Taechan Kim
email: taechan.kim@lab.ntt.co.jp

Mehdi Tibouchi
email: tibouchi.mehdi@lab.ntt.co.jp

Improved Elliptic Curve Hashing and Point Representation

For a large class of functions f : Fq → E(Fq) to the group of points of an elliptic curve E/Fq, Farashahi et al. (Math. Comp. 2013) established that the map (u, v) → f (u) + f (v) is regular, in the sense that for a uniformly random choice of (u, v) ∈ F 2 q , the elliptic curve point Fq). This result has several applications in cryptography, mainly to the construction of elliptic curve-valued hash functions and to the "Elligator Squared" technique for representating uniform points on elliptic curves as close to uniform bitstrings. In this paper, we improve upon Farashahi et al.'s character sum estimates in two ways: we show that regularity can also be obtained for a function of the form (u, v) → f (u) + g(v) where g has a much smaller domain than Fq, and we prove that the functions f considered by Farashahi et al. also satisfy requisite bounds when restricted to large intervals inside Fq. These improved estimates can be used to obtain more efficient hash function constructions, as well as much shorter "Elligator Squared" bitstring representations.

Introduction

Mapping to elliptic curves. Many elliptic curve cryptosystems involve representing a base field element u ∈ F q as a rational point f (u) ∈ E(F q ) of the elliptic curve E/F q where the computations are carried out. Moreover, it is often desirable for the corresponding "encoding function" f : F q → E(F q ) to be efficiently computable in constant time (i.e. independently of the value of u) rather than in an iterative, probabilistic manner. Many methods have been proposed to construct such functions f , starting with the technique used in Boneh and Franklin's identity-base encryption scheme [START_REF] Boneh | Identity-based encryption from the Weil pairing[END_REF], and especially with Shallue and van de Woestijne's construction [START_REF] Shallue | Construction of rational points on elliptic curves over finite fields[END_REF], which applies to essentially all isomorphism classes of elliptic curves. All constructions proposed so far are of a geometric nature. For some of them (notably Icart's function [START_REF] Icart | How to hash into elliptic curves[END_REF] and its variants), there exists a diagram:

C P 1 E π h f =h•π -1 (1)
where h : C → E is a covering of E over F q , and π : C → P 1 induces a bijection on points (it is an exceptional cover of P 1 in the terminology of Fried [START_REF] Fried | Global construction of general exceptional covers[END_REF]). The map f : F q ⊂ P 1 (F q ) → E(F q ) can then be defined on points as h • π -1 . The other constructions (including Shallue and van de Woestijne's [START_REF] Shallue | Construction of rational points on elliptic curves over finite fields[END_REF] and their variants, say SW-type encodings) arise from several coverings and admit a similar geometric description [START_REF] Tibouchi | Impossibility of surjective icart-like encodings[END_REF].

Hashing to elliptic curves. The first application of the above constructions to cryptography was hashing to curve points. It is common, especially in pairingbased cryptography, that a certain value (a message, an identity, etc.) has to be hashed to an element of the group of points of an elliptic curve, in such a way that the hash function can be reasonably modeled as a random oracle. One approach that has been considered is to take a function f : F q → E(F q ) as above, a hash function h : {0, 1} * → F q , and combine the two together by hashing a message m as H(m) = f h(m) . This is actually sufficient for certain cryptographic schemes, in the sense that they can be proved secure in the random oracle model for h, but this is not the case in general. Indeed, H is typically easy to distinguish from a random oracle to E(F q ), because the image of f consists of only a fraction of all points on the curve and image membership can be tested for efficiently. Formal conditions under which a hash function construction can securely replace a random oracle in essentially any cryptographic protocol are given by Maurer et al.'s indifferentiability framework, and Brier et al. [START_REF] Brier | Efficient indifferentiable hashing into ordinary elliptic curves[END_REF] have applied them to the elliptic curve setting, establishing that a hash function construction H(m) = F h(m) is indifferentiable (and hence can be used securely in the random oracle model for h) for any map F to E(F q ) which is efficiently computable, efficiently samplable (one can compute a close to uniform preimage of any point efficiently) and regular (the image of a uniformly random element is close to uniformly distributed in E(F q )). They call such a function F admissible, and prove the admissibility of:

F 1 : F q × Z/N Z → E(F q ); (u, v) → f (u) + vG (2)
for any curve such that E(F q ) is a cyclic group of order N generated by G and f is a function f : F q → E(F q ) verifying mild conditions. That construction is rather slow, however. They also prove the admissibility of the much more efficient construction:

F 2 : F q × F q → E(F q ); (u, v) → f (u) + f (v) (3)
but only when f is Icart's function, and the proof involves rather painful geometric arguments. A much simpler approach was later proposed by Farashahi et al. [START_REF] Farashahi | Indifferentiable deterministic hashing to elliptic and hyperelliptic curves[END_REF], who prove that the function F 2 is regular whenever f satisfies certain bounds expressed in terms of character sums on E(F q ), and they show how such bounds can be obtained for any map f of Icart type or SW type as a consequence of the Riemann hypothesis for function fields. This yields a relatively efficient hash function construction to elliptic curves from any function f of one of those forms.

Representing elliptic curve points as uniform bitstrings. For certain applications related to anonymity and privacy, elliptic curve cryptography presents a weakness: points on a given elliptic curve, when represented in a usual way, are easy to distinguish from random bit strings. This makes it relatively easy for an attacker to distinguish ECC traffic (the transcripts of multiple ECDH key exchanges, say) from random traffic, and then proceed to intercept, block or otherwise tamper with such traffic. An efficient approach to solve this problem was proposed by Bernstein et al. [START_REF] Bernstein | Elligator: Elliptic-curve points indistinguishable from uniform random strings[END_REF]. Their idea is to leverage an efficiently computable, efficiently invertible algebraic function ι that maps the integer interval S = {0, . . . , (p -1)/2} injectively to E(F p ). Since ι is injective, a uniformly random point P in ι(S) ⊂ E(F p ) has a uniformly random preimage ι -1 (P ) in S, so that P can be represented as the binary expansion of the integer ι -1 (P ) if it exists. If p is close to a power of 2, a uniform point in ι(S) will have a close to uniform bit string representation. This approach is simple and efficient, but limited to special elliptic curves such as Edwards and Montgomery curves [START_REF] Fouque | Injective encodings to elliptic curves[END_REF][START_REF] Bernstein | Elligator: Elliptic-curve points indistinguishable from uniform random strings[END_REF] for which ι exists.

