## Abstract

There are many cryptographic applications of Boolean functions. Recently, research has been done on monomial rotation symmetric (MRS) functions which have useful cryptographic properties. In this paper we use the inclusion/exclusion principle to construct formulas for the weights of two subclasses of MRS functions: degree *d* short MRS functions and *d*-functions. From these results we classify bent and balanced functions of these forms.

## 1 Introduction

A *Boolean function f* in *n* variables is a mapping from the *n*-dimensional vector space 𝕍_{n} over 𝔽_{2} to 𝔽_{2}. For *i* ∈ {1, 2, . . . , *n*}, the cyclic permutation *ρ ^{i}* is defined as

*ρ*(

^{i}*x*

_{1},

*x*

_{2}, . . . ,

*x*) = (

_{n}*x*

_{1+i},

*x*

_{2+i}, . . . ,

*x*). We say

_{i}*f*is

*rotation symmetric*if

*f*(

*ρ*(

*x*

_{1}, . . . ,

*x*)) =

_{n}*f*(

*x*

_{1}, . . . ,

*x*). Similarly,

_{n}*f*is

*k*-

*rotation symmetric*if

*f*(

*ρ*(

^{k}*x*

_{1}, . . . ,

*x*)) =

_{n}*f*(

*x*

_{1}, . . . ,

*x*), but

_{n}*f*(

*ρ*(

^{l}*x*

_{1}, . . . ,

*x*)) ≠

_{n}*f*(

*x*

_{1}, . . . ,

*x*) for any

_{n}*l*∈ {1, 2, . . . ,

*k*− 1}. Cryptographic applications of rotation symmetric functions can be found in [2]. In this paper we consider

*monomial rotation symmetric*(MRS) functions: rotation symmetric functions that are constructed by summing the powers of

*ρ*on a single monomial. Extending this idea further, a

*k*-MRS function is constructed by summing the powers of

*ρ*on a single monomial. For example,

^{k}*f*(

*x*

_{1},

*x*

_{2},

*x*

_{3}) =

*x*

_{1}

*x*

_{2}+

*x*

_{2}

*x*

_{3}+

*x*

_{3}

*x*

_{1}is a MRS function in 3 variables with generating monomial

*x*

_{1}

*x*

_{2}, while

*g*(

*x*

_{1},

*x*

_{2},

*x*

_{3},

*x*

_{4},

*x*

_{5},

*x*

_{6}) =

*x*

_{1}

*x*

_{2}

*x*

_{3}+

*x*

_{3}

*x*

_{4}

*x*

_{5}+

*x*

_{5}

*x*

_{6}

*x*

_{1}is a 2-MRS function in 6 variables with generating monomial

*x*

_{1}

*x*

_{2}

*x*

_{3}. Recent work on 2-MRS functions can be found in [4]. There has been a focus on these types of functions because their structure allows for less storage space and faster computation. We say that the

*degree of a monomial*is the number of variables in the monomial. The

*degree of a function f*is the maximum degree of any monomial of

*f*. If every monomial of

*f*is the same degree then

*f*is

*homogeneous*and if the degree of

*f*is 1 we say

*f*is

*affine*. Additionally,

*f*is defined to be

*linear*if it is both homogeneous and affine.

Let *v*_{0} = (0, 0, . . . , 0), *v*_{1} = (0, 0, . . . , 1), . . ., *v*_{2}^{n}−1 = (1, 1, . . . , 1) be the 2^{n} vectors in 𝕍_{n} listed in lexicographical order. Then the *truth table* of *f* is defined as the 2^{n}-tuple given by (*f* (*v*_{0}), *f* (*v*_{1}), . . . , *f* (*v*_{2n−1})). For example, the truth table for *f* (*x*_{1}, *x*_{2}, *x*_{3}) = *x*_{1}*x*_{2} + *x*_{2}*x*_{3} + *x*_{3}*x*_{1} is (0, 0, 0, 1, 0, 1, 1, 1). The *weight* of *f*, denoted by wt(*f*), is the number of 1's in the truth table for *f*. The *distance* between two functions *f* and *g*, denoted by *d*(*f*, *g*), is defined as *d*(*f*, *g*) = wt(*f* ⊕ *g*). The *nonlinearity* of a function *f*, denoted by *NL*(*f*), is the minimum distance between *f* and any affine function.

