# Using Inclusion / Exclusion to find Bent and Balanced Monomial Rotation Symmetric Functions

• Elizabeth M. Reid

## Abstract

There are many cryptographic applications of Boolean functions. Recently, research has been done on monomial rotation symmetric (MRS) functions which have useful cryptographic properties. In this paper we use the inclusion/exclusion principle to construct formulas for the weights of two subclasses of MRS functions: degree d short MRS functions and d-functions. From these results we classify bent and balanced functions of these forms.

MSC 2010: 94C10; 94A60; 06E30

## 1 Introduction

A Boolean function f in n variables is a mapping from the n-dimensional vector space 𝕍n over 𝔽2 to 𝔽2. For i ∈ {1, 2, . . . , n}, the cyclic permutation ρi is defined as ρi(x1, x2, . . . , xn) = (x1+i, x2+i, . . . , xi). We say f is rotation symmetric if f (ρ(x1, . . . , xn)) = f (x1, . . . , xn). Similarly, f is k-rotation symmetric if f (ρk(x1, . . . , xn)) = f (x1, . . . , xn), but f (ρl(x1, . . . , xn)) ≠ f (x1, . . . , xn) for any l ∈ {1, 2, . . . , k − 1}. Cryptographic applications of rotation symmetric functions can be found in [2]. In this paper we consider monomial rotation symmetric (MRS) functions: rotation symmetric functions that are constructed by summing the powers of ρ on a single monomial. Extending this idea further, a k-MRS function is constructed by summing the powers of ρk on a single monomial. For example, f (x1, x2, x3) = x1x2 + x2x3 + x3x1 is a MRS function in 3 variables with generating monomial x1x2, while g(x1, x2, x3, x4, x5, x6) = x1x2x3 + x3x4x5 + x5x6x1 is a 2-MRS function in 6 variables with generating monomial x1x2x3. Recent work on 2-MRS functions can be found in [4]. There has been a focus on these types of functions because their structure allows for less storage space and faster computation. We say that the degree of a monomial is the number of variables in the monomial. The degree of a function f is the maximum degree of any monomial of f. If every monomial of f is the same degree then f is homogeneous and if the degree of f is 1 we say f is affine. Additionally, f is defined to be linear if it is both homogeneous and affine.

Let v0 = (0, 0, . . . , 0), v1 = (0, 0, . . . , 1), . . ., v2n−1 = (1, 1, . . . , 1) be the 2n vectors in 𝕍n listed in lexicographical order. Then the truth table of f is defined as the 2n-tuple given by (f (v0), f (v1), . . . , f (v2n−1)). For example, the truth table for f (x1, x2, x3) = x1x2 + x2x3 + x3x1 is (0, 0, 0, 1, 0, 1, 1, 1). The weight of f, denoted by wt(f), is the number of 1's in the truth table for f. The distance between two functions f and g, denoted by d(f, g), is defined as d(f, g) = wt(fg). The nonlinearity of a function f, denoted by NL(f), is the minimum distance between f and any affine function.

A function of n variables is called balanced if its weight is exactly 2n−1. Since the weight is exactly 2n−1, balanced functions are resistant to correlation attacks. Intuitively, a function f is called bent if it is as nonlinear as possible, making bent functions resistant to linear cryptanalysis. Due to their structure, balanced and bent functions have applications in cryptography and coding theory. Some of these applications can be found in [2]. For a MRS function f we say that it is short if f has fewer than n monomials. Note that for a rotation symmetric function of degree greater than 1, if each variable appears exactly once then the function is short. Let d|n and k=nd . We say f is a d-function if f (x1, . . . , xn) = x1x2 . . . xd + xd+1xd+2 . . . x2d + · · · + x(k−1)d+1 . . . xn. Note that if f is a d-function then deg(f) = d and f is a d-MRS function. In this paper we consider short monomial rotation symmetric functions and d-functions. We develop formulas for the weight of such functions and use these results to find bent and balanced functions of these forms.

