Partially APN functions with APN-like polynomial representations

Abstract

In this paper we investigate several families of monomial functions with APN-like exponents that are not APN, but are partially 0-APN for infinitely many extensions of the binary field $\mathbb {F}_2$. We also investigate the differential uniformity of some binomial partial APN functions. Furthermore, the partial APN-ness for some classes of multinomial functions is investigated. We show also that the size of the pAPN spectrum is preserved under CCZ-equivalence.

1 Introduction

The objects of this study are functions over the field with $2^n$ elements and some of their differential properties. For more on these objects the reader can consult [3, 7, 8, 11]. We will introduce here only some needed notions.

Let $\mathbb {F}_{2^n}$ be the finite field with $2^n$ elements for some positive integer n. We call a function from $\mathbb {F}_{2^n}$ to $\mathbb {F}_2$ a Boolean function on n variables and denote the set of all such functions by ${\mathcal B}_n$. For a Boolean function $f:\mathbb {F}_{2^n}\rightarrow \mathbb {F}_2$ we define the Walsh–Hadamard transform to be the integer valued function

$$\begin{aligned} \mathcal {W}_f(u) = \sum _{x\in \mathbb {F}_{2^n}}(-1)^{f(x)+\mathrm Tr_{1}^n(u x)}, \end{aligned}$$

where $\mathrm Tr_{1}^n:\mathbb {F}_{2^n}\rightarrow \mathbb {F}_2$ is the absolute trace function, $\mathrm Tr_{1}^n(x)=\sum _{i=0}^{n-1} x^{2^i}$.

Given a Boolean function f, the derivative of f in direction $a \in \mathbb {F}_{2^n}$ is the Boolean function $D_aF$ defined by $D_{a}f(x) = f(x + a)+ f(x).$

A vectorial Boolean function (often called an (n, m)-function) is a map $F:\mathbb {F}_2^n\rightarrow \mathbb {F}_2^m$ for some positive integers m and n. When $m=n$, it can be uniquely represented as a univariate polynomial over $\mathbb {F}_{2^n}$ (up to some linear equivalence using the identification of the finite field with the vector space), namely

$$\begin{aligned} F(x)=\sum _{i=0}^{2^n-1} a_i x^i,\ a_i\in \mathbb {F}_{2^n}. \end{aligned}$$

Any positive integer $k \le 2^n-1$ can be represented as a sum $k = \sum _{i = 0}^{n-1} k_i \cdot 2^i$, with $k_i \in \{ 0, 1 \}$. The 2-weight of k is then $wt(k) = \sum _{i = 0}^{n-1} k_i$, i.e. the number of powers of two that add up to k. The algebraic degree of the function is then the largest 2-weight of an exponent i with $a_i\ne 0$.

In general, for an (n, m)-function F, we define the Walsh transform $W_F(a,b)$ to be the Walsh–Hadamard transform of its component function $\mathrm{Tr}_1^m(bF(x))$ at a, that is,

$$\begin{aligned} W_F(a,b)=\sum _{x\in \mathbb {F}_{2^n}} (-1)^{\mathrm{Tr}_1^m(bF(x))+\mathrm Tr_{1}^n(ax)}. \end{aligned}$$

For an (n, n)-function F, and $a,b\in \mathbb {F}_{2^n}$, we let $\Delta _F(a,b)=|\{x\in \mathbb {F}_{2^n}\,|\, F(x+a)+F(x)=b\}|$. We call the quantity $\Delta _F=\max \{\Delta _F(a,b)\,:\, a,b\in \mathbb {F}_{2^n}, a\ne 0 \}$ the differential uniformity of F. If $\Delta _F\le \delta$, then we say that F is differentially $\delta$-uniform. If $\delta =2$, then F is an almost perfect nonlinear (APN) function. There are several equivalent characterizations of APN-ness, and we state some below.

Lemma 1.1

([8, 10, 17]) Let F be an (n, n)-function.

• (i) The following inequality is always true:

  $$\begin{aligned} \sum _{a,b\in \mathbb {F}_{2^n}} {\mathcal W}_F^4(a,b)\ge 2^{3n+1}(3\cdot 2^{n-1}-1), \end{aligned}$$

  with equality if and only if F is APN.

• (ii) If, in addition, F is APN and satisfies $F(0)=0$, then

  $$\begin{aligned} \sum _{a,b\in \mathbb {F}_{2^n}} {\mathcal W}_F^3(a,b)=2^{2n+1}(3\cdot 2^{n-1}-1). \end{aligned}$$

• (iii) (Rodier condition) F is APN if and only if all the points x, y, z satisfying

  $$\begin{aligned} F(x)+F(y)+F(z)+F(x+y+z)=0, \end{aligned}$$

  fulfill $(x+y)(x+z)(y+z)=0$.

We introduced in [6] a notion of partial APN-ness in our attempt to resolve the open problem of the highest possible algebraic degree of an APN function [5].

Definition 1.2

For a fixed $x_0\in {{\mathbb F}}_{2^n}$, we call an (n, n)-function a (partial) $x_0$-APN function (which we typically refer to as simply $x_0$-APN, partially APN or pAPN for short) if all points, $x,\,y$, satisfying

$$\begin{aligned} F(x_0) + F(x) + F(y) + F(x_0 + x + y) = 0 \end{aligned}$$

(1)

belong to the curve

$$\begin{aligned} (x_0 + x)(x_0 + y)(x+y) = 0. \end{aligned}$$

(2)

We refer to the set of points $x_0$ for which F is $x_0$-APN as the pAPN spectrum of F.

Certainly, a function is APN if and only if it is $x_0$-APN for any $x_0 \in \mathbb {F}_{2^n}$. We refer to Eq. (1) as the Rodier equation.

An alternative way to express the fact that a given function F is $x_0$-APN is to say that, for any $a \ne 0$, the equation $F(x+a) + F(x) = F(x_0 + a) + F(x_0)$ has only two solutions x, namely $x_0$ and $x_0 + a$.

The remainder of the paper is organized as follows. In the next section, we show that the size of the pAPN spectrum is preserved under CCZ-equivalence. Next, in Sect. 3, we theoretically and experimentally investigate the partial APN-ness of monomial functions. We consider monomial functions which are known to be APN under certain conditions, and find conditions under which they are partially APN. In Sect. 4, we show that the binomial $F(x) = x^{2^n-1} + x^{2^n-2}$ over $\mathbb {F}_{2^n}$ is 1-APN but not 0-APN for $n \ge 3$. In Sect. 5 we derive some conditions under which a polynomial of the form $F(x) = x(Ax^2 + Bx^q + Cx^{2q}) + x^2(Dx^q + Ex^{2q}) + Gx^{3q}$ for $q = 2^k,2^k+1$ with $1 \le k \le n-1$ is (not) partially APN (this class of polynomials was suggested by Dillon as containing potential APN or differentially 4-uniform functions). Since every APN function is 0-APN as well, some of the results from Sects. 3, 4 and 5 imply non-existence results for APN functions.

2 The size of the pAPN spectrum is preserved under CCZ-equivalence

We first recall that two functions $F,G:\mathbb {F}_{2^n}\rightarrow \mathbb {F}_{2^m}$ are CCZ-equivalent [9] if there exists an affine permutation ${\mathcal A}$ on $\mathbb {F}_{2^n}\times \mathbb {F}_{2^m}$ such that $\displaystyle \{(x,G(x)),x\in \mathbb {F}_{2^n} \}={\mathcal A}\left( \{(x,F(x)),x\in \mathbb {F}_{2^n} \} \right)$. As in [9], we use the identification of the elements in $\mathbb {F}_{2^n}$ with the elements in $\mathbb {F}_2^n$, and denote by x both an element in $\mathbb {F}_{2^n}$ and the corresponding element in $\mathbb {F}_2^n$.

Theorem 2.1

The size of the pAPN spectrum is preserved under CCZ-equivalence. More precisely, if F and G are two CCZ-equivalent (n, n)-functions and ${\mathcal A}$ is the corresponding CCZ-isomorphism, and denoting the respective pAPN spectra of F, G by $S_F,S_G$, if $x_0\in S_F$, and $(\tilde{x}_0, G(\tilde{x}_0))={\mathcal A}(x_0,F(x_0))$, we have that $\tilde{x}_0\in S_G$.

Proof

We first decompose the affine permutation as an affine block-matrix, ${\mathcal A}\mathbf{u}=\begin{pmatrix} {\mathcal A}_{11} &{}\quad {\mathcal A}_{12}\\ {\mathcal A}_{21} &{}\quad {\mathcal A}_{22} \end{pmatrix} \mathbf{u}+\begin{pmatrix}{c}\\ {d}\end{pmatrix}$, for an input vector $\mathbf{u}$, where ${\mathcal A}_{11},{\mathcal A}_{21}$, ${\mathcal A}_{12},{\mathcal A}_{22}$ are $n \times n$ matrices with entries in $\mathbb {F}_{2}$, and $\begin{pmatrix}{c}\\ {d}\end{pmatrix}$ is a column vector in $\mathbb {F}_{2^{2n}}$.

