On APN Functions with Boomerang Uniformity One over F3n : Differential and Boomerang Spectra and CCZ-Inequivalence Namhun Koo1 , Soonhak Kwon2,3 , Minwoo Ko2 , Byunguk Kim2
arXiv:2609.08968v1 [cs.CR] 8 Sep 2026
Email: [email protected], [email protected], [email protected], [email protected] 1 Institute of Basic Science, Sungkyunkwan University, Suwon, Korea 2 Department of Mathematics, Sungkyunkwan University, Suwon, Korea 3 Applied Algebra and Optimization Research Center, Sungkyunkwan University, Suwon, Korea September 8, 2026
Abstract Let q = 3n , where n > 1 is odd, and let g : Fq → Fq be a perfect nonlinear (PN) function represented by a Dembowski–Ostrom (DO) polynomial. Put τ = g(1), let ϵ be the indicator e c (x) := g(x + c) + τ ϵ(x). We prove that every G e c is APN of F∗3 , and, for c ∈ Fq , define G and has boomerang uniformity either one or two. More precisely, βG e =1 c
⇐⇒
c ∈ Cg := {c ∈ Fq \ F3 : g(c) + τ ∈ / g(Fq )},
|Cg | =
q−3 , 2
whereas βG ec = 2 for the remaining (q + 3)/2 parameters. We determine the common differe c . Since boomerang ential spectrum and complete boomerang spectra of all the functions G uniformity one is the least possible for an APN function over a finite field of odd characteristic, this gives, to the best of our knowledge, the first general construction yielding infinite families of APN functions attaining this optimum. This common differential spectrum rules out CCZ equivalence with every power function and every Ness–Helleseth-type binomial. We also prove that CCZ equivalence between signswitches of DO PN functions forces EA equivalence between the original PN functions. Using the orders of the nuclei of the associated presemifields, we exhibit, for infinitely many odd n, three pairwise CCZ-inequivalent PN functions over F3n , one from each of the Gold f1 , Ding– Yuan f3 , and Bierbrauer f5 families. Consequently, over each such field, our construction produces three pairwise CCZ-inequivalent APN functions with boomerang uniformity one. The smallest extension degree obtained in this way is n = 45. Keywords. APN functions; planar functions; Dembowski–Ostrom polynomials; boomerang uniformity; differential spectrum; boomerang spectrum; CCZ-equivalence. Mathematics Subject Classification (2020). 94A60, 11T71, 11T06.
1
Introduction
Let q be an odd prime power of characteristic p and let Fq be the finite field with q elements. Differential and boomerang properties of functions on Fq are fundamental criteria in the study of cryptographic mappings. For a function F : Fq → Fq and a ∈ Fq , write Da F (x) := F (x + a) − F (x), and define La,F (x) := Da F (x) − Da F (0) = F (x + a) − F (x) − F (a) + F (0), 1
the nonconstant part of the derivative Da F . When the underlying function is clear, we simply write La . For a general function F , the map La,F need not be linear. If F is quadratic, then Da F is affine and La,F is its Fp -linear part; in this case we call La,F the linearized derivative of F in direction a. For a function F : Fq → Fq and a, b ∈ Fq , define the entry of the difference distribution table (DDT) of F at (a, b) by δF (a, b) := DDTF (a, b) := #{x ∈ Fq : Da F (x) = b}. Following Nyberg [28], the differential uniformity of F is δF :=
max
a∈F∗q , b∈Fq
δF (a, b).
The function F is perfect nonlinear (PN), also called planar in odd characteristic, when δF = 1, and it is almost perfect nonlinear (APN) when δF = 2. The boomerang connectivity table was introduced for permutations by Cid et al. [7] and was extended to arbitrary functions by Li et al. [24]. For a, b ∈ F∗q , its entries and the boomerang uniformity are βF (a, b) := BCTF (a, b) := #{(x, y) ∈ F2q : F (y + a) − F (x + a) = b, F (y) − F (x) = b} and βF := max∗ βF (a, b), a,b∈Fq
respectively. The very small values βF = 0, 1, 2 have recently attracted particular attention over finite fields of odd characteristic. Every PN function has boomerang uniformity zero, and recent work has also produced non-PN families with boomerang uniformity zero. A particularly active line of research concerns the Ness–Helleseth-type binomials Fr,u (x) = xr (1 + uχ(x)), where χ is the quadratic character of Fq , extended by χ(0) = 0. Lyu, Wang, and Zheng determined the differential and boomerang spectra of Fq−2,±1 and obtained classes with boomerang uniformity zero or at most one [25]. Koo and Kwon studied F(q+1)/4,±1 and found classes with boomerang uniformity zero, one, or two [19]. Further characteristic-3 classes with boomerang uniformity zero or one were obtained by Koo et al. [20, 21], while other locally-APN classes with boomerang uniformity two were studied in [18, 26]. In the terminology of [19, Definition 2.1], the terms locally-PN and locally-APN, used for monomials as well as for the Ness–Helleseth-type binomials above, refer, respectively, to the conditions δF (1, b) ≤ 1 and δF (1, b) ≤ 2 (b ∈ Fq \ Fp ). Our exhaustive BCT computations for the small-field APN binomials recorded by Budaghyan and Pal [4, Table 5] show that some have boomerang uniformity one; one such example is discussed in Subsection 3.4. Their conjecture that the binomial class contains an infinite APN subfamily was subsequently disproved in [2, 26]. Thus these examples did not provide a general construction of infinite families of APN functions with boomerang uniformity one. For boomerang uniformity two, Pal and Stănică related the BCT entries of odd APN functions F , that is, APN functions satisfying F (−x) = −F (x), to the corresponding (−1)-DDT entries and determined conditions under which the inverse function is APN with boomerang uniformity two [29]. This gives an infinite family. To the best of our knowledge, prior to the present work, the inverse family appears to have been the only established infinite family of APN functions over finite fields of odd characteristic with boomerang uniformity two. 2
Apart from PN functions, which have boomerang uniformity zero, all previously known infinite non-PN families with boomerang uniformity at most one were locally-PN or locallyAPN families; none of the families with boomerang uniformity one yielded an infinite family of APN functions. To the best of our knowledge, APN functions with boomerang uniformity one were known only through isolated examples over small fields. The present paper fills this gap by giving a general construction that produces several such infinite families. Throughout the paper, q = 3n with n > 1 odd. Thus q ≡ 3 (mod 4). Let g : Fq → Fq be represented by a Dembowski–Ostrom (DO) polynomial [11], i.e. a polynomial of the form X i j g(x) = cij x3 +3 0≤i≤j<n
up to reduction modulo xq − x. We assume that g is perfect nonlinear (PN), also called planar in odd characteristic, meaning that the derivative Da g is a permutation of Fq for every a ∈ F∗q . Unless the underlying function is explicitly specified otherwise, La denotes the linearized derivative of this fixed function g. Thus La (x) := La,g (x) = Da g(x) − Da g(0) = g(x + a) − g(x) − g(a). Put τ := g(1).
(1.1)
We shall see below that τ ̸= 0. Define the sign-switch G of g by (
G(x) =
−g(x), g(x),
x ∈ F3 , x ∈ Fq \ F 3 .
Since g(0) = 0 and g(±1) = τ , equivalently, (
G(x) := g(x) + τ ϵ(x),
ϵ(x) :=
1, 0,
x = ±1, otherwise.
(1.2)
Earlier modification and switching constructions from PN functions over fields of odd characteristic yield, up to EA equivalence, certain ternary Gold instances of the sign-switch G above, thereby already establishing their APN property [32, 36]. Apart from computational differential spectra for a few small examples in [32], those works do not give general exact differential and boomerang spectra or study CCZ equivalence among sign-switches arising from distinct PN inputs. For a map F : Fq → Fq and i ≥ 0, define the DDT and BCT entry counts by NiDDT (F ) := #{(a, b) ∈ F∗q × Fq : δF (a, b) = i}, NiBCT (F ) := #{(a, b) ∈ F∗q × F∗q : βF (a, b) = i}. Using v m for m copies of v, with v 0 omitted, define the differential and boomerang spectra of F by the multisets DDT (F )
SDDT (F ) := {{ 0N0 SBCT (F ) := {{ 0
N0BCT (F )
NδDDT (F )
, . . . , δF F
NβBCT (F ) F
, . . . , βF
}},
(1.3)
}}.
Main contributions of the paper For the fixed DO PN function g : Fq → Fq , with τ and G as in (1.1)–(1.2), define Cg := {c ∈ Fq \ F3 : g(c) + τ ∈ / g(Fq )}, e c (x) := g(x + c) + τ ϵ(x) = G(x) + Dc g(x) G
3
(c ∈ Fq ).
(1.4)
Our main construction, given in Corollary 4.4, yields q−3 |Cg | = , 2
(
δGe = 2 c
(c ∈ Fq ),
βGe = c
1, c ∈ Cg , 2, c ∈ Fq \ Cg .
Thus every DO PN function gives exactly (q−3)/2 parameter values for which the corresponding e c ∼EA G, all members natural perturbation is APN and has boomerang uniformity one. Since G of the family share the exact differential spectrum of G determined in Theorem 3.2. Corollary 4.5 determines the complete BCT row distributions and hence the boomerang spectra for every c ∈ Fq : it lists three possible types when βGe = 1 and five when βGe = 2. c c For functions with δF ≤ 2 over finite fields of odd characteristic, Proposition 3.9 identifies boomerang uniformity zero with perfect nonlinearity. Hence Corollary 3.10 shows that boomerang uniformity one is optimal for APN functions. The construction begins with the sign-switch G. Proposition 2.3, together with the two-toone property in Theorem 2.1, yields the disjoint-union decomposition F∗q = g(F∗q ) ⊔ −g(F∗q ) .
Thus g(F∗q ) contains exactly one element from each pair {a, −a} in F∗q . Corollary 2.4 gives the resulting special preimages g −1 (0) = {0}, g −1 (τ ) = {±1}, and g −1 (−τ ) = ∅, which are used throughout the paper. Theorems 3.2 and 3.5 determine the exact differential and boomerang spectra of G; in particular, δG = βG = 2. Every F3 -affine perturbation GA = G+A is APN and has βGA ∈ {1, 2}. Theorem 4.1 gives a necessary and sufficient condition for βGA = 1 and, in that case, determines the exact BCT row distribution and boomerang spectrum. Proposition 4.3 specializes this criterion to the linear part M = Lc ; adding the constant g(c) gives the derivative Dc g = Lc + g(c) and hence the natural family (1.4). We also compare the differential and boomerang spectra of G with those of power functions and Ness–Helleseth-type binomials xr (1 + uχ(x)) with u ̸= 0. For each such function, all DDT rows indexed by a ̸= 0 have the same value distribution, and likewise all BCT rows indexed by a ̸= 0 have the same value distribution. The resulting DDT and BCT entry counts are therefore divisible by q − 1. In contrast, Theorems 3.2 and 3.5 give N0DDT (G) = N2BCT (G) = 4(q − 3). Theorem 3.7 consequently shows that both spectra of G differ from those of every function in these two classes. Since the differential spectrum is CCZ-invariant, the DDT comparison yields CCZ-inequivalence. The BCT comparison gives an additional spectral distinction, but it is not used for CCZ-inequivalence because the boomerang spectrum is not a CCZ invariant in general. The construction applies to every DO PN function over F3n with n > 1 odd. Subsection 4.2 applies the main construction to the Gold f1 , Ding–Yuan f3 , Zha–Kyureghyan–Wang f4 , and Bierbrauer f5 families. Each valid family member gives natural APN functions with boomerang uniformity one for exactly (q − 3)/2 parameters, together with their complete differential and boomerang spectra. For g(x) = x10 , Remark 4.6 proves that all eight boomerang spectrum types in Corollary 4.5 occur for every odd n ≥ 9. Table 3 reports exhaustive computations realizing the six types in Corollary 4.5(a) and (b) for selected members of the f1 , f3 , and f5 families. Together with the two special types in parts (c) and (d), all eight types occur for each selected function. Finally, Theorem 5.6 proves that sign-switching does not collapse CCZ classes of the underlying DO PN functions. More precisely, if G and H are the sign-switches of g and h, respectively, then G ∼CCZ H =⇒ g ∼EA h. 4
We refer to this implication as switch-rigidity. Its proof combines an intrinsic characterization of the vertical subspace {0} × Fq , a CCZ-to-EA collapse for switched maps, and a theorem establishing the uniqueness of the underlying PN function. Since every affine perturbation constructed above is EA-equivalent to its sign-switch, Corollary 5.8 transfers pairwise CCZ-inequivalence of the underlying DO PN functions to associated APN functions with boomerang uniformity one. Using the orders of the nuclei of the associated presemifields, Theorem 5.9 obtains three such functions from one member of each of the Gold f1 , Ding–Yuan f3 , and Bierbrauer f5 families. The specialization s = 5ℓ, t = ℓ, with odd ℓ > 1, gives n = 15ℓ, beginning with n = 45. The remainder of the paper is organized as follows. Section 2 establishes the required structural facts about DO PN functions; Section 3 determines the spectra of G, proves the comparison results, and establishes optimality; Section 4 presents the affine-perturbation construction and its applications; and Section 5 proves switch-rigidity and the resulting CCZ-inequivalence results. Section 6 concludes the paper and records directions for further work.
