Non Abelian bent functions

Abstract

Perfect nonlinear functions from a finite group G to another one H are those functions f: G →H such that for all nonzero α ∈ G, the derivative $d_{\alpha}f: x \mapsto f(\alpha x) f(x)^{-1}$ is balanced. In the case where both G and H are Abelian groups, f: G →H is perfect nonlinear if, and only if, f is bent, i.e., for all nonprincipal character χ of H, the (discrete) Fourier transform of χ ∘ f has a constant magnitude equals to |G|. In this paper, using the theory of linear representations, we exhibit similar bentness-like characterizations in the cases where G and/or H are (finite) non Abelian groups. Thus we extend the concept of bent functions to the framework of non Abelian groups.

1 Introduction

Let G and H be two finite groups (in multiplicative representation). Perfect nonlinear functions from G to H are those ideal functions f: G →H that match the less possible with the pattern of group homomorphism, i.e., such that for all nonzero α ∈ G and for all β ∈ H,

$$ |\{x \in G | f(\alpha x) f(x)^{-1} = \beta \}| = \displaystyle \frac{|G|}{|H|}. $$

(1)

When G and H are both (finite-dimensional) vector spaces over ℤ₂ = {0,1}, these functions, originally introduced by Nyberg [9], exhibit the maximal resistance against the differential attack [1]. Also in the Boolean case, this notion is known to be equivalent to bent functions: $f: {\mathbb{Z}}_2^m \rightarrow {\mathbb{Z}}_2^n$ is bent if for all $\alpha \in {\mathbb{Z}}_2^m$ and for all nonzero β in ${\mathbb{Z}}_2^n$,

$$ \left|\widehat{(\chi^{\beta}_{{\mathbb{Z}}_2^n} \circ f)}(\alpha)\right|^2 = 2^m $$

(2)

where $\chi^{\beta}_{{\mathbb{Z}}_2^n}: {\mathbb{Z}}_2^n \rightarrow \{\pm 1\}$ is defined at y by ( − 1)^β.y (the point in exponent is the natural dot-product of ${\mathbb{Z}}_2^n$) and

$$ \widehat{\phi}(\alpha) = \displaystyle \sum\limits_{x \in {\mathbb{Z}}_2^m}\phi(x)(-1)^{\alpha.x} $$

(3)

is the Fourier transform of ϕ: G →ℂ (this time α.x is the dot-product in ${\mathbb{Z}}_2^m$). These functions, introduced by Rothaus [15] (see also [3]), exhibit the maximal resistance against the linear attack [8].

The equivalence between bentness and perfect nonlinearity has been recently extended by Carlet and Ding [2] and Pott [14] to the general case: f: G →H (where G and H are two finite Abelian groups) is perfect nonlinear if, and only if, for all α ∈ G and for all nonprincipal character χ of H,

$$ \left|\widehat{(\chi \circ f)}(\alpha)\right|^2 = \left|G\right| $$

(4)

where for ϕ: G →ℂ, $\widehat{\phi}$ is its discrete Fourier transform (see Section 3.2).

In this paper, we exhibit the same kind of dual characterizations in the case where at least one of the two finite groups G and H is non Abelian. This gives a general equivalence between perfect nonlinearity and bentness. Actually the notion of bentness is defined to be equivalent to perfect nonlinearity in those non Abelian cases.

Outline of the paper  Next section contains the general notations used in the paper. In Section 3 are recalled some of the main results on the duality of finite groups. In particular, we present several kind of Fourier transforms used in the new characterizations of perfect nonlinearity in the non Abelian cases. The notion of perfect nonlinearity is exposed in the general framework of finite groups in Section 4. Also in this section is given the dual characterization—i.e., the notion of bentness—of Carlet and Ding [2] and Pott [14] of perfect nonlinear functions in the Abelian groups setting. Finally our own results of non Abelian bentness are developed in Section 5.

2 Notations

|S| is the cardinality of any finite set S and if S is nonempty (possibly infinite), ${\mathit{Id}}_S$ denotes its identity map.

In this paper, the capital letters “G” and “H” always denote finite groups in multiplicative representation, e _G is the neutral element and G ^* is defined as G ∖ {e _G } (note that ℂ^* = ℂ ∖ {0}).

The vector spaces considered are always finite-dimensional complex vector spaces. For a (complex) vector space V, 0 _V is its zero, $\dim_{{\mathbb{C}}}(V)$ is its dimension and ${\mathit{GL}}(V)$ denotes the linear group of V which is a subset of the vector space of all linear endomorphisms of V, denoted ${\mathit{End}}(V)$. Now, suppose that V comes equipped with an inner-product $\langle\cdot,\cdot\rangle_V$ (so that $(V,\langle\cdot,\cdot\rangle_V$ is an Hermitian space). With respect to this Hermitian structure, if λ is any linear map, λ ^* denotes its adjoint and the unitary group of V is ${\mathbb{U}}(V)$.

By convention, for each known result recalled in this paper, the proof has been intentionally omitted and a reference—not necessarily the original reference—is given. On the contrary, our own results are obviously given with their proofs and without any reference.

3 On the duality of finite groups

3.1 Introduction

This paper is dedicated to the establishment of a dual characterization of the concept of perfect nonlinearity—similar to the one given by Carlet and Ding [2] and Pott [14] concerning Abelian groups—in the non Abelian groups setting, using some harmonic analysis techniques. So in this section, we recall some basics about the duality of finite groups and the Fourier transform. Most of the definitions and results given in this section are well-known and can be found in any book on finite groups ([4, 10] for instance).

3.2 The Abelian case

3.2.1 The theory of characters

Definition 1

Let G be a finite group. A character (also called one-dimensional representation or linear character) χ of G is a group homomorphism from G to the multiplicative group ℂ^*. We denote by $\widehat{G}$ the set of all characters, called dual of G.

The set $\widehat{G}$ is actually a group under the point-wise multiplication of characters and its elements belong to the group of the $|G|^{\mathit{th}}$ complex roots of the unity. In particular,

$$ \forall \chi \in \widehat{G},\ \forall x \in G,\ |\chi(x)| = 1\ \mbox{and}\ \chi(x^{-1}) = \overline{\chi(x)} $$

(5)

where |z| is the complex modulus and $\overline{z}$ is the conjugate of z ∈ ℂ.

Proposition 1

([5] p. 367, [10] p. 8) Let G be a finite Abelian group. Then G and $\widehat{G}$ are isomorphic.

In the remainder of this paper, when a finite Abelian group G is considered, we always implicitly suppose that an isomorphism from G to G ^* has been fixed and we use $\chi_G^{\alpha}$ to denote the image of α under this isomorphism. In particular, ∀ x ∈ G, $\chi^{e_G}_G (x) = 1$ (this character is called trivial or principal). Finally the characters satisfy the well-known orthogonality properties.

Lemma 1

([2] p. 214, [10] pp. 9–10) Let G be a finite Abelian group. For all α ∈ G we have

$$ \displaystyle \sum\limits_{x \in G} \chi_G^{\alpha}(x) = \left\{ \begin{array}{l l} 0 & \mbox{if}\ \alpha \in G^*,\\ |G| & \mbox{if}\ \alpha = e_G. \end{array} \right. $$

(6)

For all x ∈ G, we have

$$ \displaystyle \sum\limits_{\alpha \in G} \chi_G^{\alpha}(x) = \left\{ \begin{array}{l l} 0 & \mbox{if}\ x \in G^*,\\ |G| & \mbox{if}\ x = e_G. \end{array} \right. $$

(7)

3.2.2 The (discrete) Fourier transform

Definition 2

Let G be a finite Abelian group. The Fourier transform of ϕ: G →ℂ is the map $\widehat{\phi}: G \rightarrow {\mathbb{C}}$ defined for α ∈ G by

$$ \displaystyle \widehat{\phi}(\alpha) = \sum\limits_{x \in G} \phi(x)\chi^{\alpha}_G (x). $$

(8)

Some well-known and useful results are summarized below for G a finite Abelian group.

Proposition 2

([2] p. 215, [10] p. 15) Let ϕ: G →ℂ.

• 1. We have the inversion formula

  $$ \phi = \displaystyle \frac{1}{|G|}\sum\limits_{\alpha \in G}\widehat{\phi}(\alpha) \overline{\chi^{\alpha}_G}; $$

  (9)

• 2. We have the Parseval’s equation

  $$ \displaystyle \sum\limits_{x \in G}\left|\phi(x)\right|^2 = \frac{1}{|G|}\sum\limits_{\alpha \in G}\left|\widehat{\phi}(\alpha)\right|^2; $$

  (10)

• 3. ϕ(x) = 0 ∀ x ∈ G ^* if, and only if, $\widehat{\phi}$ is constant;

• 4. $\widehat{\phi}(\alpha) = 0$ ∀ α ∈ G ^* if, and only if, ϕ is constant.

The third and fourth points are stated in [2] p. 215.