We assume that F is $x_0$-APN, and we want to show that G is $\tilde{x}_0$-APN, where $\tilde{x}_0={\mathcal A}_{11} x_0+{\mathcal A}_{12} F(x_0)+c$. For that, we consider the Rodier equation of G at $\tilde{x}_0$, namely

$$\begin{aligned} G(\tilde{x}_0)+G(\tilde{x})+G(\tilde{y})+G(\tilde{x}_0+\tilde{x}+\tilde{y})=0. \end{aligned}$$

(3)

To simplify notation, we let $\tilde{z}=\tilde{x}_0+\tilde{x}+\tilde{y}$. We know that there exist $x_0,x,y,z$ such that

$$\begin{aligned} \begin{aligned} \tilde{x}_0&={\mathcal A}_{11} x_0+{\mathcal A}_{12} F(x_0)+c, \quad \tilde{x}={\mathcal A}_{11} x+{\mathcal A}_{12} F(x)+c,\\ \tilde{y}&={\mathcal A}_{11} y+{\mathcal A}_{12} F(y)+c, \quad \tilde{z}={\mathcal A}_{11} z+{\mathcal A}_{12} F(z)+c,\\ G( \tilde{x}_0)&={\mathcal A}_{21} x_0+{\mathcal A}_{22} F(x_0)+d, \quad G(\tilde{x})={\mathcal A}_{21} x+{\mathcal A}_{22} F(x)+d,\\ G(\tilde{y})&={\mathcal A}_{21} y+{\mathcal A}_{22} F(y)+d, \quad G(\tilde{z})={\mathcal A}_{21} z+{\mathcal A}_{22} F(z)+d. \end{aligned} \end{aligned}$$

(4)

Observe that if $\tilde{x}_0+\tilde{x}+\tilde{y}+\tilde{z}=0$, then

$$\begin{aligned} {\mathcal A}_{12} \left( F(x_0)+ F(x)+F(y)+F(z)\right) ={\mathcal A}_{11} \left( x_0+ x+ y+ z\right) . \end{aligned}$$

Similarly, the Rodier equation (3) for G at $\tilde{x}_0$ becomes

$$\begin{aligned} {\mathcal A}_{22} \left( F(x_0)+ F(x)+F(y)+F(z)\right) ={\mathcal A}_{21} \left( x_0+ x+ y+ z\right) . \end{aligned}$$

We can write the previous identities in matrix form, namely

$$\begin{aligned} {\mathcal A}\left( \begin{pmatrix}{x_0}\\ {F(x_0)}\end{pmatrix} +\begin{pmatrix}{x}\\ {F(x)}\end{pmatrix} +\begin{pmatrix}{y}\\ {F(y)}\end{pmatrix} +\begin{pmatrix}{z}\\ {F(z)}\end{pmatrix} \right) =0, \end{aligned}$$

to which we can apply ${\mathcal A}^{-1}$, obtaining

$$\begin{aligned} x_0+x+y+z=0 \text{ and } F(x_0)+F(x)+F(y)+F(z)=0. \end{aligned}$$

(5)

Now, since $z=x_0+x+y$ and F is $x_0$-APN, then Eq. (5) has only the trivial solutions on $(x_0+x)(x_0+y)(x+y)=0$. Therefore, $(\tilde{x}_0+\tilde{x})(\tilde{x}_0+\tilde{y})(\tilde{x}+\tilde{y})=0$, and the result is shown. $\square$

3 Partial $x_0$-APN monomials

In [6], a list of exponents i for which $x^i$ is 0-APN but not APN over $\mathbb {F}_{2^n}$ was computed. This list is given as Table 1 in this paper (exponents are taken up to cyclotomic cosets). We observe that the function $x^{21}$ appears for various dimensions, which raises the natural question of whether this is merely a coincidence or is the consequence of a more general rule. As our first result, we show that the latter is true.

Table 1 Power functions $F(x) = x^i$ over $\mathbb {F}_{2^n}$ for $1 \le n \le 10$ that are 0-APN but not APN

Proposition 3.1

The function $F(x) = x^{21}$ is 0-APN if and only if n is not a multiple of 6.

Proof

Let $F(x) = x^{21}$, and $x_0=0$. Then the conditions expressed by (1) and (2) state that the equality

$$\begin{aligned} x^{21} + y^{21} + (x+y)^{21} = 0 \end{aligned}$$

(6)

implies

$$\begin{aligned} xy(x+y) = 0. \end{aligned}$$

Assuming $y \ne 0$ (since otherwise the condition $(x_0 + x)(x_0 + y)(x+y) = 0$ is already satisfied) and dividing both sides of (6) by $y^{21}$, we get

$$\begin{aligned} a^{21} + (a + 1)^{21} + 1 = 0 \end{aligned}$$

where $a = x/y$. Assume further that $x \ne 0$, hence $a \ne 0$; this is then equivalent to

$$\begin{aligned} a^{19} + a^{16} + a^{15} + a^4 + a^3 + 1 = 0, \end{aligned}$$

which can be written as

$$\begin{aligned} (a+1)(a^6 + a^3 + 1)(a^6 + a^4 + a^3 + a + 1)(a^6 + a^5 + a^3 + a^2 + 1) = 0. \end{aligned}$$

(7)

Note that $F(x) = x^{21}$ is 0-APN if and only if $a = 1$ is the only root of the polynomial on the left-hand side of (7).

It can be easily verified that each of the three polynomials of degree six is irreducible over $\mathbb {F}_2$. We now use [16, Theorem 3.46], which states that if a degree $\ell$ polynomial f is irreducible over $\mathbb {F}_q$ and $n \in \mathbb {N}$, then f factors into d irreducible polynomials in $\mathbb {F}_{q^n}[x]$ of the same degree $\ell /d$, where $d = gcd(\ell ,n)$. Therefore, the polynomial from (7) has roots other than 1 if and only if the dimension n of $\mathbb {F}_{2^n}$ is a multiple of six. $\square$

The experimentally computed differential properties of $x^{21}$ for dimensions $n \le 15$ are given in Table 2. The differential spectrum is the multiset $\{ \Delta _F(a,b) : a \in \mathbb {F}_{2^n}^*, b \in \mathbb {F}_{2^n} \}$, with the multiplicity of a given value in this multiset given as a superscript after the value; e.g. the differential spectrum of $x^{21}$ for $n = 2$ contains the value 0 six times and the value 2 six times.

Table 2 Differential uniformity and differential spectrum of $x^{21}$ over $\mathbb {F}_{2^n}$ for $1 \le n \le 15$

The approach described above can easily be generalized to any power function $F(x) = x^\ell$: the polynomial $x^\ell + 1 + (x+1)^\ell$ can be expressed as the product $p_1^{r_1} p_2^{r_2} \ldots p_k^{r_k}$ of powers of $\mathbb {F}_{2}$-irreducible polynomials $p_1, p_2, \ldots , p_k$. If at least one of these polynomials has degree at least 2, then F is 0-APN over infinitely many fields $\mathbb {F}_{2^n}$, and is not 0-APN over infinitely many fields. More precisely, F is not 0-APN over $\mathbb {F}_{2^n}$ if n is a multiple of the degree of some $p_i$ with $\deg (p_i) \ge 2$ (since this polynomial will split into a product of linear terms by [16, Theorem 3.46]), and is 0-APN if n is not divisible by the least common multiple of all of those degrees.

We can also try to characterize those power functions $F(x) = x^\ell$ which are 0-APN over any finite field, regardless of its dimension. By the above discussion, the polynomial $x^\ell + 1 + (x+1)^\ell$ in this case can only have two irreducible factors, viz. x and $(x+1)$. Suppose we have the decomposition

$$\begin{aligned} x^\ell + 1 + (x+1)^\ell = x^\alpha (x+1)^\beta . \end{aligned}$$

Let $k = \deg (x^l + (x+1)^l + 1)$, i.e. k is the second largest exponent in $(x+1)^l$ after l. Thus,

$$\begin{aligned} x^k + \cdots + x^{\ell -k} = x^{\alpha + \beta } + \cdots + x^{\alpha } \end{aligned}$$

so that we get $k = \alpha + \beta$ and $\ell -k = \alpha$, which implies $\ell = 2 \alpha + \beta$.