A variant of that approach, "Elligator Squared", was recently suggested by Tibouchi [START_REF] Tibouchi | Elligator Squared: Uniform points on elliptic curves of prime order as uniform random strings[END_REF], eliminating most of the limitations of Bernstein et al.'s method. The idea is to represent P ∈ E(F q ) by a randomly sampled preimage under an admissible encoding F 2 of the form (3). By Farashahi et al.'s results, such encodings can be obtained for all known point encodings, and in particular for all elliptic curves. Moreover, the representation of a uniformly random point is close to uniformly distributed in (F q ) 2 by the regularity of F 2 . Since F 2 is essentially surjective, no rejection sampling is necessary contrary to Bernstein et al.'s method, yielding record performance [START_REF] Aranha | Binary Elligator Squared[END_REF]. Its main drawback, however, is that points are represented as elements of (F q ) 2 (or rather, as bitstring representations thereof), which take up at least twice as much space as Bernstein et al.'s representations.

Our contributions. In this paper, we revisit Farashahi et al.'s character sum estimates with the goal of improving the efficiency of hash function constructions and Tibouchi's "Elligator Squared" method for representing points on elliptic curves as uniform bitstrings.

Our improvements are twofold. Firstly, in §2, we establish that for any function f subject to the same conditions as introduced by Farashahi et al. (and verified by constructions of the form (1) and SW-type encodings), the following map is regular:

F 3 : F q × V → E(F q ); (u, v) → f (u) + g(v) (4)
for any map g : V → E(F q ) from a set of cardinality #V q ε and with small collision probability. This implies that the following variants of ( 2), (3) are also regular:

F 1 : F q × [0, q ε ) → E(F q ) F 2 : F q × V ε → E(F q ) (u, v) → f (u) + vG (u, v) → f (u) + f (v) (5)
where G ∈ E(F q ) is any point of order ≥ q ε and V ε ⊂ F q is any subset of cardinality q ε . This result is technically very simple, but has valuable consequences.

It is especially interesting for point representation, as it provides a way to obtain Elligator Squared-like representations of length (1+ε) log 2 q instead of 2 log 2 q (by sampling preimages under F 2 instead of F 2 ), which makes the Elligator Squared construction almost as space efficient as Bernstein et al.'s. For hash function constructions, it says that indifferentiable hashing can be obtained from shorter random oracles, and also settles the long-standing open question of whether admissibility can be obtained for all elliptic curves at a cost of less than two base field exponentiations: indeed, for ε small enough, the scalar multiplication in F 1 becomes cheaper than a base field exponentiation! Secondly, in §3, we show that for all nontrivial characters χ of E(F q ) and all intervals1 I ⊂ F q , we obtain a bound of the form u∈I χ f (u) √ q log p, where p is the characteristic of F q , which is an extension of the result by Farashahi et al.. As a consequence, we get admissibility for the maps F 1 , F 2 in which the variable u is taken from any large interval (of length q/O(1)) within F q . This is of practical relevance for hashing or point representation on elliptic curves defined over prime fields F p when p is not pseudo-Mersenne (such as most pairing-friendly elliptic curves, and many other standardized curves). Indeed, when hashing to a 256-bit curve of that type, for example, one traditionally needs to obtain a hash value in F p , which typically involves reducing a digest of at least 384 bits modulo p, since usual hash functions return bitstrings. A similar problem arises when representing an Elligator Squared value (u, v) ∈ (F p ) 2 (or F p × V ε when using F 2 ) as a bitstring: to get uniform bitstrings, elements of F p have to be greatly enlarged. Our result solves this problem completely by allowing u to be chosen from an interval of length a power of 2 (say [0, 2 255 ) in the 256-bit case), making it possible to use the output of a standard hash function directly, and to directly obtain representation as bitstrings instead of base field elements.

Stronger regularity bounds for encodings

In this section, we show how we can improve upon the regularity bounds from [START_REF] Farashahi | Indifferentiable deterministic hashing to elliptic and hyperelliptic curves[END_REF] for encodings to elliptic curves. We first formulate and prove a simple generalization of [6, Th. 3] in §2.1, and then discuss applications to elliptic curves in §2.2.

We refer to the full version of this paper [START_REF] Kim | Improved elliptic curve hashing and point representation[END_REF] for standard definitions regarding probability distributions on finite sets and regularity.

A general regularity bound

Let A be any finite abelian group (denoted additively), and f : U → A, g : V → A arbitrary functions from finite sets U, V to A. We consider, for some s ≥ 1, the following mapping:

F : U s × V → A; (u 1 , . . . , u s , v) → f (u 1 ) + • • • + f (u s ) + g(v).
We can obtain bounds on the regularity of F from bounds on the character sums S f (χ) defined by S f (χ) = u∈U χ f (u) for nontrivial characters χ of A on the one hand, and on the collision probability of g on the other hand. Indeed, the following theorem is a simple generalization of [START_REF] Farashahi | Indifferentiable deterministic hashing to elliptic and hyperelliptic curves[END_REF]Th. 3], proved in the full version of this paper [START_REF] Kim | Improved elliptic curve hashing and point representation[END_REF].

Theorem 1. Assume that for all nontrivial characters χ of A, the inequality |S f (χ)| ≤ S holds, and denote by ρ the collision probability of g. Then, the mapping F defined above is α-regular with α = (S/#U ) s √ ρ#A.

Corollary 1. Assume that for all nontrivial characters χ of A, the inequality |S f (χ)| ≤ S holds, and that ρ has preimage size bounded by some constant d (i.e. #ρ -1 ({a}) ≤ d for all a ∈ A). Then, the mapping F defined above is α-regular with α = (S/#U ) s d#A/#V .

Application to elliptic curve encodings

Consider now an encoding f : F q → E(F q ) to the group of points of an elliptic curve over F q , and recall the following definition proposed by Farashahi et al. [START_REF] Farashahi | Indifferentiable deterministic hashing to elliptic and hyperelliptic curves[END_REF].

Definition 1. The encoding f is said to be B-well-distributed for some positive constant B if for all nontrivial characters χ of E(F q ), the character sum

S f (χ) = u∈Fq χ f (u) is bounded as S f (χ) ≤ B √ q.
Farashahi et al. have shown that known encoding functions to elliptic curves (of the form (1) or SW-type encodings, say) are indeed B-well-distributed for some small B depending on the encoding construction but not on q.

