MD William A Banks
email: bankswa@slu.edu

Mouse Models of Neurological Disorders: A View From the Blood-brain Barrier

Keywords: Blood-brain Barrier, Models, Stroke, Obesity, Alzheimer's Disease, Multiple Sclerosis, Transcytosis, Paracellular, Neuroimmune, Choroid Plexus Banks p2

The number of disease models that involve an aspect of blood-brain barrier (BBB) dysregulation have increased tremendously. The main factors contributing to this expansion have been an increased number of diseases in which the BBB is known to be involved, an increase in the known functions of the BBB, and an increase in the number of models and tools with which those diverse functions can be studied. In many cases, the BBB may be a target of disease; current thinking would include hypertensive encephalopathy and perhaps stroke in this category.

Another category are those diseases in which special attributes of the BBB may predispose to disease; for example, the ability of a pathogen to cross the BBB often depends on the pathogen's ability to invoke trancytotic pathways in the brain endothelial or choroid plexus cell. Of special interest are those diseases in which the BBB may be the primary seat of disease or play a major role in the onset or progression of the disease. An increasing number of diseases are so categorized in which BBB dysfunction or dysregulation plays a major role; this review highlights such roles for the BBB including those proposed for Alzheimer's disease and obesity.

A C C E P T E D M A N U S C R I P T

Introduction Models of blood-brain barrier (BBB)-disease interactions have increased tremendously in number in the last two decades. Although there are many reasons for this, three main trends are largely responsible for the increase. First, there are more diseases which are thought to involve the BBB. At the same time, the explosion in animal models for any given disease have further enhanced this reason. Second, there are more better and models for studying the BBB. This allows functions to be investigated that previously could not be modeled. Third, the BBB has more functions than were previously appreciated. These functions can be studied and their dysfunction can participate in disease processes in ways which were not imagined even a few years ago. These three aspects are considered in more detail below.

The trends and future directions can be better appreciated by examining the state of BBB models 3-4 decades ago. Good sources for this are Rapoport's classic "Blood-Brain Barrier in Physiology and Medicine" published in 1976 [START_REF] Rapoport | Blood Brain Barrier in Physiology and Medicine[END_REF]and Bradbury's "The Concept of a Blood-Brain

Barrier"published in 1979 [START_REF] Bradbury | The Concept of a Blood-Brain Barrier[END_REF]. These books remain excellent sources for understanding the fundamentals of the BBB, but also provide snap shots of the status of BBB disease models some 30+ years ago. Many things have not changed: models of multiple sclerosis and stroke are still of major interest, debate continues about whether immune cells cross the BBB by penetrating between or through endothelial cells, and issues related to drug delivery to the CNS present major challenges. But many things have changed also: there are many more models of stroke as well as models of components of stroke (such as hypoxia/reoxygenation), immune cells are now widely believed to cross the BBB under normal physiologic conditions and not just during brain Banks p3

A C C E P T E D M A N U S C R I P T ACCEPTED MANUSCRIPT

infection, and drug delivery has become still more challenging with the discovery of, for example, efflux systems. Diseases most actively modeled in the 1970's were stroke, multiple sclerosis, trauma, cytotoxicity, invasion by cancer cells and leukemias, brain infections and encephalitides, convulsions and epilepsy, and hypertensive encephalopathy. BBB tissues were known to be enzymatically active and to be important in preventing monoamine transport across the BBB. Methods available allowed three generic types of studies to be done: the measure of uptake rates of substances which crossed the BBB very rapidly, such as hexoses, amino acids, or small lipid soluble molecules; the study of fluxes of substances which were metabolically stable such as electrolytes; studies of BBB disruption and edema, often using dye or fluid shift models.

The conceptual view of the functions of the BBB these models helped to define and exploit were that of the nutritional and homeostatic regulatory interface, the lipid permeable cell membrane, and the barrier.

General Themes

The BBB models of diseases can be subdivided into 3 general categories as to their relation to the disease that they model. The first and traditionally the most common category is that of inducing some aspect of the disease by a mechanism that is clearly not the etiology of the disease. The purpose of these studies is to investigate the downstream consequences of the disease feature while recognizing that upstream events cannot be studied. An example of this model is induction of type I diabetes mellitus with streptozotocin. Although streptozotocin induces an insulinopenic hyperglycemic state, the hallmark of type I diabetes mellitus, streptozotocin is not the common etiology of diabetes mellitus in humans. As a result, the

Banks p4

A C C E P T E D M A N U S C R I P T

ACCEPTED MANUSCRIPT

downstream consequences of deficient insulin or hyperglycemia can be studied, but questions related to etiology, predisposition to disease, or genetics are not easily studied with this model.

A second category is that in which the disease being studied arises from essentially the same etiology in the model as in the human and follows essentially the same course. Pure examples of these are rare and the most useful models. An example in this category is that of maturity onset obesity in a mouse strain which is not otherwise prone to obesity. In a version of this model, randomly selected mice are fed regular chow for an extended period. A subset will tend towards a higher level of obesity than the average, just as in the human population. In a variation of this version, a high fat diet and sedentary conditions will accentuate the differences in body weight, just as occurs in humans.

A third category of model is that in which the relation between the etiology of the disease and the inducer of the model are unclear. A C C E P T E D M A N U S C R I P T

ACCEPTED MANUSCRIPT

Alzheimer's disease, obesity, epilepsy, and diabetes mellitus [START_REF] Zlokovic | Neurovascular mechanisms of Alzheimer's neurodegeneration[END_REF][START_REF] Deane | The role of the cell surface LRP and soluble LRP in blood-brain barrier Aß clearance in Alzheimer's disease[END_REF][START_REF] Huber | Diabetes, cognitive function, and the blood-brain barrier[END_REF][START_REF] Horani | The effect of diabetes on the blood brain barrier[END_REF][START_REF] Banks | The blood-brain barrier as a cause of obesity[END_REF][START_REF] Fabene | A role for leukocyteendothelial adhesion mechanisms in epilepsy[END_REF]. The role of the BBB in many diseases has also shifted from being a passive target to an active participant, even a prime participant, in disease. Two examples of diseases in which the BBB may play the role of prime participant are obesity and Alzheimer's disease; these are considered in detail below.

Other models suggesting a primary role for the BBB in disease states are those relating to immune cell and pathogen penetration of the BBB. Diseases involving immune infiltration are often mistakenly thought to occur because a disruption of the BBB allows the immune cells to leak into the brain. It is now clearly understood that immune cells and brain endothelial cells participate in an elaborate cross talk termed diapedesis [START_REF] Engelhardt | The blood-central nervous system barriers actively control immune cell entry into Banks p20 A C C E P T E D M A N U S C R I P T ACCEPTED MANUSCRIPT the central nervous system[END_REF]. Passage of immune cells across the BBB involves activation of both the immune cell and BBB cells [10;11]. Blockade of key receptors on either brain endothelial cells or the immune cells can halt or retard diapedesis. This is most dramatically shown by treatment with natalizumab, an antibody that binds to immune cells to block alpha(4) integrin binding and is effective against multiple sclerosis (3206}.

Multiple sclerosis is a disease in which the BBB plays a major role. EAE is used as a model of multiple sclerosis [START_REF] Baxter | The origin and application of experimental autoimmune encephalomyelitis[END_REF]. There are several versions of induction of EAE that produce either relapsing and non-relapsing disease [13;14]. EAE models clearly support a role of the BBB in mediating onset and progression of disease [15;16]. The EAE models have also been important tools in the investigation of how immune cells cross the BBB [START_REF] Male | The blood-brain barrier -No barrier to a determined lymphocyte[END_REF]. Work with these models also shows that disruption of the BBB is secondary to immune cell invasion, not the other way round [START_REF] Lossinsky | Mechanisms of inflammatory cell attachment in chronic relapsing experimental allergic encephalomyelitis: a scanning and high-voltage electron microscopic study of the injured mouse blood-brain barrier[END_REF][START_REF] Wolburg | Diapedesis of mononuclear cells across cerebral venules during experimental autoimmune encephalomyelitis leaves tight junctions intact[END_REF][START_REF] Knobler | Distribution of the blood-brain barrier in heterotopic brain transplants and its relationship to the lesions of EAE[END_REF]. Other aspects of BBB function are also likely affected by induction of EAE and, presumably, in multiple sclerosis such as cytokine transport [START_REF] Pan | Differential permeability of the BBB in acute EAE: enhanced transport of TNF-α[END_REF]. The EAE model has also served as an example of how neuroimmune activation can facilitate immune cell invasion Banks p6

A C C E P T E D M A N U S C R I P T ACCEPTED MANUSCRIPT

for other conditions and diseases such as spinal cord injury [START_REF] Popovich | Concept of autoimmunity following spinal cord injury: possible roles for T lymphocytes in the traumatized central nervous system[END_REF].

HIV-1 invasion of the CNS occurs when immune cells infected with the virus cross the BBB [START_REF] Persidsky | A model for monocyte migration through the blood-brain barrier during HIV-1 encephalitis[END_REF]. Immune cells containing HIV-1 are activated and more likely to adhere to brain endothelial cells than non-infected cells [START_REF] Hurwitz | The role of the blood-brain barrier in HIV infection of the central nervous system[END_REF]. Models of this disease also show that immune cell invasion produces BBB leakage and disruption rather than the BBB disruption allowing immune cells to leak into the brain [START_REF] Toborek | Mechanisms of the blood-brain barrier disruption in HIV-1 infection[END_REF]. HIV-1 can also cross the BBB as free virus and does so by interacting in a complex manner with the cells which constitute the BBB [26;27]. This complexity occurs not just with initial binding, but with subsequent interaction with cellular machinery that controls transcytosis [START_REF] Banks | Adsorptive endocytosis mediates the passage of HIV-1 across the blood-brain barrier: evidence for a post-internalization coreceptor[END_REF][START_REF] Bobardt | Contribution of proteoglycans to human immunodeficiency virus type 1 brain invasion[END_REF][START_REF] Nakaoke | Human immunodeficiency virus type 1 transport across the in vitro mouse brain endothelial cell monolayer[END_REF][START_REF] Dohgu | Lipopolysaccharide-enhanced transcellular transport of HIV-1 across the blood-brain barrier is medited by the p38 mitogen-activated protein kinase pathway[END_REF] Indeed, the neuroAIDS field has produced an important example of how pathogen and BBB cells interact to activate one another and to forward the progression of disease [24;32]. This interaction has consequences in addition to the facilitation of passage of pathogen across the BBB [23;33]. For example, the immune activation induced by the neuroAIDS process [START_REF] Miller | Immunobiology of the blood-brain barrier[END_REF] activates other components of the neurovascular unit, secretions from BBB cells, and alters expression of p-glycoprotein at the BBB [START_REF] Ronaldson | Regulation of ABC membrane transporters in glial cells: relevance to the pharmacotherapy of brain HIV-1 infection[END_REF][START_REF] Zidovetzki | Human immunodeficiency virus Tat protein induces interleukin 6 mRNA expression in human brain endothelial cells via protein kinase Cand cAMP-dependent protein kinase pathways[END_REF][START_REF] Belliard | Effect of hr-IL-2 treatment on intestinal P-glycoprotein expression and activity in Caco-2 cells[END_REF]. This latter effect, in turn, affects the delivery of antivirals to the CNS [38;39].

These principles apply to most other neuropathogens which enter the CNS by crossing the vascular BBB or choroid plexus [START_REF] Banks | Physiology and pathophysiology of the blood-brain barrier: Implications for microbial pathogenesis, drug delivery and neurodegenerative disorders[END_REF]. That is, the virus, bacteria, or parasite induces alterations in the BBB function which facilitate the passage of the agent across the barrier as opposed to leaking across an already disrupted BBB [START_REF] Yang | Efficient delivery of circulating poliovirus to the central nervous system independently of poliovirus receptor[END_REF][START_REF] Chou | MANUSCRIPT of the Blood-Brain Barrier and Its Manipulation[END_REF][START_REF] Kim | Microbial translocation of the blood-brain barrier[END_REF][START_REF] Wang | Toll-like receptor 3 mediates West Nile virus entry into the brain causing lethal encephalitis[END_REF]. The agent often induces cooperation of the BBB, taking over some aspect of endogenous machinery.