3.2.3 The multidimensional (discrete) Fourier transform

In Section 5.2 of Section 5, we consider some V-valued functions, where V is a finite-dimensional vector space, defined on a finite Abelian group G, and we need to compute their “Fourier transforms” in some natural sense. That is the reason why we now introduce a natural extension of the discrete Fourier transform, called multidimensional Fourier transform, to deal with V-valued functions rather than ℂ-valued ones. This is a straightforward extension of the usual Fourier transform which, at our knowledge, is not presented in any mathematical textbooks. However more details on this transform may be found in [12, 13].

Definition 3

Let G be a finite Abelian group, V a finite-dimensional vector space over ℂ and ϕ: G →ℂ. The multidimensional Fourier transform of ϕ is defined as

$$ \begin{array}{l l l l} \widehat{\phi}^{\mathrm{MD}}: & G & \rightarrow & V\\ & \alpha & \mapsto & \displaystyle \sum\limits_{x \in G}\chi^{\alpha}_G (x) \phi(x). \end{array} $$

(11)

Let us fix a basis B of V. For each e ∈ B, we define the component function ϕ _e of ϕ: G →V in direction e as the map

$$ \begin{array}{l l l l} \phi_e: & G & \rightarrow & {\mathbb{C}}\\ & x & \mapsto & \pi_e(\phi(x)). \end{array} $$

(12)

where π _e :V→ℂ is the orthogonal projection onto ℂ ≅ ℂe with respect to the direct sum decomposition $V=\bigg(\bigoplus\limits_{e^{\prime}\in B\setminus\{e\}}\mathbb{C}e^{\prime}\bigg)\oplus\mathbb{C}e$. According to properties of bases, we have ∀ x ∈ G,

$$ \phi (x) = \displaystyle \sum\limits_{e \in B} \phi_e(x) e. $$

(13)

We can easily check that the multidimensional Fourier transform is actually a component-wise discrete Fourier transform given by the following equation (for α ∈ G)

$$ \widehat{\phi}^{\mathrm{MD}}(\alpha) = \displaystyle \sum\limits_{e \in B} \widehat{\phi_e}(\alpha) e. $$

(14)

Indeed,

$$ \begin{array}{rll} \widehat{\phi}^{\mathrm{MD}}(\alpha)&=&\displaystyle\sum\limits_{x\in G}\chi_{G}^{\alpha}(x)\phi(x)\\ &=&\displaystyle\sum\limits_{x\in G}\chi_G^{\alpha}(x)\sum\limits_{e\in B}\phi_e(x)e\\ &=&\displaystyle\sum\limits_{e\in B}\left( \sum\limits_{x\in G}\chi_G^{\alpha}(x)\phi(x)\right )e\\ &&\mbox{(since both sums have only f\/initely many terms)}\\ &=&\displaystyle\sum\limits_{e\in B}\widehat{\phi_e}(\alpha)e\ . \end{array} $$

(15)

Note that according to the uniqueness of the decomposition in a basis, from equality (14), we obtain $(\widehat{\phi}^{\,\mathrm{MD}})_e=\widehat{\phi_e}$. Note also that whenever V is one-dimensional, we recover the usual definition of the Fourier transform.

Example 1

• 1. Suppose that we have $\phi\colon G \rightarrow \mathbb{C}^n$. Then for every x ∈ G, ϕ(x) = (ϕ ₁(x), ⋯ ,ϕ _n (x)). Therefore, for every α ∈ G, $\widehat{\phi}^{\,\mathrm{MD}}(\alpha)=(\widehat{\phi_1}(\alpha),\cdots,\widehat{\phi_n}(\alpha))$ which explains the term “component-wise Fourier transform” used above.

• 2. Suppose that we have $\phi\colon G \rightarrow \mathbb{C}^{2\times 2}$, where, for any non-negative integers m,n, ℂ^m×n denotes the vector space of m by n matrices. For every x ∈ G,$\phi(x)=\begin{matrix} \phi_{1,1}(x)& \phi_{1,2}(x)\\ \phi_{2,1}(x) & \phi_{2,2}(x)\end{matrix}$ and for every α ∈ G,$\widehat{\phi}^{\,\mathrm{MD}}(\alpha)=\begin{array}{rl} \widehat{\phi_{1,1}}(\alpha)& \widehat{\phi_{1,2}}(\alpha)\\ \widehat{\phi_{2,1}}(\alpha) & \widehat{\phi_{2,2}}(\alpha)\end{array}\ .$

Note that, despite equality (14), the multidimensional Fourier transform is independent of the choice of the basis B as showed by its definition. Using the equation (14), we can establish an inversion formula for the multidimensional Fourier transform. Let x ∈ X.

$$ \begin{array}{rll} \phi (x) &=& \displaystyle \sum\limits_{e \in B} \phi_e (x) e \\ &=& \displaystyle \sum\limits_{e \in E} \left( \frac{1}{|G|} \sum\limits_{\alpha \in G} \widehat{\phi_e}(\alpha) \overline{\chi^{\alpha}_G}(x)\right)e\\ &&\mbox{(by the inversion formula applied on $\phi_e$)}\\ &=&\displaystyle \frac{1}{|G|} \sum\limits_{\alpha \in G}\overline{\chi^{\alpha}_G (x)} \left( \sum\limits_{e \in B} \widehat{\phi_e}(\alpha) e\right)\\ &=& \displaystyle \frac{1}{|G|} \sum\limits_{\alpha \in G} \overline{\chi^{\alpha}_G (x)} \widehat{\phi}^{\,\mathrm{MD}}(\alpha). \end{array} $$

(16)

This inversion formula is also independent of the choice of the basis. Finally this transform satisfies a result similar to the third point of Proposition 2.

Proposition 3

Let G be a finite Abelian group, V a finite-dimensional vector space over ℂ and ϕ: G →V. We have ϕ(x) = 0 _V for all x ∈ G ^* if, and only if, $\widehat{\phi}^{\,\mathrm{MD}}(\alpha) = \phi (e_G)$ for all α ∈ G.

Proof

• ⇒) Suppose that for all x ∈ G ^*, ϕ(x) = 0 _V . Then we have ∀ α ∈ G, $\widehat{\phi}^{\,\mathrm{MD}}(\alpha) = \sum\limits_{x \in G} \chi^{\alpha}_G (x) \phi(x) = \phi(e_G)$.

• ⇒) Suppose that $\widehat{\phi}^{\,\mathrm{MD}}(\alpha) = \phi (e_G)$ for all α ∈ G. Using the inversion formula (16), we get that for x ∈ G,

  $$ \phi(x) = \frac{1}{|G|}\left(\sum\limits_{\alpha \in G} \overline{\chi^{\alpha}_G (x)}\right) \phi(e_G) = \left \{ \begin{array}{l l} 0_{V} & \mbox{if}\ x \in G^*,\\ \phi(e_G) & \mbox{if}\ x = e_G, \end{array}\right . $$

  according to the orthogonality relations (Lemma 1).□

3.3 The non Abelian case

3.3.1 The theory of linear representations

In this subsection are recalled some basics on the theory of linear representations. The definitions and results may be found in any textbooks on the subject (see for instance [6, 16]).

Definition 4

Let V be a finite-dimensional complex vector space. A linear representation of a finite group G on V is a group homomorphism from G to ${\mathit{GL}}(V)$.

For each linear representation $\rho: G \rightarrow {\mathit{GL}}(V)$, it is possible to find a basis of V in which for all x ∈ G, ρ(x) is a unitary operator of V, i.e., $\rho: G \rightarrow {\mathbb{U}}(V)$. Indeed, we can check that for a linear representation ρ of G on V, for each x ∈ G, ρ(x) leaves invariant the following inner-product in V

$$ \langle u,v\rangle_{G,\rho,V} = \displaystyle \sum\limits_{x \in G} \langle \rho(x)(u),\rho(x)(v)\rangle_V $$

(17)

where (u, v) ∈ V ² and $\langle .,.\rangle_V$ denotes any inner-product of V (linear in the first variable and anti-linear in the second). Then in the remainder, without loss of generality, we only consider unitary representations and we denote by $\langle\cdot,\cdot\rangle_{G,\rho,V}$ a fixed inner-product on V which is kept invariant under ρ.

The linear representations of G on ℂ can be identified with the characters of G since ℂ^* and ${\mathit{GL}}({\mathbb{C}})$ are isomorphic groups.

Definition 5

A linear representation ρ of a finite group G on V is said to be irreducible if there is no subspace W ⊂ V, other than {0 _V } and V, such that ∀ x ∈ G, ∀ w ∈ W, ρ(x)(w) ∈ W.

Actually if G is a finite Abelian group then the notion of irreducible linear representation gives nothing new because it is equivalent to the notion of character (by the trace).

Definition 6

Two linear representations ρ and ρ′ of a finite group G on respectively V and V′ are isomorphic if there exists a linear isomorphism Φ: V →V′ such that for all x ∈ G,

$$ \Phi \circ \rho (x) = \rho' (x) \circ \Phi. $$

(18)

(A linear map that satisfies equality (18) is called equivariant map and is easily seen to be a morphism from V to V′ seen as left G-modules, see [6, 16].)