2
Preliminaries for DO PN functions
We first record the general facts for DO PN functions that will be used throughout the paper. The statements through Proposition 2.3 are formulated for arbitrary prime powers q = pm with q ≡ 3 (mod 4), as required for the application of Feng and Luo [16, Lemma 3(ii)] below. In this general part, a DO polynomial over Fq means a polynomial whose monomials have exponents pi + pj , that is, X i j f (x) = cij xp +p 0≤i≤j<m
up to reduction modulo xq −x. From Corollary 2.4 onward, we return to the standing assumption q = 3n with n odd. For a map f : Fq → Fq with f (0) = 0, we say that f is two-to-one if f −1 (0) = {0}, and every nonzero value in f (Fq ) has exactly two preimages. Theorem 2.1 (Coulter–Matthews [10, Theorem 3]). Let q be an odd prime power, and let f ∈ Fq [x] be a DO polynomial. Then f is planar over Fq if and only if f is two-to-one. Equivalently, f is planar over Fq if and only if |f (Fq )| =
q+1 . 2
For t ∈ Fp , every DO polynomial f satisfies f (tx) = t2 f (x); in particular, f (0) = 0 and f (−x) = f (x). Hence Theorem 2.1 has the following consequence: if f is a DO PN function, then f −1 (0) = {0}, and for every nonzero value c ∈ f (Fq ) one has #f −1 (c) = 2. Indeed, the domain is partitioned into the (q + 1)/2 orbits {0},
{x, −x}
(x ∈ F∗q ),
and Theorem 2.1 says that these orbits give exactly (q + 1)/2 distinct values. The following lemma is an immediate consequence of Feng and Luo [16, Lemma 3(ii)]. 5
Lemma 2.2. Let q = pm be a prime power with q ≡ 3 (mod 4), and let f be a DO PN function on Fq . For a, b ∈ Fq , define the Walsh transform of f by X
Wf (a, b) :=
ζ Tr(bf (x)−ax) ,
x∈Fq
where ζ = e2πi/p is a primitive p-th root of unity and Tr : Fq → Fp is the absolute trace map. Then, for every b ∈ F∗q , Wf (0, b)2 = −q. Proposition 2.3. Let q = pm be a prime power with q ≡ 3 (mod 4), and let f be a DO PN function on Fq . Then f (x) + f (y) = 0 =⇒ x = y = 0. Proof. Let S := {(x, y) ∈ Fq × Fq : f (x) + f (y) = 0}. Clearly (0, 0) ∈ S. For b ∈ Fq , Wf (0, b)2 =
X
ζ Tr(bf (x))
x∈Fq
X
X
ζ Tr(bf (y)) =
y∈Fq
ζ Tr(b(f (x)+f (y))) .
x,y∈Fq
Summing over b ∈ Fq and using the orthogonality of additive characters gives X
Wf (0, b)2 =
b∈Fq
X
X
X
1+
X
ζ Tr(b(f (x)+f (y)))
(x,y)∈S / b∈Fq
(x,y)∈S b∈Fq
= |S|q. On the other hand, by Lemma 2.2, X
X
Wf (0, b)2 = Wf (0, 0)2 +
Wf (0, b)2
b∈F∗q
b∈Fq
= q 2 + (q − 1)(−q) = q. Thus |S| = 1. Since (0, 0) ∈ S, we get S = {(0, 0)}. We next combine Theorem 2.1 and Proposition 2.3. The two-to-one property gives f −1 (0) = {0} and q−1 f (F∗q ) = , 2 whereas Proposition 2.3 gives f (F∗q ) ∩ −f (F∗q ) = ∅. Since these two subsets of F∗q are disjoint and each has (q − 1)/2 elements, they give the disjointunion decomposition F∗q = f (F∗q ) ⊔ −f (F∗q ) . (2.1) Equivalently, the partition (2.1) says that f (F∗q ) contains exactly one element from each pair {a, −a} in F∗q . We now apply the disjoint-union decomposition (2.1) with q = 3n and f = g. Corollary 2.4. Let q = 3n with n odd, and let g be a DO PN function on Fq . Put τ = g(1). Then τ ̸= 0, and g −1 (0) = {0},
g −1 (τ ) = {±1},
g −1 (−τ ) = ∅.
Consequently, g attains none of 0, ±τ on Fq \ F3 : g(Fq \ F3 ) ∩ τ F3 = ∅,
τ F3 := {0, τ, −τ }. 6
Proof. Since 3n ≡ 3 (mod 4) for odd n, the disjoint-union decomposition (2.1) applies to g. Proposition 2.3, with one input equal to zero, gives g −1 (0) = {0}, so τ = g(1) ̸= 0. Also g(1) = g(−1) = τ , and the two-to-one property gives g −1 (τ ) = {±1}. Since τ ∈ g(F∗q ) and g(F∗q ) ∩ (−g(F∗q )) = ∅, one has −τ ∈ / g(F∗q ). Hence g −1 (−τ ) = ∅. It remains to prove g(Fq \ F3 ) ∩ τ F3 = ∅. If x ∈ / F3 and g(x) ∈ τ F3 , then g(x) is one of 0, τ, −τ , contradicting the three preimage statements just proved. The preimage statements in Corollary 2.4 will be used in the proofs of the exact differential spectrum (Theorem 3.2), the exact boomerang spectrum (Theorem 3.5), and the affine criterion (Theorem 4.1). Recall that La is the linearized derivative of the fixed DO polynomial g. Since g(0) = 0, one has Da g(x) = La (x) + g(a). Moreover, the map (a, x) 7→ La (x) is symmetric and F3 -bilinear. In particular, La (x) = Lx (a), and, for each fixed a, La is F3 -linear in x. Lemma 2.5. One has L1 (F3 ) = τ F3 . Proof. For t ∈ F3 , the homogeneity of g gives L1 (t) = g(1 + t) − g(1) − g(t) = (1 + t)2 − 1 − t2 τ = 2tτ = −tτ.
Hence L1 (F3 ) = τ F3 . With ϵ and G as in (1.2), we shall use the following directional-derivative notation. For a, x ∈ Fq , put ϵa (x) := Da ϵ(x) = ϵ(x + a) − ϵ(x), (2.2) Da G(x) = Da g(x) + τ ϵa (x) = La (x) + g(a) + τ ϵa (x). Lemma 2.6. For the fixed DO polynomial g, the following identities hold for all x, y ∈ Fq : g(x + y) + g(x − y) = −g(x) − g(y), and g(x + y) − g(x − y) = −Ly (x) = −Lx (y). Proof. By the definition of L, the evenness g(−y) = g(y), and the F3 -linearity of L in the subscript, g(x − y) = g(x) + g(y) − Ly (x).
g(x + y) = g(x) + g(y) + Ly (x),
Adding and subtracting these two identities gives the result. The last equality follows from the symmetry Ly (x) = Lx (y).
7
Equivalence conventions and the differential spectrum For later use, we briefly recall some standard facts about CCZ equivalence and the CCZinvariance of the differential spectrum. For a function F : Fq → Fq , write GF := {(x, F (x)) : x ∈ Fq } ⊆ Fq × Fq for its graph. For v = (a, b) ∈ Fq × Fq , we also write δF (v) := δF (a, b). With this notation, the DDT entry δF (v) has the graph-intersection form δF (v) = |GF ∩ (GF − v)| = |GF ∩ (GF + v)|. Thus δF (v) = 0 if and only if the two sets GF and GF − v are disjoint. Two functions F, F ′ : Fq → Fq are CCZ-equivalent in the sense of Carlet, Charpin, and Zinoviev [5], written F ∼CCZ F ′ , if there exists an affine automorphism A(P ) = M(P ) + c of the F3 -vector space Fq ×Fq such that A(GF ) = GF ′ . They are EA-equivalent, written F ∼EA F ′ , if there exist invertible F3 -linear maps M1 , M2 : Fq → Fq , an F3 -linear map B : Fq → Fq , and constants a0 , b0 ∈ Fq such that F ′ (M1 x + a0 ) = M2 F (x) + B(x) + b0
(x ∈ Fq ).
Lemma 2.7. Suppose A(P ) = M(P ) + c sends GF to GF ′ . Then (v ∈ Fq × Fq ).
δF (v) = δF ′ (Mv) In particular, if δF (v) = 0, then δF ′ (Mv) = 0.
Proof. For v ∈ Fq × Fq , the affine bijection A restricts to a bijection ∼
A : GF ∩ (GF − v) − → GF ′ ∩ (GF ′ − Mv). Taking cardinalities gives the claim. Lemma 2.8. If F, F ′ : Fq → Fq are CCZ-equivalent, then SDDT (F ) = SDDT (F ′ ). Proof. By Lemma 2.7, the multiset of δF (v) over all nonzero v ∈ Fq × Fq is CCZ-invariant. Since δF (0, b) = 0 for every b ∈ F∗q , this multiset is obtained from SDDT (F ) by adjoining q − 1 zeros, and the claim follows.
3
Exact differential and boomerang spectra and comparison
For a map F : Fq → Fq , a fixed a ∈ F∗q , and b ∈ Fq , the fiber of Da F over b is (Da F )−1 (b) = {x ∈ Fq : Da F (x) = b}. In what follows, the unqualified term fiber always means a fiber of a derivative.
8
3.1
The exact differential spectrum
We now determine the differential rows of G. We begin with a small symmetry lemma which will be used repeatedly. Recall that a map f : Fq → Fq is called even if f (−x) = f (x) for all x ∈ Fq . Lemma 3.1. Let f : Fq → Fq be even. For a ∈ Fq , let ιa : Fq → Fq be the involution defined by ιa (x) := −x − a. Then, for every x ∈ Fq , Da f (ιa (x)) = −Da f (x).
D−a f (x) = Da f (−x),
Consequently, for every b ∈ Fq , the involution ιa maps the fiber of Da f over b bijectively onto the fiber over −b. Moreover, if Da f (x) = Da f (y), then f (ιa (y)) − f (ιa (x)) = f (y) − f (x). Proof. By the evenness of f , D−a f (x) = f (x − a) − f (x) = f (−x + a) − f (−x) = Da f (−x), Da f (ιa (x)) = f (−x) − f (−x − a) = f (x) − f (x + a) = −Da f (x). The fiber assertion follows from the second identity and the fact that ιa is an involution. Finally, if Da f (x) = Da f (y), then, by the evenness of f , f (ιa (y)) − f (ιa (x)) = f (y + a) − f (x + a) = f (y) − f (x). Here the last equality follows from Da f (x) = Da f (y). The functions g, G, and ϵ in (1.2) are even. Hence Lemma 3.1 applies to all three of them. For each a ∈ F∗q , define the exceptional input set for the sign-switch g 7→ G by Ea := {x ∈ Fq : Da G(x) ̸= Da g(x)} = {x ∈ Fq : ϵa (x) ̸= 0}. The equality follows from (2.2), since τ ̸= 0. Thus Ea is a subset of the domain. Its images Da g(Ea ) and Da G(Ea ), which are subsets of the codomain, will be called the old and new exceptional derivative-value sets, respectively. Here “old” and “new” always refer to the derivatives before and after the sign-switch g 7→ G. By definition, Da G = Da g on Fq \ Ea . For a DDT or BCT row, we use the same exponent notation for its value distribution: the row has type 0m0 1m1 · · · if it contains exactly mi entries equal to i; terms with mi = 0 are omitted. Theorem 3.2 (Exact differential spectrum). Let q = 3n with n > 1 odd, let g : Fq → Fq be a DO PN function, put τ = g(1), and let G be its sign-switch: (
G(x) =
−g(x), g(x),
x ∈ F3 , x ∈ F q \ F3 .
Then the following hold. (i) If a ∈ F∗3 , then Da G is a permutation of Fq . Equivalently, the a-row of the DDT has type 1q .
9
(ii) If a ∈ F∗q \ F3 , then the a-row of the DDT has type 04 1q−8 24 . Thus, among the DDT rows indexed by a ∈ F∗q , two have type 1q and q − 3 have type 04 1q−8 24 . Consequently, G is APN and its differential spectrum is SDDT (G) = {{ 04(q−3) , 1 2q+(q−3)(q−8) , 24(q−3) }}. Proof. By (2.2), Ea consists exactly of the points x for which exactly one of x and x + a belongs to {±1}. Case 1: a ∈ F∗3 . It is enough to treat a = 1, because Lemma 3.1, applied to the even map G, gives D−1 G(x) = D1 G(−x). Thus D−1 G is a permutation exactly when D1 G is a permutation. For a = 1, the exceptional input set is E1 = {0, 2}, and ϵ1 (2) = 2 = −1.
ϵ1 (0) = 1, Moreover, D1 g(0) = g(1) − g(0) = τ,
D1 g(2) = g(0) − g(2) = −τ.
Hence D1 G(0) = −τ,
D1 G(2) = τ.
Thus D1 g(E1 ) = D1 G(E1 ) = {±τ }: the switch merely exchanges the two exceptional derivative values. Therefore D1 G is a permutation, and consequently D2 G = D−1 G is also a permutation. This proves the permutation-row statement for a ∈ F∗3 . Case 2: a ∈ F∗q \ F3 . Here the exceptional input set is Ea = {1, 2, 1 − a, 2 − a},
(3.1)
and its four elements are distinct. At the two inputs 1 and 2 = −1 we have ϵa (1) = ϵa (2) = 2 = −1. The remaining two exceptional inputs are obtained from 1 and 2 by the involution ιa (x) = −x−a: ιa (2) = 1 − a,
ιa (1) = 2 − a.
Thus Lemma 3.1, applied to ϵ, also gives ϵa (1 − a) = ϵa (2 − a) = 1. Put A := Da g(1) = g(a + 1) − τ,
B := Da g(2) = g(a − 1) − τ.
By Lemma 3.1, applied to g, Da g(2 − a) = −Da g(1) = −A,
Da g(1 − a) = −Da g(2) = −B.