Then, fix g : V → E(F q ) any function from a set V of cardinality #V ≥ q ε and with preimage size bounded by d. Assuming that f is B-well-distributed, Corollary 1 shows that the map F 3 : F q ×V → E(F q ) from (4), given by

F 3 (u, v) = f (u) + g(v), is α-regular for α = B √ q q d•(q+2 √ q+1) #V ≤ B √ d q ε/2 • (1 + q -1/2
), which is negligible for bounded B and d. As a result, the maps F 1 , F 2 defined in (5) are indeed regular. If we assume furthermore that f is efficiently invertible and has preimage size bounded by d (which usually follows trivially for a suitable d from the fact that it is algebraic), then F 3 (and hence F 1 , F 2 ) are also efficiently and uniformly samplable using Algorithm 1, and thus admissible [START_REF] Brier | Efficient indifferentiable hashing into ordinary elliptic curves[END_REF].

Thus, if h 1 : {0, 1} * → F q , h 2 : {0, 1} * → [0, q ε ) are hash functions modeled as independent random oracles, then m → f h 1 (m) + h 2 (m)G is indifferentiable from a random oracle to E(F q ) for any element G ∈ E(F q ) of order ≥ q ε . This provides indifferentiable hashing to E(F q ) from as few as (1 + ε) log 2 q random oracle bits (and for ε small enough, it gives indifferentiable hashing for a smaller computational cost than 2 base fields exponentiations). Similarly, if h 1 : {0, 1} * → F q , h 2 : {0, 1} * → V ε are hash functions modeled as independent random oracles with V ε ⊂ F q a subset of cardinality ≥ q ε , then m → f h 1 (m) + f h 2 (m) is indifferentiable from a random oracle to E(F q ). And in the spirit of [START_REF] Tibouchi | Elligator Squared: Uniform points on elliptic curves of prime order as uniform random strings[END_REF], if P ∈ E(F q ) is a uniformly random point, then a uniformly random preimage Algorithm 1 Preimage sampling algorithm for F 3 assuming f has preimage size bounded by d.

1: function SamplePreimage(P ) 2: repeat 3: v $ ← V 4: Q ← P -g(v) 5: t ← #f -1 (Q) 6: j $ ← {1, . . . , d} 7: until j ≤ t 8: {u1, . . . , ut} ← f -1 (Q) 9:
return (uj, v) 10: end function of P under F 1 (resp. F 2 ) is statistically close to uniform in F q × [0, q ε ) (resp. F q × V ε ), and can be efficiently sampled using Algorithm 1, which provides a close-to-uniform point representation technique from a set of cardinality as small as q 1+ε .

As mentioned in the introduction, we can also extend those results to the restriction of f to a large enough interval of F q . Indeed, we introduce the following definition.

Definition 2. The encoding f is said to be B-strongly well-distributed for some positive constant B if for all nontrivial characters χ of E(F q ) and all intervals I ⊂ F q , the restricted character sum S f (χ; I) = u∈I χ f (u) is bounded as S f (χ; I) ≤ B(1 + log p) √ q, where p is the characteristic of F q .

We will show in §3 that the same techniques as used by Farashahi et al. to show that encodings are well-distributed can be adapted to prove that they are also strongly well-distributed. Now, consider a B-strongly well-distributed f to E(F q ) and a mapping g : V → E(F q ) with preimage size bounded by d from a set of cardinality #V ≥ q ε , and fix an interval I ⊂ F q of cardinality #I ≥ q/c for some constant c. Corollary 1 shows that the map F 3,I :

I × V → E(F q ) given by F 3,I (u, v) = f (u) + g(v) is α-regular for α = B(1+log p) √ q q/c d•(q+2 √ q+1) #V ≤ cB(1+log p) √ d q ε/2
• (1 + q -1/2 ), which is again negligible for bounded B, c, d. This is especially interesting in the case when q = p is prime. Then, for some ε > 0, let k 1 = log 2 p and k 2 = (1+ε) log 2 p -k 1 , and identify bitstrings in {0, 1} k with integers in [0, 2 k ). We can then introduce:

F 1,I : {0, 1} k1+k2 → E(F p ) F 2,I : {0, 1} k1+k2 → E(F p ) (u, v) → f (u) + vG (u, v) → f (u) + f (v).
The previous bound says that both of F 1,I and F 2,I are regular. If f has bounded preimage size, they are thus both admissible encodings (using the variant of Algorithm 1 where only preimages in f -1 (Q) ∩ I are considered in Steps 5, 8 for preimage sampling) from bitstrings of length

k 1 + k 2 ∼ (1 + ε) log 2 p to E(F p ).
As a result, we get an efficient indifferentiable hash functions to E(F p ) from random oracles to the set {0, 1} k1+k2 of bitstrings of length k 1 +k 2 ∼ (1+ε) log 2 p, as well as an efficient representation of uniform points in E(F p ) as close to uniform bitstrings of length k 1 + k 2 ∼ (1 + ε) log 2 p. This is a major improvement over the approach described in [START_REF] Brier | Efficient indifferentiable hashing into ordinary elliptic curves[END_REF][START_REF] Tibouchi | Elligator Squared: Uniform points on elliptic curves of prime order as uniform random strings[END_REF] for hashing and point representation, which requires strings of length ∼ (5/2) log 2 p when p is not close to a power of 2 (not a pseudo-Mersenne prime, say).

Character sums on intervals of curves

Throughout this paper, a "curve" means a smooth, projective, geometrically integral curve over a finite field (the field F q unless otherwise specified).

Let h : X → Y be a branched covering (i.e. a finite separable morphism) of curves over F q , and ξ, π : X → P 1 be rational functions. We also assume that Y has an F q rational point, and fix the embedding Y → J of Y into its Jacobian variety J defined by that rational point. The goal of this section is to obtain bounds on character sums:

S h,ξ,π (χ, ω; I) = P ∈X(Fq) π(P )∈I,ξ(P ) =∞ χ h(P ) ω ξ(P ) , (6)
where χ is a nontrivial character of J(F q ), ω is a multiplicative character of F q , and I ⊂ F q is any interval. Under mild conditions on h, ξ, π, we will obtain a bound of the form S h,ξ,π (χ, ω; I) q 1/2 log p, where p is the characteristic of F q . This extends the results of Farashahi et al. [6, §4] giving similar bounds (without the log p factor) in the case when I = F q , and makes it possible to prove that encoding functions F q → Y (F q ) constructed as in [START_REF] Aranha | Binary Elligator Squared[END_REF] or SW-type encodings are strongly well-distributed in the sense of Definition 2. The idea is to express S h,ξ,π (χ, ω; I) in terms of the sums:

S h,ξ,π (χ, ω, ψ) = P ∈X(Fq) π(P ),ξ(P ) =∞ χ h(P ) ω ξ(P ) ψ π(P ) (7)
for all additive characters ψ of F q , which are Artin character sums along X and can therefore be bounded using a theorem by Weil.