The notion of isomorphism is an equivalence relation for linear representations.¹

Definition 7

For a finite group G, the dual of G, denoted $\widetilde{G}$, is a set that contains exactly one and only one representative of each equivalence class of isomorphic irreducible representations of G.

By definition, if $(\rho,\rho') \in \widetilde{G}^2$ are distinct, then ρ and ρ′ are nonisomorphic irreducible representations of G. In the remainder, the notation

$$ \rho = \rho_V \in \widetilde{G} $$

(19)

means that $\rho: G \rightarrow {\mathbb{U}}(V)$ is an irreducible representation of G.

If G is a finite Abelian group, then $\widetilde{G}$ is equal to $\widehat{G}$ (up to a group isomorphism from ${\mathit{GL}}({\mathbb{C}})$ to ℂ^*). If G is a finite non Abelian group, the two notions of duality become distinct (in particular, $\widetilde{G}$ is not a group). By abuse of notation, $\widetilde{G}^*$ is defined as the set $\widetilde{G} \setminus \{\rho_0\}$ where ρ ₀ is the trivial or principal representation of G, i.e., ∀ x ∈ G, $\rho_0(x) = {\mathit{Id}}_{{\mathbb{C}}}$.

When dealing with linear representations, a major result, know as Schur’s lemma (see for instance chapter 9 of [6]), should be kept in mind.

Lemma 2

([6, 10], [7] p. 25) Let G be a finite group. Let $\rho = \rho_V \in \widetilde{G}$ and $\lambda \in {\mathit{End}}(V)$ . If ∀ x ∈ G, λ ∘ ρ(x) = ρ(x) ∘ λ then λ is a multiple of the identity, i.e., there exists k ∈ ℂ such that $\lambda = k {\mathit{Id}}_V$ .

As direct consequences of the Schur’s lemma, we can state the two following results that will be use in the sequel. (The first one is also given in [16] p. 18 as Corollary 2.)

Lemma 3

([10]) Let G be a finite group. For x ∈ G ^* ,

$$ \displaystyle \sum\limits_{\rho_V \in \widetilde{G}} \dim_{{\mathbb{C}}}(V) {\mathit{tr}}(\rho_V (x)) = 0 $$

(20)

where “ ${\mathit{tr}}$ ” denotes the usual trace of endomorphisms.

Lemma 4

Let G be a finite group. Let $\rho = \rho_V \in \widetilde{G}^*$ . Then

$$ \displaystyle \sum\limits_{x \in G}\rho(x) = 0_{{\mathrm{End}}(V)}. $$

(21)

Proof

Let $\lambda \in {\mathit{End}}(V)$ defined as $\lambda = \displaystyle \sum\limits_{x \in G} \rho(x)$. Let x ₀ ∈ G. We have

$$ \lambda = \displaystyle \sum\limits_{x \in G}\rho(x) = \sum\limits_{x \in G} \rho(x_0 x) = \rho(x_0) \circ \sum\limits_{x \in G} \rho(x) = \rho(x_0) \circ \lambda $$

but also

$$ \lambda = \displaystyle \sum\limits_{x \in G}\rho(x) = \sum\limits_{x \in G} \rho(x x_0) = \left(\sum\limits_{x \in G} \rho(x)\right) \circ \rho(x_0) = \lambda \circ \rho(x_0). $$

In particular λ ∘ ρ(x ₀) = ρ(x ₀) ∘ λ. As it is true for any x ₀ ∈ G, λ commutes with all ρ(x). By Schur’s lemma, λ is a multiple of the identity: there exists k ∈ ℂ such that $\lambda = k {\mathit{Id}}_{V}$. Now suppose $\lambda \not = 0_{{\mathrm{End}}(V)}$, then k ∈ ℂ^*. Using the first part of the proof, we know that λ = ρ(x) ∘ λ (for each x ∈ G). Then $({\mathit{Id}}_V - \rho(x)) \circ \lambda = 0_{{\mathrm{End}}(V)}$. As $\lambda = k {\mathit{Id}}_V$, we have $({\mathit{Id}}_V - \rho(x)) \circ (k {\mathit{Id}}_V) = 0_{{\mathrm{End}}(V)}$. Since $k \not = 0$, we have ${\mathit{Id}}_V - \rho(x) = 0_{{\mathrm{End}}(V)}$ or also $\rho(x) = {\mathit{Id}}_V$ which is a contradiction with the assumption that ρ is non trivial. □

Example 2

It is a good exercice to show that the symmetric group $\mathfrak{S}_3$ of degree 3 has two one-dimensional representations (obviously irreducible), namely the trivial one and the sign morphism σ, and one two-dimensional irreducible representation θ given in a suitable basis by

$$ \begin{array}{lll} \theta(\mathit{id})&=&\begin{pmatrix}1&0\\0&1\end{pmatrix}, \theta(23)=\begin{pmatrix} 1 & 0\\0& -1\end{pmatrix},\quad \theta(13)=\begin{pmatrix}\cos(\frac{2\pi}{3})&\sin(\frac{2\pi}{3})\\[3pt]\sin(\frac{2\pi}{3})& -\cos(\frac{-2\pi}{3})\end{pmatrix}, \\ \theta(12)&=&\begin{pmatrix}\cos(\frac{-2\pi}{3})&\sin(\frac{-2\pi}{3})\\[3pt]\sin(\frac{-2\pi}{3})& -\cos(\frac{-2\pi}{3})\end{pmatrix},\quad \theta(123)=\begin{pmatrix}\cos(\frac{-2\pi}{3})&-\sin(\frac{-2\pi}{3})\\[3pt]\sin(\frac{-2\pi}{3})& \cos(\frac{-2\pi}{3})\end{pmatrix} \mbox{ and} \\ \theta(132)&=&\begin{pmatrix}\cos(\frac{2\pi}{3})&-\sin(\frac{2\pi}{3})\\[3pt]\sin(\frac{2\pi}{3})& \cos(\frac{2\pi}{3})\end{pmatrix}. \end{array} $$

3.3.2 The representation-based Fourier transform

By substituting irreducible linear representations to characters, it is possible to define a kind of Fourier transform for finite non Abelian groups.²

Let G be any finite group.

Definition 8

Let ϕ: G →ℂ. The (representation-based) Fourier transform of ϕ is defined for $\rho = \rho_V \in \widetilde{G}$ as

$$ \widetilde{\phi}(\rho) = \displaystyle \sum\limits_{x \in G} \phi(x) \rho(x) \in {\mathit{End}}(V). $$

(22)

This notion is a generalization of the classical discrete Fourier transform.

Example 3

Using the representations given in Example 2, the following values for the representation-based Fourier transform of a map $\phi:\mathfrak{S}_3\rightarrow\mathbb{C}$ are obtained.

$$ \begin{array}{rll} \widetilde{\phi}(\rho_0)&=&\phi(\mathit{id})+\phi(12)+\phi(13)+\phi(23)+\phi(123)+\phi(132)\in\mathbb{C} \\ \widetilde{\phi}(\sigma)&=&\phi(\mathit{id})+\phi(123)+\phi(132)-(\phi(12)+\phi(13)+\phi(23))\in\mathbb{C} \end{array} $$

(23)

and

$$ \widetilde{\phi}(\theta)=\begin{matrix}a_{\phi} & b_{\phi}\\ c_{\phi} & d_{\phi}\end{matrix}\in \mathbb{C}^{2\times 2} $$

where

$$ \begin{array}{rll} \par a_{\phi}&=&\phi(\mathit{id})+\phi(23)+(\phi(13)+\phi(132))\cos\left(\frac{2\pi}{3}\right)+(\phi(12)+\phi(123))\cos\left(\frac{-2\pi}{3}\right) \\ b_{\phi}&=&(\phi(13)-\phi(132))\sin\left(\frac{2\pi}{3}\right)+(\phi(12)-\phi(123))\sin\left(\frac{-2\pi}{3}\right) \\ c_{\phi}&=&(\phi(13)+(\phi(132))\sin\left(\frac{2\pi}{3}\right)+(\phi(12)+\phi(123))\sin\left(\frac{-2\pi}{3}\right) \\ d_{\phi}&=&\phi(\mathit{id})\!-\phi(23)\!-\!(\phi(13)\!+\phi(12)\!-\!\phi(123))\cos\left(\frac{-2\pi}{3}\right)\!+\!\phi(132)\cos\left(\frac{2\pi}{3}\right). \end{array} $$

(24)

This transform is invertible so we have also an inversion formula (the original proof comes from [4] p. 209 and from [10] p. 213; it has been reproduced in [11] p. 179).

Proposition 4

([4, 10]) Let ϕ: G →ℂ. Then for all x ∈ G we have,

$$ \phi(x) = \displaystyle \frac{1}{|G|}\sum\limits_{\rho_V \in \widetilde{G}} \dim_{{\mathbb{C}}}(V) {\mathit{tr}}(\rho_V (x^{-1}) \circ \widetilde{\phi}(\rho_V)). $$

(25)

A last technical lemma is given below.