The values of Da g and Da G on the exceptional input set are summarized by x 1 Da g(x) A Da G(x) A − τ
2 B B−τ 10
1−a 2−a −B −A τ − B τ − A.
Consequently, Da g(Ea ) = {±A, ±B},
Da G(Ea ) = {±(A − τ ), ±(B − τ )}.
(3.2)
These are, respectively, the old and new exceptional derivative-value sets. We claim that Da G(Ea ) has four elements and Da G(Ea ) ∩ Da g(Ea ) = ∅. It is enough to show A, B, A + B, A − B ∈ / τ F3 . (3.3) Indeed, every equality among two elements of the new set, or between an element of the new set and an element of the old set, forces one of A, B, A + B, A − B to lie in the line τ F3 ; for example, A − τ = B ⇒ A − B = τ, A − τ = −B ⇒ A + B = τ, and A − τ = τ − A ⇒ A = τ. The remaining equalities are the same elementary check. We now prove (3.3). Since a ± 1 ∈ / F3 , Corollary 2.4 gives g(a + 1), g(a − 1) ∈ / τ F3 . Therefore A = g(a + 1) − τ ∈ / τ F3 ,
B = g(a − 1) − τ ∈ / τ F3 .
Applying Lemma 2.6 with (x, y) = (a, 1), A + B = g(a + 1) + g(a − 1) − 2τ = (−g(a) − τ ) − 2τ = −g(a). Since a ∈ / F3 , Corollary 2.4 gives g(a) ∈ / τ F3 , and hence A + B ∈ / τ F3 . Finally, A − B = g(a + 1) − g(a − 1) = −L1 (a) by Lemma 2.6 with (x, y) = (a, 1). Since g is PN, L1 is injective. Hence Lemma 2.5 and a ∈ / F3 give L1 (a) ∈ / τ F3 , and therefore A − B ∈ / τ F3 . The preceding argument shows that |Da G(Ea )| = |Ea | = 4,
Da G(Ea ) ∩ Da g(Ea ) = ∅.
Hence the restriction of Da G to Ea is injective. Since Da g is a permutation and Da G = Da g on Fq \ Ea , the restriction of Da G to Fq \ Ea is also injective, and Da G(Fq \ Ea ) = Da g(Fq \ Ea ) = Fq \ Da g(Ea ). In particular, Da G(Ea ) ⊆ Da G(Fq \ Ea ). Consequently, 0,
b ∈ Da g(Ea ), δG (a, b) = 2, b ∈ Da G(Ea ), 1, otherwise. Thus the a-row of the DDT has type 04 1q−8 24 . This proves the asserted row structure. Summing the row types gives the displayed differential spectrum and shows that δG = 2. 11
For later use, we record the following consequences of Case 2. Corollary 3.3. Let a ∈ F∗q \ F3 , and put A := Da g(1) = g(a + 1) − τ,
B := Da g(2) = g(a − 1) − τ.
Then A, B, A + B, A − B ∈ / τ F3 . Moreover, {b ∈ Fq : δG (a, b) = 0} = Da g(Ea ) = {±A, ±B}. The set Da G(Ea ) has four elements and is disjoint from Da g(Ea ). Proof. All the assertions were established in Case 2 of the proof of Theorem 3.2. The proof also gives the two-element fibers of Da G explicitly. Corollary 3.4. Let a ∈ F∗q \ F3 , and define ua := L−1 a (−τ ). Then ua ∈ / F3 , and the four two-element fibers of Da G are {1, 1 + ua },
{2, 2 + ua },
{1 − a, 1 − a − ua },
{2 − a, 2 − a − ua }.
Proof. Since La is bijective, ua is well defined. Also ua ̸= 0, because −τ ̸= 0. If ua ∈ F∗3 , then, using the F3 -bilinearity and symmetry of (a, x) 7→ La (x), −τ = La (ua ) = ua La (1) = ua L1 (a). Hence L1 (a) ∈ τ F3 = L1 (F3 ) by Lemma 2.5. Since L1 is injective, this contradicts a ∈ / F3 . Thus ua ∈ / F3 . By Corollary 3.3, the two exceptional derivative-value sets in (3.2) are disjoint. The first two displayed fibers can be treated simultaneously. For each e ∈ {1, 2}, Da g(e + ua ) = Da g(e) + La (ua ) = Da g(e) − τ = Da G(e). The value Da G(e) belongs to Da G(Ea ) and therefore, by this disjointness, does not belong to Da g(Ea ). Since Da g is a permutation, its unique preimage e + ua lies outside Ea . Consequently, Da G(e + ua ) = Da g(e + ua ) = Da G(e), so {e, e + ua } is a two-element fiber of Da G for each e ∈ {1, 2}. The remaining two displayed fibers follow from the derivative symmetry of the even map G. By Lemma 3.1, the involution ιa (x) = −x − a sends fibers of Da G to fibers of Da G. Since ιa (2) = 1 − a,
ιa (2 + ua ) = 1 − a − ua ,
ιa (1) = 2 − a,
ιa (1 + ua ) = 2 − a − ua ,
and we obtain the remaining two-element fibers {1 − a, 1 − a − ua },
{2 − a, 2 − a − ua }.
The corresponding four Da G-values are the four distinct elements of Da G(Ea ). Theorem 3.2 shows that Da G has exactly four two-element fibers, so the displayed list is complete.
12
3.2
The exact boomerang spectrum
We now determine the boomerang rows directly from the fiber structure of Da G obtained above. Theorem 3.5 (Exact boomerang spectrum). Let G be as in Theorem 3.2. Then the following hold. (i) If a ∈ F∗3 , then the a-row of the boomerang connectivity table is a zero row: 0q−1 . (ii) If a ∈ F∗q \ F3 , define ua := L−1 a (−τ ) and ba,1 := G(1 + ua ) − G(1),
ba,2 := G(2 + ua ) − G(2).
Then the four elements ±ba,1 ,
±ba,2
are nonzero and pairwise distinct. The four nonzero entries in the a-row occur precisely at these four values of b, and every one of them is equal to 2. Hence the row has type 0q−5 24 . Thus the BCT row structure of G consists of two zero rows and q − 3 rows of type 0q−5 24 . Consequently, G has boomerang uniformity βG = 2, and its boomerang spectrum is 2
SBCT (G) = {{ 0(q−1) −4(q−3) , 24(q−3) }}. Proof. For any map F : Fq → Fq and any a, b ∈ F∗q , the boomerang equations are equivalent to F (y) − F (x) = b.
Da F (x) = Da F (y),
(3.4)
Indeed, the two equations F (y + a) − F (x + a) = b,
F (y) − F (x) = b
are equivalent to the second equation and F (y + a) − F (y) = F (x + a) − F (x). If a ∈ F∗3 , then Da G is a permutation by Theorem 3.2. Thus (3.4) forces x = y, which is impossible because b = G(y) − G(x) ̸= 0. Therefore βG (a, b) = 0
(a ∈ F∗3 , b ∈ F∗q ).
This proves the zero-row statement. Now let a ∈ F∗q \ F3 , and put u = ua = L−1 a (−τ ). By Corollary 3.4, the only ordered pairs (x, y) with x ̸= y and Da G(x) = Da G(y) come from the four two-element fibers of Da G: {1, 1 + u},
{2, 2 + u},
{1 − a, 1 − a − u},
{2 − a, 2 − a − u}.
Define b1 := G(1 + u) − G(1),
b2 := G(2 + u) − G(2).
Since u ∈ / F3 , both 1 + u and 2 + u lie outside F3 , and hence b1 = g(1 + u) + τ,
b2 = g(2 + u) + τ = g(u − 1) + τ. 13
By Corollary 2.4, neither g(1 + u) nor g(2 + u) is equal to −τ . Hence b1 , b2 ̸= 0.
(3.5)
The first two-element fiber contributes the two ordered differences b1 and −b1 ; the second two-element fiber contributes b2 and −b2 . By Lemma 3.1, if Da G(x) = Da G(y), then G(ιa (y)) − G(ιa (x)) = G(y) − G(x). Thus the involution T (x, y) := (ιa (x), ιa (y)) = (−x − a, −y − a) preserves the boomerang value on ordered pairs with equal Da G-value. The remaining twoelement fibers are obtained from the first two by this involution. Consequently the four twoelement fibers contribute only the four possible values ±b1 ,
±b2 ,
and each value will occur exactly twice once we know that these four values are distinct. It remains to prove b1 ̸= ±b2 . First, b1 − b2 = g(u + 1) − g(u − 1) = −L1 (u) by Lemma 2.6 with (x, y) = (u, 1). Since L1 is bijective and u ̸= 0, this is nonzero. Therefore b1 ̸= b2 . For the nontrivial cancellation, Lemma 2.6 with (x, y) = (u, 1) gives b1 + b2 = g(u + 1) + g(u − 1) + 2τ = (−g(u) − τ ) + 2τ = τ − g(u). If b1 + b2 = 0, then g(u) = τ . By Corollary 2.4, g −1 (τ ) = {±1}, so u ∈ F3 , contradicting Corollary 3.4. Thus b1 + b2 ̸= 0, and hence b1 ̸= −b2 . Therefore the four nonzero values b1 ,
−b1 ,
b2 ,
−b2
are distinct. Each occurs exactly twice in the a-row of the boomerang table, and no other nonzero b occurs. Hence this row has type 0q−5 24 . This proves the asserted row structure. Summing the row types gives the displayed boomerang spectrum and shows that βG = 2.
3.3
Comparison with power functions and Ness–Helleseth-type binomials
We now compare the differential and boomerang spectra of G with those of two broad classes for which, in both the DDT and BCT, all rows indexed by a ̸= 0 have the same value distribution. The following terminology excludes the degenerate monomial parameter u = 0. Definition (Ness–Helleseth-type binomials). Let r be a positive integer and let u ∈ F∗q . Let χ(x) := x(q−1)/2
(x ∈ Fq )
be the quadratic character of Fq , with χ(0) = 0. The binomial function Fr,u (x) := xr 1 + uχ(x) is called a Ness–Helleseth-type binomial on Fq . 14
The original Ness–Helleseth family is obtained over Fq = F3n , with n ≥ 3 odd, by taking r = q − 2. As polynomial functions on Fq , Fq−2,u (x) = xq−2 + ux(q−3)/2 . Ness and Helleseth [27, Thm. 1] proved that if χ(u − 1) = χ(u + 1) = χ(u), then Fq−2,u is APN. Xia et al. [30, Thm. 4] later proved the converse. For primes p ≥ 7 with p ≡ 3 (mod 4) and odd m, Zeng et al. extended the construction to Fpm . With χ denoting the quadratic character of Fpm and u ∈ F∗pm , the function Fpm −2,u is APN if either χ(u + 1) = χ(u − 1) = −χ(5u + 3) or χ(u + 1) = χ(u − 1) = −χ(5u − 3); see [35]. The following row-reduction formulas are given in Mesnager and Wu [26, Lemma 11]. Lemma 3.6. Assume that q = 3n with n > 1 odd. Let u ∈ F∗q .
Fr,u (x) = xr 1 + uχ(x) ,
Then, for every a ∈ F∗q and b ∈ Fq , b 1, δ , Fr,u ar δFr,u (a, b) = b δ Fr,u 1,
χ(a) = 1,
,
(−1)r+1 ar
χ(a) = −1,
and, for every a, b ∈ F∗q , b βFr,u 1, r , a βFr,u (a, b) = b βFr,u 1,
χ(a) = 1,
(−1)r ar
,
χ(a) = −1.
Consequently, all DDT rows indexed by a ∈ F∗q have the same value distribution, and all BCT rows indexed by a ∈ F∗q have the same value distribution. Theorem 3.7 (CCZ-inequivalence of G to power functions and Ness–Helleseth-type binomials). Assume that q = 3n with n > 1 odd, and let G be as in Theorem 3.2. If H : Fq → Fq is a power function or a Ness–Helleseth-type binomial, then SDDT (G) ̸= SDDT (H)
and
SBCT (G) ̸= SBCT (H).
Consequently, by the CCZ-invariance of the differential spectrum, G ̸∼CCZ H. Proof. For a power function H(x) = xd , the substitutions x = aX in the derivative equation and (x, y) = (aX, aY ) in the boomerang system give
δH (a, b) = δH 1,
b , ad
βH (a, b) = βH 1,
b . ad
For a Ness–Helleseth-type binomial, the corresponding conclusions follow from Lemma 3.6. Hence, in either case, every DDT row indexed by a ∈ F∗q has one common value distribution and every BCT row indexed by a ∈ F∗q has one common value distribution. For i ≥ 0, put νi (H) := #{b ∈ F∗q : βH (1, b) = i}.
