The Value $4$ of Binary Kloosterman Sums

(1)

HAL Id: hal-00642290

https://hal.archives-ouvertes.fr/hal-00642290

Submitted on 17 Nov 2011

HAL is a multi-disciplinary open access archive for the deposit and dissemination of sci- entific research documents, whether they are pub- lished or not. The documents may come from teaching and research institutions in France or

L’archive ouverte pluridisciplinaire HAL, est destinée au dépôt et à la diffusion de documents scientifiques de niveau recherche, publiés ou non, émanant des établissements d’enseignement et de recherche français ou étrangers, des laboratoires

The Value 4 of Binary Kloosterman Sums

Jean-Pierre Flori, Sihem Mesnager, Gérard Cohen

To cite this version:

Jean-Pierre Flori, Sihem Mesnager, Gérard Cohen. The Value4 of Binary Kloosterman Sums. 2011.

�hal-00642290�

(2)

The Value 4 of Binary Kloosterman Sums

Jean-Pierre Flori ^∗ Sihem Mesnager ^† Gérard Cohen ^∗ Tuesday 5^th July, 2011

Abstract

Kloosterman sums have recently become the focus of much research, most notably due to their applications in cryptography and their relations to coding theory.

Very recently Mesnager has showed that the value 4 of binary Kloosterman sums gives rise to several infinite classes of bent functions, hyper-bent functions and semi-bent functions in even dimension.

In this paper we analyze the different strategies used to find zeros of binary Kloosterman sums to develop and implement an algorithm to find the value 4 of such sums. We then present experimental results showing that the value 4 of binary Kloosterman sums gives rise to bent functions for small dimensions, a case with no mathematical solution so far.

1 Introduction

Kloosterman sums have recently become the focus of much research and are actively studied for their applications in cryptography, coding theory, and other ﬁelds. We denote by Km(a), for a∈F2^m, the so-called classical binary Kloosterman sum overF2^m. Lachaud and Wolfmann have proved in [22] thatKm(a) takes all values multiple of 4 in the range [−2^(m+2)/2+ 1,2^(m+2)/2+ 1].

It has been proved that both the values 0 and 4 of Km(a) lead to construct several special important classes of Boolean functions [6] such as bent functions (introduced by Rothaus [31]

in 1972), hyper-bent functions (introduced by Youssey and Gong [41] in 2002) and semi-bent functions (introduced by Chee, Lee and Kim [9] in 1994) in even dimension. All such functions are used in various areas and are of great interest in the ﬁelds of cryptography and communication, since they play a prominent role in the security of cryptosystems. For example they play an important role in the design of hash functions and of stream and block ciphers.

It is known since 1974 that the zeros of Km(a) give rise to bent functions, but it is only in 2009 that Mesnager [28] has proved that the value 4 forKm(a) also leads to construction of bent and hyper-bent functions. Some authors have proposed algorithms for testing the zeros of binary Kloosterman sums, but until now no algorithm has been proposed in the literature to test or ﬁnd the value 4 of binary Kloosterman sums. In this paper we are interested precisely in studying the various algorithms to test whether Km(a) = 4 or not for a given a ∈F2^m or to ﬁnd an a giving value 4.

The paper is organized as follows. In Sect. 2 we give some background on Boolean functions, binary Kloosterman sums and elliptic curves over ﬁnite ﬁelds. In Sect. 3 we recall classical results

∗Institut Télécom, Télécom ParisTech, UMR 7539, CNRS LTCI, 46 rue Barrault, F-75634 Paris Cedex 13, France{flori,cohen}@enst.fr

†LAGA (Laboratoire Analyse, Géometrie et Applications), UMR 7539, CNRS, Department of Mathematics, University of Paris XIII and University of Paris VIII, 2 rue de la liberté, 93526 Saint-Denis Cedex, France smesnager@univ-paris8.fr

(3)

about divisibility of binary Kloosterman sums and give alternate proofs of such results involving the theory of elliptic curves. In Sect. 4 we first present different algorithms to test and find specific values of binary Kloosterman sums. Then, emphasizing the specificity of the zero case, we study the use of elliptic curves involved in this case, explain which results can be extended to the value 4, develop and implement an algorithm to find that value. In Sect. 5 we present experimental results showing that all the values 4 of binary Kloosterman sums for 4≤m≤16, meven, give rise to bent functions, what was not known before.