Lemma 5

Let ϕ: G →ℂ. We have

• 1. ϕ(x) = 0 ∀ x ∈ G ^* if, and only if, $\forall \rho = \rho_V \in \widetilde{G}$ , $\widetilde{\phi}(\rho) = \phi(e_G) {\mathit{Id}}_V$ ;

• 2. $\widetilde{\phi}(\rho) = 0_{{\mathrm{End}}(V)}$ $\forall \rho = \rho_V \in \widetilde{G}^*$ if, and only if, ϕ is constant.

Proof

• 1.

  • $\Rightarrow$) For $\rho = \rho_V \in \widetilde{G}$, we have

    $$ \begin{array}{rll} \widetilde{\phi}(\rho) & = & \displaystyle \sum\limits_{x \in G}\phi(x)\rho (x)\ \mbox{(by def\/inition)}\\ & = & \phi(e_G)\rho(e_G)\ \mbox{(by assumption on $\phi$)}\\ & = & \phi(e_G){\mathit{Id}}_{V}\\ &&\mbox{(since $\rho$ is a group homomorphism)}. \end{array} $$

  • $\Leftarrow$ ) For x ∈ G, the inversion formula gives

    $$ \begin{array}{rll} \phi(x) &=& \displaystyle \frac{1}{|G|}\sum\limits_{\rho_V \in \widetilde{G}}\dim_{{\mathbb{C}}}(V) {\mathit{tr}}(\rho_V (x^{-1}) \circ \widetilde{\phi} (\rho_V))\\ &=& \displaystyle \frac{1}{|G|}\sum\limits_{\rho_V \in \widetilde{G}}\dim_{{\mathbb{C}}}(V) {\mathit{tr}}(\rho_V (x^{-1}) \circ \phi(e_G){\mathit{Id}}_{V})\\ &&\mbox{(by hypothesis)}\\ &=& \displaystyle \frac{\phi(e_G)}{|G|}\sum\limits_{\rho_V \in \widetilde{G}}\dim_{{\mathbb{C}}}(V) {\mathit{tr}}(\rho_V (x^{-1}))\\ &=& \displaystyle \frac{\phi(e_G)}{|G|}\sum\limits_{\rho_V \in \widetilde{G}}\dim_{{\mathbb{C}}}(V) {\mathit{tr}}(\rho_V (x)^{-1})\\ &&\mbox{(since $\rho_V$ is a group homomorphism)}\\ &=& \displaystyle \frac{\phi(e_G)}{|G|}\sum\limits_{\rho_V \in \widetilde{G}}\dim_{{\mathbb{C}}}(V) {\mathit{tr}}(\rho_V (x)^{*})\\ &&\mbox{(since $\rho_V(x)$ is unitary)}\\ &=& \displaystyle \frac{\phi(e_G)}{|G|}\sum\limits_{\rho_V \in \widetilde{G}}\dim_{{\mathbb{C}}}(V) \overline{{\mathit{tr}}(\rho_V (x))}\\ &=& \displaystyle \frac{\phi(e_G)}{|G|}\overline{\sum\limits_{\rho_V \in \widetilde{G}}\dim_{{\mathbb{C}}}(V) {\mathit{tr}}(\rho_V (x))}\\ &=& 0\ \mbox{if $x \not = e_G$ (according to Lemma~3)}. \end{array} $$
• 2.

  • $\Rightarrow$) By the inversion formula, ∀ x ∈ G,

    $$ \begin{array}{rll} \phi(x) &=&\displaystyle \frac{1}{|G|}\sum\limits_{\rho_V \in \widetilde{G}} \dim_{{\mathbb{C}}}(V) {\mathit{tr}}(\rho_V (x^{-1}) \circ \widetilde{\phi}(\rho_V)) \\ &=& \displaystyle \frac{1}{|G|}{\mathit{tr}}(\widetilde{\phi} ({\mathit{Id}}_{{\mathbb{C}}}))\ \mbox{(by hypothesis)}. \end{array} $$

    (26)

  • $\Leftarrow$ ) Let $\rho_V \in \widetilde{G}$, we have $\widetilde{\phi}(\rho_V) = k \displaystyle \sum\limits_{x \in G}\rho_V (x)$ (with ϕ(x) = k ∀ x ∈ G). According to Lemma 4, we deduce that $\widetilde{\phi}(\rho_V) = 0_{{\mathrm{End}}(V)}$ for all $\rho_V \in \widetilde{G}^*$.□

4 On perfect nonlinear functions

4.1 Some basic definitions

Perfect nonlinearity must be seen as the fundamental notion on which our results are based. Actually our ambition in this paper is to describe this combinatorial concept in terms of Fourier transforms. Thus it is necessary to briefly present this topic.

Definition 9

Let X and Y be two finite nonempty sets. A function f: X →Y is said to be balanced if the cardinal of fibers function

$$ \begin{array}{l l l l} \phi_f:& Y & \rightarrow & \mathbb{N}\\ & y & \mapsto & |\{x \in X | f(x) = y\}| \end{array} $$

(27)

is constantly equal to $\frac{|X|}{|Y|}$.

Definition 10

Let G and H be two finite groups and f: G →H. The left derivative of f in direction α ∈ G is here defined as the map

$$ \begin{array}{l l l l} d^{(l)}_{\alpha}f: & G & \rightarrow & H\\ & x & \mapsto & f(\alpha x)f(x)^{-1}. \end{array} $$

(28)

Symmetrically, the right derivative of f in direction α ∈ G is the map

$$ \begin{array}{l l l l} d_{\alpha}^{(r)}f: & G & \rightarrow & H\\ & x & \mapsto & f(x)^{-1} f(x \alpha). \end{array} $$

(29)

The left-translation actions of both G and H are each equivalent to right-translation actions of G and H. Then it is easy to see that each result concerning right-translation action is symmetric to a result on left-translation action. So in this paper, we only focus on the left version and in the remainder we forgot the noun ${\it left}$: the derivative of f in direction α ∈ G, will be simply denoted by d _α f and will be the same as $d_{\alpha}^{(l)}f$.

Definition 11

Let G and H be two finite groups and f: G →H. The map f is said to be perfect nonlinear if for each α ∈ G ^*, d _α f is balanced, i.e., for each (α,β) ∈ G ^* ×H,

$$ |\{x \in G | f(\alpha x)f(x)^{-1} = \beta\}| = \displaystyle \frac{|G|}{|H|}. $$

(30)

When G and H are ${\mathbb{Z}}_2^m$ and ${\mathbb{Z}}_2^n$, perfect nonlinearity is a very relevant cryptographic property because it ensures the maximal resistance against the so-called differential cryptanalysis of Biham and Shamir [1]. When |G| = |H|, these functions are also known as planar functions in finite geometry.

4.2 Bent functions in finite Abelian groups

When considering the case of finite Abelian groups, it is possible to characterize the notion of perfect nonlinearity using the (discrete) Fourier transform; this dual characterization leading to an equivalent notion of bent functions. This work has been done recently and independently by Carlet and Ding [2] and Pott [14]. This subsection is then devoted to the presentation of these results.

For the remainder of this subsection, we suppose given a pair (G, H) of finite Abelian groups. The main result obtained by the three authors is essentially based on the following lemma (which is an obvious generalization of Proposition 14, p. 215 of [2]).

Lemma 6

([2] p. 215) Let X be a finite nonempty set and f: X →H. The map f is balanced if, and only if, for each β ∈ H ^* , we have

$$ \displaystyle \sum\limits_{x \in X} (\chi^{\beta}_H \circ f)(x) = 0. $$

(31)

In particular, if X is a (finite Abelian) group G, the previous lemma can be re-written as follows: f: G →H is balanced if, and only, if for each β ∈ H ^*, $\widehat{(\chi_H^{\beta} \circ f)}(e_G) = 0$. This technical result gives a link between balancedness and the Fourier transform which is used to prove the main result given below.

Theorem 1

([2] p. 216) Let f: G →H. The map f is perfect nonlinear if, and only if, for each β ∈ H ^* , we have ∀ α ∈ G,

$$ \displaystyle \left|\widehat{(\chi^{\beta}_H \circ f)}(\alpha)\right| = \sqrt{|G|}. $$

(32)

When G and H are ${\mathbb{Z}}_2^m$ and ${\mathbb{Z}}_2^n$, a function $f: {\mathbb{Z}}_2^m \rightarrow {\mathbb{Z}}_2^n$ that satisfies the equalities (32) is called a Boolean bent function. As perfect nonlinearity, this notion is very important in cryptography because it characterizes the Boolean functions that exhibit the best resistance against the linear cryptanalysis of Matsui [8]. By analogy with the Boolean case, we will say that a function f: G →H that satisfies (32) is an (Abelian) bent function. The theorem above means that Abelian bentness is strictly equivalent to perfect nonlinearity. In the remainder of this paper, we establish the same kind of dual characterization in the cases where G and/or H can be non Abelian.