## 2 Bent and Balanced short MRS functions

In this section we construct a formula for the weight of short MRS functions and determine which are bent or balanced. The following lemmas are well known results and are included here for reference.

## Lemma 1

Let f be a Boolean function. f is bent if and only if the nonlinearity of f is 2n12n21 . Also if f is bent, then wt(f)=2n1±2n21 .

## Remark 2

Lemma 3 and Lemma 4 are Theorem 4 and Lemma 5 in [3].

## Lemma 3

Every Boolean function f of degree 2 is affinely equivalent to one of the following three types: If f is balanced, it is equivalent to

x1x2+x3x4++x2k1x2k+x2k+1

for some kn12 .

If f is not balanced, it is equivalent to

x1x2+x3x4++x2k1x2k+b

for some kn2 and bGF(2). If wt(f) < 2n−1 then b = 0. If wt(f) > 2n−1 then b = 1.

## Lemma 4

Let

h(x)=i=1kx2i1x2i+i=2k+1naixi

be an n-variable function for kn2 . Then

NL(h)=2n12nk1.

If all the linear terms vanish then its weight is the same as the nonlinearity; otherwise it is balanced.

## Remark 5

The following theorem is well known. A proof can be found in [2].

## Theorem 6

Let n be an even integer and m=n2 . Then

f0(x1,,xn)=i=1mxixm+i

is a rotation symmetric bent function.

## Lemma 7

Let g1, . . . , gk be arbitrary Boolean functions in n variables. Then

wt(i=1kgi)=i=1kwt(gi)2i(1),i(2)wt(gi(1)gi(2))++(2)r1i(1),,i(r)wt(gi(1)gi(r))++(2)k1wt(g1gk),

where we use the notation

i(1),,i(r)wt(gi(1)gi(r))

to denote summing over the weights of all possible products consisting of r Boolean functions from g1, . . . , gk.

## Proof

This follows from induction on k, the number of Boolean functions, with the base case that for two Boolean functions g1 and g2, wt(g1 + g2) = wt(g1) + wt(g2) − 2wt(g1g2).

## Theorem 8

Let x = (x1, . . . , xn) and

f(x)=i=1kxixi+kxi+(d1)k

where d = deg(f) and k=nd . Then

wt(f(x))=i=1k(2)i1(ki)2nid.

## Proof

Define Ai(x) = xixi+k . . . xi+(d−1)k for 1 ≤ ik. Then

f(x)=i=1kAi.

By Lemma 7,

wt(f)=wt(i=1kAi)=i=1kwt(Ai)2i(1),i(2)wt(Ai(1)Ai(2))++(2)r1i(1),,i(r)wt(Ai(1)Ai(r))++(2)k1wt(Ai(1)Ai(k)),

where

i(1),,i(r)wt(Ai(1)Ai(r))

is defined as in Lemma 7.

Since each Ai has a disjoint set of variables, wt(Ai(1) . . . Ai(r)) = 2nrd. Note that i(1),,i(r)1=(kr) . Thus

i(1),,i(r)wt(Ai(1)Ai(r))=(ki)2nrd.

Therefore

wt(f(x))=i=1k(2)i1(ki)2nid.

## Example 9

Consider f (x) = f (x1, . . . , x6) = x1x4 + x2x5 + x3x6. So n = 6, d = 2, and k = 3. By our formula above,

wt(f(x))=i=13(2)i1(31)262i=28.

Let A1(x) = x1x4, A2(x) = x2x5, and A3(x) = x3x6. Note that when i = 1 in our formula above, we have (31)24=48 . This represents the number of x so that Aα(x) = 1 for 1 ≤ α ≤ 3.