ωi (H) := #{b ∈ Fq : δH (1, b) = i}, Then N0DDT (H) = (q − 1)ω0 (H),
N2BCT (H) = (q − 1)ν2 (H), 15
so both numbers are divisible by q − 1. On the other hand, Theorems 3.2 and 3.5 give, respectively, N2BCT (G) = 4(q − 3). N0DDT (G) = 4(q − 3), But 4(q − 3) = 4(q − 1) − 8. If q − 1 divided 4(q − 3), then q − 1 would divide 8. Since q = 3n with n > 1 odd, one has q − 1 ≥ 26, which is impossible. Thus both spectra are different. The differential-spectrum inequality and Lemma 2.8 then give G ̸∼CCZ H. Selected APN monomial families and DDT-row distributions For reference, Table 1 summarizes selected APN power functions over Fq and the known status of their DDT-row distributions. The uppercase labels Fi are local to the table and are unrelated to the lower-case PN-family labels fi in Subsection 4.2. With ωi (F ) as defined above, ω0 (F ), ω1 (F ), ω2 (F ) denotes the common value distribution of the DDT rows indexed by a ̸= 0 for an APN monomial F . In the F3 row, χ denotes the quadratic character of Fq , and λ3,n is specified by X λ3,n := 2 χ x(x2 + x − 1) , x∈Fq
λ3,1 = λ3,2 = 4,
λ3,n = −2λ3,n−1 − 3λ3,n−2
Family
Monomial Fi (x) = xdi over F3n
DDT-row distribution
F1
d1 =
F2
d2 = q − 3 = 3n − 3
3n+1 − 1 4
(n ≥ 3).
q−3 , ω1 = 3 2 q−3 ω0 = ω2 = , ω1 = 3 2 q + λ3,n − 7 ω0 = ω2 = , 4 q − λ3,n + 7 ω1 = 2 ω0 = ω2 =
F3 3n − 3 q−3 = (n ≥ 5) d3 = 2 2
Source/ status [6] [31, 34]
[33]
3(n+1)/2 − 1 , n ≡ 3 (mod 4), 2 (n+1)/2 −1 q−1 3 + , n ≡ 1 (mod 4) 2 2 3n+1 − 1 F5 , n ≡ 3 (mod 4), 8 (n ≥ 5) d5 = n+1 q−1 −1 3 + , n ≡ 1 (mod 4) 8 2 n+1 3 −1 F6 d6 = , ℓ ≥ 2, n ≡ −1 (mod 2ℓ ) ℓ 3(n+1)/2 + 1
F4 (n ≥ 5) d4 =
F7
even d7 with d7 (3m + 1) ≡ 2 (mod 3n − 1), n−1 1≤m≤ , gcd(m, n) = 1 2
Unknown in general
[15, 23]
Unknown in general
[15, 23]
q−3 , 2 q−3 ω0 = ω2 = , 2
ω0 = ω 2 =
ω1 = 3
[21, 23, 38]
ω1 = 3
[21, 38]
Table 1: Selected APN monomial families over F3n , where n ≥ 3 is odd, and the status of their DDT-row distributions. Brief notes on Table 1. (i) The DDT-row distributions of F4 and F5 have been computationally verified to equal that of F3 for every odd 5 ≤ n ≤ 11. (ii) For each admissible m, the congruence in the F7 row uniquely determines the even residue d7 modulo 3n − 1; see [38, Theorem 4.1] for the APN criterion and [21, Section 3] for an explicit parametrization and the DDT-row distribution.
16
(iii) The family F6 is contained in F7 via m = (n + 1)/2ℓ , and F6 = F1 when n + 1 = 2ℓ , equivalently m = 1. Since gcd(di , 3n − 1) = 2 for every listed exponent, Dempwolff’s criterion [12, Theorem 1.1], with the correction [13], shows that Fi ∼CCZ Fj if and only if dj ≡ 3a di (mod 3n − 1) for some 0 ≤ a < n. Equivalently, two listed monomials are CCZ-inequivalent precisely when their exponents lie in distinct 3-cyclotomic cosets modulo 3n − 1. (iv) Theorem 3.7 already proves, without computation, that the boomerang spectrum of G differs from that of every listed monomial. Computations further give βFi ≥ 4 for 1 ≤ i ≤ 6 and every odd 5 ≤ n ≤ 11 for which Fi is defined; at n = 11, (βF1 , . . . , βF6 ) = (8, 8, 4, 8, 6, 10), whereas βG = 2 by Subsection 3.2. n (v) For the original Ness–Helleseth APN family F3n −2,u (x) = x3 −2 1 + uχ(x) , where χ(u − 1) = χ(u + 1) = χ(u), exhaustive computations over F3n for n ∈ {9, 11, 13} give βF3n −2,u = 4 for every admissible u ∈ F∗3n , again exceeding βG = 2. Remark 3.8. Let p be an odd prime and let n be a positive integer. Pal and Stănică [29, Theorem 2.1 and Remark 2.3] show that the boomerang uniformity of an odd APN permutation equals its (−1)-differential uniformity. Combining this bridge with their calculation for the inverse permutation [29, Theorem 2.5] gives n
I(x) := xp −2 ,
δI = βI = 2,
whenever χ(−3) = −1
and
χ(5) ̸= 1.
These conditions yield an infinite family. For example, they hold over F5n for every odd n: in this case −3 = 2 is a nonsquare in F5n , whereas χ(5) = 0. The inverse family does not give an APN example in characteristic 3, because then −3 = 0 and hence χ(−3) = 0. In contrast, Theorems 3.2 and 3.5 give δG = βG = 2 over F3n for every odd n > 1 and every DO PN input g. Thus, to the best of our knowledge, the present construction is the first infinite family in characteristic 3 whose differential and boomerang uniformities are both equal to 2. More broadly, prior to the present work, the inverse family appears to have been the only established infinite family of APN functions over finite fields of odd characteristic with boomerang uniformity two.
3.4
A lower bound on the boomerang uniformity of APN functions
Among the small-field APN binomials recorded by Budaghyan and Pal [4, Table 5], exhaustive computation reveals isolated examples with boomerang uniformity one. For instance, δ x7 +2x2 = 2,
β x7 +2x2 = 1
over F11 .
However, Budaghyan and Pal’s conjecture that this binomial class contains an infinite APN subfamily was subsequently disproved in [2, 26]. Thus these isolated examples do not provide a general construction or an infinite family. We first show that boomerang uniformity one is the minimum possible for an APN function. Proposition 3.9. Let q be an odd prime power and let F : Fq → Fq . If δF ≤ 2 and βF = 0, then δF = 1, that is, F is perfect nonlinear. Conversely, if F is perfect nonlinear, then βF = 0. Proof. Assume first that δF ≤ 2 and βF = 0, and fix h ∈ F∗q . We claim that every nonzero value of Dh F occurs at most once. Indeed, suppose that Dh F (r) = Dh F (s) = b ̸= 0
17
for distinct r, s ∈ Fq . Put a = s − r ̸= 0,
(x, y) = (r, r + h).
Then F (y) − F (x) = Dh F (r) = b and F (y + a) − F (x + a) = Dh F (s) = b. Thus (x, y) is counted by βF (a, b), contradicting βF = 0. This proves the claim. Put m = δF (h, 0). Since δF ≤ 2, one has m ∈ {0, 1, 2}. If m = 0, then Dh F would map its q inputs injectively into the q − 1 nonzero field elements, which is impossible. Suppose that m = 2. By the claim, the remaining q − 2 inputs give q − 2 distinct nonzero derivative values, and hence these values are F∗q \ {µ} for some µ ∈ F∗q . Since q > 2, one has X
t = 0,
t∈F∗q
and consequently X
X
Dh F (x) =
t = −µ ̸= 0.
t∈F∗q \{µ}
x∈Fq
On the other hand, translation invariance gives X x∈Fq
Dh F (x) =
X
F (x + h) −
x∈Fq
X
F (x) = 0,
x∈Fq
a contradiction. Hence m = 1. The claim now shows that Dh F takes 0 exactly once and every nonzero field element exactly once. Thus Dh F is a permutation of Fq . Since h ̸= 0 was arbitrary, F is perfect nonlinear and δF = 1. Conversely, suppose that F is perfect nonlinear and that βF (a, b) ≥ 1 for some a, b ∈ F∗q . Then there exist x, y ∈ Fq such that F (y + a) − F (x + a) = b = F (y) − F (x). It follows that Da F (y) = Da F (x). Since Da F is a permutation, one has x = y, contradicting b ̸= 0. Hence βF = 0. Corollary 3.10. Every APN function F : Fq → Fq over a finite field of odd characteristic satisfies βF ≥ 1. Equivalently, an APN function cannot have boomerang uniformity zero. Proof. If an APN function had βF = 0, Proposition 3.9 would imply that it is perfect nonlinear and hence has differential uniformity 1, contradicting the APN hypothesis. In Section 4, we attain this optimal value over F3n , with n > 1 odd, by constructing large classes of affine perturbations that remain APN. To the best of our knowledge, the present work provides the first general construction yielding infinite families of APN functions with boomerang uniformity one.
4
APN functions with boomerang uniformity one via affine perturbations
This section develops the affine-perturbation construction and applies it to known DO PN families. 18
4.1
The affine-perturbation construction
Starting from the sign-switched APN map G, we determine exactly which affine perturbations reduce its boomerang uniformity from 2 to the optimal value 1, and then isolate a natural translated family whose admissible parameters can be counted exactly. Let A : Fq → Fq be an arbitrary F3 -affine map, equivalently, a polynomial function of algebraic degree at most one. Write uniquely A(x) = M (x) + d,
M (x) = A(x) − A(0) =
d = A(0),
n−1 X
i
mi x3 ,
i=0
where mi ∈ Fq and M is the F3 -linear part of A, and put GA (x) := G(x) + A(x). The constant d cancels from both derivatives and output differences. Since GA ∼EA G, every GA is APN. The next theorem gives an exact affine criterion and the complete boomerang spectrum whenever the criterion holds. Theorem 4.1 (Exact affine criterion and boomerang spectrum). For every F3 -affine map A with linear part M , βGA = 1
⇐⇒
M (u) ∈ / {0, ±L1 (u), ±(τ − g(u))}
for every u ∈ Fq \ F3 .
(4.1)
If the avoidance condition on the right of (4.1) fails, then βGA = 2. Assume that the avoidance condition in (4.1) holds and, for u ∈ Fq \ F3 , define b1 (u) := G(1 + u) − G(1) = g(u + 1) + τ,
b2 (u) := G(2 + u) − G(2) = g(u − 1) + τ.
Define ZM := {u ∈ Fq \ F3 : M (u) ∈ {±b1 (u), ±b2 (u)}},
zM := |ZM |.
Then the exact BCT row distribution of GA is number of rows BCT row type 2 0q−1 zM 0q−7 16 q − 3 − zM 0q−9 18 . Consequently, when βGA = 1, the boomerang spectrum of GA is 2
SBCT (GA ) = {{ 0(q−5) +2zM , 18(q−3)−2zM }}. Proof. For every a ̸= 0, Da GA (x) = Da G(x) + M (a). Thus Da GA and Da G have the same fibers. If a ∈ F∗3 , then Da G, and hence Da GA , is a permutation by Theorem 3.2(i); therefore the a-row of the BCT of GA is zero by (3.4). Let a ∈ F∗q \ F3 , and put u := ua = L−1 a (−τ ),
t := M (u).
Corollary 3.4 gives u ∈ / F3 , and the identity above shows that the four nonsingleton fibers of Da GA are {1, 1 + u},
{2, 2 + u},
{1 − a, 1 − a − u}, 19
{2 − a, 2 − a − u}.
Abbreviate bi := bi (u) for i = 1, 2. Equation (3.5) gives b1 , b2 ̸= 0, and Lemma 2.6 gives b1 − b2 = −L1 (u),
b1 + b2 = τ − g(u).
Since g is PN, L1 is injective, so L1 (u) ̸= 0. Also τ − g(u) ̸= 0 by Corollary 2.4. Hence the four elements ±b1 , ±b2 are distinct. Orient each displayed fiber from its first listed point to its second. By the last assertion of Lemma 3.1, the corresponding G-differences are b1 , b2 , b2 , b1 , respectively. Their increments are u, u, −u, −u, so the affine perturbation contributes t, t, −t, −t, respectively. Thus define the four representative GA -differences by d1 := GA (1 + u) − GA (1) = b1 + t, d2 := GA (2 + u) − GA (2) = b2 + t, d3 := GA (1 − a − u) − GA (1 − a) = b2 − t, d4 := GA (2 − a − u) − GA (2 − a) = b1 − t. Their negatives arise from the opposite orientations. By (3.4), the nonzero BCT columns in the a-row are therefore obtained from the signed multiset {±d1 , ±d2 , ±d3 , ±d4 }, with every occurrence of 0 omitted. Comparing the four representatives up to sign gives exactly the collisions listed below. The four nonzero values of t for which a collision occurs, namely ±L1 (u) and ±(τ −g(u)), are pairwise distinct. Indeed, using b1 − b2 = −L1 (u) and b1 + b2 = τ − g(u), an equality L1 (u) = ±(τ − g(u)) would force b1 = 0 or b2 = 0. Direct substitution in d1 , d2 , d3 , d4 gives the exact row types: condition on t collision BCT row type t=0 d1 = d4 , d2 = d3 0q−5 24 t = −L1 (u) d1 = d3 0q−7 14 22 t = L1 (u) d4 = d2 0q−7 14 22 d1 = −d2 0q−7 14 22 t = τ − g(u) t = −(τ − g(u)) d4 = −d3 0q−7 14 22 . For each of the four nonzero values of t in the table, the six nonzero BCT columns can be identified explicitly. If t = ±L1 (u), then {b ∈ F∗q : βGA (a, b) = 2} = {±(τ − g(u))}, whereas if t = ±(τ − g(u)), then {b ∈ F∗q : βGA (a, b) = 2} = {±L1 (u)}. In either case, {b ∈ F∗q : βGA (a, b) = 1} = {±b1 , ±b2 }. For example, when t = L1 (u) = b2 − b1 ,
(d1 , d2 , d3 , d4 ) = b2 , −(τ − g(u)), b1 , −(τ − g(u)) . All six column indices are nonzero and pairwise distinct. No other collision occurs, so no BCT entry can exceed 2.