Background on Artin characters

Consider an abelian covering Y → Y of curves over F q with Galois group G (i.e. a finite morphism such that F q ( Y )/F q (Y ) is abelian with Galois group G).

Any character of G determines, via the Artin map, a corresponding character on the group of F q -divisors on Y prime to the ramification locus S of Y → Y , which extends to a multiplicative map χ : Div Fq (Y ) → C vanishing on divisors not prime to S. Let us call such a map χ an Artin character of Y . One associates to χ a distinguished effective divisor f(χ) of support S called the conductor (in particular, if Y → Y is unramified, f(χ) = 0; the character itself is then said to be unramified). We mainly consider three types of Artin characters: those arising from Artin-Schreier coverings, those arising from Kummer coverings, and those attached to characters of the Jacobian. They are discussed in more details in the full version of this paper [START_REF] Kim | Improved elliptic curve hashing and point representation[END_REF], but suffice it to say that their actions on rational points y ∈ Y (F q ) are respectively given by y → ψ(π(y) for some additive character ψ of F q and some rational function π of Y not of the form u p -u, u ∈ Fq (Y ) (Artin-Schreier), by y → ω(ξ(y) for some multiplicative character ω of F q and some rational function ξ which is not a perfect power in Fq (Y ) (Kummer), and simply χ(y) some some character χ of the Jacobian group J(F q ), where we implicitly identify Y (F q ) as a subset of J(F q ) using the embedding Y → J given by some rational point.

The product χ 1 χ 2 of two Artin characters χ 1 , χ 2 is an Artin character, and if χ 1 ,χ 2 have disjoint ramification loci (which is in particular the case when one of them is unramified), the conductor of the product is given as f(χ 1 χ 2 ) = f(χ 1 ) + f(χ 2 ). Furthermore, one can pull back Artin characters along morphisms: if χ is an Artin character on Y and h : X → Y any non constant morphism of curves, one can define an Artin character h * χ on X by pulling back the Galois covering. It is given on divisors by h * χ(D) = χ(h * D), and is unramified if χ is unramified.

The main tool for estimating sums of Artin character is the following theorem by Weil, which gives a bound on sums of the form S Y (χ) = P ∈Y (Fq) χ(P ) where χ is a nontrivial Artin character on Y . √ q.

3.2 A bound for S h,ξ,π (χ, ω; I) Now consider the situation described at the beginning of this section: we have a branched covering h : X → Y , rational functions ξ, π : X → P 1 (which are not constant, say), a nontrivial character χ of J(F q ) where J is the Jacobian of Y , an additive character ψ of F q and a multiplicative character ω of F q . We want to estimate the sum S h,ξ,π (χ, ω, ψ) defined by [START_REF] Fouque | Injective encodings to elliptic curves[END_REF]. Suppose for simplicity that ξ is not a perfect power in Fq (X) and π is not of the form u p -u in Fq (X). Then, we have Artin characters ω(ξ) and ψ(π) on X. We denote their product by λ. This character has been studied in details by Perel'muter [START_REF] Perel'muter | Estimation of a sum along an algebraic curve[END_REF] and more recently by Castro and Moreno [START_REF] Castro | Mixed exponential sums over finite fields[END_REF]. In particular, they show [5, Th. 13]: Lemma 2. Suppose that ω and ψ are not both trivial characters. Then λ is a ramified Artin character, and its conductor satisfies deg f(λ) ≤ deg(π) ∞ + l + sr -a (with equality when ω and ψ are both nontrivial), where (π) ∞ is the divisor of poles of π (counted positively), and l the number of poles of π, s the number of points in the support of (ξ), r the number of points common to the supports of (π) ∞ and (ξ), and a the number of points in the union of the supports of (π) ∞ and (ξ) where λ is unramified.

Furthermore, χ also defines an unramified Artin character on Y which can be pulled back to an unramified Artin character h * χ of X. Let χ = λ • h * χ. Then by definition, for any point P ∈ X(F q ) such that π(P ), ξ(P ) = ∞, we have: χ(P ) = χ h(P ) ω ξ(P ) ψ π(P ) . As a result, the sum S h,ξ,π (χ, ω, ψ) is almost the same as S X ( χ): they differ at most by the number of points P ∈ X(F q ) which are poles of π or ξ but where λ is nonzero (hence unramified), and there are at most a such points, using the notations of Lemma 2. The following extension of [START_REF] Farashahi | Indifferentiable deterministic hashing to elliptic and hyperelliptic curves[END_REF]Th. 7] follows (the proof details are provided in the full version of this paper [START_REF] Kim | Improved elliptic curve hashing and point representation[END_REF]).

Theorem 2. Let h : X → Y be a branched covering of curves, ξ, π : X → P 1 non constant rational functions, χ a nontrivial character of J(F q ) where J is the Jacobian of Y , ψ an arbitrary additive character of F q and ω an arbitrary multiplicative character ω of F q . Assume that h does not factor through a nontrivial unramified covering of Y , and that ξ is not a perfect power in Fq (X) and ψ not of the form u p -u in Fq (X). Then, we have:

S h,ξ,π (χ, ω, ψ) ≤ 2g X -2 + 2 deg ξ + 2 deg π q 1/2 .
Remark 1. It is easy to verify that the result still holds even when the condition on ξ and π isn't verified, as those cases essentially reduce to the case of trivial characters. Similarly, the theorem remains true when ξ or π is constant, with the convention that the degree is then zero.

Let I ⊂ F q an arbitrary interval of F q . We can obtain the following estimate S h,ξ,π (χ, ω; I) by combining Theorem 2 with a standard bound on sums of additive characters on intervals (see the full version of this paper [START_REF] Kim | Improved elliptic curve hashing and point representation[END_REF]). Theorem 3. Let the notations as described earlier. Assume that the branded covering h : X → Y does not factor through a nontrivial unramified covering of Y . Then, we have (denoting by p the characteristic of q): S h,ξ,π (χ, ω; I) ≤ 2g X -2 + 2 deg ξ + 2 deg π q 1/2 (1 + log p).