{x:A1(x)=1}={(100100),(100101),(100110),(100111),(101100),(101101),(101110),(101111),(110100),(110101),(110110),(110111),(111100),(111101),(111110),(111111)}16

{x:A2(x)=1}={(010010),(010011),(010110),(010111),(011010),(011011),(011110),(011111),(110010),(110011),(110110),(110111),(111010),(111011),(111110),(111111)}16

{x:A3(x)=1}={(001001),(001011),(001101),(001111),(011001),(011011),(011101),(011111),(101001),(101011),(101101),(101111),(111001),(111011),(111101),(111111)}16

Note that in the sets of x above we have many duplicates. We also have included x from both {x : Aα(x) = 1} and {x : Aβ(x) = 1} so that Aα(x) = 1 and Aβ(x) = 1, where 1 ≤ α, β ≤ 3 and αβ. To correct for overcounting, we remove two times the number of x where Aα(x) = 1 and Aβ(x) = 1. Note that when i = 2 from our formula above we have 2(32)22=24 . This represents that we are removing two times the number of x so that Aα(x) = 1 and Aβ(x) = 1, where 1 ≤ α, β ≤ 3 and αβ.

{x:A1(x)=1andA2(x)=1}={(110110),(110111),(111110),(111111)}4

{x:A1(x)=1andA3(x)=1}={(101101),(101111),(111101),(111111)}4

{x:A2(x)=1andA3(x)=1}={(011011),(011111),(111011),(111111)}4

So far we have counted x so that Aα(x) = 1, where 1 ≤ α ≤ 3, and removed x so that Aα(x) = 1 and Aβ(x) = 1, where 1 ≤ α, β ≤ 3 and αβ. However we still need to make sure that we have x so that A1(x) = 1, A2(x) = 1, and A3(x) = 1. Note that {x : A1(x) = 1, A2(x) = 1, and A3(x) = 1} = {(111111)}. From our first step, we counted x = (111111) for each {x : Aα(x) = 1}, giving us 3. From our second step, we subtracted twice x = (111111) for each {x : Aα(x) = 1 and Aβ(x) = 1}, giving us −2(3) = −6. Thus so far we have counted 3 − 6 = −3 of x = (111111).

Note that when i = 3 from our formula above we have (2)2(33)20=4 . This represents that we are adding four times the sum of the number of x so that A1(x) = 1, A2(x) = 1 and A3(x) = 1. Hence we are adding back 4 more (111111). Therefore we have counted 3 − 6 + 4 = 1 of x = (111111), as desired.

Therefore the 48 − 24 + 4 = 28 from our formula above is the number of x so that f (x) = 1. Thus wt(f (x)) = 28.

## Remark 10

f(x)=i=1kxixi+kxi+(d1)k

where d = deg(f) and k=nd is a short function.

## Corollary 11

Let x = (x1, . . . , xn) and

f(x)=i=1kxixi+kxi+(d1)k

where d = deg(f) and k=nd . Then

f(x)=x1++xn

is the only balanced function of this form.

## Proof

By Theorem 8 it follows that

wt(f(x))=i=1k(1)i12i1(ki)2nid=2n1(1(2d(2d2))k).

Setting

2n1(1(2d(2d2))k)=2n1

and solving for d, we see that d = 1. Hence k=nd=n1=n and so the only balanced function of the form above is f (x) = x1 + · · · + xn.

## Corollary 12

Let x = (x1, . . . , xn) and

f(x)=i=1kxixi+kxi+(d1)k

where d = deg(f) and k=nd . Then

f(x)=x1xn2+1++xn2xn

is the only bent function of this form.

## Proof

By Theorem 8 it follows that

wt(f(x))=i=1k(1)i12i1(ki)2nid=2n121(2d2)nd.

By the contrapositive of Lemma 1, if wt(f)2n1±2n21 then f is not bent. So we will only consider functions of the form above where wt(f)=2n1±2n21 . Setting

2n121(2d2)nd=2n1±2n21

and solving for d we see that d = 2. Hence k=nd=n2 and so the only function of the form above where wt(f)=2n1±2n21 is f(x)=x1xn2+1++xn2xn . By Theorem 6, f(x)=x1xn2+1++xn2xn is bent.