5 Bent functions in finite non Abelian groups

5.1 Case where G is non Abelian and H is Abelian

In this subsection, G is a finite non Abelian group and H is a finite Abelian group. We first generalize Lemma 6 in this context where a non Abelian group occurs.

Lemma 7

Let f: G →H and $\rho_0 \in \tilde{G}$ the principal irreducible representation of G . The map f is balanced if, and only if, for each β ∈ H ^* ,

$$ \widetilde{\left(\chi^{\beta}_H \circ f\right)}(\rho_0) = 0_{{\mathrm{End}}({\mathbb{C}})}. $$

(33)

Proof

First let compute the representation-based Fourier transform of the function $\chi^{\beta}_H \circ f: G \rightarrow {\mathbb{C}}$ at ρ ₀.

$$ \begin{array}{rll} \widetilde{\left(\chi_H^{\beta} \circ f\right)}(\rho_0) & = & \displaystyle \sum\limits_{x \in G}\chi^{\beta}_H (f(x)) \rho_0 (x) \\ & = & \displaystyle \sum\limits_{x \in G}\chi^{\beta}_H (f(x)) {\mathit{Id}}_{{\mathbb{C}}} \\ & = & \displaystyle \sum\limits_{\gamma \in H}\phi_f (\gamma) \chi^{\beta}_H (\gamma) {\mathit{Id}}_{{\mathbb{C}}} \\ &=& \widehat{\phi_f}(\beta) {\mathit{Id}}_{{\mathbb{C}}} \end{array} $$

(34)

where we recall that ϕ _f (γ) is defined as |{x ∈ G | f(x) = γ}|.

• $\Rightarrow$) Let β ∈ H ^* and suppose that f is balanced. Then ∀ γ ∈ H, $\phi_f (\gamma) = \frac{|G|}{|H|}$ (by definition of balancedness). According to (34), we find $\widetilde{(\chi_H^{\beta} \circ f)}(\rho_0) = \frac{|G|}{|H|}\sum\limits_{\gamma \in H}\chi^{\beta}_H (\gamma) {\mathit{Id}}_{{\mathbb{C}}}$. Since for each β ∈ H ^*, we have $\sum\limits_{\gamma \in H}\chi^{\beta}_{H}(\gamma) = 0$ (by Lemma 1), we have $\widetilde{(\chi^{\beta}_H \circ f)}(\rho_0) = 0_{{\mathrm{End}}({\mathbb{C}})}$.

• $\Leftarrow$) Suppose that for each β ∈ H ^*, $\widetilde{(\chi^{\beta}_H \circ f)}(\rho_0) = 0_{{\mathrm{End}}({\mathbb{C}})}$. According to (34), we have for each β ∈ H ^*, $\widehat{\phi_f}(\beta) {\mathit{Id}}_{{\mathbb{C}}} = 0_{{\mathrm{End}}({\mathbb{C}})}$ and then for each β ∈ H ^*, $\widehat{\phi_f}(\beta) = 0$. The fourth point of Proposition 2 implies then that ϕ _f is constant. Then using the inversion formula, we obtain that for all β ∈ H, $\phi_f (\beta) = \frac{1}{|H|}\widehat{\phi_f}(e_H) = \frac{1}{|H|}\sum\limits_{\gamma \in H} \phi_f (\gamma) = \frac{|G|}{|H|}$ (by definition of ϕ _f ). Then f is balanced.□

As in the Abelian case, the previous lemma is fundamental for the dual characterization of perfect nonlinearity. Nevertheless before using it, we need an intermediary result.

Proposition 5

Let f: G → H and β ∈ H. We define the autocorrelation function of f by

$$ \begin{array}{l l l l} {\mathit{AC}}_{f,\beta}: & G & \rightarrow & {\mathbb{C}}\\ & \alpha & \mapsto & \left(\widetilde{\left(\chi^{\beta}_H \circ d_{\alpha}f\right)} (\rho_0)\right)(1). \end{array} $$

Then for all $\rho = \rho_V \in \widetilde{G}$ ,

$$ \widetilde{{\mathit{AC}}_{f,\beta}}(\rho) = \left(\widetilde{\left(\chi^{\beta}_H \circ f\right)} (\rho)\right)\circ \left(\widetilde{\left(\chi^{\beta}_H \circ f\right)}(\rho)\right)^{*}. $$

(35)

Proof

Let $\rho = \rho_V \in \widetilde{G}$.

$$ \begin{array}{rll} \widetilde{{\mathit{AC}}_{f,\beta}} (\rho) &=& \displaystyle \sum\limits_{\alpha \in G} {\mathit{AC}}_{f,\beta} (\alpha) \rho(\alpha)\\ &=& \displaystyle \sum\limits_{\alpha \in G} \left(\widetilde{\left(\chi^{\beta}_H \circ d_{\alpha}f\right)} (\rho_0)\right)(1) \rho (\alpha)\\ &=& \displaystyle \sum\limits_{\alpha \in G}\sum\limits_{x \in G} \chi^{\beta}_H \circ d_{\alpha}f(x) \rho_0 (x)(1) \rho (\alpha)\\ &=& \displaystyle \sum\limits_{\alpha \in G}\sum\limits_{x \in G} \chi^{\beta}_H \left(f(\alpha x)f(x)^{-1}\right) \rho (\alpha)\\ && \mbox{(by def\/inition of $\rho_0$)}\\ &=& \displaystyle \sum\limits_{\alpha \in G}\sum\limits_{x \in G} \chi^{\beta}_H (f(\alpha x)) \overline{\chi^{\beta}_H (f(x))} \rho (\alpha)\\ &=& \displaystyle \sum\limits_{\alpha \in G}\sum\limits_{x \in G} \chi^{\beta}_H (f(\alpha x)) \overline{\chi^{\beta}_H (f(x))} \rho \left(\alpha x x^{-1}\right)\\ &=& \displaystyle \sum\limits_{\alpha \in G}\sum\limits_{x \in G} \chi^{\beta}_H (f(\alpha x)) \overline{\chi^{\beta}_H (f(x))} \rho (\alpha x) \circ \rho (x^{-1})\\ && \mbox{($\rho$ is a morphism)}\\ &=& \displaystyle \sum\limits_{\alpha \in G}\sum\limits_{x \in G} \chi^{\beta}_H (f(\alpha x)) \overline{\chi^{\beta}_H (f(x))} \rho (\alpha x) \circ \rho (x)^{-1}\\ &=& \displaystyle \sum\limits_{\alpha \in G}\sum\limits_{x \in G} \chi^{\beta}_H (f(\alpha x)) \overline{\chi^{\beta}_H (f(x))} \rho (\alpha x) \circ \rho(x)^{*}\\ && \mbox{($\rho$ is unitary)}\\ &=& \displaystyle \sum\limits_{x \in G} \left(\sum\limits_{\alpha \in G} \chi^{\beta}_H (f(\alpha x)) \rho (\alpha x)\right) \circ \left(\,\overline{\chi^{\beta}_H (f(x))}\rho (x)^{*}\right)\\ && \mbox{(by linearity)}\\ &=& \displaystyle \sum\limits_{x \in G} \left(\widetilde{\left(\chi^{\beta}_H \circ f\right)} (\rho)\right) \circ \left(\,\overline{\chi^{\beta}_H (f(x))}\rho(x)^{*}\right)\\ &=& \left(\widetilde{\left(\chi^{\beta}_H \circ f\right)} (\rho)\right) \circ \left(\displaystyle \sum\limits_{x \in G} \overline{\chi^{\beta}_H (f(x))}\rho (x)^{*}\right)\\ &=& \left(\widetilde{\left(\chi^{\beta}_H \circ f\right)}(\rho)\right) \circ \left(\widetilde{\left(\chi^{\beta}_H \circ f\right)}(\rho)\right)^{*}. \end{array} $$

□

The dual characterization of perfect nonlinearity in this context is given below. This result generalizes the one of Carlet, Ding and Pott.

Theorem 2

Let f: G →H. The map f is perfect nonlinear if, and only if, $\forall \rho = \rho_V \in \widetilde{G}$ and ∀ β ∈ H ^* , we have

$$ \left(\widetilde{\left(\chi_H^{\beta} \circ f\right)}(\rho)\right) \circ \left(\widetilde{\left(\chi_H^{\beta} \circ f\right)}(\rho)\right)^* = |G|{\mathit{Id}}_V. $$

(36)

Proof

The map f is perfect nonlinear

• $\Leftrightarrow$ $\forall \alpha \in G^*,\ d_{\alpha}f$ is balanced (by definition)

• $\Leftrightarrow$ $\forall \alpha \in G^*,\ \forall \beta \in H^*,\ \widetilde{(\chi^{\beta}_H \circ d_{\alpha}f)} (\rho_0) = 0_{{\mathrm{End}}({\mathbb{C}})}$ (according to Lemma 7)

• $\Leftrightarrow$ ∀ z ∈ ℂ, $\forall \alpha \in G^*,\ \forall \beta \in H^*,\ (\widetilde{(\chi^{\beta}_H \circ d_{\alpha}f)}(\rho_0))(z) = 0$

• $\Leftrightarrow$ ∀ z ∈ ℂ, $\forall \alpha \in G^*,\ \forall \beta \in H^*,\ z{\mathit{AC}}_{f,\beta}(\alpha) = 0$ (by definition of ${\mathit{AC}}_{f,\beta}$)

• $\Leftrightarrow$ $\forall \alpha \in G^*,\ \forall \beta \in H^*,\ {\mathit{AC}}_{f,\beta}(\alpha) = 0$

• $\Leftrightarrow$ $\forall \rho = \rho_V \in \widetilde{G},\ \forall \beta \in H^*$, $\widetilde{{\mathit{AC}}_{f,\beta}} (\rho) = {\mathit{AC}}_{f,\beta}(e_G) {\mathit{Id}}_{V}$ (according to the first point of Lemma 5).