2 Notation and Preliminaries

For any setS,S^∗denotesS^∗=S\ {0} and #Sthe cardinality ofS. Unless stated otherwise,m will be a positive integer greater than 3 andaan element ofF2^m used to deﬁne (hyper, semi)-bent Boolean functions withn= 2minputs.

2.1 Background on Boolean Functions

A Boolean functionf onF2ⁿ is anF2-valued function on the Galois ﬁeldF2ⁿ of order 2ⁿ. The weightoff, denoted by wt(f), is theHamming weightof the image vector off, i.e. the cardinality of its support{x∈F2ⁿ |f(x) = 1}.

For any positive integerk, andrdividingk, the trace function fromF2^ktoF2^rwill be denoted by Tr^k_r(·). It can be deﬁned as:

Tr^k_r(x) =

k r−1

X

i=0

x²^ir =x+x²^r+x²^2r+· · ·+x²^k−r .

In particular, we denote theabsolute traceoverF2 of an elementx∈F2ⁿby Trⁿ₁(x) =Pn−1 i=0 x²ⁱ. Every non-zero Boolean functionf deﬁned onF2ⁿhas a (unique) trace expansion of the form:

∀x∈F2ⁿ, f(x) = X

j∈Γ_n

Tr^o(j)₁ ajx^j

+ǫ(1 +x²ⁿ⁻¹), aj ∈F₂^o(j)

called its polynomial form, where Γn is the set of integers obtained by choosing one element in each cyclotomic class of 2 modulo 2ⁿ−1, the most usual choice being the smallest element in each cyclotomic class, called the coset leader of the class, o(j) is the size of the cyclotomic coset containing j, and ǫ = wt(f) modulo 2. Recall that, given an integer e, 0≤ e≤2ⁿ−1, with binary expansion: e=Pn−1

i=0 ei2ⁱ, ei ∈ {0,1}, the 2-weight ofe, denoted by w2(e), is the Hamming weight of the binary vector (e0, e1, . . . , en−1).

Letf be a Boolean function onF2ⁿ. Its“sign” functionis the integer-valued functionχ(f) = χf = (−1)^f. TheWalsh-Hadamard transformoff is the discrete Fourier transform ofχf, whose value atω∈F2ⁿ is deﬁned as:

c

χf(ω) = X

x∈F2n

(−1)^f(x)+Trⁿ¹^(ωx) .

Bentfunctions are functions with maximum non-linearity. They only exist for even number of inputs and can be deﬁned as follows.

Definition 1. A Boolean functionf :F2ⁿ →F2 (neven) is said to be bent ifχcf(ω) =±2ⁿ², for all ω∈F2ⁿ.

(4)

Hyper-bent functions have even stronger properties than bent functions. More precisely, hyper-bent functions can be deﬁned as follows.

Definition 2. A Boolean functionf :F2ⁿ→F2 (neven) is said to be hyper-bent if the function x7→f(xⁱ)is bent, for every integeri co-prime with2ⁿ−1.

Semi-bent functions exist for even or odd number of inputs. We will only be interested in even number of inputs where they can be deﬁned as follows.

Definition 3. A Boolean function f : F2ⁿ → F2 (n even) is said to be semi-bent if χcf(ω) ∈ {0,±2ⁿ⁺²² }, for allω∈F2ⁿ.

2.2 Binary Kloosterman Sums and (Hyper, Semi)-Bentness Property

The classical binary Kloosterman sums onF2^m are deﬁned as follows.

Definition 4. The binary Kloosterman sums onF2^m are:

Km(a) = X

x∈F2m

(−1)^Tr^m¹(^ax+x¹), a∈F2^m .

Note that we assume Tr^m₁ ¹₀

= Tr^m₁

0²^m−1⁻¹

= 0. It is an elementary fact thatKm(a) = Km(a²):

Km(a) = X

x∈F2m

(−1)^Tr^m¹(^ax+x¹) = X

x∈F2m

(−1)^Tr^m¹(^a²^x²⁺_x¹2)

= X

x∈F2m

(−1)^Tr^m¹(^a²^x+¹x) =Km(a²) .