A function of *n* variables is called *balanced* if its weight is exactly 2^{n−1}. Since the weight is exactly 2^{n−1}, balanced functions are resistant to correlation attacks. Intuitively, a function *f* is called *bent* if it is as nonlinear as possible, making bent functions resistant to linear cryptanalysis. Due to their structure, balanced and bent functions have applications in cryptography and coding theory. Some of these applications can be found in [2]. For a MRS function *f* we say that it is *short* if *f* has fewer than *n* monomials. Note that for a rotation symmetric function of degree greater than 1, if each variable appears exactly once then the function is short. Let *d|n* and
*f* is a *d*-function if *f* (*x*_{1}, . . . , *x _{n}*) =

*x*

_{1}

*x*

_{2}. . .

*x*+

_{d}*x*

_{d}_{+1}

*x*

_{d}_{+2}. . .

*x*

_{2d}+ · · · +

*x*

_{(k−1)d+1}. . .

*x*. Note that if

_{n}*f*is a

*d*-function then deg(

*f*) =

*d*and

*f*is a

*d*-MRS function. In this paper we consider short monomial rotation symmetric functions and

*d*-functions. We develop formulas for the weight of such functions and use these results to find bent and balanced functions of these forms.

## 2 Bent and Balanced short MRS functions

In this section we construct a formula for the weight of short MRS functions and determine which are bent or balanced. The following lemmas are well known results and are included here for reference.

## Lemma 1

*Let f be a Boolean function. f is bent if and only if the nonlinearity of f is*
*Also if f is bent, then*

## Lemma 3

*Every Boolean function f of degree 2 is affinely equivalent to one of the following three types: If f is balanced, it is equivalent to*

*for some*

*If f is not balanced, it is equivalent to*

*for some*
*and b* ∈ *GF*(2). *If wt*(*f*) < 2^{n−1} *then b* = 0. *If wt*(*f*) > 2^{n−1} *then b* = 1.

## Lemma 4

*Let*

*be an n-variable function for*
*Then*

*If all the linear terms vanish then its weight is the same as the nonlinearity; otherwise it is balanced.*

## Remark 5

*The following theorem is well known. A proof can be found in [2].*

## Theorem 6

*Let n be an even integer and*
*Then*

*is a rotation symmetric bent function.*

## Lemma 7

*Let g*_{1}, . . . , *g _{k} be arbitrary Boolean functions in n variables. Then*

*where we use the notation*

*to denote summing over the weights of all possible products consisting of r Boolean functions from g*_{1}, . . . , *g _{k}.*

## Proof

This follows from induction on *k*, the number of Boolean functions, with the base case that for two Boolean functions *g*_{1} and *g*_{2}, wt(*g*_{1} + *g*_{2}) = wt(*g*_{1}) + wt(*g*_{2}) − 2wt(*g*_{1}*g*_{2}).

## Theorem 8

*Let* **x** = (*x*_{1}, . . . , *x _{n}*)

*and*

*where d* = *deg*(*f*) *and*
*Then*

## Proof

Define *A _{i}*(

**x**) =

*x*

_{i}x_{i}_{+k}. . .

*x*

_{i+(d−1)k}for 1 ≤

*i*≤

*k*. Then

By Lemma 7,

where

is defined as in Lemma 7.

Since each *A _{i}* has a disjoint set of variables, wt(

*A*

_{i}_{(1)}. . .