Models of the BBB

Banks p7

A C C E P T E D M A N U S C R I P T ACCEPTED MANUSCRIPT

The multiplication of models can be illustrated by the increased number of models for stroke or diabetes mellitus. Stroke models or models relating to some aspect of stroke have expanded greatly in the last few decades and demonstrated important changes in BBB tight junctions in the post-ischemic state [START_REF] Brown | Calcium modulation of adherens tight junction function: a potential mechanism for blood-brain barrier disruption after stroke[END_REF]. For example, there are currently five major categories of ischemic models: embolic middle cerebral artery occlusion, endovascular filament middle cerebral artery occlusion, permanant transcranial midddle cerebral artery occlsion, transient transcranial middle cerebral artery occluson, and cerebrocortical photothrombosis. These models are not simply variants on how to produce the same end point, but have subtle differences including how the BBB is affected or responds. There are also "component models" that involve replication of a major aspect of stroke [START_REF] Pulsinelli | A new model of bilateral hemispheric ischemia in the unanesthetized rat[END_REF]. For example, hypoxia/reoxygenation models lower the ambient oxygen to a level and for a time that affects BBB and CNS function to study the effects of hypoxia. Oxygen levels are then returned to normal to study effects of reoxygenation, a period when damage from oxidative stress can occur. In this model, unlike the focal ischemia models, blood flow does not cease, no physical damage is done to endothelial cells by a plug or clot, and hypoxia/reoxygenation is global, not localized. As stroke involves all of these, hypoxia/reoxygenation is not a stroke model, although it models a major component of stroke.

Results may be applicable to other diseases involving hypoxia or hypoxia with reoxygenation, such as sleep apnea, asthma, chronic obstructive pulmonary disease, cardiac arrest, and cardiopulmonary bypass.

Stroke models have also been used to study how drug delivery mechanisms may differ in the post-stroke BBB or how potential therapeutics affect BBB disruption in stroke [START_REF] Chi | Effects of 17beta-estradiol on blood-brain barrier disruption during focal ischemia in rats[END_REF][START_REF] Ehrenreich | Erythropoietin therapy for acute stroke is both safe and beneficial[END_REF][START_REF] Pan | Effect of testosterone on functional recovery in a castrate male rat stroke model[END_REF].

Alterations in relevant BBB transporter systems, such as those for peptides and cytokines, or Banks p8

A C C E P T E D M A N U S C R I P T ACCEPTED MANUSCRIPT

expression of other BBB proteins have also been studied in stroke or stroke-prone models [START_REF] Kirsch | Altered gene expression in cerebral capillaries of stroke-prone spontaneously hypertensive rats[END_REF][START_REF] Pan | Stroke upregulates TNFalpha transport across the blood-brain barrier[END_REF][START_REF] Somogyvari-Vigh | Effect of middle cerebral artery occulsion on the passage of pituitary adenylate cyclase activating polypeptide across the blood-brain barrier in the rat[END_REF]. Modeling can lead to therapeutic strategies such as increasing brain retention of potential therapeutics by inhibiting brain-to-blood efflux systems [START_REF] Dogrukol-Ak | Isolation of peptide transport system-6 from brain endothelial cells: therapeutic effects with antisense inhibition in Alzheimer's and stroke models[END_REF].

Stroke is usually considered a disease associated with aging, but one form, cerebral autosomal dominant arteriopathy with subcortical infarcts and leukoencephalopathy (CADASIL), occurs in persons under 40 years of age [54]. CADASIL results from a mutation in the Notch3 gene. Although the mutation is throughout the vascular bed, it seems that only the central nervous system is affected. Mouse and pig models recapitulate various aspects of the disease, developing a CADASIL-like picture. Loss of pericytes is prerequisite to the development of altered BBB permeability and hypoperfusion (R Cecchelli, personal communication). Interestingly, pericyte drop out is also key to the develop of disruption of the blood-retinal barrier in diabetes mellitus [55;56].

Most models of diabetes mellitus use streptozotocin which destroys the beta cells of the pancreas. This produces an insulinopenic hyperglycemia and so models type I diabetes mellitus.

However, as discussed below, aspects of the BBB are also affected in obesity. Most models of obesity are likely also producing animals with insulin resistance or hyperinsulinemic hyperglycemia. The latter would model diabetes mellitus type II. These models provide new opportunities to study the effects of type II diabetes mellitus on the BBB.

The BBB can be involved indirectly in models of diseases not typically thought to have a BBB component. For example, the lysosomal storage diseases result from defects in enzyme production, function, or translocation, allowing the accumulation of various storage products [START_REF] Begley | Lysosomal storage diseases and the blood-brain barrier[END_REF]. Dysfunction of both peripheral tissues and the CNS occurs with the accumulation of these A wide variety of approaches have been used to study BBB disruption and these have given different aspects to the overall picture. Injection of dyes was the original method used by Erlich in the 1880's that led eventually to the elucidation of barrier function and was used for decades [START_REF] Broman | Supravital analysis of disorders in the cerebrovascular permeability[END_REF]. This method has enjoyed a resurgence in use in the last decade or so, possibly because little special equipment or regulatory oversight is needed. The method, however, requires skill and practice to give true results. Main sources of error are inadequate washout of the vascular space, disruption of the BBB from washout of the vascular space, or administration of too high a dose of dye. The latter occurs when the amount of dye given exceeds the binding capacity of serum albumin. These common errors all act to overestimate BBB disruption.

Ultrastructural studies ultimately showed the anatomical basis for the BBB [START_REF] Reese | Fine structural localization of a blood-brain barrier to exogenous peroxidase[END_REF] and subsequently showed that most disruptions of the BBB [START_REF] Lossinsky | Ultracytochemical studies of vesicular and canalicular transport structures in the injured mammalian blood-brain barrier[END_REF] result from increased vesicular pathways (transcytosis) with or without an accompanying opening of tight junctions (paracellular pathways). Nevertheless, many current studies, especially those devoted to use of in vitro methods, focus on tight junctions. Radioactive studies using a series of molecular weight markers can often distinguish between disruption from transcytosis, in which the measure of disruption is similar regardless of the molecular size of the marker, vs paracellular mechanisms, in which smaller molecular weight markers often give larger measures of disruption [76;77].

Banks p11

A C C E P T E D M A N U S C R I P T

ACCEPTED MANUSCRIPT

In comparison to disruption, other aspects of BBB function during disease are relatively understudied. This is unfortunate, as it is likely that these other functions change much more early in the course of disease and likely are much more relevant to all but the terminal aspects of in neuroAIDS or with seizures, these conditions cause alterations in p-glycoprotein expression [88;89]. This, in turn, alters the ability of anti-virals and anti-epileptic mediations to accumulate within the CNS.

disease
Modeling of many diseases shows that the BBB is involved or altered on many levels [START_REF] Banks | Protector, prey, or perpetrator: The pathophysiology of the blood-brain barrier in NeuroAIDS[END_REF]. For example, in neuroAIDS: the BBB is minimally disrupted [25;42;91]; activation of BBB cells and immune cells leads to enhanced adhesion of immune cells to the BBB and enhanced viral entry [25;33;34;92;93]; infected immune cells, free virus, and viral proteins including the neurotoxic gp120 and TAT cross the BBB [23;26;33;94;95]; BBB surface glycoprotein composition likely determines which HIV-1 strains are taken up or transported by the BBB [START_REF] Bobardt | Contribution of proteoglycans to human immunodeficiency virus type 1 brain invasion[END_REF]; BBB efflux systems impair the accumulation by the brain of many antivirals [38;39;96]; BBB secretions and cell surface expression of immune-active cytokines and Banks p12

A C C E P T E D M A N U S C R I P T ACCEPTED MANUSCRIPT

chemokines is increased by virus or viral proteins [32;97;98]. These changes affect many aspects of AIDS and neuroAIDS including disease initiation and progression, neuroimmune activation, and drug delivery. Such multi-level changes in the BBB also occur in models for diabetes mellitus and sepsis/neuroimmune activation.

Another example of the expanded understanding of the sorts of roles the BBB may play in diseases is provided by epilepsy. Classically, the BBB has been noted to be disrupted in seizures with such disruption affected by parameters such as aging and gender [99;100]. More recently, drug delivery has become of great interest with the realization that an efflux system located at the BBB termed p-glycoprotein retards the accumulation by brain of most anti-seizure medications [101;102]. Indeed, the some 30% of epileptic patients who are resistant to antiseizure medications may be so because of overexpression of p-glycoprotein [START_REF] Löscher | Role of multidrug transporters in pharmacoresistance to antiepileptic drugs[END_REF]. Even more recently, it has been shown that seizure activity increases expression of p-glycoprotein at the BBB, thus complicating control of epilepsy [88;89]. Finally, immune cell-BBB interactions may be key to turning experimental seizure into epilepsy. Seizure activity induces selectin expression at the BBB which increases immune cell adhesion and perhaps CNS trafficking [START_REF] Fabene | A role for leukocyteendothelial adhesion mechanisms in epilepsy[END_REF]. Blockade of immune cell-BBB adhesion inhibits both induction of acute seizures and chronic recurrent seizure activity.

Diseases Caused by the BBB: The Case for Alzheimer's and Obesity Diseases in which the BBB plays a central or primary role could be those in which either the BBB is the original site of pathophysiology or in which altered BBB function is key to disease progression. Multiple sclerosis and stroke including CADASIL have been considered

Banks p13

A C C E P T E D M A N U S C R I P T ACCEPTED MANUSCRIPT

above. To this list can be added De Vivo's disease, which includes familial seizures and mental retardation resulting from underexpression of the GLUT-1 transporter at the BBB [START_REF] De Vivo | Defective glucose transport across the blood-brain barrier as a cause of persistent hypoglycorrhachia, seizures, and developmental delay[END_REF].

Encephalopathy occurs when the BBB is disrupted during hypertensive emergencies; although formerly thought to be entirely caused by physical disruption from high pressure, more recent investigations suggest that activity of the renin-angiotensin-aldosterone system in general and of angiotensin II in particular may be important. In a broader sense, epilepsy resistance to antiseizure medications, which occurs in about 30% of cases, is caused by overexpression of pglycoprotein at the BBB, and CNS infections and infestations arise because of their ability to interact with the BBB in a way to negotiate their permeation into the CNS. Arguments which place the BBB in a causal role in Alzheimer's disease and obesity are illustrative of the general concepts of this review.

Alzheimer's Disease

Several hypotheses have been advanced that would involve the BBB/cerebrovasculature (table I) in AD. These include BBB disruption, defective glucose transport, and release of neurotoxins from the BBB. One of the most recent hypotheses is the neurovascular hypothesis [START_REF] Zlokovic | Neurovascular mechanisms of Alzheimer's neurodegeneration[END_REF]. This states that deficient efflux of amyloid ß peptide (Aß) from the brain contributes to its accumulation and toxicity within the CNS. That Aß is removed from the CNS by a rapid saturable efflux system has been well documented by several laboratories [START_REF] Banks | Efflux of human and mouse amyloid ß proteins 1-40 and 1-42 from brain: Impairment in a mouse model of Alzheimer's disease[END_REF][START_REF] Ito | Functional characterization of the brain-to-blood efflux clearance of human amyloid-beta peptide (1-40) across the rat blood-brain barrier[END_REF][START_REF] Shibata | Clearance of Alzheimer's amyloid-β1-40 peptide from brain by LDL receptor-related protein-1 at the blood-brain barrier[END_REF][START_REF] Ghersi-Egea | Fate of cerebrospinal fluid-borne amyloid β-peptide: rapid clearance into blood and appreciable accumulation by cerebral arteries[END_REF]. In addition, Aß efflux is decreased in both transgenic mice and the SAMP8, a mouse strain with a natural mutation that results in an age-dependent increase in Aß and cognitive defects [105;109;110].