Theorem 3.2

Suppose $x^\ell + 1 + (x+1)^\ell$ can be written as

$$\begin{aligned} x^\ell + 1 + (x+1)^\ell = x^\alpha (x+1)^\beta , \end{aligned}$$

for some $\alpha , \beta \in \mathbb {N}$. Then $\alpha = \beta = \ell /3$, and $\ell = 3 \cdot 2^k$ for some $k > 0$. Furthermore, $F(x) = x^\ell$ with $\ell = 3 \cdot 2^k$ are the only power functions which are 0-APN over any finite binary field. All other power functions are 0-APN and not 0-APN over infinitely many finite binary fields.

Proof

Let f(x) be the polynomial $x^\ell + 1 + (x+1)^\ell$. Then

$$\begin{aligned} x^\alpha ( x+1)^\beta + x^\beta (x+1)^\alpha = f(x) + f(x+1) = 0 \end{aligned}$$

for any $x \in \mathbb {F}_{2^n}$. Suppose $\alpha \ge \beta$ and $x \notin \{ 0,1 \}$. Dividing both sides of the above equation by $x^\beta (x+1)^\beta$, we obtain

$$\begin{aligned} \frac{x^\alpha (x+1)^\beta + x^\beta (x+1)^\alpha }{x^\beta (x+1)^\beta } = x^{\alpha -\beta } + (x+1)^{\alpha - \beta } = 0 \end{aligned}$$

for all $x \in \mathbb {F}_{2^n} {\setminus } \{ 0,1 \}$. Therefore, if $\alpha - \beta \ne 0$, the polynomial $x^{\alpha - \beta } + (x+1)^{\alpha - \beta }$ has more roots than its degree, which is impossible. So $\alpha = \beta$, and hence $x^{\alpha - \beta } + (x+1)^{\alpha - \beta }$ is the null polynomial. Thus we have

$$\begin{aligned} x^\ell + 1 + (x+1)^\ell = (x(x+1))^\alpha . \end{aligned}$$

We now prove that $x^\ell + 1 + (x+1)^\ell$ can be written in the form $(x(x+1))^\alpha$ if and only if $\ell = 3 \cdot 2^k$ for some $k \in \mathbb {N}$. First, observe that we can restrict ourselves to the case of $\ell$ odd, since if we have $\ell = 2\ell '$, then

$$\begin{aligned} (x(x+1))^\alpha = x^\ell + 1 + (x+1)^\ell = (x^{l'} + 1 + (x+1)^{l'})^2 \end{aligned}$$

implies $x^{\ell '} + 1 + (x+1)^{\ell '} = (x(x+1))^{\alpha /2}$. Thus, let $\ell = 2m + 1$ for $m \in \mathbb {N}$. Note that the binomial coefficients $\left( {\begin{array}{c}2m+1\\ 1\end{array}}\right) = \left( {\begin{array}{c}2m+1\\ 2m\end{array}}\right) = 2m + 1$ are always odd, so that $x^{2m}$ is the term with largest exponent and x is the term with smallest exponent in $x^\ell + 1 + (x+1)^\ell$. Suppose $\alpha > 1$. Then the term with smallest exponent in $(x(x+1))^\alpha$ is $x^\alpha$ which contradicts x being the term with smallest exponent. Thus $\alpha = 1$, and $x^\ell + 1 + (x+1)^\ell = x(x+1)$. It is now easy to see that this implies $\ell = 3$. Hence, the exponents $\ell$ for which $x^\ell + 1 + (x+1)^\ell$ is of the form $(x(x+1))^\alpha$ are precisely those of the form $\ell = 3 \cdot 2^k$, and $\alpha = 2^k$. Finally, from the above discussion, we have that the exponents $\ell = 3 \cdot 2^k$ are precisely those for which $x^\ell$ is 0-APN over all finite fields $\mathbb {F}_{2^n}$, regardless of the dimension n. $\square$

Remark 3.3

The same approach can be used for a polynomial function F as well, however it is not possible to restrict the choice of (x, y) to pairs of the type (x, 1) in general so that we would have to factorize $F(x) + F(y) + F(x+y)$ for all possible values of y in order to obtain a necessary and sufficient condition for F to be 0-APN. Selecting some concrete y, e.g. $y = 1$, would however allow us to obtain a necessary condition for the 0-APN-ness of F.

It is also interesting whether a characterization of 1-APN-ness as the one discussed in this section can be obtained for e.g. $F(x) = x^{21}$. In this case, we consider the equation $x^{21} + y^{21} + (x+y+1)^{21} + 1 = 0$ which can be written as

$$\begin{aligned}&\left( \frac{x}{y+1} \right) ^{20} + \left( \frac{x}{y+1} \right) ^{17} + \left( \frac{x}{y+1} \right) ^{16} + \left( \frac{x}{y+1} \right) ^{5}+ \left( \frac{x}{y+1} \right) ^{4} \\&\quad + \left( \frac{x}{y+1} \right) + \frac{y}{(y+1)^{17}} + \frac{y^4}{(y+1)^{5}} + \frac{y^{16}}{(y+1)^{20}} = 0. \end{aligned}$$

This seems more difficult to handle than the 0-APN-ness by this method, however.

We showed in [6] that the Gold function $f_1(x)=x^{2^t+1}$ is 0-APN if and only if $\gcd (n,t)=1$, which is known to be also equivalent to $f_1$ being APN. One would wonder (as we suggested in [6] for monomial functions) if perhaps under $\gcd (n,t)\ne 1$, the Gold function is 1-APN. We shall see below that in reality, the Gold function is not $x_0$-APN for any $x_0\in \mathbb {F}_{2^n}$, under $\gcd (n,t)=d\ne 1$. Note that the derivatives of the Gold functions are known to be $2^{d}$-to-1 maps, so that such a function is either APN if $d = 1$, or not $x_0$-APN for any $x_0$ if $d > 1$. We now state and prove our main theorem in this section.

Theorem 3.4

The following are true:

• (i) Let $f_1(x)=x^{2^t+1}$ be the Gold function on $\mathbb {F}_{2^n}$ (known to be APN for $\gcd (t,n)=1$). If $\gcd (n,t)=d>1$, then $f_1$ is not $x_0$-APN for any $x_0\in \mathbb {F}_{2^n}$.

• (ii) Let $f_2(x)=x^{2^r-2^t+1}$, $r>s$, be the generalization of the Kasami function $x\mapsto x^{2^{2t}-2^t+1}$ on $\mathbb {F}_{2^n}$ (known to be APN for $\gcd (t,n)=1$). Then, $f_2$ is 0-APN if and only if $\gcd (t,n)=\gcd (r-t,n)=d=1$. Moreover, if $\gcd (t,r-t,n)>1$, then $f_2$ is not $x_0$-APN for any $x_0\ne 0$.

• (iii) Let $f_3(x)=x^{2^r+2^t-1}$, $r>t$, be the generalization of the Niho function $x\mapsto x^{2^{2t}+2^t-1}$ on $\mathbb {F}_{2^n}$ (known to be APN for $n=2r+1$, $2t=r$; or, $n=2t+1$ and $2r=3t+1$). Then, $f_3$ is 0-APN if and only if $\gcd (r,n)=\gcd (t,n)=1$. Note that, for $t=2$, this includes $f(x)=x^{2^r+3}$, the Welch function (known to be APN for $n=2r+1$). In this case, f is 0-APN if and only if n is odd and $\gcd (r,n)=1$. If $t=1$, this case includes the Gold function $f_1$ with $x_0=0$.

• (iv) Let $f_4(x)=x^{2^{2t}+2^t+1}$ be the Bracken–Leander function on $\mathbb {F}_{2^n}$ (we do not necessarily impose the condition $n=4t$). If t is odd, then $f_4$ is not 0-APN on any $\mathbb {F}_{2^n}$ when n is even. If $n=4t$ and t even, then f is 0-APN.

• (v) Let $f_5(x)=x^{2^n-2^s}$ (which coincides with the inverse function $x^{-1}$ extended by $0^{-1} = 0$ for $s = 1$). Then, $f_5$ is 0-APN if and only if $\gcd (n,s+1)=1$.

Proof

We proved in [6] that $f_1$ is 0-APN if and only if $\gcd (n,t)=1$. In the same paper we also proved that a quadratic function is $x_0$-APN (for some $x_0$) if and only if it is APN.

Therefore, $f_1$ is not $x_0$-APN for any $x_0\in \mathbb {F}_{2^n}$, under $\gcd (n,t)>1$.

