# { x ∈ F ∗ 2 | ( m Trm 1 x −1 + ax ) = 0 } .Using the additive version of Hilbert’s Theorem 90, we get∑χ ( Tr m (1 x −1 + ax )) = −2 m + 1 + 2# { x ∈ F ∗ 2 | ∃t ∈ F m 2 m, t2 + t = x −1 + ax } ,x∈F ∗ 2 mand applying the substitution t = t/x we get∑χ ( Tr m (1 x −1 + ax )) = −2 m + 1 + 2# { x ∈ F ∗ 2 | ∃t ∈ F m 2 m, (t/x)2 + (t/x) = x −1 + ax }x∈F ∗ 2 m= −2 m + 1 + 2# { x ∈ F ∗ 2 m | ∃t ∈ F 2 m, t2 + xt = x + ax 3} .We recognize the number of points of E a minus the only point with x-coordinate x = 0 and theonly point at infinity.∑χ ( Tr m (1 x −1 + ax )) = −2 m + 1 + #E a − 2x∈F ∗ 2 m= −2 m − 1 + #E a .Hence, the necessary and sufficient condition for hyper-bentness of the monomial functionswith the Dillon exponent given in Table 4.2 can be reformulated as follows.Proposition 4.2.2 (Reformulation of the Dillon criterion). The notation is as in Theorem 4.2.1.Moreover, let r be an integer such that gcd(r, 2 m + 1) = 1 and f a be the Boolean function with ninputs defined as f a (x) = Tr n ( )1 axr(2 m −1). Then f a is hyper-bent if and only if#E a = 2 m .