JOURNAL OF COMBINATORIAL THEORY (A) 20, 300-305 (1976)

On “Bent” Functions

0. S. ROTHAUS

Department of Mathematics, Cornell University, Ithaca, New York 14853

Communicated by the Managing Editors
Received March 25, 1975

Let P(x) be a function from GF(2”) to GF(2). P(x) is called “bent” if all
Fourier coefficients of (- 1)P(5’ are & 1. The polynomial degree of a bent function
P(x) is studied, as are the properties of the Fourier transform of (-I)““), and
a connection with Hadamard matrices.

Let V, be the vector spaceof n tuples of elements from GF(2), and ( , )

the usual scalar product thereon. Let P be a mapping from V, to VI.
P(x) may be written uniquely as a reduced polynomial in the coordinates
Xl >x2 ,..., x, of x. (Reduced means that the degree of P(x) in any xi is at
most one.) We will generally identify the mapping P with the corresponding
reduced polynomial P(x).
Now let w be the real number -1. Then CIJ~(~) is a well-defined real
function on V, , and by the character theory for abelian groups we may
write:
d(z) = & A; c(X) oJ(,J’“>
*
where the c(h), the “Fourier coefficients” of ~~~~~are given by

In words, 2*/%(X) is the number of zeros minus the number of ones of

the function P(x) + (A, x).
From Parseval’s equation, we know that

,; c2@> = 2”.
12
We call P(x) a “bent” function if all the Fourier coefficients of wpCz)are

300
Copyright 0 1976 by Academic Press, Inc.
All rights of reproduction in any form reserved.
 ON "BENT" FUNCTIONS 301

In the first part of this paper we will describe some general properties
of bent functions, while in the last part we will give some large general
classesof bent functions.
First, let us note that if P(X) is bent, then the Fourier coefficients of
cJ(~) may be written in the form c(h) = uQtA), where Q(A) is another
polynomial on V, . The Fourier coefficients of wQtn) are just wPCZ),so
Q(A) is a bent function also. Thus, there is a natural pairing of bent
functions, which we describe loosely by saying:

PROPOSITION. The Fourier transform of a bentf&tion is a bentfunction.

Subsequently, we will see that many bent functions are paired with
themselves.
Now for any polynomial P(x) on V, , the orthogonality relations for the
characters yield that

hg C(h) c(h + p) = 2” if y = 0
n
==0 otherwise.

If P(X) is bent, then the c(h) are just +I, so that in this case the matrix
whose hth row and pth column is c(h + p) is a Hadamaard matrix.
Since we have the pairing of bent functions with their Fourier transforms
we see also that cP~+~) is a Hadamaard matrix if P(x) is bent. It is not
difficult to show that the above implication is reversible, so:

PROPOSITION. P(x) is bent zJ~oJ~(~+Y)

is a Hadamard matrix.
The last proposition was also noted by Lloyd Welch.
Before going on to the next proposition, it is convenient to insert a few
trivial remarks. Let P(x) be an arbitrary reduced polynomial on V, .
By adding the values of P(X) over all x E V, , we seethat the parity of the
number of zeros of P(x) is equal to the coefficient of the monomial term
XIX%.. . x, . On the other hand, if c(0) is the zero Fourier coefficient of
CJP), we seethat the number of zeros of P(x) = 2(nP)-1~(0) + 2+l. We
will apply these remarks to the Fourier coefficients associated to the
polynomial P(x) with some of its variables specialized to 0.

PROPOSITION. If P(x) is a bentfunction on V, , then n is ez;en,n = 2k;

the degree of P(x) is at most k, except in the casek = 1.
That n is even follows trivially from the observation that 2”&(h) is an
integer.
For the second statement of the proposition, let II = 2k with k > 1,
302 0. S. ROTHAUS

and let I’ > k. We consider the polynomial P(x, , x, ,..., x, , 0,O ,... i 0) =
Q(x,, x, ,..., x,) and put

,Q(d = ‘- 1 /5(X, ) A, )...) A,) WAl”C1+A2”+..+Arxr.

2’12
A1.A2 ,..., A,=O,l

We have

On comparing, and using the uniqueness of the Fourier expansion, we

conclude

So we obtain:
The number of zeros of P(x, , x2 ,..., x, , 0, 0 ,..., 0) = 2r--k-1 CA,+, ,..,,,,,=o,1
~(0, 0, 0, 0, h,.+r , hr+2 ,..., A,) + 2p-1. There are 2”-’ summands in
c 40, o,..., 0, A,+1 ,..., A,) and they all equal &l, so the sum in question
has even parity. Consequently, the number of zeros of P(x, , x2 ,..., x, ,
0, o,..., 0) is even; but the parity of this number is just the coefficient of
x1x2 ... x, in the polynomial P(xl , x2 ,..., x, , 0,O ,..., 0).
Since we could have specialized any n - r variables to zero: we have
proved the desired result.
We will see subsequently that the inequality on the degree of P(x) is
the best possible. First we make a trivial though interesting application
of the last result.
It is easy to see that if P(x) is a bent function, so is the function obtained
by a nonsingular linear or affine transformation of coordinates. It is also
easy to see that if P(x) and Q(v) are functions on V, and V, , respectively,
then P(x) + Q(v) is a bent function on Vn+ iff P(x) and Q(v) are each
bent. This follows immediately as soon as one observes that the Fourier
coefficients of JQ)+Q(u) are just the products, a pair at a time, of the
Fourier coefficients of ~~(~1 with those of wQ@).
Let us call a polynomial on V, reducible if by a linear transformation of
coordinates it may be written as a sum of polynomials on disjoint
variables. It is clear that a linear transformation of coordinates does not
change the degree of a polynomial. Now if P(x) is a bent function on V,, ,
which may be written as a sum of polynomials on disjoint variables, then
the degree of each summand is necessarily < k, except in the case k = 2.
Thus,
 ON “BENT" FUNCTIoNS 303