Now, let $f_2(x)=x^{2^r-2^t+1}$ be the generalization of the Kasami function. Multiplying the Rodier equation for $f_2$ at 0 by $(x+y)^{2^t}$, we get

$$\begin{aligned} 0= & {} (x+y)^{2^t} \left( x^{2^r-2^t+1}+y^{2^r-2^t+1}+(x+y)^{2^r-2^t+1}\right) \\= & {} \left( x^{2^t}+y^{2^t}\right) \left( x^{2^r-2^t+1}+y^{2^r-2^t+1}\right) +(x+y)^{2^r} (x+y)\\= & {} x^{2^r-2^t+1} y^{2^t} +y^{2^r-2^t+1} x^{2^t} +x^{2^r} y +xy^{2^r}. \end{aligned}$$

Label $y=ax$. Then, assuming $xy\ne 0$, $a\ne 0,1$, the equation above becomes

$$\begin{aligned} 0= & {} a^{2^r}+a^{2^t}+a^{2^r-2^t+1}+a\\= & {} a^{2^t} (a^{2^r-2^t}+1)+a(a^{2^r-2^t}+1)\\= & {} (a^{2^t}+a)( a^{2^t(2^{r-t}-1)}+1)\\= & {} a(a^{2^t-1}+1)(a^{2^{r-t}-1}+1)^{2^t}. \end{aligned}$$

Having some $a\ne 1$ satisfy $a^{2^t-1}+1=0$ is equivalent to $\gcd (2^t-1,2^n-1)=2^{\gcd (t,n)}-1>1$, that is, $\gcd (t,n)>1$. Similarly, having $a^{2^{r-t}-1}+1=0$ for $a\ne 1$ is equivalent to $\gcd (2^{r-t}-1,2^n-1)=2^{\gcd (r-t,n)}-1>1$, that is, $\gcd (r-t,n)>1$.

We conclude that the above equation has no solutions outside of $a= 0,1$ if and only if $\gcd (t,n)=\gcd (r-t,n)=1$.

Next, let $\gcd (t,r-t,n)=d>1$, and let $x_0\in \mathbb {F}_{2^n}$. Let $\zeta$ be a $(2^n-1)$-primitive root of unity, and write $x_0=\zeta ^k$, for some $0\le k\le 2^n-2$. Multiplying the Rodier equation of $f_2$ at $\zeta ^k$ by $(x+y+\zeta ^k)^{2^t}$, we get

$$\begin{aligned}&(x+y+\zeta ^k)^{2^t}\left( x^{2^r-2^t+1}+y^{2^r-2^t+1}+\zeta ^{k(2^r-2^t+1)} \right) +(x+y+\zeta ^k)^{2^r} (x+y+\zeta ^k)\\&\quad =x^{2^t} y^{2^r-2^t+1}+y^{2^t} x^{2^r-2^t+1} +y^{2^t} \zeta ^{k(2^r-2^t+1)} +x^{2^t} \zeta ^{k(2^r-2^t+1)} \\&\qquad +\,\zeta ^{k 2^t} (x^{2^r-2^t+1}+y^{2^r-2^t+1})+y x^{2^r}+x y^{2^r} +\zeta ^k(x^{2^r}+y^{2^r}) +\zeta ^{k2^r}(x+y), \end{aligned}$$

and using $\zeta ^{k(2^t-1)}=\zeta ^{k(2^r-1)}=1$ (both identities can be shown by observing that $k=m\cdot \frac{2^n-1}{2^d-1}$ for some integer m and so, both $k(2^t-1)$ and $k(2^r-1)$ are multiples of $2^n-1$), along with the substitution $y=ax$, we get

$$\begin{aligned}&x^{2^r+1} (a^{2^r}+a^{2^r-2^t+1}+a^{2^t}+a)+x^{2^r}\zeta ^k (a^{2^r}+1)\\&\quad +\,x^{2^t} \zeta ^k (a^{2^t}+1)+x^{2^r-2^t+1} \zeta ^k (a^{2^r-2^t+1}+1)+x(1+a)\zeta ^k=0. \end{aligned}$$

Taking $a\in \mathbb {F}_{2^d}{\setminus } \mathbb {F}_2$, and so, $a^{2^d-1}=1$, which implies $a^{2^t-1}=1$, and observing that the first term above is zero, we get

$$\begin{aligned} x^{2^r} \zeta ^k (a+1)+x^{2^t}\zeta ^k (a+1)+x^{2^r-2^t+1} \zeta ^k (a+1)+x\zeta ^k (a+1)=0, \end{aligned}$$

that is,

$$\begin{aligned} x^{2^r} +x^{2^t} +x^{2^r-2^t+1} +x=x(x^{2^t-1}+1) (x^{2^{r-t}-1}+1)^{2^t}=0, \end{aligned}$$

which has nontrivial solutions if $\gcd (t,n)>1$. By [6, Proposition 4.1], if a power function is $x_0$-APN for some $x_0\ne 0$ then it is not $x_0$-APN for all $x_0\ne 0$.

For $f_3(x) = x^{2^r + 2^t - 1}$, the Rodier equation at 0 is

$$\begin{aligned} 0=x^{2^r+2^t-1}+y^{2^r+2^t-1}+(x+y)^{2^r+2^t-1}, \end{aligned}$$

which multiplied by $x+y$ gives

$$\begin{aligned} 0= & {} x^{2^r+2^t}+y^{2^r+2^t} +y x^{2^r+2^t-1}+x y^{2^r+2^t-1}+(x^{2^r}+y^{2^r})(x^{2^t}+y^{2^t})\\= & {} x y^{2^r+2^t-1} +y x^{2^r+2^t-1} +x^{2^r} y^{2^t}+y^{2^r} x^{2^t}. \end{aligned}$$

Writing $y=xa$, the above equation becomes (assuming $x\ne 0$)

$$\begin{aligned} 0= & {} a^{2^r+2^t-1}+a^{2^r}+a^{2^t}+a\\= & {} a(a^{2^r-1}+1)(a^{2^t-1}+1). \end{aligned}$$

Thus, f is 0-APN if and only if $\gcd (r,n)=\gcd (t,n)=1$.

The Rodier equation (1) for $f_4(x) = x^{2^{2t} + 2^t + 1}$ at 0 becomes

$$\begin{aligned} 0= & {} x^{2^{2t}+2^t+1}+y^{2^{2t}+2^t+1}+(x+y)^{2^{2t}+2^t+1}\\= & {} x^{2^{2t}+2^t+1}+y^{2^{2t}+2^t+1}+(x+y)^{2^{2t}}(x+y)^{2^t}(x+y)\\= & {} x^{2^{2t}+1} y^{2^t}+x^{2^{2t}} y^{2^t+1}+x^{2^t+1} y^{2^{2t}}+x^{2^t} y^{2^{2t}+1}+x^{2^{2t}+2^t} y+x y^{2^{2t}+2^t}. \end{aligned}$$

Taking $y=ax$, $a\ne 0,1$, and dividing by $x^{2^{2t}+2^t+1}\ne 0$, we obtain

$$\begin{aligned} 0=a^{2^{2t}+2^t}+a^{2^{2t}+1}+a^{2^{2t}}+a^{2^t+1}+a^{2^t} +a, \end{aligned}$$

(8)

or, equivalently,

$$\begin{aligned} 0= (a^{2^{t}+1}+a^{2^{t}}+a)^{2^t}+a(a^{2^{t}}+a+1)^{2^t}. \end{aligned}$$

(9)

If t is odd and n is even, then $3\,|\, \gcd (2^{t-1}-1,2^n-1)=2^{\gcd (t-1,n)}-1$ and so, we can choose $a\in \mathbb {F}_{2^2}{\setminus } \mathbb {F}_2$. Then $a\ne 0,1$ and $a^2+a+1=0$. Further, $a^{2^t}+a+1=0$ (since $a^{2^{t-1}}=a$) and the equation above becomes

$$\begin{aligned} (a(a+1)+(a+1)+a)^{2^t}= (a^2+a+1)^{2^t}=0, \end{aligned}$$

which certainly holds, and so, $f_4$ is not 0-APN.