Application to encodings

Let us now succinctly discuss how Theorem 3 enables us to prove that encodings are strongly well-distributed. Take Icart's function [START_REF] Icart | How to hash into elliptic curves[END_REF] as an example: let E : y 2 = x 3 + ax + b (a = 0) an elliptic curve over a field F q such that q ≡ 2 (mod 3). It admits a geometric description of the form (1) with h : C → E such that F q (C) = F q (E)[u]/(u 4 -6xu 2 +6yu-3a), and a morphism π : C → P 1 induced by u. Icart's function f : F q → E(F q ) can then be defined as h • π -1 on F q ⊂ P 1 (F q ). Therefore, for any interval I ⊂ F q and any nontrivial character χ of E(F q ): S f (χ; I) = u∈I χ f (u) = P ∈C(Fq) π(P )∈I χ h(P ) = S h,1,π (χ, ω 0 ; I) for ω 0 the trivial multiplicative character of F q . Moreover, C is of genus g C = 7 and it is easy to see (by eliminating y between y 2 -x 3 -ax-b and u 4 -6xu 2 +6yu-3a, say) the rational function π is of degree deg π = 3. As a result, we obtain |S f (χ; I)| ≤ (2 • 7 -2 + 2 • 3)q 1/2 (1 + log p) = 18q 1/2 (1 + log p). In other words: Theorem 4. Icart's function f is 18-strongly well-distributed.

In particular, the results of §2.2 apply to Icart's function. Similarly, the same approach as in [START_REF] Farashahi | Indifferentiable deterministic hashing to elliptic and hyperelliptic curves[END_REF] shows that all other known types of encodings, such as the Shallue-van de Woestijne-Ulas encodings [START_REF] Shallue | Construction of rational points on elliptic curves over finite fields[END_REF][START_REF] Brier | Efficient indifferentiable hashing into ordinary elliptic curves[END_REF] are also strongly well-distributed.

Lemma 1 .

 1 If χ is a nontrivial Artin character on the curve Y is of genus g Y , the following bound holds: |S Y (χ)| ≤ (2g Y -2 + deg f(χ))

An interval in a not necessarily prime finite field Fq is any subset of the form H + x[m, . . . , m + k] where H is an additive subgroup of Fq, x an element of Fq, and m, k non negative integers.


A Pott

E Pasalic
email: enes.pasalic6@gmail.com

A Muratović-Ribić

S Bajrić

Vectorial quadratic bent functions as a product of two linearized polynomials

Keywords: Cryptography, Boolean functions, Bent functions, Vectorial bent functions, Trace functions, CCZ inequivalence

To identify and specify trace bent functions of the form T r n 1 (P (x)), where P (x) ∈ GF (2 n )[x], has been an important research topic lately. We show that an infinite class of quadratic vectorial bent functions can be specified in the univariate polynomial form as

, where n = 2k, i = 0, . . . , n -1, and α ∈ GF (2 k ). Most notably, apart from the cases i ∈ {0, k} for which the polynomial

) is affinely equivalent to the monomial x 2 k +1 , for the remaining indices i the function x 2 i (x+x 2 k ) seems to be affinely inequivalent to x 2 k +1 , as confirmed by computer simulations for small n. It is well-known that T r n 1 (αx 2 k +1 ) is Boolean bent for exactly 2 2k -2 k values (this is at the same time the maximum cardinality possible) of α ∈ GF (2 n ) and the same is true for our class of quadratic bent functions of the form T r n 1 (αx 2 i (x + x 2 k )), though for i > 0 the associated functions F : GF (2 n ) → GF (2 n ) are in general CCZ inequivalent and also have different differential distributions.

Introduction

Bent functions are extremal combinatorial objects with several areas of application, such as coding theory, maximum length sequences, cryptography, the theory of difference sets to name a few. The term bent Boolean function was introduced by Rothaus [START_REF] Rothaus | On "bent" functions[END_REF], where also two classes of bent functions were considered. Among other equivalent characterizations of bent functions, the one that is most often used is a characterization of bent functions as a class of Boolean functions having so-called flat Walsh-Hadamard spectrum. It means that for any bent function over GF (2) n , its Hamming distance to any affine function in n variables is constant including the distance to the all-zero function (or all-one function).

Monomial Boolean trace bent functions of the form T r n 1 (ax d ) have been considered in several works [START_REF] Charpin | Cubic monomial bent functions: a subclass of M[END_REF][START_REF] Leander | Monomial bent functions[END_REF][START_REF] Canteaut | A new class of monomial bent functions[END_REF][START_REF] Dillon | New cyclic difference sets with singer parameters[END_REF][START_REF] Dillon | Elementary Haddamard Difference Sets[END_REF], and to the best of our knowledge the functions in these references are the only known classes of monomial trace bent functions (up to affine equivalence), see also Section 4. On the other hand, binomial (or generally multiple) trace bent functions are harder to analyze and only a few (absolute trace) 1 classes of these functions have been exhibited [START_REF] Dobbertin | Construction of bent functions via Niho power functions[END_REF][START_REF] Charpin | Hyperbent functions, Kloosterman sums and Dickson polynomials[END_REF][START_REF] Youssef | Hyper-bent functions[END_REF][START_REF] Carlet | Hyper-bent functions and cyclic codes[END_REF][START_REF] Mesnager | Hyperbent functions via Dillon-like exponents[END_REF][START_REF] Flori | An efficient characterization of a family of hyper-bent functions with multiple trace terms[END_REF]. The result of Dobbertin and Leander [START_REF] Dobbertin | Construction of bent functions via Niho power functions[END_REF] related to so-called linear Niho exponents was later generalized in [START_REF] Leander | Bent functions with 2 r Niho exponents[END_REF], where the existence of bent functions with multiple trace terms consisting of 2 r Niho exponents were confirmed.

The bent property of Boolean functions can be easily extended to vectorial mappings F : GF (2 n ) → GF (2 m ) by requesting that all nonzero linear combinations of the coordinate functions of F are also bent, i.e., T r m 1 (λF (x)) is bent for all λ ∈ GF (2 m ) * , x ∈ GF (2 n ). The construction of such vectorial bent functions have been initially considered by Nyberg in [START_REF] Nyberg | Perfect nonlinear S-boxes[END_REF]. It was shown in [START_REF] Nyberg | Perfect nonlinear S-boxes[END_REF] that vectorial bent functions can only exist for m ≤ n/2, and can be constructed coordinate-wise using some known classes of bent functions. The same problem has also been treated in [START_REF] Wu | An optimized method for multiple output bent functions[END_REF] and more recently in [START_REF] Feng | Vectorial boolean functions with good cryptographic properties[END_REF]. Instead, the bent property of functions f :

GF (2 n ) → GF (2 m ) for GF (2 m ) ⊂ GF (2 n
) may also be established directly as it was done recently in [START_REF] Muratović-Ribić | Vectorial bent functions from multiple terms trace functions[END_REF] for the trace functions of the form

F (x) = T r n k ( 2 k i=0 a i x i(2 k -1)
), where n = 2k and a i ∈ GF (2 n ). In this article, we consider binomial trace functions of the form