20
It remains to translate the parameter u = ua back to the BCT row index a. The identity Lua (a) = La (ua ) = −τ , together with the bijectivity of Lua , gives uua = a. Hence a 7→ ua is an involution of Fq \ F3 . Consequently, every u violating the avoidance condition in (4.1) corresponds to the unique row index a = uu , and conversely. The row types above therefore prove (4.1), including the assertion that βGA = 2 when the avoidance condition fails. Suppose now that the avoidance condition in (4.1) holds. From the definitions of the four representatives, d1 = 0 ⇐⇒ t = −b1 , d2 = 0 ⇐⇒ t = −b2 , d3 = 0
⇐⇒
t = b2 ,
d4 = 0
⇐⇒
t = b1 .
Because the four values ±b1 , ±b2 are distinct, exactly one representative vanishes when t ∈ {±b1 , ±b2 }, and none vanishes otherwise. Thus the row has type 0q−7 16 in the former case and 0q−9 18 in the latter. The involution a 7→ ua shows that exactly zM directions a ∈ F∗q \ F3 have row type 0q−7 16 , and the remaining q − 3 − zM such directions have row type 0q−9 18 . Together with the two zero rows indexed by a ∈ F∗3 , this proves the asserted row distribution. Finally, N1BCT (GA ) = 6zM + 8(q − 3 − zM ) = 8(q − 3) − 2zM , N0BCT (GA ) = (q − 1)2 − N1BCT (GA ) = (q − 5)2 + 2zM , which completes the proof. Corollary 4.2. For each of the two choices of g below, one has τ = g(1) = 1. Let σ ∈ {±1}, put Aσ (x) := σx, and write Gσ := GAσ ;
Gσ (x) = g(x) + ϵ(x) + σx.
Then the following statements hold over Fq . (a) If g(x) = x4 , the Gold function [9, 11], then Gσ is APN with boomerang uniformity one, and its boomerang spectrum is 2
SBCT (Gσ ) = {{0(q−5) , 18(q−3) }}. (b) If g(x) = x10 + x6 − x2 is the Ding–Yuan function with λ = −1 [14], then Gσ is APN with boomerang uniformity one. Let zn = 0, 6, 10, 16 according as gcd(n, 15) = 1, 3, 5, 15, respectively. Then its boomerang spectrum is 2
SBCT (Gσ ) = {{0(q−5) +2zn , 18(q−3)−2zn }}. Proof. For Aσ (x) = σx, one has d = 0 and M (u) = σu. Since, for each u, both the forbidden set in (4.1) and the set {±b1 (u), ±b2 (u)} defining ZM are closed under negation, replacing M by −M changes neither the avoidance condition in (4.1) nor zM . It therefore suffices to take M = id. For either choice of g, put bs (X) := g(X + s) + 1
(s ∈ {±1}).
Since both choices of g are even, one has b−1 (X) = b+1 (−X). First let g(x) = x4 . Then L1 (u) = u3 + u. The equalities u = ±L1 (u) have only solutions in F3 , whereas u = ±(1 − u4 ) gives u4 + u − 1 = 0 or u4 − u − 1 = 0. Both quartics are irreducible over F3 , and hence have no roots in the odd-degree extension Fq . Thus the avoidance condition in (4.1) holds. To compute zM , one has b+1 (X) − X = X 4 + X 3 − 1,
b+1 (X) + X = (X − 1)3 (X + 1). 21
The quartic X 4 + X 3 − 1 is irreducible over F3 , while (X − 1)3 (X + 1) has only the roots ±1. The same conclusions hold after replacing X by −X, so zM = 0. Part (a) now follows from Theorem 4.1. Now let g(x) = x10 + x6 − x2 . Then L1 (X) = X 9 − X 3 − X, and L1 (X) + X = X 9 − X 3 = (X 3 − X)3 , L1 (X) − X = X(X 2 + 1)(X 6 − X 4 + X 2 + 1). The first polynomial has only the roots in F3 , while the quadratic and sextic factors in the second line are irreducible over F3 . The two remaining equalities arising from the forbidden set in (4.1) are u = 1 − g(u) and u = −(1 − g(u)), which are equivalent to g(u) = 1 − u and g(u) = 1 + u, respectively. For s ∈ {±1}, g(X) − 1 − sX = (X 4 − sX 3 + sX + 1)(X 6 + sX 5 + X 4 − X 2 − 1), where both factors are irreducible over F3 . Thus every root of either of the two equations g(X) = 1 ± X has even degree over F3 , so neither equation has a root in Fq . Thus the avoidance condition in (4.1) holds. It remains to compute zM . Direct factorization gives b+1 (X) − X = (X 4 − X − 1)(X 6 + X 5 + X 3 + X + 1), b+1 (X) + X = (X 2 − 1)(X 3 − X 2 + 1)(X 5 − X 4 + 1). The quartic, sextic, cubic, and quintic factors displayed here are irreducible over F3 . The irreducible quartic and sextic factors have no roots in Fq , while the roots ±1 of X 2 − 1 are excluded from ZM . Moreover, gcd b+1 (X) + X, b+1 (−X) − X = X 2 − 1,
so the remaining root sets obtained from b+1 and b−1 are disjoint. Since q = 3n , the two cubic factors contribute six roots precisely when 3 | n, and the two quintic factors contribute ten roots precisely when 5 | n. Consequently, zM = zn . Substitution into Theorem 4.1 proves part (b). Corollary 4.2 gives two examples for which the fixed perturbations A(x) = ±x yield boomerang uniformity one. Such perturbations are not universal: for a general DO PN function g, the admissibility of A depends on g through the criterion in Theorem 4.1. A natural g-dependent family is provided by the derivatives Dc g(x) = Lc (x) + g(c). The next proposition and Corollary 4.4 show that, for every DO PN function g under our standing assumptions, exactly (q − 3)/2 parameters c ∈ Fq give βG+Dc g = 1. Proposition 4.3. Put Cg := {c ∈ Fq \ F3 : g(c) + τ ∈ / g(Fq )}. Then |Cg | = (q − 3)/2. Moreover, for every c, d ∈ Fq , βG+Lc +d = 1
⇐⇒
c ∈ Cg .
In particular, taking d = g(c), one obtains G(x) + Dc g(x) = g(x + c) + τ ϵ(x). Consequently, the function g(x + c) + τ ϵ(x) has boomerang uniformity one if and only if c ∈ Cg . 22
For each c ∈ Fq \ F3 , define κc := #{σ ∈ {±1} : g(c + σ) + τ ∈ g(Fq )} = #{σ ∈ {±1} : c + σ ∈ / Cg } ∈ {0, 1, 2}.
(4.2)
For c ∈ Cg , one has zLc = 4κc ∈ {0, 4, 8}. Proof. We first count Cg . Put D := g(F∗q ). We claim that exactly (q−3)/4 elements z ∈ D satisfy z + τ ∈ D. Since g is PN, there are exactly q − 1 pairs (w, c) ∈ F2q satisfying g(w) − g(c) = τ : for each a = w − c ∈ F∗q , the equation Da g(c) = τ has a unique solution. Exactly two of these pairs have c = 0, namely (w, c) = (1, 0), (−1, 0), and none has w = 0, since g −1 (−τ ) = ∅ by Corollary 2.4. Hence there are q − 3 such pairs in (F∗q )2 . Since every element of D has exactly two preimages by Theorem 2.1, each ordered pair (z + τ, z) ∈ D2 has four ordered preimages under g × g, which proves the claim. Since −τ ∈ / D, one has z + τ ∈ g(Fq ) if and only if z + τ ∈ D. Therefore the number of nonzero c satisfying g(c) + τ ∈ / g(Fq ) is q−1 q−3 2 − 2 4
=
q+1 . 2
The two elements c = ±1 are among them, whereas c = 0 is not. Removing F3 gives |Cg | = (q − 3)/2. We next prove the asserted equivalence. For M = Lc , the choices c = 0, 1, −1 give M (u) = 0, L1 (u), −L1 (u), respectively, so each violates the avoidance condition in (4.1). Now suppose c ∈ / F3 . Since c, c − 1, c + 1 ̸= 0, the PN property of g implies that Lc , Lc−1 , and Lc+1 are bijective. Therefore, for every u ̸= 0, one has Lc (u) ∈ / {0, ±L1 (u)}. For every u ∈ Fq , the two remaining equalities arising from the forbidden set in (4.1) are equivalent to Lc (u) = τ − g(u) ⇐⇒ g(c + u) = g(c) + τ, Lc (u) = −(τ − g(u))
⇐⇒
g(c − u) = g(c) + τ.
Consequently, if c ∈ Cg , then Lc (u) does not lie in the forbidden set in (4.1) for any u ∈ Fq \ F3 , so the avoidance condition in (4.1) holds. Conversely, still assuming c ∈ / F3 , suppose that c ∈ / Cg . Choose w ∈ Fq such that g(w) = g(c) + τ , and put u := w − c. Since τ ̸= 0, one has u ̸= 0, and the first displayed equivalence gives Lc (u) = τ − g(u). If u = ±1, then g(u) = τ , so Lc (u) = 0, contradicting the bijectivity of Lc . Therefore u ∈ Fq \ F3 , and the equality above violates the avoidance condition on the right-hand side of (4.1) for M = Lc . Hence βG+Lc +d = 2. This proves the asserted equivalence. The translated identity in the statement follows directly from the definition of Lc . It remains to determine zLc . Let c ∈ Cg and u ∈ Fq \F3 . Since M = Lc satisfies the avoidance condition of Theorem 4.1, the last part of its proof shows that at most one of d1 , d2 , d3 , d4 can vanish for a fixed u, and that u ∈ ZLc
⇐⇒
one of d1 , d2 , d3 , d4 is zero.
Substituting t = Lc (u) into the displayed formulas for d1 , d2 , d3 , d4 in that proof, the bilinearity of (a, x) 7→ La (x) gives d1 = g(c + 1 + u) − g(c + 1) − τ, d2 = g(c − 1 + u) − g(c − 1) − τ, d3 = g(c + 1 − u) − g(c + 1) − τ, d4 = g(c − 1 − u) − g(c − 1) − τ. 23
Consider first e = c + 1. If g(e) + τ ∈ / g(Fq ), neither d1 nor d3 vanishes. Suppose that g(e) + τ ∈ g(Fq ). This image value is nonzero, because g −1 (−τ ) = ∅ by Corollary 2.4. Since g is a DO PN function, Theorem 2.1 shows that d1 = 0 has exactly two solutions u and d3 = 0 has exactly two solutions u. None of these solutions lies in F3 : u = 0 is impossible because τ ̸= 0, while u = ±1 would give g(e + u) = g(e) + τ = g(e) + g(u) and hence Le (u) = 0, contradicting the bijectivity of Le . By the at-most-one property just noted, the four solutions obtained from d1 = 0 and d3 = 0 are distinct elements of Fq \ F3 . The same argument with e = c − 1 shows that d2 = 0 and d4 = 0 together give exactly four elements of Fq \ F3 if g(c − 1) + τ ∈ g(Fq ), and none otherwise. These four elements are disjoint from those obtained from d1 = 0 and d3 = 0, again because at most one of d1 , d2 , d3 , d4 can vanish for a fixed u. Therefore each e ∈ {c − 1, c + 1} satisfying g(e) + τ ∈ g(Fq ) contributes exactly four elements of ZLc . By (4.2), zLc = 4κc . The preceding proposition now yields the following natural translated family. Corollary 4.4 (Main construction: APN functions with boomerang uniformity one). For each c ∈ Fq , define e c (x) := G(x) + Dc g(x) = g(x + c) + τ ϵ(x). G e c are Then the differential and boomerang uniformities of G (
δGe = 2, c
βGe = c
1, 2,
c ∈ Cg , c ∈ Fq \ Cg .
Consequently, among the q parameter values c ∈ Fq , exactly (q −3)/2 give boomerang uniformity 1, and exactly (q + 3)/2 give boomerang uniformity 2. e c ∼EA G, Proof. The displayed identity follows from Dc g(x) = g(x + c) − g(x) and (1.2). Since G one has δGe = δG = 2. Taking d = g(c) in Proposition 4.3 and applying Theorem 4.1 gives the c stated values of βGe . Finally, |Fq \ Cg | = q − (q − 3)/2 = (q + 3)/2. c
We next complete the main result by determining the boomerang spectrum for every parameter, including the nonadmissible parameters and the three special parameters c ∈ F3 . e c be Corollary 4.5 (Complete boomerang spectra of the main family). For each c ∈ Fq , let G as in Corollary 4.4. For c ∈ Fq \ F3 , let κc be defined by (4.2). e c is (a) If c ∈ Cg , the exact BCT row distribution of G
number of rows BCT row type 2 0q−1 4κc 0q−7 16 q − 3 − 4κc 0q−9 18 . e c is Consequently, the boomerang spectrum of G 2
e c ) = {{ 0(q−5) +8κc , 18(q−3)−8κc }}. SBCT (G
e c is (b) If c ∈ Fq \ F3 ∪ Cg , the exact BCT row distribution of G
number of rows BCT row type 2 0q−1 4 0q−7 14 22 4κc 0q−7 16 q − 7 − 4κc 0q−9 18 . e c is Consequently, the boomerang spectrum of G 2
e c ) = {{ 0(q−5) +8(κc +1) , 18(q−5−κc ) , 28 }}. SBCT (G
24
e c is (c) If c = 0, the exact BCT row distribution of G
number of rows BCT row type 2 0q−1 q−5 0 24 . q−3 e 0 is Consequently, the boomerang spectrum of G 2
e 0 ) = {{ 0q −6q+13 , 24(q−3) }}. SBCT (G e c is (d) If c ∈ F∗3 , the exact BCT row distribution of G
number of rows BCT row type 2 0q−1 q−7 0 14 22 . q−3 e c is Consequently, the boomerang spectrum of G 2
e c ) = {{ 0q −8q+19 , 14(q−3) , 22(q−3) }}. SBCT (G e c = GA , where A = Dc g = Lc + g(c) has linear part Lc . Part Proof. Apply Theorem 4.1 to G (a) follows by substituting zLc = 4κc from Proposition 4.3 into Theorem 4.1. For part (b), suppose that c ∈ Fq \ (F3 ∪ Cg ). The proof of Proposition 4.3 shows that the avoidance condition in (4.1) can fail precisely when
g(c + u) = g(c) + τ
or
g(c − u) = g(c) + τ.