Banks p14

A C C E P T E D M A N U S C R I P T ACCEPTED MANUSCRIPT

Efflux of Aß from brain has been suggested to be mediated by low density lipoprotein receptor-related protein-1 (LRP-1) and by p-glycoprotein [107;111-113]. Aß is a ligand for liver LRP-1 which likely plays an important role in its clearance from blood. Immunohistochemistry studies show that LRP-1 levels decrease in brains of AD patients [START_REF] Deane | The role of the cell surface LRP and soluble LRP in blood-brain barrier Aß clearance in Alzheimer's disease[END_REF]. However, other studies suggest that the relations among LRP-1, Aß, and p-glycoprotein are complex and may involve other ligands or transporters [106;114]. A model in which LRP-1 at the BBB was knocked down with antisense given by intracerebroventricular infusion showed that brain Aß levels increased about 40% and mice developed cognitive impairments [START_REF] Jaeger | Testing the neurovascular hypothesis of Alzheimer's disease: LRP-1 antisense reduced blood-brain barrier clearance, increases brain levels of amyloid beta protein, and impairs cognition[END_REF]. These results are consistent with a major role in AD for the BBB efflux of Aß by an LRP-1 dependent system.

Other work has suggested that blood-to-brain transport of blood-borne Aß could contribute to brain levels of Aß with the receptor for advanced glycation end products (RAGE) acting as the primary transporter [116;117]. The contribution that circulating Aß makes to CNS levels of Aß is not established and so the role of blood-to-brain transport is less clear. Findings suggest, however, that just as Aß efflux is decreased in AD, blood-to-brain transport is increased.

Given the evidence that the BBB transporters are altered to favor increased influx and decreased efflux of Aß, the question arises as to what dictates these changes. Isoforms of Aß are differentially transported by LRP-1 and w ith aging in the SAMP8, efflux of Aß1-42 is more significantly lost than efflux of Aß1-40 [105;118]. This would favor retention of the more toxic form of Aß1-42 with aging. Dimerization and complexing with other LRP-1 ligands also retards Aß efflux [START_REF] Ito | Cerebral clearance of human amyloid-beta peptide (1-40) across the blood-brain barrier is reduced by self-aggregation and formation of low-density lipoprotein receptor-related protein-1 ligand complexes[END_REF]. Models of inflammation induced by lipopolysaccharide also recapitulate the proposed findings in AD, increasing influx and decreasing efflux of Aß. Interestingly, administration of the nonsteroidal antiinflammatory drug indomethacin prevents the

Banks p15

A C C E P T E D M A N U S C R I P T

ACCEPTED MANUSCRIPT

lipopolysacchride-induced impairment of Aß efflux [START_REF] Jaeger | Effects of lipopolysaccharide on the blood-brain barrier transport of amyloid beta protein: A mechanism for inflammation in the progression of Alzheimer's disease[END_REF]. This is consistent with the proposed beneficial role of indomethacin in AD [121;122].

Obesity

Obesity is characterized by resistance to leptin, a 17 kDa protein secreted by fat tissue [START_REF] Friedman | Leptin and the regulation of body weight in mammals[END_REF]. Leptin crosses the BBB by way of a saturable transport system where it interacts with its receptors located throughout the brain [START_REF] Banks | MANUSCRIPT saturable system independent of insulin[END_REF]. Most studied of the CNS sites is the arcuate nucleus. Here, leptin acts through its receptor to inhibit orexigenic peptides such as neuropeptide Y and orexin and to stimulate anorexigenic peptides such as melanocortin [START_REF] Schwartz | Central nervous system control of food intake[END_REF]. Leptin inhibits feeding through these mechanisms and also increases caloric expenditure. These two factors together result in a decrease in fat mass. As fat mass decreases, so does leptin levels in blood and the CNS; this, in turn, decreases anorexia and caloric expenditure. Thus, a negative feedback loop is formed between adipose tissue and feeding/caloric expenditure. Resistance to these actions of leptin or an absence of leptin results in obesity.

Leptin interactions with the BBB have been studied in several animal models, especially those of obesity. The earliest studies were those of van Heek and [126;127] in two models of obesity prone mice. These two studies showed that as obesity increased, these mice passed through a phase of resistance to peripherally administered leptin while remaining sensitive to centrally administered leptin. This is consistent with a block in the blood-to-brain transfer of leptin and suggested that failure of transport at the BBB preceded that of resistance at the arcuate nucleus. Pharmacokinetic studies in an obesity of maturity model, the Koletsy rat, and several other obesity models showed transport of leptin across the BBB to be decreased in proportion to Banks p16

A C C E P T E D M A N U S C R I P T ACCEPTED MANUSCRIPT

the degree of obesity [START_REF] Banks | Impaired transport of leptin across the blood-brain barrier in obesity[END_REF][START_REF] Burguera | Obesity is associated with a decreased leptin transport across the blood-brain barrier in rats[END_REF][START_REF] Levin | Obesity-prone rats have normal blood-brain barrier transport but defective central leptin signaling before obesity onset[END_REF][START_REF] Kastin | Decreased transport of leptin across the blood-brain barrier in rats lacking the short form of the leptin receptor[END_REF]. Studies with the brain perfusion model showed that leptin resistance at the BBB is complex, induced by both circulating factors, such as leptin inducing its own self-inhibition, and longer term factors inducing down regulation [128;132].

Investigation of transport of leptin across the BBB in various models has revealed several interesting characteristics. The transport rate is not static but influenced by obesity, ovarian factors, starvation, triglycerides, insulin, glucose, and epinephrine [133][START_REF] Kastin | Chronic loss of ovarian function decreases transport of leptin into mouse brain[END_REF][START_REF] Kastin | Glucose and insulin increase the transport of through the bloodbrain barrier in normal mice but not in streptozotocin-diabetic mice[END_REF][START_REF] Banks | Enhanced leptin transport across the blood-brain barrier by α1-adrenergic agents[END_REF] . Effects of lipopolysaccharide, cholecystokinin, and alcohol administration have also been studied [START_REF] Nonaka | Effects of lipopolysaccharide on leptin transport across the blood-brain barrier[END_REF][START_REF] Pan | Increased leptin permeation across the bloodbrain barrier after chronic alcohol ingestion[END_REF][START_REF] Cano | A cholecystokinin-1 receptor agonist (CCK-8) mediates increased permeability of brain barriers to leptin[END_REF]. The nature of the BBB transporter protein for leptin is of great interest. Most work has indicated that at the vascular BBB, the short form of the leptin receptor likely acts as the leptin transporter. However, the Koletsky rat does not express functional receptors, yet is still able to transport leptin across the BBB by a saturable mechanism [131;140;141]. Therefore, there is likely a leptin transporter at the BBB other than the short form. Megalin has been proposed as the leptin transporter at the choroid plexus [START_REF] Dietrich | Megalin mediates the transport of leptin across the blood-CSF barrier[END_REF].

The role of the BBB in modifying leptin actions in the CNS likely affects many of leptin's other effects. Leptin has effects on immune function, bone density, cognition, breathing, reproduction, and other functions, most mediated through CNS sites [START_REF] Ahima | Regulation of neuronal and glial proteins by leptin: implications for brain development[END_REF][START_REF] Ahima | Leptin accelerates the onset of puberty in normal female mice[END_REF][START_REF] Ducy | Leptin inhibits bone formation through a hypothalamic relay: A central control of bone mass[END_REF][START_REF] Elefteriou | Leptin regulation of bone resorption by the sympathetic nervous system and CART[END_REF][START_REF] Lord | Leptin modulates the T-cell immune respone and reverses starvation-induced immunosuppression[END_REF][START_REF] O'donnell | Leptin prevents respiratory depression in obesity[END_REF][START_REF] Saaresranta | Does leptin link sleep loss and breathing disturbances with major public Banks p37 A C C E P T E D M A[END_REF][START_REF] Farr | Effects of leptin on memory processing[END_REF]. Leptin has receptors throughout the brain as well, including on non-neuronal cells such as astrocytes [START_REF] Pan | Astrocyte leptin receptor (ObR) and leptin transport in adult-onset obese mice[END_REF], so many of these actions may be mediated through different CNS locales and cell types. The rate of transport of leptin across the BBB varies among brain regions [START_REF] Banks | Partial saturation and regional variation in the blood to brain transport of leptin in normal weight mice[END_REF]. As such, the regional differences obesity has on transport likely means that obesity has differential effects on the leptin actions mediated through the CNS. Leptin also has functioning receptors within the subfornical organ, a circumventricular organ [START_REF] Smith | The subfornical organ: a central nervous system site for actions of circulating leptin[END_REF]. Similarly, there is evidence for some arcuate nucleus Banks p17

A C C E P T E D M A N U S C R I P T

ACCEPTED MANUSCRIPT

neurons projecting into the median eminence [START_REF] Faouzi | Differential accessibility of circulating leptin to individual hypothalamic sites[END_REF]. This suggests a dynamic interaction of CNS leptin receptor sites that are inside and outside the BBB as has been proposed for other peptides and regulatory proteins such as amylin and interleukin.

BBB interactions with other peptides and proteins related to feeding and metabolism have been studied in various models of disease. Starvation, immune activation with lipopolysacchride, obesity, and hypertriglyceridemic models have been used to study ghrlein or insulin transport [87;155-160]. Urocortin transport across the BBB is induced by leptin and tumor necrosis factor-alpha administration [161;162].

Conclusions

Our understanding of the BBB continues to evolve. As it does, the BBB is discovered to be involved ever more intimately in an ever wider array of diseases. This understanding has been greatly fostered and defined by models of the BBB and models of disease states. As these models continue to conceptualize the BBB not only as a physical barrier but also as a regulatory interface between the CNS and blood, more roles in disease states will likely be discovered.

Most exciting are a series of diseases in which the BBB and its dysfunctions play key roles to disease onset and development.

Banks p18

Table I. Theories Relating Alzheimer's Disease to the Blood-brain Barrier and the Cerebrovasculature Leaky Blood-brain Barrier [START_REF] Blennow | Blood-brain barrier disturbance in patients with Alzheimer's disease is related to vascular factors[END_REF] Tortuous Capillary Bed [START_REF] De La Torre | Can disturbed brain microcirculation cause Alzheimer's disease?[END_REF] Defective Glucose Transporters [START_REF] Harik | Blood-brain barrier abnormalities in Alzheimer's disease[END_REF] Microvascularopathy [START_REF] Kalaria | Neurodegenerative disease: Diabetes, microvascular pathology and Alzheimer disease[END_REF] Cerebrovascular Degeneration [START_REF] Kalaria | Cerebrovascular degeneration is related to amyloid-beta protein depositon in Alzheimer's disease[END_REF] Brain Endothelium and the Release of Neurotoxins [START_REF] Grammas | Production of neurotoxic factors by brain endothelium in Alzheimer's disease. de la Torre[END_REF] Permeation of Aluminum-glutamate Complexes [START_REF] Deloncle | Mechanism of Alzheimer's disease: arguments for a neurotransmitteraluminium complex implication[END_REF] Inhibition of Brain Endothelial Cell Proliferation [START_REF] Grammas | Alzheimer disease amyloid proteins inhibit brain endothelial cell proliferation in vitro[END_REF] Decreased Vitamin B12 Transport [START_REF] Ikeda | Vitamin B12 levels in serum and cerebrospinal fluid of people with Alzheimer's disease[END_REF] Vascular Cognitive Impairment [START_REF] Erkinjuntii | The concept of vascular cognitive impairment[END_REF] Altered Insulin Transport into Brain [START_REF] Craft | Cerebrosinal fluid and plasma insulin levels in Alzheimer's disease: relationship to severity of dementia and apolipoprotein E genotype[END_REF] Decreased Cerebral Blood Flow [START_REF] Risberg | 133 Xe cerebral blood flow in dementia and in neuropsychiatry research[END_REF] Aß Formation of Ionophores [START_REF] Arispe | Alzheimer disease amyloid β protein forms calcium channels in bilayer membranes: blockade by tromethamine and aluminum[END_REF] Neurovascular Hypothesis: Decreased Aß Efflux from Brain