## Lemma 13

Let x = (x1, . . . , xn) and f (x) be a monomial rotation symmetric short function with disjoint variables and deg(f) ≠ 2. Then

wt(f(x))2n1±2n2.

## Proof

By Corollary 2.5 in [1],

wt(f)=2n12nd1(2d11)nd.

Note that

2n12nd1(2d11)nd=2n1±2n2

if and only if d = 2. Hence if deg(f) ≠ 2 then

wt(f(x))2n1±2n2.

## Remark 14

Since every bent function has weight 2n1±2n21 there are no bent monomial rotation symmetric short functions with disjoint variables of degree ≠ 2.

## Corollary 15

Let x = (x1, . . . , xn). Then

f(x)=x1xn2+1++xn2xn

is the only short bent monomial rotation symmetric function with disjoint variables.

## Proof

Corollary 15 follows directly from Corollary 12 and Lemma 13.

## 3 Bent and Balanced d-functions

In this section we look at the weights of d-functions and determine whether or not they are bent or balanced.

## Remark 16

Note that, up to a permutation of the variables,

f(x)=i=1kxixi+kxi+(d1)k

is equivalent to

g(x)=i=1kxd(i1)+1xd(i1)+2xd(i1)+d,

where d = deg(f) and k=nd , since each monomial in f and g is degree d and every variable appears exactly once in both functions. Therefore the results in this section follow directly from the results in the previous section.

## Theorem 17

Let x = (x1, . . . , xn) and

g(x)=i=1kxd(i1)+1xd(i1)+2xd(i1)+d

where d = deg(g) and k=nd . Then

wt(g(x))=i=1k(2)i1(ki)2nid.

## Corollary 18

Let x = (x1, . . . , xn) and

g(x)=i=1kxd(i1)+1xd(i1)+2xd(i1)+d

where d = deg(g) and k=nd . Then

g(x)=x1++xn

is the only balanced function of this form.

## Corollary 19

Let x = (x1, . . . , xn) and

g(x)=i=1kxd(i1)+1xd(i1)+2xd(i1)+d

where d = deg(g) and k=nd . Then

g(x)=x1x2+x3x4++xn1xn

is the only bent function of this form.

## 4 Discussion / Conclusion

In this paper we constructed formulas for the weights of short MRS functions and d-functions by using the inclusion / exclusion principle. We used these results to determine which functions of those forms are bent or balanced. Next, it would be interesting to use the techniques demonstrated in this paper to develop formulas for weights of other rotation symmetric functions to potentially classify additional functions with cryptographic applications.

## Acknowledgement

I would like to thank Thomas Cusick for his support and advice throughout this process.

1. Author's Statement:

There are no potential financial, personal, or professional conflics regarding the publication of this article.

2. Biography:

Elizabeth Reid earned her Ph.D. in Mathematics at the University at Buffalo. She is currently an Assistant Professor of Mathematics in the School of Computer Science and Mathematics at Marist College in Poughkeepsie, NY. Her research interests include Number Theory, Cryptography, and Combinatorics.

## References

[1] T. W. Cusick and D. Padgett, A recursive formula for weights of Boolean rotation symmetric functions, Discrete Appl. Math. 160 (2011), 391–397.10.1016/j.dam.2011.11.006Search in Google Scholar

[2] T.W. Cusick and P. Stănică, Cryptographic Boolean Functions and Applications, 2nd ed., London: Academic Press (2017).10.1016/B978-0-12-811129-1.00005-5Search in Google Scholar

[3] H. Kim, S-M. Park, and S. G. Hahn, On the weight and nonlinearity of homogeneous rotation symmetric Boolean functions of degree 2, Discr. Appl. Math. 157 (2009), 428–432.10.1016/j.dam.2008.06.022Search in Google Scholar

[4] E. M. Reid and T. W. Cusick, Affine equivalence classes of 2-rotation symmetric cubic Boolean functions, Int. J. Comput. Math.: Computer Systems Theory 3:3 (2018), 145–159.10.1080/23799927.2018.1499496Search in Google Scholar