Assume now that $n=4t$ for t even (hence $\gcd (t-1,n)=1$ and $\gcd (2t-1,n)=1$). As in [2], we apply the relative trace $\mathrm{Tr}_t^{4t}(x) = x + x^{2^t} + x^{2^{2t}} + x^{2^{3t}}$ to Eq. (8) and obtain

$$\begin{aligned} 0= & {} \mathrm{Tr}_t^{4t} \left( a^{2^{2t}+2^t}+a^{2^{2t}+1}+a^{2^{2t}}+a^{2^t+1}+a^{2^t} +a\right) \nonumber \\= & {} a^{2^{2t}+2^t}+a^{2^{2t}+1}+a^{2^{2t}}+a^{2^t+1}+a^{2^t}+a\nonumber \\&+\, a^{2^{3t}+2^{2t}}+a^{2^{3t}+2^t}+a^{2^{3t}}+a^{2^{2t}+2^t}+a^{2^{2t}}+ a^{2^t}\nonumber \\&+\, a^{2^{4t}+2^{3t}}+a^{2^{4t}+2^{2t}}+a^{2^{4t}}+a^{2^{3t}+2^{2t}}+a^{2^{3t}}+a^{2^{2t}}\nonumber \\&+\, a^{2^{5t}+2^{4t}}+a^{2^{5t}+2^{3t}}+a^{2^{5t}}+a^{2^{4t}+2^{3t}}+a^{2^{4t}}+a^{2^{3t}}\nonumber \\= & {} a^{2^{2t}+2^t}+a^{2^{2t}+1}+a^{2^{2t}}+a^{2^t+1}+a^{2^t}+a\nonumber \\&+\, a^{2^{3t}+2^{2t}}+a^{2^{3t}+2^t}+a^{2^{3t}}+a^{2^{2t}+2^t}+a^{2^{2t}}+ a^{2^t}\nonumber \\&+\, a^{2^{3t}+1}+a^{2^{2t}+1}+a+a^{2^{3t}+2^{2t}}+a^{2^{3t}}+a^{2^{2t}}\nonumber \\&+\, a^{2^{t}+1}+a^{2^{3t}+2^{t}}+a^{2^{t}}+a^{2^{3t}+1}+a+a^{2^{3t}}\nonumber \\= & {} a+a^{2^t}+a^{2^{2t}}+a^{2^{3t}}, \end{aligned}$$

(10)

since $a^{2^{4t}}=a$. Adding the first and second powers of (10) to (8) renders

$$\begin{aligned} a^2+a^{2^{3t}+1}+a^{2^{2t}+2^t}+a^{2^{3t}}=0. \end{aligned}$$

(11)

Taking the $2^{2t}$ powers of both sides of this last equation, we get

$$\begin{aligned} a^{2^{2t+1}}+a^{2^{5t}+2^{2t}}+a^{2^{4t}+2^{3t}}+a^{2^{5t}}=a^{2^{2t+1}}+a^{2^{2t}+2^t}+a^{2^{3t}+1}+a^{2^t} =0, \end{aligned}$$

which added to (11) gives

$$\begin{aligned} a^{2^{3t}}+a^{2^{2t+1}} +a^{2^t} + a^2=0. \end{aligned}$$

Using (10), we obtain

$$\begin{aligned} a^{2^{2t+1}} +a^{2^{2t}}+a^2+a=0, \end{aligned}$$

implying

$$\begin{aligned} (a+a^{2^{2t}})^2+a+a^{2^{2t}}=(a^{2^{2t}}+a)(a^{2^{2t}}+a+1)=0, \end{aligned}$$

which has solutions if and only if $a+a^{2^{2t}}=0$, or $1+a+a^{2^{2t}}=0$. Substituting $a^{2^{2t}}=a$ into (8) renders

$$\begin{aligned} a^{2^t+1}+a^2+a+a^{2^t+1}+a^{2^t}+a=0, \end{aligned}$$

that is,

$$\begin{aligned} 0=a^{2^t}+a^2= a^2(a^{2^t-2}+1)=a^2(a^{2^{t-1}-1}+1)^2, \end{aligned}$$

and so $a^{2^{t-1}-1}=1$, which is impossible under $\gcd (t-1,n)=1$. If $a^{2^{2t}}=a+1$, then (8) becomes $a^2+a+1=0,$ which implies that $a^{2^{2t}}=a^2$. This is equivalent to $a^{2^{2t-1}-1}=1$, which is impossible if $\gcd (2t-1,n)=1$.

Lastly, the Rodier equation for $f_5(x) = x^{2^n - 2^s}$ at 0 is

$$\begin{aligned} x^{2^n-2^s}+y^{2^n-2^s}+(x+y)^{2^n-2^s}=0. \end{aligned}$$

Suppose that $x,y\ne 0,1$, and that $x\ne y$. Let $y=x a$, with $a\ne 0,1$. Then, we can rewrite the equation as

$$\begin{aligned} x^{2^n-2^s}\left( 1+a^{2^n-2^s}+(1+a)^{2^n-2^s}\right) =0. \end{aligned}$$

Since $x\ne 0$, this implies that $1+a^{2^n-2^s}+(1+a)^{2^n-2^s}=0$. Multiplying by $(1+a)^{2^s}$, renders $a^{2^n-2^s}+a^{2^s}=a^{2^s}(a^{2^{n-s-1}-1}+1)^{2^{s+1}}=0.$ This equation has solutions if and only if $\gcd (n,s+1)>1$. $\square$

Remark 3.5

Note that the case (iv) includes the function $F(x)=x^{21}$. In that particular case, however, we were able to prove a stronger result than the one contained in (iv) above.

Remark 3.6

We could have referred to (reversed) Dickson polynomials [13] in some of the arguments above, but we felt that in this case it would not bring further light to the proofs.

As in Remark 3.5, it is not difficult to find specific values of exponents that are 0-APN for infinitely many extensions of $\mathbb {F}_{2^n}$, but, in this paper, we prefer to give more general results. On the other hand, there are polynomials for which we can find general conditions not to be partial APN (and, consequently, not APN), and we provide such instances below.

Proposition 3.7

Let s and n be positive integers, then the following functions over $\mathbb {F}_{2^n}$ are not 0-APN:

• (1) $f_6(x)=x^{2^{2s+1}+2^{s+1}+2^s-1}$ when $n\ge 4$ is even;

• (2) $f_7(x)=x^{2^{4s}+2^{3s}+2^{2s}+2^s-1}$ (a Dobbertin-like function known to be APN for $n=5s$) when s is odd and n is even;

• (3) $f_8(x)=x^{2^{2s+1}+5}$ when n is even.

Proof

The Rodier equation for $f_6$ at $x_0=0$ is

$$\begin{aligned} x^{2^{2s+1}+2^{s+1}+2^s-1}+y^{2^{2s+1}+2^{s+1}+2^s-1}+(x+y)^{2^{2s+1}+2^{s+1}+2^s-1}=0, \end{aligned}$$

rendering, in the same way as before, for $y=ax$ (under $0\ne x\ne y\ne 0$)

$$\begin{aligned} a^{2^s+2^{s+1}+2^{2s+1}-1}+a^{2^{s+1}+2^{2s+1}}+a^{2^s+2^{2 s+1}}+a^{2^s+2^{s+1}}+a^{2^{2 s+1}}+a^{2^{s+1}}+a^{2^s}+a=0. \end{aligned}$$

Since n is even, then we can take $a\in \mathbb {F}_{2^2}{\setminus } \mathbb {F}_2$, and so $a^3=1$, implying $a^2+a+1=0$. For such an a, observe that $\displaystyle a^{2^{s+1}}=a^{2^s}+1, a^{2^{2s+1}}=a^{2^{2s}}+1$, and the previous expression becomes

$$\begin{aligned}&a^{2^s-1} (a^{2^s}+1)(a^{2^{2s}}+1)+(a^{2^s}+1)(a^{2^{2s}}+1)+a^{2^s}(a^{2^{2s}}+1)\\&\qquad +a^{2^s}(a^{2^s}+1)+a^{2^{2s}}+1+a^{2^s}+1+a^{2^s}+a\\&\quad =a^{2^{2s}+2^{s+1}-1}+a^{2^{2s}+2^s-1}+a^{2^{s+1}-1}+a^{2^s-1}+a^{2^{2s}+2^s}+a^{2^{2s}}\\&\qquad +a^{2^s}+1+ a^{2^{2s}+2^s}+a^{2^{s}}+a^{2^{s+1}}+a^{2^s}+a^{2^{2s}}+a\\&\quad =a^{2^{2s}-1}(a^{2^s}+1)+a^{2^{2s}+2^s-1}+a^{2^{s+1}-1}+a^{2^s-1}+a^{2^s}+a^{2^s}+1+1+a\\&\quad =a^{2^{2s}+2^s-1}+a^{2^{2s}-1}+a^{2^{2s}+2^s-1}+a^{2^{s+1}-1}+a^{2^s-1}+a\\&\quad = a^{2^{2s}-1} +a^{2^{s+1}-1}+a^{2^s-1}+a =a^{-1}\left( a^{2^{2s}} +a^{2^{s+1}}+a^{2^s}+a^2 \right) \\&\quad =a^{-1}\left( a^{2^{2s}} +a^{2^{s}}+1+a^{2^s}+a^2 \right) =a^{-1}\left( a^{2^{2s}} +a^2+1 \right) =0, \end{aligned}$$

since $\displaystyle a^{2^{2s}}=a^{2^{2s-1}}+1=a^{2^{2s-2}}=\cdots =a^{2^{2s-2s}}=a$, and so $\displaystyle a^{2^{2s}} + a^2+1=a+a^2+1=0.$