F (x) = T r n k (αx 2 i (x + x 2 n/2
)), where n = 2k, i = 0, . . . , n -1, and α is a primitive element of GF (2 n ). It is shown that F is vectorial bent for any even n ≥ 4. Thus, a new generic class of vectorial bent functions is deduced and most notably this class has the property of having the maximum cardinality of those α for which

f α (x) = T r n 1 (αx 2 i (x + x 2 n/2
)) is Boolean bent. More precisely, we show that f α is a bent function for any α ∈ F 2 n \ F 2 k , thus the cardinality being 2 n -2 n/2 which can be shown to be maximal. This interesting property is not shared by many classes of known bent functions. For the known classes of monomial bent functions of the form f (x) = T r n 1 (αx d ) (for some suitable choices of the exponent d) it turns out that the maximum cardinality of α's for which f is bent is only achieved for d = 2 k + 1. Moreover, we show that the function T r n k (αx 2 i (x 2 j + (x 2 j ) 2 k )) is also vectorial bent, for any even n = 2k.

Nevertheless, the corresponding functions over finite fields, namely x 2 i (x + x 2 n/2 ) and x 2 k +1 are not CZZ equivalent unless i = 0 or i = k. Furthermore, the two polynomials also have different differential distributions but however it does not imply that the associated vectorial bent mappings are necessarily EA-inequivalent. Notice that for bent functions CCZ equivalence is identical to EA-equivalence. The problem of establishing the EA-(non)equivalence of the two classes is left open.

The rest of the article is organized as follows. Some basic definitions are given in Section 2. In Section 3, we show that the function

F (x) = T r n k (αx 2 i (x+x 2 n/2
)) is vectorial bent, for any even n = 2k. Furthermore, some interesting facts regarding the maximum cardinality of the corresponding Boolean bent mappings are provided. Some simulation results concerning the distribution of differentials of our class and their comparison to x 2 k +1 are given in Section 4. A few concluding remarks are found in Section 5.

Preliminaries

Let F 2 n denote the finite Galois field GF (2 n ) consisting of 2 n elements. The group of units of F 2 n , denoted by F * 2 n , is a cyclic group consisting of 2 n -1 elements. An element α ∈ F 2 n is said to be a primitive element if it is a generator of the multiplicative group F * 2 n . Once the basis of the field is fixed, say {γ 0 , . . . , γ n-1 } so that α = α 0 γ 0 + . . . + α n-1 γ n-1 , where γ i ∈ F 2 n and α i ∈ F 2 , there is a natural isomorphism between F 2 n and F n 2 given by α 0 γ 0 + . . .

+ α n-1 γ n-1 ∈ F 2 n -→ (α 0 , . . . , α n-1 ) ∈ F n 2 . Any function from F 2 n to F 2 , or alternatively from F n 2 → F 2
, is said to be a Boolean function on n variables. The set of all Boolean functions on n variables is denoted by B n .

The trace function T r n m :

F 2 n → F 2 m , a mapping to a subfield F 2 m ⊂ F 2 n , when m | n, is defined as T r n m (x) = x + x 2 m + x 2 2m + . . . + x 2 (n/m-1)m , for all x ∈ F 2 n . (1)
The absolute trace T r n 1 : F 2 n → F 2 , then maps to the prime field. The Walsh-Hadamard transform of a Boolean function

f ∈ B n at λ ∈ F 2 n is defined by W f (λ) = x∈F 2 n (-1) f (x)+T r n 1 (λx) . (2)
The multiset

{W f (λ) : λ ∈ F 2 n } (3)
is said to be the Walsh-Hadamard spectrum of the Boolean function f . For any even positive integer n = 2k, there exist Boolean functions with a flat Walsh-Hadamard spectrum.

A function f ∈ B n is called bent if and only if |W f (λ)| = 2 k for all λ ∈ F 2 n .
The nonlinearity of F : F 2 n → F 2 m and hereby the resistance to linear cryptanalysis of Matsui [START_REF] Matsui | Linear cryptanalysis method for DES cipher[END_REF] is measured through extended Walsh-Hadamard transform defined as,

W F (σ, γ) = x∈F 2 n (-1) T r m 1 (γF (x))+T r n 1 (σx) , σ ∈ F 2 n , γ ∈ F * 2 m . (4)
Here, γ ∈ F * 2 m selects nonzero linear combinations of the coordinate functions of F , where F is represented as

F (x) = (f 1 (x), . . . , f m (x)), for f i : F 2 n → F 2 . Using this representation, F is a vectorial bent function of dimension m ≤ n/2, n is even, if and only if a 1 f 1 (x) + . . . + a m f m (x) is a bent function for any choice of a i ∈ F 2 ,
where not all of the a i s are zero. Equivalently, F is a vectorial bent function if and only if

|W F (σ, γ)| = 2 n/2 , for any γ ∈ F * 2 m and any σ ∈ F 2 n .

Vectorial bentness through adjoint operators

In this section we derive our main results related to the vectorial bentness of

F (x) = T r n k (αx 2 i (x + x 2 k
)) and to the maximum possible cardinality of those α so that

f α (x) = T r n 1 (αG(x)) is Boolean bent for an arbitrary polynomial G(x) ∈ F 2 n [x].
To establish the upper bound on the cardinality of αs for which f α (x) is bent we utilize an old result due to Bose and Burton [START_REF] Bose | A characterization of flat spaces in a finite geometry and the uniqueness of the Hamming and the MacDonald codes[END_REF].

Theorem 1 [START_REF] Bose | A characterization of flat spaces in a finite geometry and the uniqueness of the Hamming and the MacDonald codes[END_REF] Let F q be the finite field of order q = p r and PG(n, F q ) the projective space of dimension n over F q . A set S of points in PG(n, F q ) that meet all (n -k)-dimensional subspaces of PG(n, F q ) has at least q k+1 -1 q-1 points with equality if and only if S is a subspace of dimension k.

Translating this into affine language (and setting q = 2 to deal with the Boolean case), we obtain two important corollaries.

Corollary 1 A set S of elements in F n 2 \{0} meeting all (n+1-k)-dimensional subspaces of F n 2 has at least 2 k -1 elements with equality if and only if S ∪ {0} is a k-dimensional subspace of F n 2 .
The correspondence to bent functions is as follows.

Corollary 2 Let n = 2k, and F : F 2 n → F 2 n be arbitrary. Define

S := {α ∈ F 2 n : x → T r n 1 (αF (x)) is not bent}.
Then, |S| ≥ 2 k with equality if and only if S is a linear subspace of dimension k.

