On a conjecture on the Kasami APN function: reductions, structure theorems, a proof for $k\bmod n\in\{1,2,n{-}2,n{-}1\}$, and exhaustive verification for $n\le 13$

Abstract: We study a conjecture on the Kasami almost perfect nonlinear (APN) function $F(x)=x<sup>{4<sup>k-2<sup>k+1}$ on $GF(2<sup>n)$, $\gcd(k,n)=1$: for the $2<sup>{n-1}$-element set $Δ={F(b)+F(b+1)+1: b\in GF(2<sup>n)}$ and all distinct nonzero $v_1,v_2\in GF(2<sup>n)$, [ \bigl|{(x,y,z)\inΔ^3 : v_1x+v_2y+(v_1+v_2)z=0}\bigr| \;=\; 2^{2n-3}. ] The conjecture was proposed at the NSUCRYPTO~2019 cryptographic olympiad (the proposer of the problem was not publicly disclosed). We prove the conjecture for $k\bmod n\in{1,2,n-2,n-1}$, in particular a complete proof for $k=2$ ($d=13$) via a quadratic-form theory and an exact root-count reduction, and we verify it exhaustively by computer for every admissible $(n,k)$ with $n\le13$.

• The paper proves the Kasami APN function conjecture for specific cases where k mod n ∈ {1,2,n−2,n−1}, using reductions and structural insights.
• Develops three successive reductions to a vanishing character-sum statement, providing a detailed structural analysis of the conjecture over various finite fields.
• Verifies the conjecture exhaustively for all admissible (n, k) with n <= 13, using Walsh-Hadamard transforms and random permutations.

The conjecture and its meaning

Let $F=\mathbb{F}_{2^n}$ and let $F(x)=x^d$ with $d=4^k-2^k+1$, $\gcd(k,n)=1$, be the Kasami APN monomial. For the $2^{n-1}$-element set

$\Delta=\{F(b)+F(b+1)+1:\ b\in F\},$

the conjecture posed at NSUCRYPTO 2019 (with undisclosed proposer) asserts that for all distinct nonzero $v_1,v_2\in F$,

$$N(v_1,v_2)=\bigl|\{(x,y,z)\in\Delta^3:\ v_1x+v_2y+(v_1+v_2)z=0\}\bigr|=2^{2n-3}.$$

The value $2^{2n-3}$ is exactly what a single $F$-linear condition would impose on a perfectly equidistributed subset of size $F(x)=x^d$0; moreover, the paper shows unconditionally that $F(x)=x^d$1 is the average of $F(x)=x^d$2 over $F(x)=x^d$3, so the conjecture asserts that $F(x)=x^d$4 is constant and pinned at its mean. This average identity plays a decisive role later: it converts any lower bound on individual counts into an exact determination.

Reductions to a single character-sum vanishing statement

The paper develops three successive reductions. First, by additive-character orthogonality,

$F(x)=x^d$5

where $F(x)=x^d$6, $F(x)=x^d$7, and $F(x)=x^d$8. Thus the count depends only on $F(x)=x^d$9, with an $d=4^k-2^k+1$0-symmetry generated by $d=4^k-2^k+1$1 and $d=4^k-2^k+1$2.

Second, using the key identity (verified in Lean 4 in a companion repository)

$d=4^k-2^k+1$3

the conjecture becomes a balancedness statement about the derivative $d=4^k-2^k+1$4: the map $d=4^k-2^k+1$5 must vanish exactly $d=4^k-2^k+1$6 times.

Third — and this is the sharpest reformulation — after a Frobenius transfer reduces to odd $d=4^k-2^k+1$7 (for which $d=4^k-2^k+1$8 is a permutation), the conjecture is equivalent to

$d=4^k-2^k+1$9

where $\gcd(k,n)=1$0: a uniform vanishing statement over all planes through the diagonal of $\gcd(k,n)=1$1.

One correction to prior informal fact lists is recorded: $\gcd(k,n)=1$2 is a permutation only for odd $\gcd(k,n)=1$3; for even $\gcd(k,n)=1$4 one has $\gcd(k,n)=1$5.

Proved cases and structural results

The easy case. For $\gcd(k,n)=1$6, one has $\gcd(k,n)=1$7 (the trace hyperplane), the support of $\gcd(k,n)=1$8 is $\gcd(k,n)=1$9, every term of $2^{n-1}$0 vanishes individually, and the conjecture holds for all $2^{n-1}$1.