Similarly, the Rodier equation for the 0-APN-ness of $f_7$ implies

$$\begin{aligned}&a^{2^s+2^{2 s}+2^{3 s}+2^{4s}}+a^{1+2^{2 s}+2^{3 s}+2^{4s}}+a^{1+2^s+2^{3 s}+2^{4s}}+a^{1+2^s+2^{2 s}+2^{4s}}\\&\quad +a^{1+2^s+2^{2 s}+2^{3 s}}+a^{1+2^{3 s}+2^{4s}}+a^{1+2^{2 s}+2^{4s}}+a^{1+2^{ s}+2^{4s}}+a^{1+2^{2 s}+2^{3s}}\\&\quad +a^{1+2^{s}+2^{3s}}+a^{1+2^{2s}+2^{s}}+a^{1+2^{4s}}+a^{1+2^{3s}}+ a^{1+2^{2s}}+a^{1+2^{s}}+a^2 = 0. \end{aligned}$$

Using a similar method as in the first part of our proposition, with n even, and taking $a\in \mathbb {F}_{2^2}{\setminus } \mathbb {F}_2$ and s odd, one can show that the above expression is zero, and so, $f_7$ is not 0-APN.

The Rodier equation for $f_8$ is

$$\begin{aligned} x^{2^{2s+1}+5}+y^{2^{2s+1}+5}+(x+y)^{2^{2s+1}+5}=0, \end{aligned}$$

which, when $y=ax$, $a\ne 0,1$, $x\ne 0$, becomes

$$\begin{aligned} 0&=1+a^{2^{2s+1}+5}+(1+a^{2^{2s+1}})(1+a)^5\\&=1+a^{2^{2s+1}+5}+\left( 1+a^{2^{2s+1}}\right) \left( 1+a+a^4+a^5\right) \\&=a+a^4+a^5+a^{2^{2s+1}}+a^{2^{2s+1}+1}+a^{2^{2s+1}+4}. \end{aligned}$$

Since n is even, we can take $a\in \mathbb {F}_{2^2}{\setminus } \mathbb {F}_2$, and so $a^3=1$, implying $a^2+a+1=0$. For such an a, observe that $a^4=a, a^5=a^2, a^{2^{2s+1}}=a^2, a^{2^{2s+1}+4}=a^{2^{2s+1}+1}$, and the previous expression becomes $a+a+a^2+a^{2}+a^{2^s+1}+a^{2^s+1} =0,$ implying that $f_8$ is not 0-APN. $\square$

4 Binomial partial APN functions

It was observed in [6] that if a monomial is 0-APN and $x_0$-APN for some $0 \ne x_0\in \mathbb {F}_{2^n}$, then it is APN. We also know that for any quadratic (n, n)-function F and for any $x_0 \in \mathbb {F}_{2^n}$, F is $x_0$-APN if and only if it is APN. Similarly, it was suggested and consequently shown in [6] that any partially 1-APN monomial function is APN. It is natural to wonder if such a statement is true for other types of functions. We give below an instance when such a claim fails.

Theorem 4.1

Let $F(x)=x^{2^n-1}+x^{2^n-2}$ be defined on $\mathbb {F}_{2^n}$. Then F is 1-APN, but not 0-APN, for all $n\ge 3$. Furthermore, F is differentially 4-uniform.

Proof

Let $F(x)=x^{2^n-1}+x^{2^n-2}$, and $x_0=1$. Then, the Rodier condition (1) becomes

$$\begin{aligned} x^{2^n-1}+x^{2^n-2}+y^{2^n-1}+y^{2^n-2}+(x+y+1)^{2^n-1}+(x+y+1)^{2^n-2}=0, \end{aligned}$$

which is equivalent to (since $x^{2^n-1}=1$, for $x\in \mathbb {F}_{2^n}^*$),

$$\begin{aligned} 1+x^{-1}+1+y^{-1}+1+(x+y+1)^{-1}=0, \text { assuming } xy(x+y+1)\ne 0. \end{aligned}$$

Multiplying the previous equation by $xy(x+y+1)$, we obtain

$$\begin{aligned}&y(x+y+1)+x(x+y+1)+xy(x+y+1)+xy=0 \\&\quad \Longleftrightarrow \ (x+y)(1+x)(1+y)=0, \end{aligned}$$

which proves the first claim.

To show that F is not 0-APN, let us consider the Rodier equation for $x_0=0$,

$$\begin{aligned}&x^{2^n-1}+x^{2^n-2}+y^{2^n-1}+y^{2^n-2}+(x+y)^{2^n-1}+(x+y)^{2^n-2}=0\nonumber \\&\quad \Longleftrightarrow \ 1+x^{-1}+1+y^{-1}+1+(x+y)^{-1}=0\nonumber \\&\quad \Longleftrightarrow \ y(x+y)+x(x+y)+xy(x+y)+xy=0\nonumber \\&\quad \Longleftrightarrow \ (x+y)^2 + xy(x+y)+xy=0\nonumber \\&\quad \Longleftrightarrow \ 1+\frac{xy}{x+y}+\frac{xy}{(x+y)^2}=0. \end{aligned}$$

(12)

We will find $0\ne x\ne y\ne 0$ to satisfy the previous equation. Let $t=x+y$. Then, the previous equation is equivalent to

$$\begin{aligned}&t^2+x(x+t)(t+1)=0, \ (\text {observe that }t\ne 1) \\&\quad \Longleftrightarrow \ x^2+tx +\frac{t^2}{t+1}=0\\&\quad \Longleftrightarrow \ \left( \frac{x}{t}\right) ^2+\frac{x}{t}+\frac{1}{t+1}=0. \end{aligned}$$

Labeling $z=\frac{x}{t}$, we obtain the equation

$$\begin{aligned} z^2+z+\frac{1}{t+1}=0. \end{aligned}$$

We now use the fact that for $0\ne v\in \mathbb {F}_{2^n}$ the equation $X^2+X=v$ has solutions in $\mathbb {F}_{2^n}$ if and only if $\mathrm Tr_{1}^n(v)=0$ (see Berlekamp et al. [1]). Taking any of the $2^{n-1} -1$ nontrivial values of $v\in \mathbb {F}_{2^n}^*$ for which $\mathrm Tr_{1}^n(v)=0$, $t=1+v^{-1}\ne 0$ and z a solution of $X^2+X=v$, we have that $x=tz,y=t(z+1)$ will satisfy Eq. (12) and $0\ne x\ne y\ne 0$, hence F is not 0-APN.

We next show that F is differentially 4-uniform. We first write the equation $D_aF(x) = b$, under $a \ne 0,b\in \mathbb {F}_{2^n}$, namely,

$$\begin{aligned} x^{2^n-1}+x^{2^n-2}+(x+a)^{2^n-1}+(x+a)^{2^n-2}=b, \end{aligned}$$

(13)

with $x\in \mathbb {F}_{2^n}$. Case 1. Let $b=1+a^{-1}$. We can see that $x=0$, $x=a$ are solutions of (13). Further, if $x\ne 0,x\ne a$, then (13) becomes $x^{2^n-2}+(x+a)^{2^n-2}=b$, which is equivalent to $x^{-1}+(x+a)^{-1}=b=1+a^{-1}$, that is,

$$\begin{aligned} (a+1) x^2+(a^2+a)x+a^2=0. \end{aligned}$$

(14)

We can see that $a\ne 1$ and so, $a^2+a\ne 0$, and therefore, by taking $y=x a^{-1}$, we obtain that (14) is equivalent to $y^2+y=(a+1)^{-1}$, which, by [1] has solutions y (and thus x) if and only if $\mathrm Tr_{1}^n((a+1)^{-1})=0$. There certainly exist $a \in \mathbb {F}_{2^n}$ satisfying this condition, in which case Eq. (14) has two more solutions, in addition to 0, a.

Case 2 Let $b\ne 1 + a^{-1}$. Then x is not equal to 0 or to a in (13) and so, the first and third terms are equal to 1, and (13) becomes

$$\begin{aligned} x^{-1}+(x+a)^{-1}=b, \end{aligned}$$

(15)

that is, $bx^2+abx+a=0$, which has at most two solutions x (in general, the equation above may have four solutions if $b=a^{-1}$, namely $\{0,a,a\alpha ,a\alpha ^2\}$, where $\alpha \in \mathbb {F}_{2^2}{\setminus } \mathbb {F}_2$, but we removed 0, a from the possibilities because of (13)). In fact, we know exactly when Eq. (15) has no solutions, namely, when $\mathrm Tr_{1}^n\left( \frac{1}{ab} \right) =1$.