Since c ∈ / Cg , the common right-hand side is a nonzero element of g(Fq ) by Corollary 2.4. By Theorem 2.1, each equation has exactly two solutions. As in the proof of Proposition 4.3, none lies in F3 ; moreover, by the same equivalences the two pairs are disjoint, since a common solution would give g(u) = τ , and hence u = ±1. Thus precisely four parameter values u ∈ Fq \F3 violate (4.1). For these four values, t = Lc (u) = ±(τ − g(u)), so the corresponding cases in the collision table in the proof of Theorem 4.1 give type 0q−7 14 22 and no vanishing di . For every u ∈ Fq \ F3 , the four values ±b1 (u), ±b2 (u) are distinct, independently of the avoidance condition in (4.1), as shown in the proof of Theorem 4.1. Hence at most one of d1 , d2 , d3 , d4 can vanish for a fixed u. This allows us to repeat the counting argument from Proposition 4.3 even when c ∈ / Cg . The same calculation in the final two paragraphs of the proof of Proposition 4.3, which uses only c ∈ / F3 , shows that d1 = 0 and d3 = 0 have altogether four distinct solutions u precisely when g(c + 1) + τ ∈ g(Fq ), while d2 = 0 and d4 = 0 have altogether four distinct solutions u precisely when g(c − 1) + τ ∈ g(Fq ). Hence, by (4.2), one of d1 , d2 , d3 , d4 vanishes for exactly 4κc values of u ∈ Fq \ F3 . Each such value gives type 0q−7 16 . The remaining q − 7 − 4κc parameter values give type 0q−9 18 . The involution a 7→ ua from the proof of Theorem 4.1 shows that these parameter counts are exactly the corresponding BCT row counts. Summing the row types gives the asserted boomerang spectrum. e 0 = G, so part (c) follows from Theorem 3.5. If c = 0, then G Finally, let c ∈ F∗3 . For c = 1 and c = −1, respectively, the third and second rows of the collision and BCT row-type table in the proof of Theorem 4.1 apply, since t = Lc (u) = cL1 (u). Hence every row indexed by a direction a ∈ F∗q \F3 has type 0q−7 14 22 , which proves part (d). 2
Remark 4.6 (A Gold example realizing all eight spectrum types). Let g(x) = x10 = x3 +1 on Fq , where q = 3n and n ≥ 9 is odd. This is a Gold DO PN function [9, 11]. Put P0 (X) := X 10 + 1,
P±1 (X) := (X ± 1)10 + 1. 25
′ = (X ± 1)9 have their only roots at 0 and ∓1, respectively, The derivatives P0′ = X 9 and P±1 where the corresponding polynomial equals 1; hence P0 , P+1 , and P−1 are squarefree. Using P±1 = X 10 ± X 9 ± X − 1, a direct calculation also gives
gcd(P0 , P+1 ) = gcd(P0 , P−1 ) = gcd(P+1 , P−1 ) = 1. Consequently, every nonempty product of the polynomials P0 , P+1 , P−1 is squarefree. For ε = (ε0 , ε+1 , ε−1 ) ∈ {±1}3 , let Nε := #{c ∈ Fq : χ(Pj (c)) = εj for j ∈ {0, +1, −1}}. Put J := {0, +1, −1}. Since −1 is a nonsquare in Fq , one has Pj (c) ̸= 0 for every c ∈ Fq and j ∈ J. Hence the indicator of the condition χ(Pj (c)) = εj is 1{χ(Pj (c))=εj } =
1 + εj χ(Pj (c)) . 2
Consequently, Nε =
1 X Y 1 + εj χ(Pj (c)) 8 c∈F j∈J q
=
X X 1 q+ εj χ(Pj (c)) 8 j∈J c∈F q
+
X
εj εk
X
χ(Pj (c)Pk (c))
c∈Fq
{j,k}⊆J j̸=k
!
+ ε0 ε+1 ε−1
X
χ(P0 (c)P+1 (c)P−1 (c)) .
c∈Fq
The products involving one, two, or three of the Pj have degrees 10, 20, or 30, respectively. Applying the Weil bound for quadratic-character sums [22, Lemma 1] to these seven sums therefore gives √ √ q − (3 · 9 + 3 · 19 + 29) q q − 113 q Nε ≥ = . 8 8 Since q ≥ 39 , the last lower bound is greater than 3. Thus every sign pattern occurs for some c ∈ F q \ F3 . Since g(F∗q ) = (F∗q )2 , the condition χ(P0 (c)) = −1 is equivalent to c ∈ Cg for c ∈ Fq \ F3 . Consequently, each of the three patterns (−1, −1, −1),
(−1, +1, −1),
(−1, +1, +1)
occurs for some parameter c ∈ Cg . Moreover, by (4.2), κc = #{j ∈ {+1, −1} : χ(Pj (c)) = +1}. Therefore (−1, −1, −1) =⇒ κc = 0,
(−1, +1, −1) =⇒ κc = 1,
(−1, +1, +1) =⇒ κc = 2.
Hence {κc : c ∈ Cg } = {0, 1, 2}. These parameters realize all three spectra in Corollary 4.5(a). Likewise, each of the patterns (+1, −1, −1),
(+1, +1, −1),
(+1, +1, +1)
occurs for some c ∈ Fq \ (F3 ∪ Cg ) and gives κc = 0, 1, 2, respectively. Thus all three spectra in Corollary 4.5(b) also occur. The parameters c = 0 and c = ±1 give the two remaining spectra in e c : c ∈ Fq } parts (c) and (d), respectively. Consequently, for every odd n ≥ 9, the APN family {G arising from g(x) = x10 realizes all eight boomerang spectra in Corollary 4.5. Subsection 4.2 presents further examples from known DO PN families, verified by exhaustive computation. 26
4.2
Applications to known DO PN families
The preceding affine-perturbation results apply to every DO PN function over Fq , where q = 3n and n > 1 is odd. For orientation, Table 2 records selected known PN families over Fq that remain valid in this setting. The rows are arranged in the chronological order of the cited constructions and are assigned the local labels f1 , . . . , f5 . The Coulter–Matthews monomial f2 is included for context but is not represented by a DO polynomial in general and is not used below. Family
PN function over Fq , q = 3n k
Conditions for validity
Source
k ≥ 0. The general condition 2 ∤ n/ gcd(n, k) is automatic because n is odd.
[9, 11]
f1
x3 +1
f2
x(3 +1)/2
k odd and gcd(n, k) = 1. This is the Coulter–Matthews family; it is not represented by a DO polynomial in general.
[9]
f3
x10 − λx6 − λ2 x2
λ ∈ F∗q . The original odd-degree condition is automatic because n is odd.
[14]
f4
x3 +1 − ω 3 −1 x3 +3
Here n = 3s, 3 ∤ s, ord(ω) = 3n − 1, and s ≡ k (mod 3). The further condition s/ gcd(s, k) odd is automatic here because n = 3s is odd.
[37, Thm. 1]
f5
x3 +1 − µx3
Here n = 3s, ord(µ) = 32s + 3s + 1, s+t ≡ 0 (mod 3). The and gcd(s, t) s further condition odd is gcd(s, t) automatic here because n = 3s is odd.
[3, Thm. 4]
k
k
t
s
s
2s
2s+k
+3s+t
Table 2: Selected known PN families over Fq for q = 3n with n odd.
Relation between f4 and f5 . For a member of the Zha–Kyureghyan–Wang f4 family, put s t = s + k and µ = ω 1−3 . The corresponding f5 satisfies Bierbrauer’s conditions and
2s
f4 x3
s
= −ω 3 −1 f5 (x).
Hence f4 and the corresponding f5 are linearly equivalent, and therefore EA- and CCZequivalent; this is the relation underlying Bierbrauer’s description of Theorem 4 as a slight generalization of the Zha–Kyureghyan–Wang family [3]. For i ∈ {1, 3, 4, 5}, let gi = fi be any valid member of the corresponding DO PN family in Table 2, and set τi := gi (1),
Gi (x) := gi (x) + τi ϵ(x),
Ci := {c ∈ Fq \ F3 : gi (c) + τi ∈ / gi (Fq )}, e i,c (x) := Gi (x) + Dc gi (x) = gi (x + c) + τi ϵ(x) G
(c ∈ Fq ).
Since gi is DO PN, Theorem 2.1 gives τi ̸= 0. For c ∈ Fq \ F3 , let κi,c denote the quantity in (4.2) with g = gi and τ = τi .
27
Applying Corollary 4.4 to gi gives |Ci | =
q−3 , 2
δGe
i,c
=2
(c ∈ Fq ),
βGe
i,c
= 1 ⇐⇒ c ∈ Ci .
e i,c ∼EA Gi . Hence Lemma 2.8 and Theorem 3.2 give its differential Moreover, Dc gi is affine, so G spectrum, whereas Corollary 4.5(a) directly gives its boomerang spectrum. Consequently, for every c ∈ Ci , e i,c ) = {{ 04(q−3) , 1 2q+(q−3)(q−8) , 24(q−3) }}, SDDT (G 2
e i,c ) = {{ 0(q−5) +8κi,c , 1 8(q−3)−8κi,c }}. SBCT (G
Computational evidence for all eight spectrum types. Table 3 reports computations for selected members of the f1 , f3 , and f5 families over F37 , F37 , and F315 , respectively. Each row contains two triples, whose entries correspond, in order, to κi,c = 0, 1, 2. The first triple counts the parameters c ∈ Ci , and the second counts those c ∈ Fq \ (F3 ∪ Ci ). These distributions were obtained by exhaustive computation for the functions and parameters listed in the table. For the f5 row, n = 15 is the smallest admissible extension degree in the present odd-degree setting for which the family yields a genuine binomial. At the smaller admissible degrees n = 3 and n = 9, the two monomial terms have congruent exponents modulo 3n −1, so every admissible f5 member reduces to a nonzero scalar multiple of a Gold monomial. For this example, take 10 6 F315 = F3 [X]/(X 15 + 2X 2 + 1), α = X (mod X 15 + 2X 2 + 1), and f5 (x) = x4 − α242 x3 +3 . The defining polynomial is primitive, and hence ord(α242 ) = (315 − 1)/(35 − 1) = 310 + 35 + 1. Together with s = 5 and t = 1, this verifies the defining conditions of the Bierbrauer f5 family, so this function is an admissible member of that family and is a genuine binomial. c ∈ Ci
Family n Parameters f1 f3 f5
7 k=2 7 λ=1 15 s = 5, t = 1, µ = α242
c ∈ Fq \ (F3 ∪ Ci )
(252, 588, 252) (294, 504, 294) (294, 504, 294) (252, 588, 252) (1 785 492, 3 600 988, 1 787 972) (1 800 494, 3 575 944, 1 798 014)
Table 3: Computed distributions of κi,c for selected members of the f1 , f3 , and f5 families. Each triple lists, in order, the numbers of parameters with κi,c = 0, 1, 2. All six counts in each row of Table 3 are positive. Thus, for each displayed PN function, the computations realize all three boomerang-uniformity-one spectrum types in Corollary 4.5(a) and all three boomerang-uniformity-two spectrum types in Corollary 4.5(b). The two remaining boomerang-uniformity-two spectrum types, corresponding to c = 0 and c ∈ F∗3 , are given by Corollary 4.5(c) and (d), respectively. Consequently, the computations, together with these two special cases, provide numerical evidence that all eight spectrum types described in Corollary 4.5 are realized for each of the three displayed PN functions. e i,c has algebraic degree 2n. Indeed, τi ̸= 0, so Remark 4.7. For every c ∈ Fq , the function G q−1 τi ϵ has a nonzero x term of base-3 weight 2n, whereas gi (x + c) has algebraic degree exactly 2, since gi is a DO PN function and translation preserves algebraic degree. For functions of algebraic degree at least 2, algebraic degree is invariant under EA equivalence; hence this common degree cannot distinguish the EA-equivalence classes of these functions. e H e be associFor arbitrary DO PN functions g, h, let G, H be their sign-switches and let G, ated functions with boomerang uniformity one. Corollary 5.8 proves that
g ̸∼CCZ h
=⇒
G ̸∼CCZ H
and
e ̸∼CCZ H. e G
e i,c is EA-equivalent to Gi , it follows that if two selected PN functions gi , gj are Since each G e i,c , G e ′ , with c ∈ Ci and c′ ∈ Cj , is CCZ-inequivalent. CCZ-inequivalent, then every pair G j,c
28
Theorem 5.9 uses the orders of the nuclei of the associated presemifields to show that, for infinitely many odd extension degrees n, the Gold f1 , Ding–Yuan f3 , and Bierbrauer f5 PN functions over F3n are pairwise CCZ-inequivalent; consequently, their associated APN functions with boomerang uniformity one are also pairwise CCZ-inequivalent.
5
Switch-rigidity and CCZ-inequivalence
This section establishes the rigidity results needed to prove that CCZ-inequivalent PN inputs yield CCZ-inequivalent associated functions.