It has been shown that the zeros of binary Kloosterman sums lead to bent, hyper-bent and semi-bent functions. We summarize the known results in Table 1:

• A class of functions is given in terms of a ∈F2^m; remember that a∈ F2^m, but that the corresponding Boolean functions have n= 2minputs.

• Unless stated otherwise, the given conditions on a are necessary and suﬃcient for the Boolean functions to verify the given property.

Similarly the value 4 of binary Kloosterman sums gives rise to bent, hyper-bent and semi-bent functions. We summarize the known results about (hyper)-bent function in Table 2 and those about semi-bent functions in Table 3. The conventions are the same as for Table 1.

Hence it is of cryptographic interest to study divisibility properties of binary Kloosterman sums and develop efficient algorithms to find specific values of such sums or test their values.

2.3 Elliptic Curves over Finite Fields

In this subsection, we present some classical results about elliptic curves over ﬁnite ﬁelds, as well as their connections with binary Kloosterman sums.

Let m be a positive integer, Fq the ﬁnite ﬁeld of characteristic p with q = p^m and Fq

its algebraic closure. Let E be an elliptic curve deﬁned over Fq and given by a Weierstrass equation [35, Chapter III]:

E:y²+a1xy+a3y=x³+a2x²+a4x+a6 .

(5)

Table 1: Families of (hyper)-bent and semi-bent functions forKm(a) = 0

Class of functions Property Conditions References

Trⁿ₁ ax^r(2^m⁻¹⁾

; gcd(r,2^m+ 1) = 1 hyper-bent K_m(a) = 0 [13, 22, 24, 7]

+ Trⁿ₁

cx⁽²^m⁻¹⁾¹²⁺¹

; c∈F2ⁿ\F2^m, gcd(r,2^m+ 1) = 1

semi-bent K_m(a) = 0 [29]

+ Trⁿ₁

cx⁽²^m⁻¹⁾¹²⁺¹

+ Trⁿ₁

x⁽²^m⁻¹⁾¹⁴⁺¹

; Trⁿ_m(c) = 1, gcd(r,2^m+ 1) = 1,modd

semi-bent Km(a) = 0 [29]

+ Trⁿ₁

cx⁽²^m⁻¹⁾¹²⁺¹

+ Trⁿ₁ x⁽²^m⁻¹⁾³⁺¹

; Trⁿ_m(c) = 1, gcd(r,2^m+ 1) = 1

+ Trⁿ₁

cx⁽²^m⁻¹⁾¹²⁺¹

+ Trⁿ₁

x⁽²^m⁻¹⁾¹⁶⁺¹

; Trⁿ_m(c) = 1, gcd(r,2^m+ 1) = 1,meven

+ Trⁿ₁ αx²^m⁺¹

+ Trⁿ₁P2^ν−1−1

i=1 x⁽²^m⁻¹⁾²ⁱ^ν⁺¹

; gcd(r,2^m+ 1) = 1, gcd(ν, m) = 1, Trⁿ_m(α) = 1,

Table 2: Families of (hyper)-bent functions forKm(a) = 4

Trⁿ₁ aζⁱx³⁽²^m⁻¹⁾

+ Tr²₁

β^jx²

n−1 3

;

modd andm6≡3 (mod 6), β is a primitive element ofF4,ζis a generator of the cyclic groupU of (2^m+ 1)-th roots of unity, (i, j)∈ {0,1,2}²

hyper-bent K_m(a) = 4 and Tr^m₁ a^1/3

= 0 [27]

+ Tr²₁

bx²

n−1 3

; modd, gcd(r,2^m+ 1) = 1

hyper-bent Km(a) = 4 [28]

Trⁿ₁ ax²^m⁻¹

+ Tr²₁

bx²

n−1 3

; meven

bent K_m(a) = 4 (necessary condition) [28]