In conclusion, Eq. (13) has at most 4 solutions (with that bound attained), and therefore F is differentially 4-uniform. $\square$

Remark 4.2

The non-0-APN-ness of the above function can also be derived from [6, Theorem 5.5], but we preferred to give a self-contained argument above.

5 Partial APN functions based on Dillon’s polynomial

Dillon [12] suggested investigating functions of the form

$$\begin{aligned} F(x)=x(Ax^2+B x^{2^k}+C x^{2^{k+1}})+x^2(Dx^{2^k}+E x^{2^{k+1}})+G x^{3\cdot {2^k}} \end{aligned}$$

(16)

over $\mathbb {F}_{2^n}$, with $n=2k$, as candidates for APN or differentially 4-uniform functions. An infinite family of APN functions of this type was constructed in [4]. In this section, we investigate several such functions for being partial APN functions, and consequently, APN functions (recall that we showed in [6] that for quadratic functions, pAPN property is equivalent to the APN property). The motivation for this section is to point out that any of the functions coming from F can be investigated quite easily for APN-ness using the not so restrictive concept of pAPN-ness.

First, we write the Rodier condition at $x_0=0$ for the function F above, which we generalize by taking arbitrary $1\le k\le n-1$. Now, letting $y=ax$, $a\ne 0,1,x\ne 0$, we obtain

$$\begin{aligned} \begin{aligned} 0&=A x^3(a+a^2)+B x^{2^k+1} \left( a+a^{2^k}\right) +C x^{2^{k+1}+1} \left( a+a^{2^{k+1}}\right) \\&\quad +\,D x^{2^k+2}\left( a^2+a^{2^k}\right) +E x^{2^{k+1}+2} \left( a^2+a^{2^{k+1}}\right) +G x^{2^{k+1}+2^k} \left( a^{2^k}+a^{2^{k+1}}\right) . \end{aligned}\nonumber \\ \end{aligned}$$

(17)

We will not provide the proof of the next theorem (whose proof is not that complicated, containing cases that are known via APN-ness), but we will provide the proof of the last theorem of this section, since it is more involved.

Theorem 5.1

Let $1\le k\le n-1$ and consider the function F from (16). The following functions are not $x_0$-APN for any $x_0\in \mathbb {F}_{2^n}$:

• (i) $F_1(x)=A x^3+B x^{2^k+1}$ if $AB\ne 0$, $\gcd (k-1,n)=1$, $k\ge 1$, and $F_2(x)= A x^3+C x^{2^{k+1}+1}$ if $AC\ne 0$ and $\gcd (k,n)=1$.

• (ii) $F_3(x)=A x^3+D x^{2^k+2}$ if $AD\ne 0$ and $\gcd (k,n)=1$, $k>1$.

• (iii) $F_4(x)=A x^3+E x^{2^{k+1}+2}$ if $AE\ne 0$ and $\gcd (k+1,n)=1$.

• (iv) $F_5(x)=A x^3+G x^{3\cdot 2^k}$ if $AG \ne 0$, $\frac{A}{G}\in {{\mathbb F}}_{2^n}^{2^k-1}$ and there exists z such that $\mathrm Tr_{1}^n((A/G)^{1/(2^k-1)}/z^3)=0$.

• (v) $F_6(x)=B x^{2^k+1}+C x^{2^{k+1}+1}$ if $BC\ne 0$ and $k\ge 1$.

• (vi) $F_7(x)=B x^{2^k+1}+D x^{2^k+2}$ if $BD\ne 0$.

• (vii) $F_8(x)= B x^{2^k+1}+E x^{2^{k+1}+2}$ if $BE\ne 0$, and $\gcd (k,n)>1$, or n is odd and $\gcd (k,n)=1$.

• (viii) $F_9(x)= B x^{2^k+1}+G x^{2^{k+1}+2^k}$ if $BG\ne 0$ and $\gcd (k+1,n)=1$.

• (ix) $F_{10}(x)=C x^{2^{k+1}+1}+D x^{2^k+2}$ if $CD\ne 0$ and $\gcd (k,n)=1$.

• (x) $F_{11}(x)=C x^{2^{k+1}+1}+E x^{2^{k+1}+2}$ if $CE\ne 0$.

• (xi) $F_{12}(x)=C x^{2^{k+1}+1}+G x^{2^{k+1}+2^k}$ if $CG\ne 0$.

• (xii) $F_{13}(x)=D x^{2^k+2}+E x^{2^{k+1}+2}$ if $DE\ne 0$.

• (xiii) $F_{14}(x)=D x^{2^k+2}+G x^{2^{k+1}+2^k}$ if $DG\ne 0$ and $\gcd (k,n)=1$.

• (xiv) $F_{15}(x)=E x^{2^{k+1}+2}+G x^{2^{k+1}+2^k}$ if $EG\ne 0$ and $\gcd (k-1,n)=1$.

We can certainly go beyond binomials and we do so in the next theorem without attempting to be exhaustive.

Theorem 5.2

Let Let $1\le k\le n-1$, $G\ne 0$, $\gcd (k,n)>1$, n odd, and $A/G\in \mathbb {F}_{2^n}^{2^k-1}$. Then $F_{16}(x)=A x^3+B x^{2^{k}+1}+E x^{2^{k+1}+2}+G x^{2^{k+1}+2^k}$ is not $x_0$-APN for any $x_0$.

Proof

The Rodier equation (17) for $F_{16}$ at $x_0=0$ is equivalent to

$$\begin{aligned}&x^3(a+a^2)\left( A+G x^{3\cdot (2^k-1)} (a+a^2 )^{2^k-1}\right) \\&\quad +x^{2^{k}+1} a \left( 1+a^{2^k-1}\right) \left( B+E x^{2^k+1}\left( a+a^{2^k}\right) \right) =0. \end{aligned}$$

If $\gcd (k,n)>1$, then taking $a\ne 0,1$ such that $a^{2^k-1}=1$, the second term is zero. Furthermore $(a+a^2)^{2^k-1}= a^{2^k-1} (a+1)^{2^k-1}=\frac{(a+1)^{2^k}}{a+1}= \frac{a^{2^k}+1}{a+1}=\frac{a+1}{a+1}=1$, and so the first term becomes $x^3(a+a^2)\left( A+G x^{3\cdot (2^k-1)}\right)$, which is zero for the unique solution x of $x^3=\left( \frac{A}{G}\right) ^{1/(2^k-1)}$, which exists since n is odd (that is, $\gcd (3,2^n-1) = 1$).

A quadratic function is pAPN for some $x_0$ if and only if it is APN [6]. Hence the claim of the theorem follows. $\square$

We now replace $2^{k}$ by $2^{k}+1$ in Dillon’s polynomial (16).

Theorem 5.3

Let $1\le k\le n-1$. The following statements hold:

• (i) If $AC\ne 0$, then the functions $H_1(x)=Ax^3+Cx^{2^{k+1}+3}$ (respectively, $H_2(x)=Ax^3+Cx^{2^k+3}$) is not 0-APN.

• (ii) If $AG\ne 0$, then the functions $H_3(x)=Ax^3+Gx^{2^{k+1}+2^k+3}$ is not 0-APN if n is odd; if n is even, then $H_3$ is 0-APN if and only if $\left( \frac{A}{G}\right) ^{2^{-k}}\notin \{u^3\,:\,x\in \mathbb {F}_{2^n}\}$.

• (iii) If $BC\ne 0$, and $\gcd (2^k+1,2^n-1)=1$, which happens if n is odd, or $n\equiv 2\pmod 4$ and k is even, then $H_4(x)=Bx^{2^k+2}+C x^{2^{k+1}+3}$ is not 0-APN.

• (iv) If $BD\ne 0$, $H_5(x)=Bx^{2^k+2}+D x^{2^k+3}$ is never 0-APN.

• (v) If $BG\ne 0$, and $\gcd (2^{k+1}+1,2^n-1)=1$ (which happens if n is odd, or $n\equiv 2\pmod 4$ and k is odd), then $H_6(x)=Bx^{2^k+2}+G x^{2^{k+1}+2^k+3}$ is not 0-APN.

• (vi) If $CDEG\ne 0$, then $H_7(x)=C x^{2^{k+1}+3}+D x^{2^k+3}$, $H_8(x)=C x^{2^{k+1}+3}+E x^{2^{k+1}+4}$, and $H_9(x)=C x^{2^{k+1}+3}+G x^{2^{k+1}+2^k+3}$ are never 0-APN.