  products. In many of these diseases, normal function can be returned to the peripheral tissues by treatment with enzyme. However, these enzymes are large and do not cross the BBB of adults. As such, lysosomal storage diseases represent a major challenge for CNS drug delivery[58;59]. They also represent an excellent model for the development of drug delivery systems for large proteins. Animal models with the enzyme of interest knocked out will give a clear signal of clearing of storage product when therapeutic amounts of the enzyme are delivered to the brain. Most drug development for this disease has concentrated on delivering enzyme as a cargo attached to some other substance that will cross the BBB rapidly, the oft-called Trojan horse approach. More recent work has noted that the perinatal BBB expresses function mannose-6 phosphate receptor which transports into the brain two enzymes, GUSB whose deficiency causes Sly syndrome and sulfamidase whose deficiency causes Sanfilippo syndrome[60;61]. Thus, the brains of neonates in which these enzymes are knocked out can be successfully treated by giving peripheral enzyme[START_REF] Vogler | Enzyme replacement in murine mucopolysaccharidosis type VII: neuronal and glial response to beta-glucuronidase requires early initiation of enzyme replacement therapy[END_REF][START_REF] Auclair | Replacement therapy for mucopolysaccharidosis type VI: advantages of early onset of therapy[END_REF][START_REF] Gliddon | Enzyme-replacement therapy from birth delays the development of behavior and learning problems in mucopolysaccharidosis Type IIIA mice[END_REF]. However, the transporter function is lost with maturity and is virtually absent by adulthood. Recent work has shown that epinephrine can re-induce transporter function in adults[START_REF] Urayama | Epinephrine enhances lysosomal enzyme delivery across the blood-brain barrier by up-regulation of the mannos 6-phosphate receptor[END_REF]. Thus, lysosomal storage diseases may provide an excellent model for the study of transcytotic events and their induction at the BBB. Recent work has also suggested that the BBB is not itself resistant to the pathologies of lysosomal storage disease (DJ Begley, personal communication). Knockouts for MPS IIIA have a decreased brain vascular space, altered penetration of diazepam, and increased penetration of glycine. This opens the possibility that among the targets of these diseases is the BBB itself.Functions of the BBBBanks p10 A C C E P T E D M A N U S C R I P T ACCEPTED MANUSCRIPT Traditional studies have focused on BBB disruption. Classically, diseases such as multiple sclerosis, stroke/ischemia, trauma, Alzheimer's disease, epilepsy, CNS cancers, hypertensive encephalopathy, and sepsis have been modeled [21;66-69]. More recently, neuroAIDs, diabetes mellitus, and chronic pain syndromes have been shown to have disruptions in the BBB [70-72].


Céline Blondeau
email: celine.blondeau@inria.fr

Anne Canteaut
email: anne.canteaut@inria.fr

Pascale Charpin
email: pascale.charpin@inria.fr

Differential properties of functions x → x 2 t -1 -extended version *

Keywords: Differential cryptanalysis, block cipher, S-box, power function, monomial, differential uniformity, APN function, permutation, linear polynomial, Kloosterman sum, cyclic codes

We provide an extensive study of the differential properties of the functions x → x 2 t -1 over F 2 n , for 1 < t < n. We notably show that the differential spectra of these functions are determined by the number of roots of the linear polynomials x 2 t + bx 2 + (b + 1)x where b varies in F 2 n .We prove a strong relationship between the differential spectra of x → x 2 t -1 and x → x 2 s -1 for s = n -t + 1. As a direct consequence, this result enlightens a connection between the differential properties of the cube function and of the inverse function. We also determine the complete differential spectra of x → x 7 by means of the value of some Kloosterman sums, and of x → x 2 t -1 for t ∈ {⌊n/2⌋, ⌈n/2⌉ + 1, n -2}.

Introduction

Differential cryptanalysis is the first statistical attack proposed for breaking iterated block ciphers. Its publication [START_REF] Biham | Differential cryptanalysis of DES-like cryptosystems[END_REF] then gave rise to numerous works which investigate the security offered by different types of functions regarding differential attacks. This security is quantified by the so-called differential uniformity of the Substitution box used in the cipher [START_REF] Nyberg | Provable security against differential cryptanalysis[END_REF]. Most 1 notably, finding appropriate S-boxes which guarantee that the cipher using them resist differential attacks is a major topic for the last twenty years, see e.g. [START_REF] Carlet | Codes, bent functions and permutations suitable for DES-like cryptosystems[END_REF][START_REF] Edel | A new APN function which is not equivalent to a power mapping[END_REF][START_REF] Budaghyan | New classes of almost bent and almost perfect nonlinear polynomials[END_REF][START_REF] Bracken | New families of quadratic almost perfect nonlinear trinomials and multinomials[END_REF][START_REF] Browning | An APN permutation in dimension six[END_REF].

Power functions, i.e., monomial functions, form a class of suitable candidates since they usually have a lower implementation cost in hardware. Also, their particular algebraic structure makes the determination of their differential properties easier. However, there are only a few power functions for which we can prove that they have a low differential uniformity. Up to equivalence, there are two large families of such functions: a subclass of the quadratic power functions (a.k.a. Gold functions) and a subclass of the socalled Kasami functions. Both of these families contain some permutations which are APN over F 2 n for odd n and differentially 4-uniform for even n. The other known power functions with a low differential uniformity correspond to "sporadic" cases in the sense that the corresponding exponents vary with n [START_REF] Hernando | Proof of a conjecture on the sequence of exceptional numbers, classifying cyclic codes and APN functions[END_REF] and they do not belong to a large class: they correspond to the exponents defined by Welch [START_REF]Almost perfect nonlinear power functions on GF (2 n ): the Welch case[END_REF][START_REF] Canteaut | Binary m-sequences with three-valued crosscorrelation: A proof of Welch conjecture[END_REF], by Niho [START_REF] Dobbertin | Almost perfect nonlinear power functions on GF (2 n ): the Niho case[END_REF][START_REF] Hollmann | A proof of the Welch and Niho conjectures on crosscorrelations of binary m-sequences[END_REF], by Dobbertin [START_REF]Almost perfect nonlinear power functions on GF (2 n ): a new class for n divisible by 5[END_REF], by Bracken and Leander [START_REF] Bracken | A highly nonlinear differentially 4-uniform power mapping that permutes fields of even degree[END_REF], and to the inverse function [START_REF] Nyberg | Differentially uniform mappings for cryptography[END_REF]. It is worth noticing that some of these functions seem to have different structures because they do not share the same differential spectrum. For instance, for a quadratic power function or a Kasami function, the differential spectrum has only two values, i.e., the number of occurrences of each differential belongs to {0, δ} for some δ [START_REF] Blondeau | Differential properties of power functions[END_REF]. The inverse function has a very different behavior since its differential spectrum has three values, namely 0, 2 and 4 and, for each input difference, there is exactly one differential which is satisfied four times.

However, when classifying all functions with a low differential uniformity, it can be noticed that the family of all power functions x → x 2 t -1 over F 2 n , with 1 < t < n, contains several functions with a low differential uniformity. Most notably, it includes the cube function and the inverse function, and also x → x 2 (n+1)/2 -1 for n odd, which is the inverse of a quadratic function. At a first glance, this family of exponents may be of very small relevance because the involved functions have distinct differential spectra. Then, they are expected to have distinct structures. For this reason, one of the motivations of our study was to determine whether some link could be established between the differential properties of the cube function and of the inverse function. Our work then answers positively to this question since it exhibits a general relationship between the differential spectra of x → x 2 t -1 and x → x 2 n-t+1 -1 over F 2 n . We also determine the complete differential spectra of some other exponents in this family.

The rest of the paper is organized as follows. Section 2 recalls some defi-nitions and some general properties of the differential spectrum of monomial functions. Section 3 then focuses on the differential spectra of the monomials x → x 2 t -1 . First, the differential spectrum of any such function is shown to be determined by the number of roots of a family of linear polynomials. Then, we exhibit a symmetry property for the exponents in this family: it is proved that the differential spectra of x → x 2 t -1 and x → x 2 n-t+1 -1 over F 2 n are closely related. In Section 5, we determine the whole differential spectrum of x → x 7 over F 2 n . It is expressed by means of some Kloosterman sums, and explicitly computed using the work of Carlitz [START_REF] Carlitz | Kloosterman sums and finite field extensions[END_REF]. We then derive the differential spectra of x → x 2 n-2 -1 . Further, we study the functions x → x 2 ⌊n/2⌋ -1 and x → x 2 ⌈n/2⌉+1 -1 . We finally end up with some conclusions.

Preliminaries

2.1 Functions over F 2 n and their derivatives

Any function F from F 2 n into F 2 n can be expressed as a univariate poly- nomial in F 2 n [X]
. The univariate degree of the polynomial F is, as usual, the maximal integer value of its exponents. The algebraic degree of F is the maximal Hamming weight of its exponents:

deg 2 n -1 i=0 λ i X i = max {wt(i) | λ i = 0 },
where λ i ∈ F 2 n and the Hamming weight is calculated as follows :

i = n-1 j=0 i j 2 j with i j ∈ {0, 1}, wt(i) = n-1 j=0 i j .
In this paper, we will identify a polynomial of F 2 n [X] with the corresponding function over

F 2 n . For instance, F ∈ F 2 n [X] is called a permutation polynomial of F 2 n if the function x → F (x) is a permutation of F 2 n .
Boolean functions are also involved in this paper and are generally of the form

x ∈ F 2 n → T r(P (x)) ∈ F 2 ,
where P is any function from F 2 n into F 2 n and where T r denotes the absolute trace on F 2 n , i.e.,

T r(

β) = β + β 2 + • • • + β 2 n-1 , β ∈ F 2 n .
In the whole paper, #E denotes the cardinality of any set E.

The resistance of a cipher to differential attacks and to its variants is quantified by some properties of the derivatives of its S(ubstitution)-box, in the sense of the following definition. It is worth noticing that this definition is general: it deals with functions from F 2 n into F 2 m for any m ≥ 1.

Definition 1 Let F be a function from F 2 n into F 2 m . For any a ∈ F 2 n , the derivative of F with respect to a is the function D a F from F 2 n into F 2 m defined by D a F (x) = F (x + a) + F (x), ∀x ∈ F 2 n .
The resistance to differential cryptanalysis is related to the following quantities, introduced by Nyberg and Knudsen [START_REF] Nyberg | Provable security against differential cryptanalysis[END_REF][START_REF] Nyberg | Differentially uniform mappings for cryptography[END_REF].

Definition 2 Let F be a function from F 2 n into F 2 n . For any a and b in F 2 n , we denote δ(a, b) = #{x ∈ F 2 n , D a F (x) = b}.
Then, the differential uniformity of F is

δ(F ) = max a =0, b∈F 2 n δ(a, b).
Those functions for which δ(F ) = 2 are said to be almost perfect nonlinear (APN).

Differential spectrum of power functions

In this paper, we focus on the case where the S-box is a power function, i.e., a monomial function on F 2 n . In other words, F (x) = x d over F 2 n , which will be denoted by F d when necessary. In the case of such a power function, the differential properties can be analyzed more easily since, for any nonzero a ∈ F 2 n , the equation (x + a) d + x d = b can be written

a d x a + 1 d + x a d = b, implying that δ(a, b) = δ(1, b/a d ) for all a = 0.
Then, when

F : x → x d is a monomial function, the differential characteris- tics of F are determined by the values δ(1, b), b ∈ F 2 n . From now on, this quantity δ(1, b) is denoted by δ(b). Since #{b ∈ F 2 n |δ(a, b) = i} = #{b ∈ F 2 n |δ(b) = i} ∀a = 0,
the differential spectrum of F can be defined as follows.

Definition 3 Let F (x) = x d be a power function on F 2 n . We denote by ω i the number of output differences b that occur i times:

ω i = #{b ∈ F 2 n |δ(b) = i}. (1)
The differential spectrum of F d is the set of ω i :

S = {ω 0 , ω 2 , ..., ω δ(F ) }.
With same notation, we have the following equalities. They are well-known but we indicate the proof for clarity.

Lemma 1

2 n k=0 ω k = 2 n and 2 n k=2 (k × ω k ) = 2 n ,
where ω i = 0 for i odd.

Proof. The first equality is obviously deduced from (1). And, for k > 0, k × ω k equals the number of x ∈ F 2 n such that

x d + (x + 1) d = b and δ(b) = k
for some b. Thus, any x is counted in the second sum. ⋄

Remark 1

The differential spectrum of the power function F (x) = x d over F 2 n is also related to the weight enumerator of the cyclic code of length (2 n -1) with defining set {1, s} [START_REF] Carlet | Codes, bent functions and permutations suitable for DES-like cryptosystems[END_REF]. In particular, the number of codewords with Hamming weight 3 and 4 in this cyclic code can be derived from the differential spectrum of F (see e.g. Corollary 1 in [START_REF] Blondeau | Differential properties of power functions[END_REF]).