Table 3: Families of semi-bent functions forKm(a) = 4

+ Tr²₁

bx²

n−1 3

+ Trⁿ₁

cx⁽²^m⁻¹⁾¹²⁺¹

; b∈F^∗₄ andc∈F2ⁿ\F2^m, gcd(r,2^m+ 1) = 1,modd

Trⁿ₁ ax³⁽²^m⁻¹⁾

+ Trⁿ₁

cx⁽²^m⁻¹⁾¹²⁺¹

+ Tr²₁

bx²

n−1 3

; modd andm6≡3 (mod 6)

+ Tr²₁

bx²

n−1 3

+ Trⁿ₁

cx⁽²^m⁻¹⁾¹²⁺¹

+ Trⁿ₁

x⁽²^m⁻¹⁾¹⁴⁺¹

;

b∈F^∗₄, Trⁿ_m(c) = 1, gcd(r,2^m+ 1) = 1,modd

+ Tr²₁

bx²

n

−1 3

+ Trⁿ₁

cx⁽²^m⁻¹⁾¹²⁺¹

+ Trⁿ₁ x³⁽²^m⁻¹⁾⁺¹

;

b∈F^∗₄, Trⁿ_m(c) = 1, gcd(r,2^m+ 1) = 1,modd

+ Trⁿ₁ αx²^m⁺¹

+ Trⁿ₁P2^ν−1−1

i=1 x⁽²^m⁻¹⁾²ⁱ^ν⁺¹

+ Tr²₁

bx²

n

−1 3

;

b∈F^∗₄; gcd(r,2^m+ 1) = 1, gcd(ν, m) = 1, Trⁿ_m(α) = 1,modd

(6)

We denote by OE the point at inﬁnity of E (i.e. the neutral point for the addition law), by [n]

the multiplication by an integernonEand by End(E) = End_F

q(E) the ring of endomorphisms ofE over the algebraic closure Fq. Over Fq, elliptic curves are classiﬁed up to isomorphism by theirj-invariant.

The group of rational points of E over an extension F_qk of Fq (i.e. points with coordinates inFq) is denoted byE(F_qk); the number of points of this group by #E(F_qk). When the context is clear, we denote #E(Fq) simply by #E. It is a classical result that #E =q+ 1−t where t is the trace of the Frobenius automorphism ofE over Fq and the following theorem has been shown by Hasse.

Theorem 5 ([35, Theorem V.2.3.1]). Let t be the trace of the Frobenius automorphism of an elliptic curve overFq, then:

|t| ≤2√q .

For an integern, we denote byE[n] then-torsion subgroup of the points ofE overFq, i.e.

E[n] ={P ∈E(Fq)|[n]P=OE} .

The subgroup of rational points of n-torsion is denoted by E[n](Fq) = E[n]∩E(Fq). The following classical result gives the structure of the groups of torsion points.

Proposition 6([35, Corollary III.6.4]). Let nbe a positive integer.

• If p∤n, thenE[n]≃Z/nZ×Z/nZ.

• One of the following is true: E[pê]≃ {0} for all e≥1or E[pê]≃Z/pêZ for alle≥1.

It can also be shown that a point of E is ofn-torsion if and only if its coordinates are roots of a bivariate polynomial called then-division polynomial ofE [3, Section III.4]. In fact one can even choose a univariate polynomial in thexcoordinate that we denote byfn.

Here we will be interested inordinaryelliptic curves which can be deﬁned as follows.

Definition 7 ([35, Theorem V.3.1]). Let E be an elliptic curve defined overFq andt the trace of the Frobenius automorphism ofE. We say thatEis ordinary if it verifies one of the following equivalent properties:

• p∤t;

• E[p]≃Z/pZ;

• End(E)is an order in an imaginary quadratic extension ofQ.

IfE is not ordinary, we say it issupersingular.

Finally, using classical results of Deuring [12] and Waterhouse [39], the number of ordinary elliptic curves (up to isomorphism) with a given trace t of the Frobenius automorphism (or equivalently a number of pointsq+ 1−t), verifying |t| ≤ 2√q and p∤ t, can be computed as follows. This property indeed implies that End(E) must be an orderOinK=Q[α] and contains the orderZ[α] of discriminant ∆ whereα= ^t+^√₂^∆ and ∆ =t²−4q. We denote by H(∆) the Kronecker class number[33, 11]:

H(∆) = X

Z[α]⊂O⊂K

h(O) ,

where the sum is taken over all the ordersOinK containingZ[α] andh(O) is the classical class number.