*A*

_{i}_{(r)}) = 2

^{n−rd}. Note that

Therefore

## Example 9

*Consider f* (**x**) = *f* (*x*_{1}, . . . , *x*_{6}) = *x*_{1}*x*_{4} + *x*_{2}*x*_{5} + *x*_{3}*x*_{6}. *So n* = 6, *d* = 2, *and k* = 3. *By our formula above,*

*Let A*_{1}(**x**) = *x*_{1}*x*_{4}, *A*_{2}(**x**) = *x*_{2}*x*_{5}, *and A*_{3}(**x**) = *x*_{3}*x*_{6}. *Note that when i* = 1 *in our formula above, we have*
*This represents the number of* **x** *so that A _{α}*(

**x**) = 1

*for*1 ≤

*α*≤ 3.

*Note that in the sets of* **x** *above we have many duplicates. We also have included* **x** *from both* {**x** : *A _{α}*(

**x**) = 1}

*and*{

**x**:

*A*(

_{β}**x**) = 1}

*so that A*(

_{α}**x**) = 1

*and A*(

_{β}**x**) = 1,

*where*1 ≤

*α, β*≤ 3

*and α*≠

*β. To correct for overcounting, we remove two times the number of*

**x**

*where A*(

_{α}**x**) = 1

*and A*(

_{β}**x**) = 1.

*Note that when i*= 2

*from our formula above we have*

*This represents that we are removing two times the number of*

**x**

*so that A*(

_{α}**x**) = 1

*and*

*A*(

_{β}**x**) = 1,

*where*1 ≤

*α, β*≤ 3

*and α*≠

*β*.

*So far we have counted* **x** *so that A _{α}*(

**x**) = 1,

*where*1 ≤

*α*≤ 3,

*and removed*

**x**

*so that A*(

_{α}**x**) = 1

*and A*(

_{β}**x**) = 1,

*where*1 ≤

*α, β*≤ 3

*and α*≠

*β. However we still need to make sure that we have*

**x**

*so that A*

_{1}(

**x**) = 1,

*A*

_{2}(

**x**) = 1,

*and*

*A*

_{3}(

**x**) = 1.

*Note that*{

**x**:

*A*

_{1}(

**x**) = 1,

*A*

_{2}(

**x**) = 1,

*and A*

_{3}(

**x**) = 1} = {(111111)}.

*From our first step, we counted*

**x**= (111111)

*for each*{

**x**:

*A*(

_{α}**x**) = 1},

*giving us 3. From our second step, we subtracted twice*

**x**= (111111)

*for each*{

**x**:

*A*(

_{α}**x**) = 1

*and A*(

_{β}**x**) = 1},

*giving us*−2(3) = −6.

*Thus so far we have counted*3 − 6 = −3

*of*

**x**= (111111).

*Note that when i* = 3 *from our formula above we have*
*This represents that we are adding four times the sum of the number of* **x** *so that A*_{1}(**x**) = 1, *A*_{2}(**x**) = 1 *and A*_{3}(**x**) = 1. *Hence we are adding back 4 more* (111111). *Therefore we have counted* 3 − 6 + 4 = 1 *of* **x** = (111111), *as desired.*

*Therefore the* 48 − 24 + 4 = 28 *from our formula above is the number of* **x** *so that f* (**x**) = 1. *Thus wt*(*f* (**x**)) = 28.

## Remark 10

*where d* = *deg*(*f*) *and*
*is a short function.*

## Corollary 11

*Let* **x** = (*x*_{1}, . . . , *x _{n}*)

*and*

*where d* = *deg*(*f*) *and*
*Then*

*is the only balanced function of this form.*

## Proof

By Theorem 8 it follows that

Setting

and solving for *d*, we see that *d* = 1. Hence
*f* (**x**) = *x*_{1} + · · · + *x _{n}*.