• (vii) If $DE\ne 0$, and $\gcd (2^k+1,2^n-1)=1$, which happens if n is odd, or $n\equiv 2\pmod 4$ and k is even, then $H_{10}(x)=D x^{2^k+3}+E x^{2^{k+1}+4}$ is not 0-APN.

• (viii) If $DG\ne 0$, then $H_{11}(x)= D x^{2^k+3}+G x^{2^{k+1}+2^k+3+1}$ is never 0-APN.

• (ix) If $EG\ne 0$ and $gcd(k,n)=1$, then $H_{12}(x)=E x^{2^{k+1}+4}+G x^{2^{k+1}+2^k+3}$ is not 0-APN.

Proof

Let us replace $2^{k}$ by $2^{k}+1$ in Dillon’s polynomial (16); as before, letting $y=ax$, $x\ne 0$, $a\ne 0,1$, in the Rodier equation for Dillon’s polynomial we obtain

$$\begin{aligned} 0&= Ax^3(a+a^2)+Bx^{2^k+2} \left( a^2+a^{2^k}\right) \nonumber \\&\quad +Cx^{2^{k+1}+3}\left( a+a^2+a^3+a^{2^{k+1}}+a^{2^{k+1}+1}+a^{2^{k+1}+2}\right) \nonumber \\&\quad + Dx^{2^k+3} \left( a+a^2+a^3+a^{2^k}+a^{2^k+1}+a^{2^k+2}\right) \nonumber \\&\quad +Ex^{2^{k+1}+2^2} \left( a^4+a^{2^{k+1}}\right) +G x^{2^{k+1}+2^k+3}\left( a^{2^{k+1}+2^k+3}+(a+1)^{2^{k+1}+2^k+3}+1 \right) \nonumber \\&=Ax^3(a+a^2)+Bx^{2^k+2} \left( a^2+a^{2^k}\right) +Cx^{2^{k+1}+3}\left( 1+a+a^2\right) \left( a+a^{2^{k+1}}\right) \nonumber \\&\quad +Dx^{2^k+3}\left( 1+a+a^2\right) \left( a+a^{2^k}\right) +Ex^{2^{k+1}+2^2} \left( a^4+a^{2^{k+1}}\right) \nonumber \\&\quad +G x^{2^{k+1}+2^k+3} \left( a^{2^{k+1}+2^k+3}+(a+1)^{2^{k+1}+2^k+3}+1 \right) . \end{aligned}$$

(18)

We only consider combinations rendering non-quadratic functions. Let $AC\ne 0$, $H_1(x)=Ax^3+Cx^{2^{k+1}+3}$ (similarly, for $AD\ne 0$, $H_2(x)=Ax^3+Dx^{2^k+3}$). The Rodier equation (18) for $H_1$ at 0 is therefore

$$\begin{aligned} \displaystyle Ax^3(a+a^2)= Cx^{2^{k+1}+3}\left( 1+a+a^2\right) \left( a+a^{2^{k+1}}\right) , \end{aligned}$$

that is $x^{2^{k+1}}=\frac{A(1+a)}{C\left( 1+a+a^2\right) \left( 1+a^{2^{k+1}-1}\right) }$ (recall that $a\ne 0,1$ and if a is a primitive third root of unity then the displayed equation above cannot hold for nontrivial solutions x). Since this last equation always has nontrivial solutions, the function $H_1$ cannot be 0-APN.

Next, $H_3(x)=Ax^3+G x^{2^{k+1}+2^k+3}$ whose Rodier equation at 0 is

$$\begin{aligned} Ax^3(a+a^2)=G x^{2^{k+1}+2^k+3}\left( a^{2^{k+1}+2^k+3}+(a+1)^{2^{k+1}+2^k+3}+1 \right) , \end{aligned}$$

which is equivalent to (the expression in the parentheses on the right-hand side cannot be zero, otherwise there are no non-trivial solutions)

$$\begin{aligned} x^{3\cdot 2^k} =\frac{A (a+a^2)}{G\, \left( a^{2^{k+1}+2^k+3}+(a+1)^{2^{k+1}+2^k+3}+1 \right) }. \end{aligned}$$

(19)

If n is odd, then Eq. (19) will always have nontrivial solutions. If n is even, taking $2^k$-th roots on both sides, we obtain

$$\begin{aligned} u^{3} =\left( \frac{A}{G}\right) ^{2^{-k}}, \end{aligned}$$

where

$$\begin{aligned} u=x \left( \frac{ a^{2^{k+1}+2^k+3}+(a+1)^{2^{k+1}+2^k+3}+1}{a+a^2}\right) ^{2^{-k}} \end{aligned}$$

is any of the $2^k$ roots. The claim is inferred.

Next, take $BC\ne 0$, and $H_4(x)=Bx^{2^k+2}+C x^{2^{k+1}+3}$. The Rodier equation at 0 is now

$$\begin{aligned} x^{2^k+1}=\frac{B\left( a^2+a^{2^k}\right) }{C\left( 1+a+a^2\right) \left( a+a^{2^{k+1}}\right) }. \end{aligned}$$

If $\gcd (2^k+1,2^n-1)=1$ (which happens if n is odd, or $n\equiv 2\pmod 4$ and k is even), then the equation above has nontrivial solutions (certainly, for example, for a such that $a\notin \mathbb {F}_{4}^*$).

If $BD\ne 0$, then it is straightforward to check that the cubic $H_5(x)=Bx^{2^k+2}+D x^{2^k+3}$ is never 0-APN, since its Rodier equation at 0 is equivalent to

$$\begin{aligned} x=\frac{B\left( a^2+a^{2^k}\right) }{D\left( 1+a+a^2\right) \left( a+a^{2^k}\right) }, \end{aligned}$$

which obviously has nontrivial solutions (certainly, for a such that the denominator above is not zero).

If $BG\ne 0$, then the Rodier equation at 0 for $H_6(x)=Bx^{2^k+2}+G x^{2^{k+1}+2^k+3}$ is

$$\begin{aligned} x^{2^{k+1}+1}=\frac{B\left( a^2+a^{2^k}\right) }{G\, \left( a^{2^{k+1}+2^k+3}+(a+1)^{2^{k+1}+2^k+3}+1\right) }. \end{aligned}$$

If $\gcd (2^{k+1}+1,2^n-1)=1$ (which happens if n is odd, or $n\equiv 2\pmod 4$ and k is odd), then the equation above has nontrivial solutions (certainly, for a such that the denominator above is not zero, which can easily be achieved).

If $CD\ne 0$, the Rodier equation at 0 for the cubic $H_7(x)=C x^{2^{k+1}+3}+D x^{2^k+3}$ is

$$\begin{aligned} x^{2^k} =\frac{D\left( a+a^{2^k}\right) }{C\left( a+a^{2^{k+1}}\right) }. \end{aligned}$$

Since $\gcd (2^k,2^n-1)=1$, the above equation always has nontrivial solutions (for an a that is not a $(2^{k+1}-1)$ root of 1). A similar straightforward analysis can be done, under $CEG\ne 0$, for the cubics $H_8(x)=C x^{2^{k+1}+3}+E x^{2^{k+1}+4}$ and $H_9(x)=C x^{2^{k+1}+3}+G x^{2^{k+1}+2^k+3}$.

If $DE\ne 0$, the Rodier equation at 0 for $H_{10}(x)=D x^{2^k+3}+E x^{2^{k+1}+4}$ renders

$$\begin{aligned} x^{2^k+1} = \frac{D(1+a+a^2) \left( a+a^{2^k}\right) }{E\left( a^4+a^{2^{k+1}}\right) }, \end{aligned}$$

a similar equation as for $H_4$. If $DG\ne 0$, the Rodier equation at 0 for $H_{11}(x)= D x^{2^k+3}+G x^{2^{k+1}+2^k+3}$ is similar to the one of $H_7$.

If $EG\ne 0$, the Rodier equation for the quartic $H_{12}(x)=E x^{2^{k+1}+4}+G x^{2^{k+1}+2^k+3}$ is equivalent to

$$\begin{aligned} x^{2^k-1}=\frac{E\left( a^4+a^{2^{k+1}}\right) }{G\, \left( a^{2^{k+1}+2^k+3}+(a+1)^{2^{k+1}+2^k+3}+1\right) }, \end{aligned}$$

which has a nontrivial solution x if $\gcd (k,n)=1$ (for any value of a for which the denominator does not vanish).

Thus, the theorem is shown. $\square$

Certainly, there are other values of q, for which one can investigate the pAPN property of various combinations of terms in Dillon’s polynomial. Furthermore, a fruitful direction for future work is to check and find conditions for pAPN-ness of other classes of multinomials, like the generalization proposed by Budaghyan and Carlet in [4], or perhaps, as a separate and quite interesting venue, to find classes of pAPN permutations.