A refuted mechanism. A natural candidate proof would require that no three distinct elements of $2^{n-1}$2 sum to zero (e.g., support contained in $2^{n-1}$3). The computations refute this decisively: for every tested pair with $2^{n-1}$4 the support contains many zero-sum triples (e.g., $2^{n-1}$5 violating pairs for $2^{n-1}$6), yet $2^{n-1}$7 throughout. Any general proof must therefore exploit genuine cancellation between nonzero terms rather than support disjointness. This negative result is arguably the most instructive structural finding short of the main theorem.

The monomial paradigm. For power permutations $2^{n-1}$8, the scaling fibration $2^{n-1}$9 collapses $\Delta=\{F(b)+F(b+1)+1:\ b\in F\},$0 to an exact root count: $\Delta=\{F(b)+F(b+1)+1:\ b\in F\},$1 where $\Delta=\{F(b)+F(b+1)+1:\ b\in F\},$2 counts roots of $\Delta=\{F(b)+F(b+1)+1:\ b\in F\},$3. Using this, the paper proves the analogue holds for all Gold permutations $\Delta=\{F(b)+F(b+1)+1:\ b\in F\},$4 ($\Delta=\{F(b)+F(b+1)+1:\ b\in F\},$5 odd) and for inversion $\Delta=\{F(b)+F(b+1)+1:\ b\in F\},$6 (all $\Delta=\{F(b)+F(b+1)+1:\ b\in F\},$7). Notably, $\Delta=\{F(b)+F(b+1)+1:\ b\in F\},$8 itself fails the identity for $\Delta=\{F(b)+F(b+1)+1:\ b\in F\},$9, so the property genuinely concerns the inverse map; and it is mask-sensitive for non-monomial $v_1,v_2\in F$0, while inner scalings $v_1,v_2\in F$1 preserve it.

Closed form. For odd $v_1,v_2\in F$2, a Gold substitution yields a second rational parametrization $v_1,v_2\in F$3 with $v_1,v_2\in F$4 bijective on $v_1,v_2\in F$5, converting the conjecture into a plain point count over the trace coset.

The main theorem: the case $v_1,v_2\in F$6

The first genuinely open case, $v_1,v_2\in F$7 ($v_1,v_2\in F$8, $v_1,v_2\in F$9 forced odd), is proved in full. Since here $$N(v_1,v_2)=\bigl|\{(x,y,z)\in\Delta^3:\ v_1x+v_2y+(v_1+v_2)z=0\}\bigr|=2^{2n-3}.$$0, every relevant character sum becomes a quadratic-form Gauss sum governed by radicals $$N(v_1,v_2)=\bigl|\{(x,y,z)\in\Delta^3:\ v_1x+v_2y+(v_1+v_2)z=0\}\bigr|=2^{2n-3}.$$1 of dimension $$N(v_1,v_2)=\bigl|\{(x,y,z)\in\Delta^3:\ v_1x+v_2y+(v_1+v_2)z=0\}\bigr|=2^{2n-3}.$$2. Three stages complete the proof:

1. Master correspondence. Incidences $$N(v_1,v_2)=\bigl|\{(x,y,z)\in\Delta^3:\ v_1x+v_2y+(v_1+v_2)z=0\}\bigr|=2^{2n-3}.$$3 are classified into two low-degree families — type I, parametrized by roots of the Bluher polynomial $$N(v_1,v_2)=\bigl|\{(x,y,z)\in\Delta^3:\ v_1x+v_2y+(v_1+v_2)z=0\}\bigr|=2^{2n-3}.$$4, and type II via $$N(v_1,v_2)=\bigl|\{(x,y,z)\in\Delta^3:\ v_1x+v_2y+(v_1+v_2)z=0\}\bigr|=2^{2n-3}.$$5 — with exact counts $$N(v_1,v_2)=\bigl|\{(x,y,z)\in\Delta^3:\ v_1x+v_2y+(v_1+v_2)z=0\}\bigr|=2^{2n-3}.$$6.
2. Counting theorem. Compatibility values satisfy $$N(v_1,v_2)=\bigl|\{(x,y,z)\in\Delta^3:\ v_1x+v_2y+(v_1+v_2)z=0\}\bigr|=2^{2n-3}.$$7 on type I and $$N(v_1,v_2)=\bigl|\{(x,y,z)\in\Delta^3:\ v_1x+v_2y+(v_1+v_2)z=0\}\bigr|=2^{2n-3}.$$8 on type II. A global-versus-local double count of "null pairs" (exactly $$N(v_1,v_2)=\bigl|\{(x,y,z)\in\Delta^3:\ v_1x+v_2y+(v_1+v_2)z=0\}\bigr|=2^{2n-3}.$$9 globally) forces $2^{2n-3}$0: hence $2^{2n-3}$1, and consequently $2^{2n-3}$2 is exactly 2-to-1 on $2^{2n-3}$3 with trace-split fibers. The spectrum of $2^{2n-3}$4 is thereby pinned inside $2^{2n-3}$5 without any Arf-invariant computation.
3. Sign elimination. A monomial change of variables removes all signs, reducing $2^{2n-3}$6 to the exact root count