5.1
Uniqueness of the vertical subspace and CCZ-to-EA collapse
We now turn to CCZ equivalence, using the graph notation and equivalence conventions introduced in Section 2. Let π(a, b) := a be the projection to the first coordinate, and put K := ker π = {0} × Fq . For every function F : Fq → Fq and every v = (0, b) ∈ K \ {(0, 0)}, one has δF (v) = 0 because b ̸= 0. For orientation, recall the standard fact that, for arbitrary PN functions over finite fields of odd characteristic, CCZ equivalence coincides with EA equivalence. This fact does not apply directly here, because the sign-switched functions considered in this paper are APN and therefore are not PN. The point of Lemma 5.2 below is to prove the corresponding collapse for the present switched maps, using the uniqueness of the vertical subspace established in Lemma 5.1. Lemma 5.1. Let G be the sign-switch of a DO PN function g, as in (1.2). Then K = ker π is the unique n-dimensional F3 -subspace U ≤ Fq × Fq such that U \ {(0, 0)} ⊆ {v ∈ Fq × Fq : δG (v) = 0}.
(5.1)
Proof. Let U ≤ Fq × Fq be an n-dimensional F3 -subspace satisfying (5.1). If π(U ) = {0}, then U ⊆ K. Since both U and K have F3 -dimension n, this gives U = K. Assume, for contradiction, that π(U ) ̸= {0}. Put W := {b ∈ Fq : (0, b) ∈ U },
U0 := {0} × W,
r := dimF3 W.
For each a ∈ π(U ), define the fiber of the restricted projection by Ua := (π|U )−1 (a) = U ∩ {a} × Fq .
Then one has the disjoint union U=
G
Ua .
a∈π(U )
If (a, b) ∈ Ua , then Ua = (a, b) + U0 = {a} × (b + W ),
|Ua | = 3r .
Choose a ∈ π(U ) \ {0} and (a, b) ∈ Ua . For every c ∈ b + W , the vector (a, c) is a nonzero element of U , and hence δG (a, c) = 0. We cannot have a ∈ F∗3 , because Da G is then a permutation by Theorem 3.2. Thus a ∈ F∗q \ F3 . Corollary 3.3 and (3.2) give b + W ⊆ {±A, ±B}, where the four elements are distinct and nonzero. Hence 3r = |b + W | ≤ 4, so r ∈ {0, 1}.
29
Suppose that r = 1. Choose 0 ̸= t ∈ W . Then W = {0, t, −t},
b + W = {b, b + t, b − t},
whose elements sum to zero. On the other hand, every three-element subset of {±A, ±B} has sum equal to the negative of its omitted element, and hence has nonzero sum. This is impossible. Therefore r = 0. It follows that every Ua is a singleton. Since the preceding disjoint union has |U | = 3n = q, one has |π(U )| = q, and hence π(U ) = Fq . Choose b ∈ Fq such that (1, b) ∈ U . Then (5.1) gives δG (1, b) = 0, whereas D1 G is a permutation and therefore δG (1, b) = 1, a contradiction. Hence π(U ) = {0}, and therefore U = K. Lemma 5.2 (CCZ collapses to EA for switched maps). Let G and H be sign-switches of DO PN functions. If G ∼CCZ H, then the linear part of every affine CCZ map sending GG to GH preserves the kernel K = ker π of the projection to the first coordinate. Consequently, G and H are EA-equivalent. Proof. Let A(P ) = M(P ) + c be an affine automorphism of Fq × Fq satisfying A(GG ) = GH . By Lemma 2.7, if δG (v) = 0, then δH (Mv) = 0. Since every v ∈ K \ {(0, 0)} satisfies δG (v) = 0, every u ∈ M(K) \ {(0, 0)} satisfies δH (u) = 0. Thus M(K) is an n-dimensional subspace satisfying (5.1), with H in place of G. By Lemma 5.1, M(K) = K. For x, y ∈ Fq , the F3 -linearity of M gives M(x, y) = M(x, 0) + M(0, y). Since (0, y) ∈ K and M(K) = K, we have M(0, y) ∈ K. Hence the first coordinate of M(x, y) depends only on x. Thus there exist invertible F3 -linear maps M1 , M2 : Fq −→ Fq and an F3 -linear map B : Fq −→ Fq such that, writing c = (a0 , b0 ) and using A(GG ) = GH , M(x, y) = (M1 x, M2 y + B(x)),
A(x, y) = M(x, y) + c = M1 x + a0 , M2 y + B(x) + b0 , H(M1 x + a0 ) = M2 G(x) + B(x) + b0
(5.2)
(x ∈ Fq ).
This is precisely EA equivalence. Lemma 5.3. In the notation of Lemma 5.2, the input linear map M1 satisfies M1 (F∗3 ) = F∗3 .
(5.3)
Proof. Taking the derivative of the last identity in (5.2) in direction a, we obtain DM1 a H(M1 x + a0 ) = M2 Da G(x) + B(a). Therefore DM1 a H is a permutation if and only if Da G is a permutation. By Theorem 3.2, for either F = G or F = H, the derivative Da F is a permutation exactly when a ∈ F∗3 . Hence (5.3) follows. 30
5.2
Uniqueness of the underlying PN function and switch-rigidity
The following lemma identifies the original PN function as the unique PN function that agrees with its sign-switch outside a two-point translate of F∗3 . Lemma 5.4. Let h : Fq → Fq be a DO PN function, put σ := h(1), and let H(x) := h(x)+σϵ(x) be its sign-switch, with ϵ as in (1.2). Suppose f : Fq → Fq is PN and agrees with H outside a two-point set C = c + F∗3 = {c + 1, c − 1}. Then c = 0 and f = h. Proof. We proceed in three steps. For this proof, write La (x) := h(x+a)−h(x)−h(a) and, for a ∈ F∗q \F3 , put ua := L−1 a (−σ). For every a ∈ F∗q \ F3 , Corollary 3.4, applied with (g, G, τ ) replaced by (h, H, σ), shows that the only nonsingleton fibers of Da H are {1, 1 + ua }, {1 − a, 1 − a − ua },
{−1, −1 + ua }, {−1 − a, −1 − a − ua }.
(5.4)
For every a ∈ F∗q \ F3 , since f = H on Fq \ C, one has Da f (x) = Da H(x) for every x ∈ Fq \ C ∪ (C − a) . Whenever |C ∪ (C − a)| = 4, the set C ∪ (C − a) meets each of the four two-element fibers in (5.4) exactly once. Indeed, if one of these fibers were disjoint from C ∪ (C − a), its two points would still have the same image under Da f , contradicting that Da f is a permutation. Since the four fibers are pairwise disjoint and C ∪ (C − a) has four elements, each fiber is met exactly once. Step 1: c ∈ F∗q \ F3 is impossible. Suppose that c ∈ F∗q \ F3 and consider the derivative in direction c. Since f differs from H only on C = c + F∗3 , the derivatives Dc f and Dc H agree outside the four-element set C ∪ (C − c) = {1, −1, 1 + c, −1 + c}. The preceding observation applies. The points 1 and −1 meet the first two fibers in (5.4), so 1 + c and −1 + c meet the last two. Neither is one of their first listed points 1 − c and −1 − c: any such equality would give 2c ∈ F3 , contrary to c ∈ / F3 . Hence {1 + c, −1 + c} = {1 − c − uc , −1 − c − uc }. Comparing sums gives uc = c. Therefore −σ = Lc (uc ) = Lc (c) = h(2c) − 2h(c) = −h(c), because h(2c) = h(−c) = h(c). Hence h(c) = σ = h(1), which is impossible by Corollary 2.4 because c ∈ / F3 . Step 2: c ∈ F∗3 is impossible. Let c ∈ F∗3 and choose any a ∈ F∗q \ F3 . Since C = c + F∗3 = {0, −c}, the derivatives Da f and Da H agree outside the four-element set C ∪ (C − a) = {0, −c, −a, −c − a}. The preceding observation applies. The points −c and −c − a are the first listed points of two fibers in (5.4). The remaining points 0 and −a therefore meet the other two fibers. Their first listed points are c and c − a, and neither 0 nor −a equals either of them, because c ̸= 0 and a∈ / F3 . Thus {0, −a} = {c + ua , c − a − ua }. Comparing sums gives −a = 2c − a, and hence 2c = 0, contrary to c ∈ F∗3 . 31
Step 3: c = 0, and it remains to show f = h. By Steps 1 and 2, the only remaining possibility is c = 0. Now C = F∗3 = {1, −1}. Since f = H = h outside C, the permutations D1 f and D1 h agree outside C ∪ (C − 1) = F3 . Their image sets on F3 are therefore equal, each being the complement of their common image of Fq \ F3 . Evaluating at 0, 1, −1 gives {f (1), f (−1) − f (1), −f (−1)} = D1 f (F3 ) = D1 h(F3 ) = {σ, 0, −σ}. Choose any a ∈ F∗q \ F3 and put A := Da h(1) = h(a + 1) − σ,
B := Da h(−1) = h(a − 1) − σ.
Since f = h outside C = F∗3 , equation (3.1) shows that Da f and Da h agree outside Ea . Both derivatives are permutations, so their images of Ea coincide. Therefore (3.2) and (3.3), applied with (g, G, τ ) replaced by (h, H, σ), give Da f (Ea ) = Da h(Ea ) = {±A, ±B},
A, B, A + B, A − B ∈ / σF3 .
In particular, Da f (±1) ∈ {±A, ±B}. Suppose first that f (1) = 0. Since a + 1 ∈ / C, one has f (a + 1) = h(a + 1), and hence Da f (1) = f (a + 1) − f (1) = h(a + 1) = A + σ ∈ {±A, ±B}. Equality with one of ±A, ±B would force σ = 0 or one of A, A − B, A + B to lie in σF3 , a contradiction. Thus f (1) ̸= 0. If f (−1) = 0, then a − 1 ∈ / C similarly gives Da f (−1) = f (a − 1) − f (−1) = h(a − 1) = B + σ ∈ {±A, ±B}. The same check, with B in place of A, gives a contradiction. Thus f (−1) ̸= 0. Consequently, the equality {f (1), f (−1) − f (1), −f (−1)} = {σ, 0, −σ} forces f (−1) − f (1) = 0, so f (1) = f (−1) ∈ {±σ}. If f (1) = f (−1) = −σ, then f = H, because H(±1) = −σ; this contradicts δf = 1 and δH = 2 from Theorem 3.2. Therefore f (1) = f (−1) = σ = h(1) = h(−1). Together with f = h outside C, this proves f = h. Remark 5.5. In Lemma 5.4, f is assumed only to be PN; its quadraticity and representation by a DO polynomial follow from the conclusion f = h. Theorem 5.6 (Switch-rigidity). Let g, h : Fq → Fq be DO PN functions, and let G, H be their sign-switches. If G ∼CCZ H, then g ∼EA h. Proof. Assume G ∼CCZ H. By Lemma 5.2, the CCZ equivalence is induced by an EA map A of the normal form (5.2), and (5.3) gives M1 (F∗3 ) = F∗3 . By (1.2), the graph Gg differs from GG exactly at the two inputs F∗3 = {1, 2}. Since the first coordinate of A is M1 x + a0 , the graph A(Gg ) differs from A(GG ) = GH exactly at a0 + M1 (F∗3 ) = a0 + F∗3 . Because g is PN and A is an EA map, A(Gg ) is the graph Gf of a PN function f . Thus f agrees with H outside the two-point set a0 + F∗3 . Lemma 5.4, applied to H, gives a0 = 0 and f = h. Therefore A(Gg ) = Gh , so g ∼EA h. Corollary 5.7. The EA equivalence between g and h in Theorem 5.6 is in fact a linear equivalence; that is, there exist invertible F3 -linear maps M1 , M2 such that H(M1 x) = M2 G(x),
h(M1 x) = M2 g(x)
(x ∈ Fq ).
More precisely, every affine CCZ map A sending GG to GH has the form A(x, y) = (M1 x, M2 y) and also satisfies A(Gg ) = Gh . 32
Proof. Let A be any affine CCZ map sending GG to GH . By Lemma 5.2, it has the normal form (5.2). The proof of Theorem 5.6, applied to this map, gives a0 = 0 and A(Gg ) = Gh . Evaluating (5.2) at x = 0 gives b0 = 0, since G(0) = H(0) = 0. Since G and H are even, comparing the identity H(M1 x) = M2 G(x) + B(x), obtained from (5.2), at x and −x gives 2B(x) = 0, and hence B = 0. Thus A(x, y) = (M1 x, M2 y). The identities H(M1 x) = M2 G(x) and h(M1 x) = M2 g(x) now follow from the corresponding graph equalities.
5.3
CCZ-inequivalence arising from inequivalent PN inputs
Throughout this subsection, g denotes a DO PN function, G denotes its sign-switch as in (1.2), e denotes any one of the functions G e c in (1.4), with c ∈ Cg . We suppress c because its and G choice plays no role below. By Corollary 4.4, δG = δGe = 2,
βG = 2,
e ∼EA G. G
βGe = 1,
(5.5)
e is used analogously, and the corresponding For a second DO PN function h, the notation H, H relations in (5.5) hold.
Corollary 5.8. Let g, h : Fq → Fq be DO PN functions, with the notation above. If g ̸∼CCZ h, then both G ̸∼CCZ H
e ̸∼CCZ H. e G
and
Proof. Indeed, if G ∼CCZ H, then Theorem 5.6 gives g ∼EA h, and hence g ∼CCZ h, contrary to the hypothesis. Thus G ̸∼CCZ H. Moreover, since EA equivalence implies CCZ equivalence, e ∼CCZ H e if and only if G ∼CCZ H; hence G e ̸∼CCZ H. e (5.5) yields G Theorem 5.9 (Three CCZ-inequivalent classes with boomerang uniformity one). Let q = 3n = 33s , where s > 1 is odd, choose 1 ≤ t < 3s, put ℓ := gcd(s, t), and assume ℓ > 1,
s+t ≡0 ℓ
s ∤ t,
(mod 3).