A power function F is said to be differentially 2-valued if and only if for any b ∈ F 2 n , we have δ(b) ∈ {0, κ} (and then only two ω i in S do not vanish). It is known that κ = 2 r for some r > 1 (see an extensive study in [START_REF] Blondeau | Differential properties of power functions[END_REF]Section 5]). Note that APN functions are differentially 2-valued with κ = 2.

There are some basic transformations which preserve S.

Lemma 2 Let F d (x) = x d and F e (x) = x e over F 2 n . If there exists k such that e = 2 k d mod 2 n -1 or if ed = 1 mod 2 n -1,
then F e has the same differential spectrum as F d .

General properties on the differential spectrum

In this section, F d (x) = x d and notation is as in Section 2.2. Studying δ(b) for special values of b may give us as least a lower bound on δ(F d ). So we first focus on δ(0).

Lemma 3 Let d be such that gcd(d, 2 n -1) = s. Then F d : x → x d is such that δ(0) = s -1.
In particular s = 1 if and only if δ(0) = 0.

Proof. Note that s = 1 if and only if F d is a permutation. Obviously, x is a solution of x d + (x + 1) d = 0 if and only if

x + 1 x d = 1 that is x + 1 = xz with z d = 1, since x → (x + 1)/x is a permutation over F 2 n \ {0, 1}.
As there are exactly s -1 such nonzero z, the proof is completed. ⋄

There is an immediate consequence of Lemma 3 for specific values of d. We conclude that δ(F d ) = d -1. Now, let d = 2 t -1 with gcd(t, n) = t. Then gcd(d, 2 n -1) = 2 t -1 so that δ(0) = 2 t -2. As previously we conclude that δ(

Proposition 1 Let d ≥ 3 such that d divides 2 n -1. Then δ(F d ) = δ(0) = d -1. In particular, if d = 2 t -1 with gcd(t, n) = t then δ(F d ) = δ(0) = 2 t -2.
F d ) = 2 t -2. ⋄ Example 1 If d = 3 then δ(F d ) = δ(0) = 2 for any even n. If d = 5 then δ(F d ) = δ(0) = 4 for n = 4k for all k > 1. If d = 7 then δ(F d ) = δ(0) = 6 for n = 3k for all k > 1.
The previous remarks combined with our simulation results point out that δ(0) and δ(1) play a very particular role in the differential spectra of power functions. This leads us to investigate the properties of the differential spectrum restricted to the values δ(b) with b ∈ F 2 .

Definition 4 Let F be a power function on F 2 n . We say that F has the same restricted differential spectrum as an APN function when

δ(b) ≤ 2 for all b ∈ F 2 n \ F 2 .
For the sake of simplicity, we will say that F is locally-APN.

This definition obviously generalizes the APN property. For instance, the inverse function over F 2 n is locally-APN for any n, while it is APN for odd n only. Another infinite class of locally-APN functions is exhibited in Section 5.2.

3 The differential spectrum of x → x 2 t -1

From now on, we investigate the differential spectra of the following specific monomial functions

G t : x → x 2 t -1 , 2 ≤ t ≤ n -1, over F 2 n .
Note that such a function has algebraic degree t.

Link with linear polynomials

In this section, we first give some general properties.

Theorem 1 Let G t (x) = x 2 t -1 over F 2 n with 2 ≤ t ≤ n -1. Then, G t (x + 1) + G t (x) + 1 = (x 2 t-1 + x) 2 x 2 + x . (2)
Consequently, for any b ∈ F

2 n \ {1}, δ(b) is the number of roots in F 2 n \ F 2 of the linear polynomial P b (x) = x 2 t + bx 2 + (b + 1)x .
And we have

δ(0) = 2 gcd(t,n) -2 δ(1) = 2 gcd(t-1,n) for any b ∈ F 2 n \ F 2 , δ(b) = 2 r -2
for some r with 1 ≤ r ≤ min(t, n -t + 1).

Proof. To prove (2) we simply compute

(x+ x 2 )(1+ x 2 t -1 + (1+ x) 2 t -1 ) = x+ x 2 + x 2 t + x 2 t +1 + x(1+ x) 2 t = x 2 + x 2 t .
Thus, δ(1) is directly deduced and it corresponds to the number of roots of

P 1 (x) = (x 2 t-1 + x) 2 . Let b ∈ F 2 n \ {1}. Then x ∈ F 2 n \ F 2 is a solution of (x + 1) d + x d = b, d = 2 t -1, if and only if it is a solution of (x 2 t-1 + x) 2 = (b + 1)x(x + 1),
or equivalently if it is a root of the linear polynomial

P b (x) = x 2 t + bx 2 + (b + 1)x.
The values x = 0 and x = 1 are counted in δ(1) (as solutions of (x+1

) d +x d = 1), while P b (0) = P b (1) = 0 for any b. So, we get that, if b = 1, the number of roots of P b in F 2 n is equal to (δ(b) + 2).
Because the set of all roots of a linear polynomial is a linear space, we deduce that

∀b ∈ F 2 n \ {1}, δ(b) = 2 r -2 with r ≤ t.
Moreover, by raising P b to the 2 n-t -th power, we get that any root of

P b is also a root of b ′ x 2 n-t+1 + (b ′ + 1)x 2 n-t + x with b ′ = b 2 n-t . This then implies that δ(b) = 2 r -2 with r ≤ n -t + 1. Finally, for b = 0, P 0 (x) = x 2 t + x, implying that δ(0) = 2 gcd(t,n) -2, which naturally corresponds to Lemma 3. ⋄ Remark 2
As a first easy corollary, we recover the following well-known form of the differential spectrum of the inverse function, G n-1 : x → x 2 n-1 -1 over F 2 n . Actually, the previous theorem applied to t = n-1 leads to δ(0) = 0 and δ(1) = 2 when n is odd and δ(1) = 4 when n is even. For all b ∈ F 2 , δ(b) ∈ {0, 2}. Therefore, we have

• if n is odd, δ(G n-1 ) = 2 and ω 0 = 2 n-1 , ω 2 = 2 n-1 ; • if n is even, δ(G n-1 ) = 4 and ω 0 = 2 n-1 + 1, ω 2 = 2 n-1 -2, ω 4 = 1.
Clearly G n-1 is locally-APN for any n, as we previously noticed (see Definition 4).

The following corollary is a direct consequence of Theorem 1.

Corollary 1 Let G t (x) = x 2 t -1 over F 2 n with 2 ≤ t ≤ n -1.
Then, its differential uniformity is of the form either 2 r -2 or 2 r for some 2 ≤ r ≤ n. Moreover, if δ(G t ) = 2 r for some r > 1, then this value appears only once in the differential spectrum, i.e., ω 2 r = 1, and it corresponds to the value of δ(1), implying δ(G t ) = 2 gcd(t-1,n) .

Equivalent formulations

In Theorem 1, we exhibited some tools for the computation of the differential spectra of functions x → x 2 t -1 . The problem boils down to the determination of the roots of a linear polynomial whose coefficients depend on b ∈ F 2 n . There are equivalent formulations that we are going to develop now. The first one is obtained by introducing another class of linear polynomials over F 2 n . For any subspace E of F 2 n (where F 2 n is identified with F n 2 ), we define its dual as follows:

E ⊥ = { x | T r(xy) = 0, ∀ y ∈ E }.
Also, we denote by Im(F ) the image set of any function F . Lemma 4 Let t, s ≥ 2 and s = n -t + 1. Let us consider the linear applications

P t,b (x) = x 2 t + bx 2 + (b + 1)x, b ∈ F 2 n .
Then the dual of Im(P t,b ) is the set of all α satisfying P * t,b (α) = 0 where

P * t,b (x) = x 2 s + (b + 1) 2 x 2 + bx.
Note that P * t,b is called the adjoint application of P t,b .

Proof. By definition,

Im(P t,b ) ⊥ consists of all α such that T r(αP t,b (x)) = 0 for all x ∈ F 2 n . We have T r(αP t,b (x)) = T r(αx 2 t ) + T r(bαx 2 ) + T r(α(b + 1)x) = T r(α 2 n-t+1 x 2 ) + T r(bαx 2 ) + T r(α 2 (b + 1) 2 x 2 ) = T r(x 2 (α 2 s + α 2 (b + 1) 2 + αb)).
Hence α belongs to the dual of the image of P t,b if and only if α 2 s + α 2 (b + 1) 2 + αb = 0, i.e., α is a root of P * t,b , completing the proof. ⋄

The following theorem gives an equivalent formulation of the quantity r which is presented in Theorem 1.

Theorem 2 Notation is as in Lemma 4. Then

dim Ker(P t,b ) = dim Ker(P * t,b ).
Consequently, this dimension can be determined by solving P t,b (x) = 0 or equivalently by solving

x 2 s + (b + 1) 2 x 2 + bx = 0, where s = n -t + 1.
Proof. Let κ be the dimension of the image set of P t,b . It is well-known that n = κ + dim Ker(P t,b ). On the other hand, Lemma 4 shows that α is in the dual of the image of P t,b if and only if P * t,b (α) = 0. We deduce that n -κ = dim Ker(P * t,b ) = dim Ker(P t,b ) , completing the proof. ⋄ Now, we discuss a different point of view, using an equivalent linear system.

Theorem 3 For any 2 ≤ t < n, we define the following equations:

E b : x 2 t + bx 2 + (b + 1)x = 0, b ∈ F 2 n .
Let N b be the number of solutions of

E b in F 2 n \ F 2 .
Let M b be the number of solutions in F * 2 n of the system

y 2 t-1 + • • • + y 2 + y(b + 1) = 0 T r(y) = 0 Then N b = 2 × M b .
Proof. We simply write

x 2 t + bx 2 + (b + 1)x = x 2 t + x + b(x 2 + x)
which is equal to

= (x 2 + x) 2 t-1 + (x 2 + x) 2 t-2 + • • • + (x 2 + x) + b(x 2 + x) = y 2 t-1 + y 2 t-2 + • • • y 2 + y(b + 1), with y = x 2 + x.
We are looking at the number of solutions of E b which are not in F 2 . So, it is equivalent to compute the number of nonzero solutions y of

y 2 t-1 + y 2 t-2 + • • • y 2 + y(b + 1) = 0
such that the equation x 2 +x+y = 0 has solutions. This last condition holds if and only if T r(y) = 0, providing two distinct solutions

x 1 , x 2 = x 1 + 1 such that x 2 i + x i = y,
N b = δ(b). If b = 1, P 1 (x) = x 2 t + x 2
and the number of roots of P 1 in F 2 n is equal to

N 1 + 2 = 2 gcd(t-1,n) = δ(1)
.

Therefore, we have

M 1 = δ(1)/2 -1.

A property of symmetry

Recall that G t (x) = x 2 t -1 . Now, we are going to examine some symmetries between the differential spectra of G t and G s where t, s ≥ 2 and s = n-t+1.

In the list of properties below, notation is conserved as soon it is defined.

Recall that

P * t,b (x) = x 2 s + x 2 (b + 1) 2 + xb is the adjoint polynomial of P t,b (x) = x 2 t + bx 2 + (b + 1)
x. Thus, both polynomials have a kernel with the same dimension (see Lemma 4 and Theorem 2). It is worth noticing that this dimension is at least 1 since

P t,b (0) = P t,b (1)
= 0. In this section we want to prove the following theorem.

Theorem 4 For any ν with 2 ≤ ν ≤ n -1, we define

S i ν = { b | dim Ker(P ν,b ) = i } with 1 ≤ i ≤ ν .
Then, for any s, t ≥ 2 with t = n -s + 1 and for any i, we have #S i s = #S i t .

We begin by some lemmas. The next one will not be used for the proof of Theorem 4 but clarifies some arguments.