$2^{2n-3}$7

over parameters $2^{2n-3}$8. The explicit root $2^{2n-3}$9 shows $F$0, and since $F$1 by the unconditional average identity, each term must vanish: $F$2, hence $F$3.

Geometrically, the residual claim states that on the supersingular Fermat cubic $F$4, the system $F$5, $F$6 has the unique solution $F$7 — a translation by the rational 3-torsion point $F$8; the 14 remaining intersection points of a degree-15 correspondence are never rational. Via Frobenius transfer this settles the conjecture for all $F$9.

Byproducts include an APN-free proof that $F(x)=x^d$00 for $F(x)=x^d$01, and the trace-separation lemma showing fibers of $F(x)=x^d$02 pair one element of $F(x)=x^d$03 with one of $F(x)=x^d$04.

Numerical verification

All admissible $F(x)=x^d$05 with $F(x)=x^d$06 were verified exhaustively over all $F(x)=x^d$07 (equivalently, all pairs $F(x)=x^d$08 up to the proved scaling invariance), implemented from first principles in pure Python with Walsh–Hadamard transforms; counts equal $F(x)=x^d$09 in every instance, with brute-force cross-checks for $F(x)=x^d$10. Every theoretical identity (closed form, master correspondence, $F(x)=x^d$11-values, counting ingredients, root-count reduction) was independently validated at $F(x)=x^d$12, and random permutations fail $F(x)=x^d$13, confirming the property is special rather than generic.

Limitations and open questions

The general case remains open for $F(x)=x^d$14. The refuted termwise mechanism means no currently available Walsh-spectrum technology (Bluher root counts, Dillon–Dobbertin machinery) directly classifies the needed cancellation; the spectra are not uniformly plateaued and vary with the cyclotomic class of $F(x)=x^d$15. The closed form requires odd $F(x)=x^d$16, though the reduction to the $F(x)=x^d$17-statement holds for both parities and even-$F(x)=x^d$18 cases are verified exhaustively up to $F(x)=x^d$19. The difference-set connection shows the conjecture is a canonical third moment beyond the Dillon–Dobbertin pair correlation, but generic Singer-parameter sets have non-flat triple correlations, so the difference-set property alone cannot suffice. The authors identify as most promising the template suggested by $F(x)=x^d$20: prove the analogue of the trace-splitting/2-to-1 statement for general even $F(x)=x^d$21, and find the monomial substitutions adapted to the Gold-ratio structure $F(x)=x^d$22 that eliminate sign dependence.

It should also be noted plainly that the proofs were obtained by prompting an AI assistant (Claude Fable 5) and subsequently formalized in Lean 4 (by Aristotle, Harmonic); the mathematical content stands on the Lean verification and the self-contained arguments reproduced in the paper, but the provenance is unconventional.

Conclusion

The paper converts an open olympiad conjecture into a single clean vanishing statement for $F(x)=x^d$23, proves it completely for $F(x)=x^d$24 — including a fully unconditional, self-contained treatment of $F(x)=x^d$25 via quadratic forms, Bluher-type classifications, a double-counting theorem, and a Fermat-cubic root count — verifies all cases with $F(x)=x^d$26 exhaustively, and establishes by counterexample that only genuine cancellation mechanisms can close the remaining residue classes.