We have

$$ \begin{array}{rll} {\mathit{AC}}_{f,\beta} (e_G) &=& \left(\widetilde{\left(\chi^{\beta}_H \circ d_{e_G}f\right)} (\rho_0)\right)(1)\\ &=& \displaystyle \sum\limits_{x \in G} \chi^{\beta}_H (e_H) \rho_0 (x)(1)\\ &=& \displaystyle \sum\limits_{x \in G}\chi^{\beta}_H (e_H)\\ &=& |G|. \end{array} $$

(37)

Then f is perfect nonlinear $\Leftrightarrow$ ∀ β ∈ H ^*, $\forall \rho = \rho_V \in \widetilde{G}$, $\widetilde{{\mathit{AC}}_{f,\beta}} (\rho) = |G| {\mathit{Id}}_{V}$

• $\Leftrightarrow$ ∀ β ∈ H ^*, $\forall \rho \in \widetilde{G}$, $(\widetilde{(\chi^{\beta}_H \circ f)}(\rho))\circ (\widetilde{(\chi^{\beta}_H \circ f)} (\rho))^{*} = |G| {\mathit{Id}}_{V}$ (according to Proposition 5). □

Example 4

Let us consider $f:\mathfrak{S}_3\rightarrow H$ where H is a finite Abelian group whose order divides 6. Let β ∈ H ^* and let us define $\phi_{\beta}=\chi_H^{\beta}\circ f$. According to Example 3 and Theorem 2, f is perfect nonlinear if, and only if, for every β ∈ H ^*,

$$ \begin{array}{lll} \displaystyle \sum_{(x,y)\in \mathfrak{S}_3^2} \phi_{\beta}(x)\overline{\phi_{\beta}(y)} &=&6\\ \displaystyle |S_{\beta}|^2&=&6 \end{array} $$

(38)

(the equalities above are equivalent) where $S_{\beta}=\phi_{\beta}(\mathit{id})+\phi_{\beta}(123)+\phi_{\beta}(132)-(\phi_{\beta}(12)+\phi_{\beta}(13)+\phi_{\beta}(23))$ and finally,

$$ \begin{pmatrix} a_{\phi_{\beta}} & b_{\phi_{\beta}}\\ c_{\phi_{\beta}} & d_{\phi_{\beta}} \end{pmatrix}\begin{pmatrix} \overline{a_{\phi_{\beta}}} & \overline{c_{\phi_{\beta}}}\\ \overline{b_{\phi_{\beta}}} & \overline{d_{\phi_{\beta}}} \end{pmatrix} = \begin{pmatrix} 6 & 0\\ 0 & 6 \end{pmatrix}\ . $$

(39)

This example shows that the combinatorial constraints on bent functions in this non Abelian setting are much stronger than in the usual case.

By definition, functions that satisfy formula (36) are called bent functions in this particular context where G is a finite non Abelian group and H is a finite Abelian group, and therefore are perfect nonlinear.

We can note that this version of bentness is very similar to the one given in Theorem 1: the discrete Fourier transform is replaced by its representation-based version, the complex-conjugate is replaced by the adjoint of endomorphisms, the multiplication of complex numbers by the composition of operators and the factor ${\mathit{Id}}_V$ is added (which is equal to 1 in the case V = ℂ). The discrete Fourier transform of Carlet, Ding and Pott’s bent functions is, up to a factor |G|, ${\mathbb{U}}({\mathbb{C}})$-valued. Regarding this last notion of bentness, the representation-based Fourier transform, also up to the factor |G|, is now ${\mathbb{U}}(V)$-valued. It is possible to deduce from this theorem a result really similar to the traditional notion of bentness.

Corollary 1

Let f: G →H. If the map f is perfect nonlinear then we have $\forall \rho = \rho_V \in \widetilde{G}$ and ∀ β ∈ H ^* ,

$$ \left\| \widetilde{\left(\chi^{\beta}_H \circ f\right)}(\rho) \right\|^{2}_{{\mathrm{End}}(V)} = |G|\dim_{{\mathbb{C}}}(V), $$

(40)

where $\parallel \lambda \parallel^2_{{\mathrm{End}}(V)} = {\mathit{tr}}(\lambda \circ \lambda^*)$ for $\lambda \in {\mathit{End}}(V)$ .

Proof

The result is obvious by using on each member of (36) the trace ${\mathit{tr}}$ of endomorphisms of V. □

An interesting question, kept open in this paper, is to know if, whether or not, the reciprocal assertion of the previous corollary is true. Therefore, as pointed out by one of the reviewers, our definition of a bent function in this context seems stronger than the one obtained by functions that satisfy equation (40) for every $\rho\in \widetilde{G}$ and every β ∈ H ^*. But our choice for the definition of bent functions has the obvious property, from its definition, to be equivalent to perfect nonlinearity.

5.2 Case where G is Abelian and H is non Abelian

In this subsection, G is a finite Abelian group and H is a finite non Abelian group. Another time a technical result similar to both Lemmas 6 and 7 is needed to establish a dual characterization of perfect nonlinearity in this context.

Lemma 8

Let X be a finite nonempty set and f: X →H. Then f is balanced if, and only if, for each $\rho = \rho_V \in \widetilde{H}^*$ , we have

$$ \displaystyle \sum\limits_{x \in X} (\rho \circ f)(x) = 0_{{\mathrm{End}}(V)}. $$

(41)

Proof

Let $\rho = \rho_V \in \widetilde{H}$. We have

$$ \begin{array}{rll} \displaystyle \sum\limits_{x \in X} (\rho \circ f)(x) &=& \displaystyle \sum\limits_{\gamma \in H} |\{x \in X | f(x) = \gamma\}|\rho(\gamma)\\ &=& \displaystyle \sum\limits_{\gamma \in H}\phi_f (\gamma)\rho(\gamma)\\ &=& \widetilde{\phi_f} (\rho). \end{array} $$

(42)

• $\Rightarrow$) Suppose that f is balanced and let $\rho \in \widetilde{H}^*$, then we have

  $$ \displaystyle \sum_{x \in X}(\rho \circ f)(x) = \frac{|X|}{|H|} \sum_{\gamma \in H}\rho(\gamma) = 0_{{\mathrm{End}}(V)} $$

  (according to Lemma 4).

• $\Leftarrow$) Suppose that for all $\rho = \rho_V \in \widetilde{H}^*$, $\sum\limits_{x \in X}(\rho \circ f)(x) = 0_{{\mathrm{End}}(V)}$. Then the representation-based Fourier transform of ϕ _f : H →ℕ ⊂ ℂ is

  $$ \rho_V \mapsto \left \{ \begin{array}{l l} 0_{{\mathrm{End}}(V)} & \mbox{if}\ \rho_V \in \widetilde{H}^*,\\ |X| & \mbox{if}\ \rho_V = \rho_0. \end{array} \right . $$

  (43)

  According to Lemma 5, we know that ϕ _f is constant and more precisely (according to the proof of the lemma), ∀ β ∈ H, $\phi_f (\beta) = \frac{1}{|X|}{\mathit{tr}}(\widetilde{\phi_f}({\mathit{Id}}_{{\mathbb{C}}}))$. But $\widetilde{\phi_f} ({\mathit{Id}}_{{\mathbb{C}}}) = \sum\limits_{\gamma \in H}\phi_f(\gamma){\mathit{Id}}_{{\mathbb{C}}} = |X| {\mathit{Id}}_{{\mathbb{C}}}$ (by definition of ϕ _f ). Then ∀ β ∈ H, $\phi_f (\beta) = \frac{|X|}{|H|}$ and f is balanced.□

As in the previous case, we introduce a kind of autocorrelation functions and we compute its discrete Fourier transform.