2 a 2 + ba + a 2 s + a 2 = a 2 b 2 + b a + a 2 s + a 2 a 2 = 0.
There is b such that this equation is satisfied if and only if

T r a 2 s + a 2 a 2 × a 2 = T r(a 2 s + a 2 ) = 0,
which holds for any a. Thus, for any nonzero a there are exactly two solutions, say b 1 and b 2 whose sum equals a -1 . To complete the proof, we observe that

P * t,b (1) = b 2 + b. ⋄ Lemma 6 Let s, t ≥ 2 with t = n -s + 1. Let π be the permutation of F * 2 n × F 2 n defined by π(a, b) = a 2 s , ab a 2 s + 1 .
Then, for any

(a, b) in F * 2 n × F 2 n , (α, β) = π(a, b) satisfies P * s,β (α) = P * t,b (a) .
Proof. First, we clearly have that π is a permutation of

F * 2 n × F 2 n . Indeed, π (F * 2 n × F 2 n ) ⊂ F * 2 n × F 2 n
and one can define the inverse of π as follows:

π -1 (α, β) = α 2 n-s , α(β + 1)) α 2 n-s .
Actually, (α 2 n-s ) 2 s = α and it can be checked that

π(π -1 (α, β)) = α, α 2 n-s α(β + 1) αα 2 n-s + 1 = (α, β).
Then, by using that (β + 1) 2 = a 2 b 2 a 2 s+1 and s + t = n + 1, we deduce that

P * s,β (α) = (a 2 s ) 2 t + (a 2 s ) 2 (β + 1) 2 + (a 2 s )β = a 2 + a 2 b 2 + ab + a 2 s = P * t,b (a) . ⋄ Lemma 7 Let s, t ≥ 2 with t = n -s + 1. Let b ∈ F 2 n and let a ∈ F * 2 n
such that P * t,b (a) = 0. Then dim Ker(P * t,b ) = dim Ker(P * s,β ), where β = 1 + ab/a 2 s .

Proof.

Recall that

P * t,b (x) = x 2 s + x 2 (b + 1) 2 + xb. We know that for any b ∈ F 2 there is a ∈ F 2 n \ {0, 1} such that P * t,b (
P * t,0 (x) = x 2 s + x 2 = P s,1 (x)
and for b = 1 Now, we suppose that a ∈ F 2 . With x = ay, the equation

P * t,1 (x) = x 2 s + x = P s,0 (x)
P * t,b (x) = 0 is equivalent to a 2 s y 2 s + a 2 y 2 (b + 1) 2 + ayb = 0
which is

a 2 s y 2 s + a 2 (b + 1) 2 a 2 s y 2 + y ab a 2 s = 0.
We can set

β = a 2 (b + 1) 2 a 2 s and β + 1 = ab a 2 s , since a 2 (b + 1) 2 a 2 s + 1 = ab a 2 s is equivalent to a 2 s + a 2 (b + 1) 2 + ab = 0, i .
S i ν = { b ∈ F 2 n | dim Ker(P ν,b ) = i } .
Then, we want to show that, for any i, #S i t = #S i s . For any 2 ≤ ν ≤ n -1 and for any 1 ≤ i ≤ ν, we define

E i ν = {(a, b) ∈ F * 2 n × F 2 n | P * ν,b (a) = 0 and dim Ker(P ν,b ) = i } .
From Theorem 2, we know that dim Ker(P ν,b ) = dim Ker(P * ν,b ). Then,

E i ν = {(a, b) ∈ F * 2 n × F 2 n | P * ν,b (a) = 0 and dim Ker(P * ν,b ) = i }.
For any b ∈ S i ν there are 2 i -1 nonzero a in Ker(P * ν,b ) and then 2 i -1 pairs (a, b), for a fixed b, in E i ν so that

#E i ν = (2 i -1)#S i ν . (3)
We use Lemma 6. Recall that π is the permutation of

F * 2 n × F 2 n defined by π(a, b) = a 2 s , ab a 2 s + 1 .
Then, we have

E i t = {(a, b) ∈ F * 2 n × F 2 n | P * t,b (a) = 0 and dim Ker(P * t,b ) = i }, E i s = {(α, β) ∈ F * 2 n × F 2 n | P * s,β (α) = 0 and dim Ker(P * s,β ) = i } = {(α, β) = π(a, b), (a, b) ∈ E i t } .
Indeed, any (α, β) is as follows specified from (a, b). We have P * s,β (α) = P * t,b (a) from Lemma 6. Moreover, according to Lemma 7, dim Ker(P * t,b ) = dim Ker(P * s,β ), where β is calculated from a and b, for any a such that

P * t,b (a) = 0.
In other terms, to any pair (a, b) ∈ E i t corresponds a unique pair (α, β) ∈ E i s . We finally get that #E i s = #E i t and it directly follows from (3) that #S i s = #S i t , completing the proof. ⋄

Now we are going to explain Theorem 4, in terms of the differential spectra of G t and G s , s, t ≥ 2 with t = n -s + 1. Actually, we can deduce from the previous theorem that both functions G t and G s have the same restricted differential spectrum, i.e. the multisets {δ(b), b ∈ F 2 n \ F 2 } are the same for both functions.

Corollary 2 We denote by δ ν (b), b ∈ F 2 n , the quantities δ(b) corresponding to G ν : x → x 2 ν -1 . Then, for any s, t ≥ 2 with t = n -s + 1, we have

δ s (0) = δ t (1) -2 = 2 gcd(t-1,n) -2 δ s (1) = δ t (0) + 2 = 2 gcd(t,n)
and we have equality between both following multisets: Thus, applying Theorem 1, we get

{δ s (b), b ∈ F 2 n \ F 2 } = {δ t (b), b ∈ F 2 n \ F 2 }. (4
δ s (0) = 2 gcd(s,n) -2 = 2 gcd(t-1,n) -2 = δ t (1) -2 and δ s (1) = 2 gcd(s-1,n) = 2 gcd(t,n) = δ t (0) + 2.
Moreover, we have

(P t,1 (x)) 2 s-1 = x 2 t + x 2 2 s-1 = x + x 2 s = P s,0 (x)
(P t,0 (x)) 2 s = x 2 t + x 2 s = x 2 s + x 2 = P s,1 (x) ,
implying that {dim KerP t,0 , dim KerP t,1 } = {dim KerP s,0 , dim KerP s,1 } .

We deduce from Theorem 4 that

#{ b ∈ F 2 n \F 2 | dim Ker(P t,b ) = i } = #{ b ∈ F 2 n \F 2 | dim Ker(P s,b ) = i }.
Equality ( 4) is then a direct consequence of Theorem 1, since

{δ ν (b), b ∈ F 2 n \ F 2 } = {2 κ(b) -2, κ(b) = dim Ker(P ν,b )} .
Now, we note that δ s (0) = δ t (0) if and only if δ s (1) = δ t (1). Thus, G t and G s have the same differential spectrum if and only if δ s (0) = δ t (0). Since δ s (0) = 2 gcd(s,n) -2 and δ t (0) = 2 gcd(t,n) -2, this holds if and only if gcd(t, n) = gcd(s, n) = 1. It cannot hold when n is even, because in this case either s or t is even too. Using Definition 4, the last statement is obviously derived. ⋄

The previous result implies that, if G t is APN over F 2 n , then G s is locally-APN. Moreover, the differential spectrum of G s can be completely determined as shown by the following corollary.

Corollary 3 Let n and t < n be two integers such that G

t : x → x 2 t -1 is APN over F 2 n . Let s = n -t + 1. Then,
• if n is odd, both G t and G s are APN permutations;

• if n is even, G t is not a permutation and G s is a differentially 4uniform permutation (locally-APN) with the following differential spectrum:

ω 4 = 1, ω 2 = 2 n-1 -2 and ω 0 = 2 n-1 + 1.
Proof. From Theorem 1, we deduce that, if F is APN, then δ t (b) ∈ {0, 2} for all b ∈ F 2 n \ F 2 ; moreover, gcd(n, t -1) = 1 and gcd(n, t) ∈ {1, 2} since δ t (1) = 2 and δ t (0) ∈ {0, 2}.

If n is odd, gcd(n, t) = 1 is then the only possible value, implying that δ t (0) = 0. It follows that δ s (0) = 0, δ s (1) = 2 and δ s (b) ∈ {0, 2} for all b ∈ F 2 n \ F 2 . In other words, both G t and G s are APN permutations.

If n is even, it is well-known that G t is not a permutation (see e.g. [START_REF] Berger | On almost perfect nonlinear functions[END_REF]). More precisely, we have here gcd(n, t) = 2 since t and t -1 cannot be both coprime with n. Then, we deduce that δ s (0) = 0 and δ s (1) = 4. The differential spectrum of G s directly follows from Corollary 2. ⋄ Example 2 Notation is as in Corollary 3. For t = 2, we have

G t (x) = x 3 . It is well-known that G 2 is an APN function over F 2 n for any n. Since s = n -1, G s (x)
is equivalent to the inverse function and it is also wellknown that the inverse function is APN for odd n. For even n, δ(G n-1 ) = 4 and the differential spectrum is computed in Remark 2.

Corollary 4 Let n and t < n be two integers such that G t : x → x 2 t -1 is differentially 4-uniform. Then, n is even and G t is a permutation with the following differential spectrum:

ω 4 = 1, ω 2 = 2 n-1 -2 and ω 0 = 2 n-1 + 1. Moreover, for s = n -t + 1, G s is APN.
Proof. From Corollary 1, we deduce that δ(G t ) = 4 implies gcd(n, t-1) = 2 and ω 4 = 1. In particular, n is even. Since gcd(n, t -1) and gcd(n, t) cannot be both equal to 2, we also deduce that that G t is a permutation. Its differential spectrum is then derived from Lemma 1. Moreover, we have δ s (0) = 2 and δ s (1) = 2, implying that G s is APN. ⋄

Specific classes

In this section, we apply the results of Section 3 to the study of the differential spectrum of G t : x → x 2 t -1 , for special values of t.

The function x → x 7

We first focus on G 3 : x → x 7 over F 2 n , i.e., t = 3. In this case, we determine the complete differential spectrum of the function. Moreover, thanks to the work of Carlitz [START_REF] Carlitz | Kloosterman sums and finite field extensions[END_REF], we emphasize that this spectrum is related to some Kloosterman sums defined as follows.

Proposition 2 [12, Formula (6.8)] Let K(1) be the Kloosterman sum

K(1) = x∈F 2 n (-1) T r(x -1 +x)
extended to 0 assuming that (-1) T r(x -1 ) = 1 for x = 0. Then,

K(1) = 1 + (-1) n-1 2 n-1 ⌊ n 2 ⌋ i=0 (-1) i n 2i 7 i .
Theorem 5 Let G 3 : x → x 7 over F 2 n with n ≥ 4. Then, its differential spectrum is given by:

• if n is odd, ω 6 = 2 n-2 + 1 6 - K(1) 8 ω 4 = 0 ω 2 = 2 n-1 -3ω 6 ω 0 = 2 n-1 + 2ω 6 ; • if n is even, ω 6 = 2 n-2 -4 6 + K(1) 8 ω 4 = 1 ω 2 = 2 n-1 -3ω 6 -2 ω 0 = 2 n-1 + 2ω 6 + 1.
where K(1) is the Kloosterman sum defined as in Proposition 2. In particular, G 3 is differentially 6-uniform for all n ≥ 6.

To prove this theorem, we need some preliminary results. We first recall some basic results on cubic equations.

• Q β has a unique root y ∈ F 2 n . From Lemma 8, this occurs if and only if T r(β -1 ) = T r(1). In this case, N b = 0 if T r(y) = 1 and N b = 2 if T r(y) = 0.

• Q β has three roots y 1 , y 2 , y 3 ∈ F 2 n . Since these roots are roots of a linear polynomial of degree 4 then y 3 = y 1 + y 2 , implying T r(y 3 ) = T r(y 1 ) + T r(y 2 ). Then, at least one y i is such that T r(y i ) = 0. It follows that, in this case, N b is either 6 or 2.