## Corollary 12

*Let* **x** = (*x*_{1}, . . . , *x _{n}*)

*and*

*where d* = *deg*(*f*) *and*
*Then*

*is the only bent function of this form.*

## Proof

By Theorem 8 it follows that

By the contrapositive of Lemma 1, if
*f* is not bent. So we will only consider functions of the form above where

and solving for *d* we see that *d* = 2. Hence

## Lemma 13

*Let* **x** = (*x*_{1}, . . . , *x _{n}*)

*and f*(

**x**)

*be a monomial rotation symmetric short function with disjoint variables and deg*(

*f*) ≠ 2.

*Then*

## Proof

By Corollary 2.5 in [1],

Note that

if and only if *d* = 2. Hence if deg(*f*) ≠ 2 then

## Remark 14

*Since every bent function has weight*
*there are no bent monomial rotation symmetric short functions with disjoint variables of degree* ≠ 2.

## Corollary 15

*Let* **x** = (*x*_{1}, . . . , *x _{n}*).

*Then*

*is the only short bent monomial rotation symmetric function with disjoint variables.*

## Proof

Corollary 15 follows directly from Corollary 12 and Lemma 13.

## 3 Bent and Balanced *d*-functions

In this section we look at the weights of *d*-functions and determine whether or not they are bent or balanced.

## Remark 16

*Note that, up to a permutation of the variables,*

*is equivalent to*

*where d* = *deg*(*f*) *and*
*since each monomial in f and g is degree d and every variable appears exactly once in both functions. Therefore the results in this section follow directly from the results in the previous section.*

## Theorem 17

*Let* **x** = (*x*_{1}, . . . , *x _{n}*)

*and*

*where d* = *deg*(*g*) *and*
*Then*

## Corollary 18

*Let* **x** = (*x*_{1}, . . . , *x _{n}*)

*and*

*where d* = *deg*(*g*) *and*
*Then*

*is the only balanced function of this form.*

## Corollary 19

*Let* **x** = (*x*_{1}, . . . , *x _{n}*)

*and*

*where d* = *deg*(*g*) *and*
*Then*

*is the only bent function of this form.*

## 4 Discussion / Conclusion

In this paper we constructed formulas for the weights of short MRS functions and *d*-functions by using the inclusion / exclusion principle. We used these results to determine which functions of those forms are bent or balanced. Next, it would be interesting to use the techniques demonstrated in this paper to develop formulas for weights of other rotation symmetric functions to potentially classify additional functions with cryptographic applications.

## Acknowledgement

I would like to thank Thomas Cusick for his support and advice throughout this process.

**Author's Statement:**There are no potential financial, personal, or professional conflics regarding the publication of this article.

**Biography:**Elizabeth Reid earned her Ph.D. in Mathematics at the University at Buffalo. She is currently an Assistant Professor of Mathematics in the School of Computer Science and Mathematics at Marist College in Poughkeepsie, NY. Her research interests include Number Theory, Cryptography, and Combinatorics.

## References

[1] T. W. Cusick and D. Padgett, A recursive formula for weights of Boolean rotation symmetric functions, Discrete Appl. Math. 160 (2011), 391–397.10.1016/j.dam.2011.11.006Search in Google Scholar

[2] T.W. Cusick and P. Stănică, Cryptographic Boolean Functions and Applications, 2nd ed., London: Academic Press (2017).10.1016/B978-0-12-811129-1.00005-5Search in Google Scholar

[3] H. Kim, S-M. Park, and S. G. Hahn, On the weight and nonlinearity of homogeneous rotation symmetric Boolean functions of degree 2, Discr. Appl. Math. 157 (2009), 428–432.10.1016/j.dam.2008.06.022Search in Google Scholar

[4] E. M. Reid and T. W. Cusick, Affine equivalence classes of 2-rotation symmetric cubic Boolean functions, Int. J. Comput. Math.: Computer Systems Theory 3:3 (2018), 145–159.10.1080/23799927.2018.1499496Search in Google Scholar

**Received:**2020-05-20

**Accepted:**2020-12-10

**Published Online:**2021-01-29

© 2021 Elizabeth M. Reid, published by De Gruyter

This work is licensed under the Creative Commons Attribution 4.0 International License.