Proposition 6

Let f: G →H and $\rho = \rho_V \in \widetilde{H}$ . We define the autocorrelation function of f by

$$ \begin{array}{l l l l} {\mathit{AC}}_{f,\rho}: & G & \rightarrow & {\mathit{End}}(V)\\ & \alpha & \mapsto & \displaystyle \sum\limits_{x \in G} (\rho \circ d_{\alpha}f)(x). \end{array} $$

Then for all α ∈ G,

$$ \widehat{{\mathit{AC}}_{f,\rho}}^{\mathrm{MD}}(\alpha) = \left(\widehat{(\rho \circ f)}^{\mathrm{MD}} (\alpha)\right)\circ \left(\widehat{(\rho \circ f)}^{\mathrm{MD}} (\alpha)\right)^{*}. $$

(44)

Proof

Let α ∈ G.

$$ \begin{array}{rll} \widehat{{\mathit{AC}}_{f,\rho}}^{\mathrm{MD}}(\alpha) &=& \displaystyle \sum\limits_{x \in G}\chi^{\alpha}_G (x) {\mathit{AC}}_{f,\rho}(x)\\ &=& \displaystyle \sum\limits_{x \in G} \chi^{\alpha}_G (x) \sum\limits_{y \in G} (\rho \circ d_{x}f)(y)\\ &=& \displaystyle \sum\limits_{x \in G} \sum\limits_{y \in G} \chi^{\alpha}_G (x) \rho(f(x y)) \circ (\rho(f(y)))^*\\ &&\mbox{(since $\rho(x)$ is unitary)}\\ &=& \displaystyle \sum\limits_{x \in G} \sum\limits_{y \in G} \chi^{\alpha}_G (x y y^{-1}) \rho(f(x y)) \circ (\rho(f(y)))^*\\ &=& \displaystyle \sum\limits_{x \in G} \sum\limits_{y \in G} \chi^{\alpha}_G (x y) \rho(f(x y)) \circ \overline{\chi^{\alpha}_G (y)}(\rho(f(y)))^*\\ &=& \displaystyle \sum\limits_{y \in G} \widehat{\rho \circ f}^{\mathrm{MD}}(\alpha) \circ (\chi^{\alpha}_G (y) \rho(f(y)))^*\\ &=& \left(\widehat{(\rho \circ f)}^{\mathrm{MD}}(\alpha)\right) \circ \left(\widehat{(\rho \circ f)}^{\mathrm{MD}}(\alpha)\right)^*. \end{array} $$

(45)

□

The corresponding notion of bentness in this context is given by the following theorem (in such a way that we obtain the conservation of the equivalence with perfect nonlinearity).

Theorem 3

Let f: G →H. The map f is perfect nonlinear if, and only if, ∀ α ∈ G, $\forall \rho = \rho_V \in \widetilde{H}^*$ ,

$$ \left(\widehat{(\rho \circ f)}^{\mathrm{MD}}(\alpha)\right) \circ \left(\widehat{(\rho \circ f)}^{\mathrm{MD}}(\alpha)\right)^* = |G|{\mathit{Id}}_V. $$

(46)

Proof

$$ \begin{array}{lll} && f\ \mbox{is perfect nonlinear} \Leftrightarrow \forall \alpha \in G^*,\ d_{\alpha}f\ \mbox{is balanced} \\ && \Leftrightarrow \forall \alpha \in G^*,\ \forall \rho = \rho_V \in \widetilde{H}^*,\ \displaystyle \sum_{x \in G}(\rho \circ d_{\alpha}f)(x) = 0_{{\mathrm{End}}(V)} \\ &&\mbox{(according to Lemma 8)} \\ && \Leftrightarrow \forall \alpha \in G^*,\ \forall \rho \in \widetilde{H}^*,\ {\mathit{AC}}_{f,\rho}(\alpha) = 0_{{\mathrm{End}}(V)} \\ \end{array} $$

$$ \begin{array}{lll} &&\mbox{(by def\/inition of ${\mathit{AC}}_{f,\rho}$)} \\ &&\Leftrightarrow \forall \alpha \in G,\ \forall \rho \in \widetilde{H}^*,\ \widehat{{AC}_{f,\rho}}^{\mathrm{MD}}(\alpha) = {\mathit{AC}}_{f,\rho}(e_G) \\ &&\mbox{(according to Proposition 3).} \end{array} $$

(47)

But ${\mathit{AC}}_{f,\rho}(e_G) = \displaystyle \sum_{x \in G}(\rho \circ d_{e_G}f)(x) = \sum_{x \in G}\rho(e_H) = \sum_{x \in G}{\mathit{Id}}_V = |G| {\mathit{Id}}_V$. Then according to (45) and (47), f is perfect nonlinear $\Leftrightarrow$ $\forall \alpha \in G,\ \forall \rho = \rho_V \in \widetilde{H}^*$,

$$ \left(\widehat{(\rho \circ f)}^{\mathrm{MD}} (\alpha)\right) \circ \left(\widehat{(\rho \circ f)}^{\mathrm{MD}} (\alpha)\right)^* = |G| {\mathit{Id}}_V. $$

(48)

□

Example 5

Let G be a finite Abelian group such that 6 divides its order. Let $f:G\rightarrow \mathfrak{S}_3$. Then, f is perfect nonlinear if, and only if, for every α ∈ G,

$$ \left|\widehat{\sigma\circ f}(\alpha)\right|^2=|G| $$

(49)

and

$$ \begin{array}{rl} \widehat{A}(\alpha) & \widehat{B}(\alpha)\\ \widehat{C}(\alpha) & \widehat{D}(\alpha) \end{array} \begin{array}{rl} \,\overline{\widehat{A}(\alpha)} & \overline{\widehat{C}(\alpha)}\\ \overline{\widehat{B}(\alpha)} & \overline{\widehat{D}(\alpha)} \end{array}= \begin{array}{rl} |G| & 0\\ 0 & |G| \end{array}$$

(50)

where

$$ \theta(x)=\begin{array}{rl} A(x) & B(x)\\ C(x) & D(x) \end{array} $$

for every $x\in \mathfrak{S}_3$.

Another time, by using the trace on both sides of (46), we deduce the following corollary. As in the previous case, an interesting question should be to check if this result is or not a sufficient condition for bentness in this particular context.

Corollary 2

Let f: G →H. If the map f is perfect nonlinear then ∀ α ∈ G and $\forall \rho = \rho_V \in \widetilde{H}^*$ ,

$$ \left\|\widehat{(\rho \circ f)}^{\mathrm{MD}}(\alpha) \right\|_{{\mathrm{End}}(V)}^2 = |G|\dim_{{\mathbb{C}}}(V). $$

(51)

5.3 Case where G and H are both non Abelian

In this subsection, G and H are both finite non Abelian groups.

Let $\rho' = \rho_{W}' \in \widetilde{H}$ and $\displaystyle B = \{e_i\}_{i=1}^{\dim_{{\mathbb{C}}}(W)}$ be an orthonormal basis of W (for the scalar product $\langle .,. \rangle_{H,\rho',W}$ of W as introduced by (17)) such that for all y ∈ H, ρ′(y) is a unitary operator. For $(i,j) \in \{1,\ldots,\dim_{{\mathbb{C}}}(W)\}^2$, let us define the representative functions

$$ \begin{array}{l l l l} \rho_{ij}': & H & \rightarrow & {\mathbb{C}}\\ & y & \mapsto & \langle \rho'(e_i),e_j\rangle_{H,\rho',W}. \end{array} $$

(52)

In other terms, for each y ∈ H, ρ _ij ′(y) is simply the coefficient (i,j) of the $\dim_{{\mathbb{C}}}(W) \times \dim_{{\mathbb{C}}}(W)$ unitary matrix that represents ρ′(y) in the basis B.

Let see some obvious results on ρ _ij ′ for $(i,j) \in \{1,\ldots,\dim_{{\mathbb{C}}}(W)\}^2$.

• 1. Let $(y_1,y_2) \in H^2$. We have ρ′(y ₁ y ₂) = ρ′ (y ₁) ∘ ρ′(y ₂). Therefore $\rho_{ij}'(y_1 y_2) = \displaystyle \sum\limits_{k = 1}^{\dim_{{\mathbb{C}}}(W)} \rho_{ik}' (y_1)\rho_{kj}' (y_2)$;

• 2. Let y ∈ H. Since ρ′(y ^− 1) = ρ′(y)^* then we deduce that $\rho_{ij}'(y^{-1}) = \overline{\rho_{ji}'(y)}$.

Note also that the identity map ${\mathit{Id}}_W$ is written in any orthonormal basis of W as the identity matrix and 0_End(W) is associated, in any basis of W, with the all-zero matrix.

As in the previous subsections, we introduce some kind of autocorrelation functions for f: G →H.