(7)

Proposition 8 ([33, 19, 11]). Let t be an integer such that |t| ≤ 2√q and p∤ t. The number N(t)of elliptic curves over Fq with q+ 1−t rational points is given by:

N(t) =H(∆) , where∆ =t²−4q.

It should be noted that H(∆) can be computed from the value of the classical class number of (the maximal order of)K using the following proposition.

Proposition 9([23, 11, 19, 10]). LetObe the order of conductorf inK, an imaginary quadratic extension ofQ, , O^K the maximal order ofK and∆K the discriminant of (the maximal order of)K. Then:

h(O) = f h(OK) [OK^∗ :O^∗]

Y

p|f

1−

∆K

p 1

p

, where

p·

is the Kronecker symbol.

Denoting the conductor ofZ[α] byf,H(∆) can then be written as:

H(∆) =h(O^K)X

d|f

d [O^∗K:O]

Y

p|d

1−

∆K

p 1

p

.

We now give results speciﬁc to characteristic 2. First, E is supersingular if and only if its j-invariant is 0. Second, if E is ordinary, then its Weierstrass equation can be chosen to be of the form:

E:y²+xy=x³+bx²+a ,

wherea∈F^∗_q andb∈Fq, itsj-invariant is then 1/a; moreover its ﬁrst division polynomials are given by [20, 3]:

f1(x) = 1, f2(x) =x, f3(x) =x⁴+x³+a, f4(x) =x⁶+ax² .

The quadratic twist ofE is an elliptic curve with the samej-invariant asE, so isomorphic over the algebraic closure Fq, but not over Fq (in fact it becomes so over Fq²). It is unique up to isomorphism and we denote it byE. It is given by the Weierstrass equation:e

Ee:y²+xy=x³+ebx²+a , whereeb is any element ofFq such that Tr^m₁

eb

= 1−Tr^m₁ (b) [15]. The trace of its Frobenius automorphism is given by the opposite of the trace of the Frobenius automorphism ofE, so that their number of rational points are closely related [15, 3]:

#E+ #Ee= 2q+ 2 .

Lachaud and Wolfmann [21] (see also [19]) proved the following well-known theorem which gives a connection between binary Kloosterman sums and elliptic curves.

Theorem 10([21, 19]). Letm≥3be any positive integer,a∈F^∗₂m andEm(a)the elliptic curve defined overF2^m by the equation:

Em(a) :y²+xy=x³+a . Then:

#Em(a) = 2^m+Km(a) .

(8)

3 Divisibility of Binary Kloosterman Sums

3.1 Classical Results

Because of their cryptographic interest, divisibility properties of Kloosterman sums have been studied in several recent papers. The following proposition is directly obtained from the result of Lachaud and Wolfmann [22].

Proposition 11([22]). Let m≥3be a positive integer. The set {Km(a), a∈F2^m}is the set of all the integers multiple of4 in the range [−2^(m+2)/2+ 1,2^(m+2)/2+ 1].

This result states in particular that binary Kloosterman sums are always divisible by 4.

Afterwards several papers studied divisibility properties of binary Kloosterman sums by multiples of 4 and other integers.

The following classical result was ﬁrst proved by Helleseth and Zinoviev [18] and classiﬁes the values ofKm(a) modulo 8 according to the value of the absolute trace ofa.

Proposition 12 ([18]). Let m ≥ 3 be any positive integer and a ∈ F2^m. Then Km(a) ≡ 0 (mod 8)if and only if Tr^m₁ (a) = 0.

In the same article, they gave the following suﬃcient conditions to get certain values ofKm(a) modulo 3.

Proposition 13 ([18]). Let m ≥ 3 be any positive integer and a ∈ F^∗₂m. Suppose that there existst∈F^∗₂m such thata=t⁴+t³.

• If mis odd, then Km(a)≡1 (mod 3).

• If m is even, then Km(a) ≡ 0 (mod 3) if Tr^m₁ (t) = 0 and Km(a) ≡ −1 (mod 3) if Tr^m₁ (t) = 1.

