On Dillon's class H of Niho bent functions and o-polynomials

Bent functions (Dillon 1974; Rothaus 1976) are extremal objects in combinatorics and Boolean function theory. They have been studied for about 40 years; even more, under the name of difference sets in elementary Abelian 2-groups. The motivation for the study of these particular difference sets is mainly cryptographic (but bent functions play also a role in coding theory and sequences; and as difference sets they lead to designs). Symmetric cryptosystems using Boolean functions can be cryptanalyzed when these Boolean functions can be approximated by affine Boolean functions, that is, by functions of the form `(x1, . . . , xn) = a0 + a1x1 + · · ·+ anxn = a0 + a · x, where x = (x1, . . . , xn) ∈ F2 , a = (a1, . . . , an) ∈ F2 and a0 ∈ F2. The Hamming distance dH(f, `) = #{x ∈ F2 | f(x) 6= `(x)} between them is then small. A Boolean function resists attacks by affine approximation if its minimum distance to all affine functions is large. This distance is called the nonlinearity of the function. The maximal possible nonlinearity of n-variable Boolean functions, given by the so-called covering radius bound 2n−1−2n/2−1 (see in (Carlet 2010) a survey on Boolean functions), can be achieved with equality for n even only. A Boolean function f on F2 (n = 2m even) is called bent if its nonlinearity equals 2n−1 − 2m−1 (hence its resistance to the attacks based on affine approximation is optimal). Equivalently, as shown in (Dillon 1974; Rothaus 1976), f is bent if and only if its Walsh transform χ̂f defined at every a ∈ F2 by χ̂f (a) = ∑ x∈F2 (−1)f(x)+a·x, where “·” denotes any inner product in F2 (for instance the inner product defined above), takes values ±2 only (this characterization is independent of the choice of the inner product in F2 . If f is bent, then the dual function f̃ of f , defined on F2 by: χ̂f (u) = 2(−1) e f(u)