Proposition 7

Let f: G →H, $\rho' = \rho_W' \in \widetilde{H}$ and $(i,j) \in \{1,\ldots,\dim_{{\mathbb{C}}}(W)\}^2$ . We define the autocorrelation function of f

$$ \begin{array}{l l l l} {\mathit{AC}}_{f,\rho',i,j}: & G & \rightarrow & {\mathbb{C}}\\ & \alpha & \mapsto & \displaystyle \sum\limits_{x \in G}(\rho_{ij}' \circ d_{\alpha}f)(x). \end{array} $$

(53)

Then for all $\rho = \rho_V \in \widetilde{G}$ ,

$$ \widetilde{{\mathit{AC}}_{f,\rho',i,j}}(\rho) = \displaystyle \sum\limits_{k=1}^{\mathrm{dim}_{{\mathbb{C}}}(W)}\left(\widetilde{\left(\rho_{ik}' \circ f\right)}(\rho)\right) \circ \left(\widetilde{\left(\rho_{jk}' \circ f\right)}(\rho)\right)^*. $$

(54)

Proof

Let $\rho = \rho_V \in \widetilde{G}$.

$$ \begin{array}{rll} \widetilde{{\mathit{AC}}_{f,\rho',i,j}}(\rho) &=& \displaystyle \sum\limits_{x \in G} {\mathit{AC}}_{f,\rho',i,j}(x) \rho(x) \\ &=& \displaystyle \sum\limits_{x \in G} \sum\limits_{y \in G} (\rho_{ij}' \circ d_x f)(y) \rho(x) \\ &=& \displaystyle \sum\limits_{x \in G} \sum\limits_{y \in G} \rho_{ij}' \left(f(xy)f(y)^{-1}\right) \rho(x) \\ &=& \displaystyle \sum\limits_{x \in G} \sum\limits_{y \in G} \sum\limits_{k = 1}^{\dim_{{\mathbb{C}}}(W)} \rho_{ik}'(f(xy))\overline{\rho_{jk}'(f(y))} \rho(x) \\ &=& \displaystyle \sum\limits_{k=1}^{\dim_{{\mathbb{C}}}(W)} \sum\limits_{x \in G} \sum\limits_{y \in G} \rho_{ik}'(f(xy))\overline{\rho_{jk}'(f(y))} \rho\left(xyy^{-1}\right) \\ &=& \displaystyle \sum\limits_{k=1}^{\dim_{{\mathbb{C}}}(W)} \sum\limits_{x \in G} \sum\limits_{y \in G} \rho_{ik}'(f(xy))\overline{\rho_{jk}'(f(y))} \rho(xy) \circ \rho(y)^* \\ &=& \displaystyle \sum\limits_{k = 1}^{\dim_{{\mathbb{C}}}(W)} \sum\limits_{x \in G} \sum\limits_{y \in G} \rho_{ik}'(f(xy)) \rho(xy) \circ \left ( \overline{\rho_{jk}'(f(y))} \rho(y)^*\right) \\ &=& \displaystyle \sum\limits_{k = 1}^{\dim_{{\mathbb{C}}}(W)} \left(\widetilde{\left(\rho_{ik}' \circ f\right)}(\rho)\right) \circ \sum\limits_{y \in G} \left (\rho_{jk}'(f(y)) \rho(y)\right )^* \\ &=& \displaystyle \sum\limits_{k = 1}^{\dim_{{\mathbb{C}}}(W)} \left(\widetilde{\left(\rho_{ik}' \circ f\right)}(\rho)\right) \circ \left(\widetilde{\left(\rho_{jk}' \circ f\right)}(\rho)\right)^*. \end{array} $$

(55)

□

Using this autocorrelation function and its Fourier transform we can exhibit the appropriate notion of bentness for this context where both groups G and H are non Abelian.

Theorem 4

Let f: G →H. The map f is perfect nonlinear if, and only if, $\forall \rho = \rho_V \in \widetilde{G}$ , $\forall \rho' = \rho_{W}' \in \widetilde{H}^*$ , $\forall (i,j) \in \{1,\ldots,\dim_{{\mathbb{C}}}(W)\}^2$ ,

$$ \displaystyle \sum\limits_{k=1}^{\dim_{{\mathbb{C}}}(W)} \left(\widetilde{\left(\rho_{ik}' \circ f\right)}(\rho)\right) \circ \left(\widetilde{\left(\rho_{jk}' \circ f\right)}(\rho)\right)^* = \left \{ \begin{array}{l} |G| {\mathit{Id}}_V\ \mbox{if}\ i=j,\\ 0_{{\mathrm{End}}(V)}\ \mbox{if}\ i \not = j. \end{array} \right . $$

(56)

Proof

$$ \begin{array}{lll} && f\ \mbox{is perfect nonlinear} \Leftrightarrow \forall \alpha \in G^*,\ d_{\alpha}f\ \mbox{is balanced} \\ && \Leftrightarrow \forall \alpha \in G^*,\ \forall \rho' = \rho_{W}' \in \widetilde{H}^*, \\ && \quad \quad \quad \displaystyle \sum\limits_{x \in G}(\rho' \circ d_{\alpha}f)(x) = 0_{{\mathrm{End}}(W)} \\ &&\mbox{(according to Lemma 8)} \\ && \Leftrightarrow \forall \alpha \in G^*,\ \forall \rho' \in \widetilde{H}^*,\ \forall (i,j) \in \{1,\ldots,\dim_{{\mathbb{C}}}(W)\}^2, \\ && \quad \quad \quad\displaystyle \sum\limits_{x \in G}(\rho_{ij}' \circ d_{\alpha}f)(x) = 0 \\ &&\Leftrightarrow \forall \alpha \in G^*,\ \forall \rho' \in \widetilde{H}^*,\ \forall (i,j) \in \{1,\ldots,\dim_{{\mathbb{C}}}(W)\}^2, \\ && \quad \quad \quad{\mathit{AC}}_{f,\rho',i,j}(\alpha) = 0 \\ &&\Leftrightarrow\forall \rho_V \in \widetilde{G},\ \forall \rho' \in \widetilde{H}^*,\ \forall (i,j) \in \{1,\ldots,\dim_{{\mathbb{C}}}(W)\}^2, \\ && \quad \quad \quad\widetilde{{\mathit{AC}}_{f,\rho',i,j}}(\rho_V) = {\mathit{AC}}_{f,\rho',i,j}(e_G){\mathit{Id}}_V \\ &&\mbox{(by Lemma 5).} \end{array} $$

(57)

But ${\mathit{AC}}_{f,\rho',i,j}(e_G) = \sum\limits_{x \in G}(\rho_{ij}' \circ d_{e_G}f)(x) = \sum\limits_{x \in G}\rho_{ij}'(e_H)$. Since we know that $\rho'(e_H) = {\mathit{Id}}_W$, then ρ′(e _H ) is written in the orthonormal basis B of W as the identity matrix and then $\forall (i,j) \in \{1,\ldots,\dim_{{\mathbb{C}}}(W)\}^2$,

$$ \rho_{ij}'(e_H) = \left \{ \begin{array}{l l} 1 & \mbox{if}\ i=j,\\ 0 & \mbox{if}\ i \not = j. \end{array} \right . $$

(58)

From this last result, the equality (55) and the equivalence (57), it follows the expected result. □

This case where both groups G and H are non Abelian involves some kind of tensor (or at least of block-matrix) notion of bentness. This is essentially due to the lack of commutativity of both groups.

6 Summary

The different notions of bentness, depending on the fact that the finite groups G and H are Abelian or not, are summarized below.

A function f: G →H is bent (or equivalently perfect nonlinear) if, and only if,

• 1. If G and H are Abelian [2, 14]: ∀ (α,β) ∈ G ×H ^*,

  $$ \left|\widehat{(\chi^{\beta}_G \circ f)}(\alpha)\right|^2 = |G|. $$

• 2. If G is non Abelian and H is Abelian: $\forall (\rho,\beta) \in \tilde{G} \times H^*$ (with $\rho: G \rightarrow {\mathbb{U}}(V)$),

  $$ \left(\widetilde{\left(\chi^{\beta}_H \circ f\right)}(\rho)\right) \circ \left(\widetilde{\left(\chi^{\beta}_H \circ f\right)}(\rho)\right)^* = |G| {\mathit{Id}}_V. $$

• 3. If G is Abelian and H is non Abelian: $\forall (\alpha,\rho') \in G \times \widetilde{H}^*$ (with $\rho': H \rightarrow {\mathbb{U}}(W)$):

  $$ \left(\widehat{(\rho' \circ f)}^{\mathrm{MD}}(\alpha)\right) \circ \left(\widehat{(\rho' \circ f)}^{\mathrm{MD}}(\alpha)\right)^* = |G| {\mathit{Id}}_W. $$

• 4. If G and H are both non Abelian groups: $\forall (\rho,\rho',(i,j)) \in \widetilde{G} \times \widetilde{H}^* \times \{1,\ldots,\dim_{{\mathbb{C}}}(W)\}^2$ (with $\rho: G \rightarrow {\mathbb{U}}(V)$ and $\rho': H \rightarrow {\mathbb{U}}(W)$),

  $$ \displaystyle \sum_{k = 1}^{\dim_{{\mathbb{C}}}(W)} \left(\widetilde{\left(\rho_{ik}' \circ f\right)}(\rho)\right) \circ \left(\widetilde{\left(\rho_{jk}' \circ f\right)}(\rho)\right)^* = \left \{ \begin{array}{cc} |G|{\mathit{Id}}_V & \mbox{if}\ i=j,\\ 0_{{\mathrm{End}}(V)} & \mbox{if}\ i\not=j. \end{array}\right . $$

A continuation of this paper should be to construct some families of perfect nonlinear maps in one of these non Abelian settings.