Furthermore Charpin, Helleseth and Zinoviev gave in [8] additional results about values of Km(a) modulo 3.

Proposition 14 ([8]). Let a∈F^∗₂m. Then we have:

• If m is odd, then Km(a)≡1 (mod 3) if and only ifTr^m₁ a^1/3= 0. This is equivalent to a= _(1+b)^b 4 for someb∈F^∗₂m.

• Ifmis even, thenKm(a)≡1 (mod 3)if and only ifa=b³for somebsuch thatTr^m₂ (b)6= 0.

Most of these results about divisibility were ﬁrst proved studying the link between exponential sums and coset weight distribution [18, 8]. However some of them can be proved in a completely diﬀerent manner as we show in the next subsection.

3.2 Using Torsion of Elliptic Curves

Theorem 10 giving the value ofKm(a) as the cardinality of an elliptic curve can indeed be used to deduce divisibility properties of binary Kloosterman sums from the rich theory of elliptic curves.

We recall that the quadratic twist ofEm(a) that we denote byEem(a) is given by:

Eem(a) :y²+xy=x³+bx²+a ,

(9)

whereb∈F2^m has absolute trace 1; it has cardinality:

#Eem(a) = 2^m+ 2−Km(a) .

First of all, we recall a proof of the divisibility by 4 stated in Proposition 11 which is already mentioned in [1]. For m ≥3, Km(a)≡ #Em(a) (mod 4), so Km(a)≡ 0 (mod 4) if and only if #Em(a)≡ 0 (mod 4). This is equivalent to Em(a) having a non-trivial rational point of 4- torsion. This can also be formulated as both the equation ofEm(a) and its 4-division polynomial f4(x) =x⁶+ax² having a rational solution. It is easily seen that P = (a^1/4, a^1/2) is always a non-trivial solution to this problem.

Then Lisoněk gave in [26] a similar proof of Proposition 12. Indeed, for m ≥3, Km(a) is divisible by 8 if and only if Em(a) has a non-trivial rational point of 8-torsion. This is easily shown to be equivalent to Tr^m₁ a^1/4

= Tr^m₁ (a) = 0.

Finally it is possible to prove directly that the condition given in Proposition 13 is not only suﬃcient, but also necessary, using torsion of elliptic curves. We use this property in Subsection 4.3.

Proposition 15. Let a∈F^∗₂m.

• Ifmis odd, thenKm(a)≡1 (mod 3)if and only if there existst∈F2^msuch thata=t⁴+t³.

• If mis even, then:

– Km(a) ≡ 0 (mod 3) if and only if there exists t ∈ F2^m such that a = t⁴+t³ and Tr^m₁ (t) = 0;

– Km(a)≡ −1 (mod 3) if and only if there exists t ∈ F2^m such that a =t⁴+t³ and Tr^m₁ (t) = 1.

Proof. According to Proposition 13 we only have to show that ifaveriﬁes the given congruence, it can be written asa=t⁴+t³.

• We begin with the case m odd, so that 2^m ≡ −1 (mod 3). ThenKm(a) ≡1 (mod 3) if and only if #Em(a)≡0 (mod 3), i.e. ifEm(a) has a non-trivial rational point of 3-torsion.

It implies that the 3-division polynomial of Em(a) given by f3(x) = x⁴+x³+a has a rational solution, so that there existst∈F2^m such thata=t⁴+t³.

• Suppose now thatm is even, so that 2^m≡1 (mod 3).

– IfKm(a)≡ −1 (mod 3), then #Em(a)≡0 (mod 3), and as in the previous case we can ﬁndt∈F2^m such thata=t⁴+t³.

– If Km(a)≡0 (mod 3), then #Em(a)≡1 (mod 3), but #Eem(a)≡0 (mod 3). The 3-division polynomial of Eem(a) is also given by f3(x) = x⁴+x³+a, so that there existst∈F2^m such thata=t⁴+t³.

4 Finding Specific Values of Binary Kloosterman Sums

4.1 Generic Strategy

In this section we present the most generic method to ﬁnd speciﬁc values of binary Kloosterman sums. To this end one picks random elements of F2^m and computes the corresponding values