PROPOSITION. If P(x) is a bentfunction on V,, , k >, 3, of degree k, then

P(x) is irreducible.
At this point, we decided to make an exhaustive search for all bent
polynomials on V, . This was made feasible by virtue of the following
observation due to Welch. By a linear transformation of coordinates, the
degree three part of any such polynomial could be brought into one of the
following four forms:
(1) XlX2X3

(2) X1X2X3 + X4X5X6

(3) X1X2X3 + X2X4X5

(4) X1x2X3 + X2X4X5 + X3XqXlj .

It was now only necessary to try each of the above four degree three parts
with all of the 215 possible quadratic parts. The program was written and
run by Gerry Mitchell. Answers were found in classes 1, 3, and 4 of which
typical ones are listed below
(l) X1X2X3 + x1X4 + x2x:, + x3x6
(3) X1X2X3 + X2X4X.j + XIX2 + x1x4 + X2X6 + X3X5 + x4x5

(4) X1X2X3 + X2X4X5 + X3X4X6 + X1X4 + X2X6 + X3X4 + X3X5 + X3X6

X4X5 + x4X6
A perfunctory examination of all the answers seemed to indicate that
all the members in a class were related to each other by an affine transfor-
mation of coordinates followed by the addition of linear terms. A more
carefully designed program written by Welch verified this observation.
A careful analysis of the answers also gave us two large general classes
of bent functions, which explain the survivors of the machine run. These
we now present.
(I) Let x, y E V,< and P(x) be an arbitrary polynomial on V, .
Then the polynomial Q(x, y) on V,, given by
Q<x,Y> = X,Y, + X,Y, + ... + X,Y, + P(x)
is bent.
(II) Let A(x), B(x), C(x) be bent polynomials on V,, such that
A(x) + B(x) + C(x) is also bent. Let y, z c V, . Then the polynomial
Qh Y, 4 = 44 %4 + B(x) C(x) + C(x) A(x)
+ Mx) + WIY f Mx) + C(x)lz + YZ
is a bent polynomial on V,,,, .
304 0. S. ROTHAUS

Note that the requirement that A(X) + B(x) f C(x) be bent is very
readily met by taking A, B, and C from Class I for example, or by putting
A = B, or by putting B = C.
The proofs that I and II give bent functions are straightforward. We
take a polynomial Q(x, JJ) in Class I and compute the number of zeros of

for fixed but arbitrary h, p E V, . We must show that the number of zeros
is of the form 22”-1 * 2/;-l to guarantee that the Fourier coefficients are
all &I. Let Q(x, v) = (x, y> + P(X) and write

To count the zeros, we consider two cases:

(i) x + p # 0. Then P(x) f (X, x) + (x + p, JJ) is nontrivially
linear in y, so for any such x there are 2”-i zeros. In the other hand there
are (2” - 1) such choices for x, giving us all told 22”-1 - 2L-1 zeros.
(ii) x + TV= 0. Then P(x) + <A, X> + (X + P, Y> = P(P) + 0, P>
and we obtain 27cadditional zeros if P(p) + (X, p) = 0, and no additional
zeros if P(p) + (X, p) = 1.

This completes the proof for this case. Note that we have 22’;-1 f 2L-1
zeros if P(p) + (X, p) = 0 and 227G-1- 21ip1zeros if P(p) + (X, FL) = 1.
This is equivalent to the assertion that Q(x, v) is its own Fourier transform.
We now verify the assertion for Class II. Let h E V,, and 01,/3 E V, .
We must count the number of zeros of

4x) B(x) + B(x) C(x) t C(x)44 + (A(x) + B(x))Y

+ (A(x) t C(x)b + YZ+ <A,x> + w + 132.
Again we consider two cases:
(i) Take the X, y for which A(x) + C(x) + y + ,8 = 1. There are 22”
such pairs x, y, and then there is a unique value of z making polynomial 0.
(ii) Take the x, y for which A(x) + C(x) + y + /I = 0 and so
replace y in the polynomial above by A(x) + C(x) + p. The polynomial
then becomes:

(1 + 01+ P) A(x) + PB(x)+ a+) + $ + <A,x>.

No matter what the values of 01and /?, the number of zeros as functions
of x will be by virtue of our hypotheses of form 2”k-1 + 2k-1, and since z
is arbitrary, we obtain all told in this case 2”” & 2” zeros.
 ON “BENT" FUNCTIONS 305

Assembling (i) and (ii), we see that we always have the correct number
of zeros, so Case II is settled. We might add that Case II gives the most
general polynomial which can be written in the form

We have not investigated the Fourier transforms of Class II.

It should be remarked that Class II include Class I; but Class I is given
explicitly, while Class II has implicit features.
Other classes of bent functions, and their general connection with
difference sets in elementary abehan 2-groups are described in [I].

REFERENCE

1. R. MCFARLAND, A family of difference sets in noncyclic groups, J. Combinatorial

Theory, Ser. A 15 (1973), l-10.