Proof. If |S| < 2 k , then there are at most 2 k -2 non-zero elements α for which T r n 1 (αF (x)) is not bent. Due to Corollary 1, this set cannot meet all subspaces of dimension n+1-k = k + 1, hence there must be at least one subspace T of dimension k + 1 disjoint from S \ {0}. This shows that there is a (k + 1)-dimensional subspace

T ⊆ {α : T r n 1 (αF (x)) is bent} ∪ {0},
that is, there is a vectorial bent function from F 2k 2 to F k+1 2 , which is impossible due to the Nyberg bound.

We now proceed with our main results regarding the vectorial bentness of F (x) = T r n k (αx

2 i (x + x 2 k )). Let V = F 2k
2 be the vector space over F 2 of dimension 2k = n. The result below uses a well-known fact that a Boolean function f :

V → F 2 is bent if and only if x → f (x) + f (x + a) is balanced for all nonzero a ∈ V . Proposition 1 Let V = F 2k
2 and let , be a non-degenerate symmetric bilinear form on V . If L : V → V is linear, we denote the adjoint operator by L * , i.e., x, L(y) = L * (x), y for all x, y ∈ V . The function f : V → F 2 , defined by x → x, L(x) , is bent if and only if L + L * is invertible.

Proof. We have

f (x + a) + f (x) = x + a, L(x + a) + x, L(x) = a, L(a) + x, L(a) + a, L(x) = a, L(a) + x, L(a) + L * (a), x = a, L(a) + x, L(a) + L * (a) .
This function is balanced if and only if L(a) + L * (a) = 0 for all nonzero a ∈ V , hence f is bent if and only if L + L * is invertible.

Remark 1 Let V = F n
2 and , be the standard inner product. If L : V → V such that L(x) = Ax, where A is a binary matrix of size n × n, then L * : V → V is defined by L * (x) = A T x. Hence, x → x T Ax is bent if and only if A + A T is regular (of full rank).

Remark 1 is well known and it is essentially equivalent to Proposition 1. However, Proposition 1 is a more elegant (since it is coordinate-free) statement. It has the advantage that it can be used, no matter how the inner product is defined. For instance, in the multivariate case the inner product is usually defined using the classical form

x i y i , or, in the univariate world, using the trace bilinear version T r n 1 (xy). We believe that one should try to formulate theorems coordinate-free as long as it is possible.

Proposition 2 Let V = F 2 n and x, y = T r n 1 (xy) be the trace bilinear form. If L : V → V is defined by L(x) = αx 2 i , α ∈ V and for i = 0, . . . , n -1, then L * (x) = α 2 n-i x 2 n-i . Proof. Note that x, L(y) = T r n 1 (xL(y)) = T r n 1 (xαy 2 i ) = T r n 1 (x 2 n-i α 2 n-i y) = L * (x), y ,
for all x, y ∈ V , which then implies the result.

We are now going to prove the main theorem of this article.

Theorem 2 Let V = F 2 n , n = 2k and i be an positive integer. Then, the mapping f α defined by

f α (x) = T r n 1 (αx 2 i (x + x 2 k )) is bent if and only if α ∈ F 2 k .
Proof. We have

f α (x) = T r n 1 (αx 2 i (x + x 2 k )) = T r n 1 (xαx 2 i ) + T r n 1 (x 2 i αx 2 k ) = T r n 1 (xαx 2 i ) + T r n 1 (xα 2 k x 2 i+k ) = T r n 1 (xL(x)),
where

L(x) = αx 2 i + α 2 k x 2 i+k . The adjoint operator L * is L * (x) = α 2 n-i x 2 n-i + (α 2 k ) 2 n-(i+k) x 2 n-(i+k) = α 2 2k-i x 2 2k-i + α 2 2k-i x 2 k-i .
Then it follows,

L(x) + L * (x) = αx 2 i + α 2 k x 2 i+k + α 2 2k-i x 2 2k-i + α 2 2k-i x 2 k-i = (αx 2 i ) + (αx 2 i ) 2 k + α 2 2k-i (x 2 k-i + (x 2 k-i ) 2 k
).

Note that y + y

2 k ∈ F 2 k iff y ∈ F 2 2k , hence we have αx 2 i + (αx 2 i ) 2 k
∈ F 2 k as well as

x 2 k-i + (x 2 k-i ) 2 k ∈ F 2 k .
In order to show that L(x) + L * (x) is invertible, we need to show that L(x) + L * (x) = 0 if and only if

x = 0. If α ∈ F 2 k , then L(x) + L * (x) = 0 is possible only if αx 2 i + (αx 2 i ) 2 k = 0 and x 2 k-i + (x 2 k-i ) 2 k
= 0. Otherwise, 0 would be the sum of an element in F 2 k and an element not in

F 2 k (the element α 2 2k-i (x 2 k-i + (x 2 k-i ) 2 k
)) which is impossible. Since y + y 2 k = 0 iff y ∈ F 2 k , we obtain that both x as well as αx 2 i have to belong to F 2 k , which is possible only if x = 0 since α ∈ F 2 k . This shows the bentness of f α for α ∈ F 2 k . Now assume that α ∈ F 2 k and f α is bent. This is impossible due to Corollary 2 since in that case we would have |S| < 2 k (using the notation of Corollary 2).

The next result shows that the above property of being Boolean bent for any α ∈ F 2 k implies that the corresponding vectorial mapping is bent.

Proposition 3 Let f α (x) = T r n 1 (αG(x)), n = 2k, be a Boolean bent function for any α ∈ F 2 2k \ F 2 k , where G : F 2 n → F 2 n . Then, F : F 2 n → F 2 k , defined as F (x) = T r n k (αG(x)) is a vectorial bent function for any α ∈ F 2 2k \ F 2 k .
Proof. For γ ∈ F 2 k * and σ ∈ F 2 n , we consider the extended Walsh spectra,

W F (σ, γ) = x∈F 2 n (-1) T r k 1 (γF (x))+T r n 1 (σx) = x∈F 2 n (-1) T r k 1 (γT r n k (αG(x)))+T r n 1 (σx) = x∈F 2 n (-1) T r k 1 (T r n k (γαG(x)))+T r n 1 (σx) = x∈F 2 n (-1) fγα(x)+T r n 1 (σx) = ±2 n/2 ,
by assumption on f α , since for any α ∈ F 2 n \ F 2 k we have γα ∈ F 2 k .

Example 1 Consider the Boolean function T r n 1 (αx 4 (x + x 2 k )), n = 2k, which can be verified to be bent for any α ∈ F 2 k . Thus, F (x) = T r n k (αx 4 (x + x 2 k )) is a vectorial bent function.