Proof. (Proof of Theorem 5) In accordance with Lemma 1, we obtain the differential spectrum of G 3 as soon as we are able to solve the following system:

ω 0 + ω 2 + ω 4 + ω 6 = 2 n 2ω 2 + 4ω 4 + 6ω 6 = 2 n (6)
Now, we apply Theorem 1 and we recall first that δ(b) ∈ {0, 2, 6} for any b ∈ F 2 n \ {1}. Moreover, we know that ω 0 = ν 0 as defined in Theorem 6. Since t = 3, gcd(t -1, n) equals 1 for odd n and 2 otherwise. Then, if n is even then δ(1) = 4 else δ(1) = 2. Thus, ω 4 = 1 for even n and ω 4 = 0 otherwise. From the second equation of ( 6), we get

ω 2 = 2 n-1 -3ω 6 -2ω 4
and using the first equation of ( 6)

ω 6 = 2 n -ω 0 -ω 2 -ω 4 = 2 n-1 -ω 0 + ω 4 + 3ω 6 , leading to ω 6 = -2 n-2 + ω 0 -ω 4 2 .
Finally, we deduce from Theorem 6 that, for odd n,

ω 6 = -2 n-2 + ω 0 2 = -2 n-3 + 2 n + 1 6 - K (1) 8
= 2 n-2 + 1 6 - K (1
) 8 and for even n

ω 6 = -2 n-2 + ω 0 -1 2 = -2 n-3 + 2 n -1 6 + K(1) 8 - 1 2 = 2 n-2 -4 6 + K (1) 8 .
Finally, it can be proved that ω 6 ≥ 1 for any n ≥ 6, implying that G 3 is differentially 6-uniform. Actually, it has been proved in [START_REF] Lachaud | The weights of the orthogonal of the extended quadratic binary Goppa codes[END_REF]Th. 3.4] that

-2 n 2 +1 + 1 ≤ K(1) ≤ 2 n 2 +1 + 1
implying that ω 6 > 0 when n > 5. It is worth noticing that G 3 is APN when n = 5 since its inverse is the quadratic APN permutation x → x 9 . When n = 4, G 3 is locally-APN, and not APN, since it corresponds to the inverse function over F 2 4 . ⋄ By combining the previous theorem and Corollary 2, we deduce the differential spectrum of G n-2 : x → x 2 n-2 -1 over F 2 n .

Corollary 5 Let G n-2 : x → x 2 n-2 -1 over F 2 n with n ≥ 6. Then, we have:

• if gcd(n, 3) = 1, G n-2 is differentially 6-uniform and for any b ∈ F 2 n , δ (b)
∈ {0, 2, 6}. Moreover, its differential spectrum is given by:

ω 6 = 2 n-2 +1 6 -K(1)

8

for odd n

2 n-2 -4 6 + K(1) 8 for even n ω 2 = 2 n-1 -3ω 6 ω 0 = 2 n-1 + 2ω 6 ; • if 3 divides n, G n-2 is differentially 8-uniform and for any b ∈ F 2 n , δ (b)
∈ {0, 2, 6, 8}. Moreover, its differential spectrum is given by:

ω 8 = 1 ω 6 = 2 n-2 -5 6 -K(1)

8

for odd n 2 n-2 -10 6

+ K(1) 8 for even n ω 2 = 2 n-1 -3ω 6 -4 ω 0 = 2 n-1 + 2ω 6 + 3 ; Proof. Let (ω ′ 0 , ω ′ 2 , ω ′ 4 , ω ′ 6 )
denote the differential spectrum of G 3 over F 2 n . We apply Corollary 2 (with s = 3). Then, if gcd(3, n) = 1, δ 3 (0) = 0 and δ n-2 (1) = 2. Otherwise, δ 3 (0) = 6 and δ n-2 (1) = 8. Moreover, in both cases, δ 3 (1) = 4 for n even and δ 3 (1) = 2 for n odd. It follows that,

• for gcd(3, n) = 1, n odd, we have (δ 3 (0), δ 3 (1)) = (0, 2) and (δ n-2 (0), δ n-2 (1)) = (0, 2). Then, ω i = ω ′ i for all i;

• for gcd(3, n) = 1, n even, we have (δ 3 (0), δ 3 (1)) = (0, 4) and (δ n-2 (0), δ n-2 (1)) = (2, 2). Then,

ω 0 = ω ′ 0 -1, ω 4 = ω ′ 4 -1 and ω 2 = ω ′ 2 + 2.
• for gcd(3, n) = 3, n odd, we have (δ 3 (0), δ 3 (1)) = (6, 2) and (δ n-2 (0), δ n-2 (1)) = (0, 8). Then,

ω 8 = 1, ω 6 = ω ′ 6 -1, ω 2 = ω ′ 2 -1 and ω 0 = ω ′ 0 + 1.
• for gcd(3, n) = 3, n even, we have (δ 3 (0), δ 3 (1)) = [START_REF] Bracken | New families of quadratic almost perfect nonlinear trinomials and multinomials[END_REF][START_REF] Biham | Differential cryptanalysis of DES-like cryptosystems[END_REF] and

(δ n-2 (0), δ n-2 (1)) = (2, 8). Then, ω 8 = 1, ω 6 = ω ′ 6 -1, ω 4 = ω ′ 4 -1, ω 2 = ω ′ 2 + 1 and ω 0 = ω ′ 0 .
The result finally follows from Theorem 5.

⋄

The minimum distance of the cyclic code of length 2 n -1 with defining set {1, 7} has been studied by van Lint and Wilson in [START_REF] Van Lint | Binary cyclic codes generated by m 1 m 7[END_REF]. More precisely, they have proved that this code has minimum distance at most 4 for n ≥ 6. The previous corollary recovers this result and also provides the exact number of codewords of weight 3 and 4 in this code.

Corollary 6 Let B 3 (resp. B 4 ) denote the number of codewords of Hamming weight 3 (resp. of Hamming weight 4) in the binary cyclic code of length 2 n -1 with defining set {1, 7}. Then, we have

• if n is odd B 3 = 0 B 4 = (2 n -1) 2 n-2 + 1 6 - K (1) 8 ;
• if n is even It is known from Proposition 2 and Lemma 2 in [START_REF] Blondeau | Differential properties of power functions[END_REF] that the number of codewords of weight 3 and 4 in the cyclic code of length (2 n -1) with defining set {1, d} is given by

B 3 = (2 n -1) 3
B 4 = (2 n -1) 2 n-2 -4 6 + K (1) 8 .
B 3 = (2 n -1) 6 (δ(1) -2) B 3 + B 4 = (2 n -1) 24 #{(x, y) ∈ F 2 n ×F 2 n : D 1 F (x) = D 1 F (y)} -2 n+1 .
Therefore, we have

B 3 + B 4 = (2 n -1) 24   b∈F 2 n δ(b) 2 -2 n+1   = (2 n -1) 24
This formula was proved in Corollary 1 of [START_REF] Blondeau | Differential properties of power functions[END_REF], but only in the particular case where gcd(d, 2 n -1) = 1. For d = 7, Theorem 5 implies that

B 3 + B 4 = (2 n -1)ω 6 .
Then, the values of B 3 and B 4 are deduced from the expression of ω 6 given in Theorem 5. ⋄ 5.2 Exponents 2 ⌊n/2⌋ -1

We are going to determine the differential uniformity of G t for t = ⌊n/2⌋. We first consider the case where n is even. Note that in this case, G t is not a permutation since 2 n -1 = (2 t -1)(2 t + 1).

Theorem 7 Let n be an even integer, n > 4 and G t (x) = x 2 t -1 for t = n 2 . Then G t is locally-APN. More precisely

δ(G t ) = 2 t -2 and δ(b) ≤ 2, ∀ b ∈ F 2 n \ F 2 .
Moreover, the differential spectrum of G t is:

• if n ≡ 0 mod 4 then ω 2 t -2 = 1 ω i = 0, ∀ i, 2 < i < 2 t -2 ω 2 = 2 n-1 -2 t-1 + 1 ω 0 = 2 n-1 + 2 t-1 -2; • if n ≡ 2 mod 4,
ω 2 t -2 = 1 ω i = 0, ∀ i, 4 < i < 2 t -2 ω 4 = 1 ω 2 = 2 n-1 -2 t-1 -1 ω 0 = 2 n-1 + 2 t-1 -1.
Proof. From Theorem 1, we obtain directly δ(0) = 2 t -2. Also, δ(1) = 2 if t is even and δ(1) = 4 otherwise. Now, for all b ∈ F 2 , we have to determine the number of roots in F 2 n of P b (x) = x 2 t + bx 2 + (b + 1)x or, equivalently, the number of roots of (P b (x))

2 t = x + b 2 t x 2 t+1 + (b + 1) 2 t x 2 t . (7)
If x is a root of P b then x 2 t = bx 2 + (b + 1)x. So, P b (x) = 0 implies

(P b (x)) 2 t = x + b 2 t (x 2 t ) 2 + (b 2 t + 1)x 2 t = x + b 2 t (bx 2 + (b + 1)x) 2 + (b 2 t + 1)(bx 2 + (b + 1)x) = b 2 t +2 x 4 + (b 2 t +2 + b 2 t +1 + b 2 t + b)x 2 + (b 2 t +1 + b 2 t + b)x = b 2 t +2 (x 2 + x) 2 + (b 2 t +1 + b 2 t + b)(x 2 + x).
Thus, we get a linear polynomial of degree 4 which has at least the roots 0 and 1. Hence, this polynomial has τ roots where τ is either 4 or 2, including x = 0 and x = 1. Therefore, for any b ∈ F 2 , δ(b) ≤ 2 since δ(b) ≤ τ -2. We deduce that G t is localy-APN. We also proved that ω i = 0 unless i ∈ {0, 2, 2 t -2} when t is even and i ∈ {0, 2, 4, 2 t -2} otherwise. Moreover ω 2 t -2 = ω 4 = 1. According to Lemma 1, we have for t even :

2 n = ω 0 + ω 2 + ω 2 t -2 = ω 0 + ω 2 + 1 and 2 n = 2ω 2 + (2 t -2)ω 2 t -2 = 2ω 2 + (2 t -2).
So, we get ω 2 = 2 n-1 -2 t-1 + 1 and conclude with ω 0 = 2 n -ω 2 -1.

We proceed similarly for odd t, with the following equalities derived from Lemma 1: 2 n = ω 0 + ω 2 + 2 and 2 n = 2ω 2 + 2 t + 2.

⋄

And we directly deduce a property on the corresponding class of linear polynomials.

Corollary 7 Let n = 2t and let T r t denote the absolute trace on F 2 t . Consider the polynomials over F 2 n :

x 2 t + bx 2 + (b + 1)x and x 2 t+1 + bx 2 + (b + 1)x.
Then, for any b ∈ F 2 n \F 2 , these polynomials have either 2 or 4 roots in F 2 n . The first one has 4 roots if and only if

T r t (b -(2 t +1) ) = 1 with (1 + b) ∈ G, where G is the cyclic subgroup of F 2 n of order 2 t + 1. Proof. Let P b (x) = x 2 t + bx 2 + (b + 1)x. We define Q b (x) = (P b (x)) 2 t + b 2 t (P b (x)) 2 + (b 2 t + 1)P b (x) b 2 t +2 (x 2 + x)
Using ( 7), we get :

Q b (x) = x 2 + x + A, with A = b 2 t +1 + b 2 t + b b 2 t +2 .
To be clear, we summarize the situation:

-if P b (x) = 0, x ∈ {0, 1}, then Q b (x) = 0; -when Q b (x) = 0, x ∈ {0, 1}, one can have P b (x) = 0; -if Q b (x) = 0 for x ∈ {0, 1}
only, this holds for P b (x) too.