Let ω be a primitive element of F33s , and define s
g1 (x) := x3 +1 , g3 (x) := x10 − x6 − x2 , t
s
2s +3s+t
g5 (x) := x3 +1 − ω 3 −1 x3
.
e i be any one of the functions in (1.4), with g replaced by gi and with its For i ∈ {1, 3, 5}, let G e1, G e 3 , and G e 5 are pairwise CCZ-inequivalent APN functions, and parameter in Cgi . Then G
βGe = βGe = βGe = 1. 1
3
5
Taking s = 5ℓ and t = ℓ for any odd ℓ > 1 yields infinitely many odd extension degrees n = 15ℓ for which such a triple exists; the first is n = 45. Proof. Equation (5.5), applied to each gi , gives the APN and boomerang-uniformity assertions. It remains to prove that g1 , g3 , and g5 are pairwise CCZ-inequivalent. Since ω is primitive, one s has ord(ω 3 −1 ) = (33s − 1)/(3s − 1) = 32s + 3s + 1. Hence the validity conditions for g1 , g3 , and g5 follow from Table 2; in particular, g5 is a member of the Bierbrauer f5 family [3, Thm. 4]. 33
Moreover, s ∤ t excludes t = 2s, the only value for which the two exponents of g5 are congruent modulo 33s − 1; hence g5 is a genuine binomial. Semifields in the isotopy classes associated with g1 , g3 , and g5 have nucleus and middle-nucleus orders (3s , 3s ),
(3, 3),
(3ℓ , 3ℓ ),
(5.6)
respectively. The first two pairs in (5.6) are recorded, respectively, in [1, Sec. 3, p. 830] and [1, Sec. 3, p. 831]; see also [8]. In the notation of [17, Sec. 4, Thm. 4.3, p. 18], the function g5 is F3t ,ω over F33s and is GL(3, 3s )-equivalent to a function in the family of their Theorem 1.9. This equivalence induces a strong isotopy between the associated presemifields [17, Sec. 2.7, p. 10]. t The automorphism x 7→ x3 of F3s has fixed field F3ℓ , so [17, Appendix A, Thm. A.4, p. 23] gives the third pair in (5.6). Since 1 < ℓ < s, the three pairs in (5.6) are distinct. The orders of the nuclei are isotopy invariants [1, Sec. 2.2, p. 827]; hence the three associated semifields are pairwise nonisotopic. For planar DO polynomials, CCZ equivalence is equivalent to strong isotopy [1, Sec. 2.3, p. 827], and strong isotopy implies isotopy. Therefore the three inputs are e1, G e 3 , and G e 5 are pairwise CCZpairwise CCZ-inequivalent. Corollary 5.8 then shows that G inequivalent. Finally, s = 5ℓ and t = ℓ give (s + t)/ℓ = 6 and satisfy the other conditions immediately.
6
Conclusion and further directions
We have shown that every DO PN function g over Fq , where q = 3n and n > 1 is odd, gives rise to a family of APN functions whose exact differential and boomerang spectra can be determined. Writing τ = g(1), the sign-switch G = g + τ ϵ is APN with δG = βG = 2, and every function e c (x) := G(x) + Dc g(x) = g(x + c) + τ ϵ(x), G
c ∈ Fq ,
is APN. Exactly (q − 3)/2 choices of c yield boomerang uniformity one, and the remaining (q + 3)/2 yield boomerang uniformity two. This family has a common exact differential spectrum, while its complete boomerang spectra fall into three types in the former case and five in the latter. We also proved that, for functions over finite fields of odd characteristic with differential uniformity at most two, boomerang uniformity zero implies perfect nonlinearity; hence boomerang uniformity one is the least possible value for an APN function in odd characteristic. The common differential spectrum also separates the constructed functions from every power function and every Ness–Helleseth-type binomial; its CCZ-invariance therefore yields CCZinequivalence from both classes. Furthermore, switch-rigidity shows that CCZ equivalence between sign-switches of DO PN functions forces EA equivalence between their PN inputs. Combining this result with the different orders of the nuclei of the associated presemifields yields three pairwise CCZ-inequivalent APN functions with boomerang uniformity one for infinitely many odd extension degrees, using the Gold, Ding–Yuan, and Bierbrauer families. The first degree obtained by this argument is n = 45. The present method relies essentially on the DO property, which makes every derivative k Dc g affine. A natural next case is therefore the Coulter–Matthews PN family x(3 +1)/2 , with k odd and gcd(n, k) = 1. This family is generally non-DO, so the present affine-perturbation argument does not apply directly. It would be interesting to determine the exact spectra of its sign-switches and to find a modified perturbation that yields APN functions with boomerang uniformity one. More broadly, one may ask whether analogous switching and perturbation methods can produce APN functions with boomerang uniformity one beyond the ternary DO setting.
34
Acknowledgments: Soonhak Kwon was supported by Basic Science Research Program through the National Research Foundation of Korea (NRF) funded by the Ministry of Education (No. RS-2019-NR040081). Namhun Koo was supported by Basic Science Research Program through the National Research Foundation of Korea (NRF) funded by the Ministry of Education (No. RS-2026-25575984).
References [1] S. Andreoli, L. Budaghyan, R. S. Coulter, A. Haukenes, N. Kaleyski, and E. Piccione, On a classification of planar functions in characteristic three, Cryptogr. Commun. 17 (2025), 823–853. DOI: 10.1007/s12095-025-00781-y. [2] D. Bartoli and P. Stănică, Non-existence of infinite APN families from patched monomials in odd characteristic, Cryptogr. Commun. (2026), published online. DOI: 10.1007/s12095026-00880-4. [3] J. Bierbrauer, New semifields, PN and APN functions, Des. Codes Cryptogr. 54 (2010), 189–200. DOI: 10.1007/s10623-009-9318-7. [4] L. Budaghyan and M. Pal, Arithmetization-oriented APN permutations, Des. Codes Cryptogr. 93 (2025), no. 4, 1067–1088. DOI: 10.1007/s10623-024-01487-7. [5] C. Carlet, P. Charpin, and V. Zinoviev, Codes, bent functions and permutations suitable for DES-like cryptosystems, Des. Codes Cryptogr. 15 (1998), 125–156. DOI: 10.1023/A:1008344232130. [6] S.-T. Choi, S. Hong, J.-S. No, and H. Chung, Differential spectrum of some power functions in odd prime characteristic, Finite Fields Appl. 21 (2013), 11–29. [7] C. Cid, T. Huang, T. Peyrin, Y. Sasaki, and L. Song, Boomerang connectivity table: A new cryptanalysis tool, in Advances in Cryptology–EUROCRYPT 2018, Lecture Notes in Computer Science 10821, Springer, 2018, 683–714. DOI: 10.1007/978-3-319-78375-8_22. [8] R. S. Coulter and M. Henderson, Commutative presemifields and semifields, Adv. Math. 217 (2008), no. 1, 282–304. DOI: 10.1016/j.aim.2007.07.007. [9] R. S. Coulter and R. W. Matthews, Planar functions and planes of Lenz–Barlotti class II, Des. Codes Cryptogr. 10 (1997), no. 2, 167–184. [10] R. S. Coulter and R. W. Matthews, On the number of distinct values of a class of functions over a finite field, Finite Fields Appl. 17 (2011), no. 3, 220–224. DOI: 10.1016/j.ffa.2010.12.002. [11] P. Dembowski and T. G. Ostrom, Planes of order n with collineation groups of order n2 , Math. Z. 103 (1968), no. 3, 239–258. [12] U. Dempwolff, CCZ equivalence of power functions, Des. Codes Cryptogr. 86 (2018), 665– 692. [13] U. Dempwolff, Correction to: CCZ equivalence of power functions, Des. Codes Cryptogr. 90 (2022), 473–475. DOI: 10.1007/s10623-021-00979-0. [14] C. Ding and J. Yuan, A family of skew Hadamard difference sets, J. Combin. Theory Ser. A 113 (2006), 1526–1535. [15] H. Dobbertin, D. Mills, E. N. Müller, A. Pott, and W. Willems, APN functions in odd characteristic, Discrete Math. 267 (2003), 95–112. [16] K. Feng and J. Luo, Value distributions of exponential sums from perfect nonlinear functions and their applications, IEEE Trans. Inf. Theory 53 (2007), no. 9, 3035–3041. DOI: 10.1109/TIT.2007.903153. 35
[17] F. Göloğlu and L. Kölsch, Commutative semifields from bijections of the Desarguesian plane, J. Lond. Math. Soc. 114 (2026), no. 1, Art. e70635. DOI: 10.1112/jlms.70635. [18] Z. Hu, N. Li, L. Xu, X. Zeng, and X. Tang, The differential spectrum and boomerang spectrum of a class of locally-APN functions, Des. Codes Cryptogr. 91 (2023), no. 5, 1695– 1711. DOI: 10.1007/s10623-022-01161-w. [19] N. Koo and S. Kwon, On differential and boomerang properties of a class of binomials over finite fields of odd characteristic, IEEE Trans. Inf. Theory 72 (2026), no. 3, 1928–1942. DOI: 10.1109/TIT.2026.3657603. [20] N. Koo, S. Kwon, M. Ko, and B. Kim, Locally-APN binomials with low boomerang uniformity in odd characteristic, arXiv:2512.17603v2, 2026. [21] N. Koo, S. Kwon, M. Ko, and B. Kim, On APN exponents and the differential and boomerang properties of binomials in characteristic 3, arXiv:2605.23224, 2026. [22] T. Lange and A. Winterhof, Incomplete character sums over finite fields and their application to the interpolation of the discrete logarithm by Boolean functions, Acta Arith. 101 (2002), no. 3, 223–229. DOI: 10.4064/aa101-3-3. [23] E. Leducq, New families of APN functions in characteristic 3 or 5, in Arithmetic, Geometry, Cryptography and Coding Theory, Contemp. Math. 574, Amer. Math. Soc., 2012, 115–123. [24] K. Li, L. Qu, B. Sun, and C. Li, New results about the boomerang uniformity of permutation polynomials, IEEE Trans. Inf. Theory 65 (2019), no. 11, 7542–7553. DOI: 10.1109/TIT.2019.2918531. [25] C. Lyu, X. Wang, and D. Zheng, A further study on the Ness–Helleseth function, Finite Fields Appl. 98 (2024), Art. 102453. DOI: 10.1016/j.ffa.2024.102453. [26] S. Mesnager and H. Wu, The differential and boomerang properties of a class of binomials, IEEE Trans. Inf. Theory 71 (2025), no. 6, 4854–4871. DOI: 10.1109/TIT.2025.3550851. [27] G. J. Ness and T. Helleseth, A new family of ternary almost perfect nonlinear mappings, IEEE Trans. Inf. Theory 53 (2007), no. 7, 2581–2586. DOI: 10.1109/TIT.2007.899508. [28] K. Nyberg, Differentially uniform mappings for cryptography, in Advances in Cryptology– EUROCRYPT ’93, Lecture Notes in Computer Science 765, Springer, 1994, 55–64. DOI: 10.1007/3-540-48285-7_6. [29] M. Pal and P. Stănică, A connection between the boomerang uniformity and the extended differential in odd characteristic and applications, Adv. Math. Commun. 19 (2025), no. 5, 1382–1403. DOI: 10.3934/amc.2024059. [30] Y. Xia, F. Bao, S. Chen, C. Li, and T. Helleseth, More differential properties of the Ness–Helleseth function, IEEE Trans. Inf. Theory 70 (2024), no. 8, 6076–6090. DOI: 10.1109/TIT.2024.3408882. [31] Y. Xia, X. Zhang, C. Li, and T. Helleseth, The differential spectrum of a ternary power mapping, Finite Fields Appl. 64 (2020), 101660. [32] G. Xu, X. Cao, and S. Xu, Constructing new APN functions and bent functions over finite fields of odd characteristic via the switching method, Cryptogr. Commun. 8 (2016), 155–171. DOI: 10.1007/s12095-015-0145-6. [33] H. Yan, S. Mesnager, and X. Tan, On a class of APN power functions over odd characteristic finite fields: their differential spectrum and c-differential properties, Discrete Math. 347 (2024), 113881.
36
[34] H. Yan, Y. Xia, C. Li, T. Helleseth, M. Xiong, and J. Luo, The differential spectrum of the n power mapping xp −3 , IEEE Trans. Inf. Theory 68 (2022), no. 8, 5535–5547. [35] X. Zeng, L. Hu, Y. Yang, and W. Jiang, On the inequivalence of Ness–Helleseth APN functions, IACR Cryptology ePrint Archive, Report 2007/379, 2007. [36] Z. Zha and L. Hu, Constructing new APN functions from known PN functions, Int. J. Found. Comput. Sci. 24 (2013), no. 8, 1209–1219. DOI: 10.1142/S0129054113500299. [37] Z. Zha, G. M. Kyureghyan, and X. Wang, Perfect nonlinear binomials and their semifields, Finite Fields Appl. 15 (2009), no. 2, 125–133. DOI: 10.1016/j.ffa.2008.09.002. [38] Z. Zha and X. Wang, Power functions with low uniformity on odd characteristic finite fields, Sci. China Math. 53 (2010), 1931–1940.
37