Generalization of the approach

In what follows, we show that the function T r n k (αx

2 i (x 2 j + (x 2 j ) 2 k
)) is vectorial bent, for any even n = 2k. Before proving the main result of this section we first give some preparatory results.

Proposition 4 Assume that f : F 2 n → F 2 is a bent function. Then the function g(x) = f (x 2 i ) is bent.
Proof. Note that mapping y → y 2 i is a permutation on F 2 n . Also T r n 1 (y) = T r n 1 (y 2 i ) for all y ∈ F 2 n . Computing the Walsh-Hadamard transform we have

W g (σ) = x∈F 2 n (-1) f (x 2 i )+T r n 1 (σx) = x∈F 2 n (-1) f (x 2 i )+T r n 1 (σ 2 i x 2 i ) = y∈F 2 n (-1) f (y)+T r n 1 (σ 2 i y) = W f (σ 2 i ) = ±2 k , for all σ ∈ F 2 n .
Proposition 5 Assume that F : F 2 n → F 2 m is a vectorial bent function. Then the function G(x) = F (x 2 i ) is vectorial bent.

Proof. Computing the extended Walsh-Hadamard transform we have

W G (σ, γ) = x∈F 2 n (-1) T r m 1 (γG(x))+T r n 1 (σx) = x∈F 2 n (-1) T r m 1 (γF (x 2 i ))+T r n 1 (σ 2 i x 2 i ) = y∈F 2 n (-1) T r m 1 (γF (y))+T r n 1 (σ 2 i y) = W F (σ 2 i , γ) = ±2 n/2 . Corollary 3 A function f (x) is bent if and only if f (x 2 i ) is a bent function. A function F (x) is vectorial bent if and only if F (x 2 i ) is a vectorial bent function.
Remark 2 Note that the opposite direction of the proof of the above corollary follows directly from the fact x = (x 2 i ) 2 (n-i) .

The main results of this section are the following.

Theorem 3 The function g α (x) = T r n 1 (αx

2 i (x 2 j + (x 2 j ) 2 k )) is bent if and only if α ∈ F 2 k .
Proof. By Theorem 2 we know that f α (x) = T r n 1 (αx 2 t (x + x 2 k )) is bent if and only if α ∈ F 2 k , for any t ∈ Z. By Corollary 3 f α (x) is bent if and only if g α (x) = f α (x 2 j ) is bent. Therefore, for t = i -j we have

g α (x) = f α (x 2 j ) = T r n 1 α(x 2 j ) 2 t (x 2 j + (x 2 j ) 2 k ) = T r n 1 αx 2 (j+t) (x 2 j + (x 2 j ) 2 k ) = T r n 1 αx 2 i (x 2 j + (x 2 j ) 2 k ) is bent if and only if α ∈ F 2 k . Theorem 4 The function G α (x) = T r n k αx 2 i (x 2 j + (x 2 j ) 2 k ) is vectorial bent.
Proof. The proof follows from Corollary 3 and Proposition 3.

CCZ and EA (non)equivalence to some bent monomials

In the previous section we have established that

f α (x) = T r n 1 (αx 2 i (x 2 j + (x 2 j ) 2 k
)) is bent for any α ∈ F 2 2k \ F 2 k . In other words, |S| = 2 k is of minimal cardinality (the set of those α for which f α is bent is of maximal cardinality 2 2k -2 k where S was defined in Corollary 2. This situation does not arise frequently for the known bent monomials. In the first place, certain bent monomials x d such as those with Dillon's exponent of the form d = r(2 k -1) (where integer r is suitably chosen) may give rise to sporadic Boolean bent functions T r n 1 (αx r(2 k +1) ) for a few α but the function T r n k (αx r(2 k +1) ) cannot be vectorial bent, see [START_REF] Muratović-Ribić | Vectorial bent functions from multiple terms trace functions[END_REF]. The following list [START_REF] Mullen | Handbook of Finite Fields[END_REF] of monomial functions f (x) = T r n 1 (αx d ) are bent on F 2 n , with n = 2k: Remark that it has been check exhaustively that these are no other monomial bent functions for n ≤ 20. Then, apparently the maximum possible cardinality of α in the previously mentioned sense is only achieved by the first class for the special case when m = k. In this case the exponent d = 2 k +1 and it is easily verified that |S| = 2 k as it is the case for our class. Since both corresponding polynomials, namely x 2 i (x + x 2 k ) and x 2 k +1 are quadratic it might be the case that our class is CCZ equivalent to the monomial x 2 k +1 . This is indeed the case for i = 0 and i = k, whereas for i = 0, k it has been established by MAGMA (for small values of n) that the functions are not CCZ equivalent, therefore it is not possible that our functions are, in general, CCZ equivalent to x 2 k +1 . Nevertheless, it still does not imply that the vectorial bent mappings T r n k (αx 2 i (x + x 2 k )) and T r n k (αx 2 k +1 ) are inequivalent. This interesting question remains open for the time being.

Conclusions

An infinite class of quadratic vectorial bent functions of the form F (x) = T r n k (αx 2 i (x + x 2 n/2 )), where n = 2k and α is a primitive element of the field GF (2 n ), have been specified. It would be of interest to specify similar classes where instead of x + x 2 n/2 some other suitable linear mappings are used. This appears as an interesting challenge for future work on this topic along with the analysis of non-quadratic cases.

  1. d = 2 m + 1 with n/ gcd(m, n) being even and α ∈ {yd : y ∈ F 2 n }; 2. d = r(2 k -1) with gcd(r, 2 k + 1) = 1 and α ∈ F 2 k being -1 of the Kloosterman sum; 3. d = 2 2m -2 m + 1 with gcd(m, n) = 1 and α ∈ {y 3 : y ∈ F 2 n }; 4. d = (2 m + 1) 2 with n = 4m and m odd, α ∈ ωF 2 m with ω ∈ F 4 \ F 2 ; 5. d = 2 2m + 2 m + 1 with n = 6m and m > 1, α ∈ F 2 3m with T r 3m m (α) = 0.

Here the absolute trace is used to distinguish the functions of the type T r n 1 ( r i=1 λix d i ) from the functions that use different trace such as the function defined by T r n 1 (λx d 1 ) + T r

1 (βx d 2 ) as considered in[START_REF] Mesnager | A new class of bent and hyper-bent functions in polynomial form and their link with some exponential sums and Dickson polynomials[END_REF].

Acknowledgements : The authors thank Prof. Klaus Metsch (University of Giessen) for pointing out the connection to the Bose-Burton theorem.