We consider the case where P b (x) = 0 has more than the two solutions 0 and 1. The equation

Q b (x) = 0 has two solutions (not in {0, 1}) if and only if T r(A) = 0 with A = 0. But T r(A) = T r 1 b + 1 b 2 + 1 b 2 t +1 = T r 1 b 2 t +1 = 0, for all b, since b 2 t +1 ∈ F 2 t . And, A = 0 ⇔ b 2 t +1 + b 2 t + b = 0 ⇔ (b + 1) 2 t +1 = 1, that is : b + 1 is not in the cyclic subgroup G of order 2 t + 1 of F * 2 n . On the other hand, if Q b (x) = 0 then x 2 + x = A and we get P b (x) = x 2 t + x + b(x 2 + x) = (x 2 + x) 2 t-1 + (x 2 + x) 2 t-2 + • • • + (x 2 + x) + b(x 2 + x) = A 2 t-1 + • • • + A + bA.
We compute this last expression by replacing the value of A:

P b (x) = t-1 i=0 1 b + 1 b 2 2 i + t-1 i=0 1 b 2 t +1 2 i + 1 + 1 b + 1 b 2 t = T r t 1 b 2 t +1 + 1,
where T r t is the absolute trace on F 2 t . We conclude that P

b (x) = 0 if and only if T r t (b -(2 t +1) ) = 1, with b + 1 ∈ G. ⋄ According to Corollary 2, the differential spectrum of x → x 2 n 2 -1 determines the differential spectrum of x → x 2 n 2 +1 -1
Theorem 8 Let n be an even integer n > 4 and G t+1 (x) = x 2 t+1 -1 for t = n 2 . Then, G t+1 is locally-APN. It is differentially 2 t -uniform and its differential spectrum is

ω 2 t = 1 ω i = 0, ∀ i, 2 < i < 2 t ω 2 = 2 n-1 -2 t-1 ω 0 = 2 n-1 + 2 t-1 -1 .
Moreover, G t+1 is a permutation if and only if n ≡ 0 mod 4.

Proof.

First, since n = 2t, we have gcd(t + 1, n) = 1 if t is even (i.e., n ≡ 0 mod 4) and gcd(t + 1, n) = 2 if t is odd (i.e., n ≡ 2 mod 4). Here s = t + 1.

Let (ω ′ i ) 0≤i≤2 n (resp. (ω i ) 0≤i≤2 n ) denote the differential spectrum of G t (resp. G t+1 ) over F 2 n .

• For n ≡ 0 mod 4, we have (δ t (0), δ t (1)) = (2 t -2, 2) and (δ s (0), δ s (1)) = (0, 2 t ). Thus, ω 0 = ω ′ 0 + 1, ω 2 = ω ′ 2 -1, ω 2 t -2 = ω ′ 2 t -2 -1 and ω 2 t = 1. • For n ≡ 2 mod 4, we have (δ t (0), δ t (1)) = (2 t -2, 4) and (δ s (0), δ s (1)) =

(2, 2 t ). Thus, ω 2 = ω ′ 2 + 1, ω 4 = ω ′ 4 -1, ω 2 t -2 = ω ′ 2 t -2 -1 and ω 2 t = 1. The differential spectrum of G t+1 is then directly deduced by combining the previous formulas with the values of ω ′ i computed in Theorem 7. ⋄

In the case where n is odd, the differential uniformity of G t , with t = n-1 2 , can also be determined.

Theorem 9 Let n be an odd integer, n > 3. Let G t (x) = x 2 t -1 with t = (n -1)/2. Then, G t is a permutation and for all b ∈ F 2 n \ F 2 we have δ(b) ∈ {0, 2, 6}. Moreover • if n ≡ 0 mod 3, then δ(G t ) = 8, and the differential spectrum satisfies ω i = 0 for all i ∈ {0, 2, 6, 8} and ω 8 = 1.

• if n ≡ 0 mod 3, then δ(G t ) ≤ 6 and the differential spectrum satisfies ω i = 0 for all i ∈ {0, 2, 6}.

Conclusions

In this work, we point out that the family of all power functions

{ G t : x → x 2 t -1 over F 2 n , 1 < t < n} (8)
has interesting differential properties. The study of these properties led us to introduce locally-APN functions, as a generalization of the differential spectrum of the inverse function.

In particular, we give several results about the functions with a low differential uniformity within family [START_REF] Browning | An APN permutation in dimension six[END_REF]. There are classes of functions G t such that δ(G t ) = 6. It is the case for the functions G 3 over F 2 n (see Theorem 5).

The functions such that δ(G t ) ≤ 4 can be differentially 4-uniform for even n only (see Corollary 4). We have shown that, for exponents of the form 2 t -1, the APN property imposes many conditions of the value of t.In particular, it is easy to prove, using Theorem 1 that such exponent must satisfy gcd(t, n) = 2 for even n and gcd(t, n) = gcd(t -1, n) = 1 for odd n. Another condition can be derived from the recent result by Aubry and Rodier [START_REF] Aubry | Differentially 4-uniform functions[END_REF] who proved the following theorem.

Proof.

  Since gcd(d, 2 n -1) = d, δ(0) = d -1 from Lemma 3. But the polynomial x d + (x + 1) d + b has degree d -1 for any b, so that δ(b) ≤ d -1.

  completing the proof. ⋄ Remark 3 In Theorem 3, b takes any value while P b is defined for b = 1 in Theorem 1. For all b = 1, we have clearly

Lemma 5

 5 Let a ∈ F * 2 n and 2 ≤ t ≤ n -1. Then there are exactly two elements, b 1 and b 2 with b 2 = b 1 + a -1 , such that P * t,b i (a) = 0 for i = 1, 2. In particular, P * t,b (1) = 0 for b ∈ {0, 1}. Proof. Let a be fixed and let us consider the equation P * t,b (a) = 0 for some b: b

  a) = 0. This is because dim Ker(P t,b ) = dim Ker(P * t,b ) (see Theorem 2) and {0, 1} is included in the kernel of P t,b . Moreover, P * t,b (1) = b 2 + b = 0 if and only if b ∈ F 2 . We treat the case a = 1 separately, a case where P t,b (a) = 0 for b ∈ F 2 only. In this case, Lemma 6 leads to P * s,β (1) = 0 too where β = b + 1, since π(1, b) = (1, b + 1). And we have for b = 0

  . Thus, we conclude: for a = 1, if b is such that P * t,b (1) = 0 then β = b + 1 and dim Ker(P * t,b ) = dim Ker(P s,β ) = dim Ker(P * s,β ) where the last equality comes from Theorem 2.

  e., P * t,b (a) = 0. We have proved that P * t,b (x) = 0 is equivalent to P s,β (y) = y 2 s + βy 2 + (β + 1)y = 0. Then, dim Ker(P s,β ) = dim Ker(P * t,b ). But dim Ker(P s,β ) = dim Ker(P * s,β ) by Theorem 2, completing the proof. ⋄ Proof of Theorem 4. Recall that

Proof. 1 F

 1 Let F (x) = x d over F 2 n and let δ(b), b ∈ F 2 n , denote the number of solutions x of D (x) = F (x + 1) + F (x) = b .

Proof. From Theorem 1 , 2 = 2 =

 122 we have δ(0) = 0; moreover, if 3 divides n then δ(1) = 8 else δ(1) = 2. Now, for all b ∈ F 2 , we have to determine the number of roots inF 2 n of P b (x) = x 2 t + bx 2 + (b + 1)x,or, equivalently, the number of roots of(P b (x)) 2 t+1 = x + b 2 t+1 x 2 t+2 + (b + 1) 2 t+1 x 2 t+1 . Set c = b 2 t+1 and Q b (x) = (P b (x)) 2 t+1 . If x is a root of P b then x 2 t = bx 2 + (b + 1)x. So, P b (x) = 0 implies Q b (x) = x + c(x 2 t ) 4 + (c + 1)(x 2 t ) x + c(bx 2 + (b + 1)x) 4 + (c + 1)(bx 2 + (b + 1)x) cb 4 x 8 + (c(b + 1) 4 + (c + 1)b 2 )x 4 + (c + 1)(b 2 + 1)x 2 + x .Since Q b has degree 8, it has either 8 or 4 or 2 solutions. In other terms, δ(b) ∈ {0, 2, 6}. ⋄

)

  Moreover, G t and G s have the same differential spectrum if and only if

	gcd(s, n) = gcd(t, n) = 1,
	which can hold for odd n only. In any case, G t is locally-APN if and only if
	G s is locally-APN.

Proof. Since s = n -t + 1, we clearly have gcd(s, n) = gcd(t -1, n) and gcd(s -1, n) = gcd(t, n).

  Theorem 10 [1,Theorem 9] Let G t : x → x 2 t -1 over F 2 n with t ≥ 3. If 7 ≤ 2 t -1 < 2 n/4 + 4.6 then δ(G t ) > 4.Thanks to Corollary 2, we can extend this result as follows.Corollary 8 Let G t : x → x 2 t -1 over F 2 n with 3 ≤ t ≤ n -2. If δ(G t ) ≤ 4, then log 2 (2 n 4 + 5.6) ≤ t ≤ n + 1 -log 2 (2

n 4 + 5.6) .

n i=0 i 2 ω i -2 n+1 .

Lemma 8 [START_REF] Berlekamp | On the solution of algebraic equations over finite fields[END_REF] The cubic equation x 3 +ax+b = 0, where a ∈ F 2 n and b ∈ F * 2 n has a unique solution in F 2 n if and only if T r(a 3 /b 2 ) = T r [START_REF] Aubry | Differentially 4-uniform functions[END_REF]. In particular, if it has three distinct roots in F 2 n , then T r(a 3 /b 2 ) = T r [START_REF] Aubry | Differentially 4-uniform functions[END_REF].

Proposition 3 [START_REF] Kumar | Large families of quaternary sequences with low correlation[END_REF]Appendix] Let f a (x) = x 3 + x + a and

Then, we have for odd n

and for even n

Now we are going to solve the equations P b (x) = 0 (see Theorem 1) by solving a system of equations, including a cubic equation, thanks to the equivalence presented in Theorem 3.

Theorem 6

Let

The number ν 0 of b ∈ F 2 n \ {1} such that P b has no roots in F 2 n \ {0, 1} is given by

4 where K(1) is the Kloosterman sum defined as in Proposition 2.

Proof. Let b ∈ F 2 n \{1}. According to Theorem 3 we know that the number (denoted by N b ) of roots in F 2 n \ F 2 of P b is twice the number of roots in F * 2 n of the following system where β = b + 1:

Then, for any β = 0, the following situations may occur:

Let us now define

From the previous discussion, we have

where the last equality comes from Proposition 3. Let us now compute the value of B.

and T r(y) = 1} , by using that β = y 3 + y. But, we have

Therefore,

Now, we clearly have that (y 3 + y) = 0 if and only if y ∈ F 2 . Moreover, two distinct elements y 1 and y 2 in F 2 n \ F 2 with T r(y -1 1 ) = T r(1) and T r(y -1 2 ) = T r(1) satisfy (y 3 1 +y 1 ) = (y 3 2 +y 2 ) (otherwise, Q β with β = y 3 1 +y 1 has at least 2 roots in F 2 n ). Therefore, we deduce that

If n is odd, we deduce that

If n is even, we deduce that

On the other hand, by definition of the Kloosterman sum K(1), we have

Thus,

We then deduce that, for any n,

It follows that

In this proof, we denote by δ t (b) (resp. δ s (b)) the quantities δ(b) corresponding to G t (resp. G s ). From Theorem 10, we know that δ(G t ) ≤ 4 implies

We consider now the function G s . Note that, from Theorem 1, δ(G t ) ≤ 4 implies δ t (0) ∈ {0, 2} and δ t (1) ∈ {2, 4}. Moreover, we obtain directly from Corollary 2 :

• δ s (0) ∈ {0, 2} and δ s (1) ∈ {2, 4}.

⋄

We now concentrate on APN functions belonging to the family [START_REF] Browning | An APN permutation in dimension six[END_REF]. Some are well-known as the inverse permutation for n odd (t = n -1) and the quadratic function x → x 3 (t = 2). There is also the function G t for t = (n + 1)/2 with n odd, because this function is the inverse of the quadratic function x → x 2 (n+1)/2 +1 . Recall that x 2 i +1 is an APN function over F 2 n if and only if gcd(n, i) = 1 and we have obviously gcd(n, (n + 1)/2) = 1 (for odd n). We conjecture that these three functions are the only APN functions within family [START_REF] Browning | An APN permutation in dimension six[END_REF].

or n is odd and t ∈ { n+1 2 , n -1}. If the previous conjecture holds then there are some consequences for the functions of (8) which are differentially 4-uniform. From Corollary 4, we can say that such a function G t is a function over F 2 n with n even. Moreover G s , s = n -t + 1, is APN. If the conjecture holds then s = 2 (t = n -1) is the only one possibility. So, in this case we could conclude that the inverse function is the only one differentially 4-uniform function of family [START_REF] Browning | An APN permutation in dimension six[END_REF].