Generalized partially bent functions, generalized perfect arrays, and cocyclic Butson matrices

Cryptography and Communications https://doi.org/10.1007/s12095-023-00657-z RESEARCH Generalized partially bent functions, generalized perfect arrays, and cocyclic Butson matrices J. A. Armario1·R. Egan2·D. L. Flannery3 Received: 29 August 2022 / Accepted: 14 June 2023 © The Author(s) 2023 Abstract In a recent survey, Schmidt compiled equivalences between generalized bent functions, group invariant Butson Hadamard matrices, and abelian splitting relative difference sets. We establish a broader network of equivalences by considering Butson matrices that are cocyclic rather than strictly group invariant. This result has several applications; for example, to the construction of Boolean functions whose expansions are generalized partially bent functions, including cases where no bent function can exist. Keywords Generalized bent functions ·Butson Hadamard matrices ·Generalized perfect arrays ·Cocycles Mathematics Subject Classification 15B34 ·05B20 ·94D05 1 Introduction Let f:Zn 2→Z2be a Boolean function with na positive integer, and set F(v) =(−1)f(v) for v∈Zn 2(throughout, we view Ztfor an integer t>1as{0,1,...,t−1}under addition modulo t). The Walsh–Hadamard transform ˆ Fof Fis defined by ˆ F(u)= v∈Zn 2 (−1)u·vF(v), BJ. A. Armario [email protected] R. Egan [email protected] D. L. Flannery [email protected] 1Departamento de Matemática Aplicada I, Universidad de Sevilla, Avda. Reina Mercedes s/n, 41012 Sevilla, Spain 2School of Mathematical Sciences, Dublin City University, Dublin, Ireland 3School of Mathematical and Statistical Sciences, University of Galway, Galway, Ireland 123 Cryptography and Communications where u·vdenotes the inner product uvof uand v. The Walsh–Hadamard transform is used to analyze cryptographic properties of Boolean functions. A Boolean function fis bent if |ˆ F(u)|is constant for all u∈Zn 2. Parseval’s theorem (see, e.g., [5, (8.36), p. 322]) gives  v∈Zn 2 ˆ F(v)2=22n. Hence, fcan be bent only if nis even. If the Walsh–Hadamard transform takes no more than one non-zero absolute value, then it is plateaued. A bent function is so-called because it is as far from being linear as possible. However, bent functions are not balanced (another desirable cryptographic property), while plateaued functions can be balanced and have large nonlinearity. These highly non-linear functions offer a robust defence against linear cryptanalysis [6, Chapter 3]. Bent functions are equivalent to certain Hadamard matrices and difference sets; see, e.g., [11, Lemma 14.3.2] and [6, Corollary 3.30]. The concept has been generalized, yielding equivalences between associated objects. Indeed, our paper is inspired by Schmidt’s survey [16], which describes equivalences between generalized bent functions, group invariant Butson Hadamard matrices, and splitting relative difference sets. There is also a connection to perfect arrays, not covered in [16]. We study how the aforementioned equivalences are affected when the property of being group invariant is broadened to cocyclic development. For example, a group-invariant Butson Hadamard matrix is a type of cocyclic matrix. As a consequence, we incorporate generalized partially bent functions [18], and construct a family of generalized partially bent functions with domain for which no generalized bent functions exist. We now outline the paper. Preliminary definitions and results are given in Section 2. Section 3is devoted to generalized perfect arrays and generalized partially bent functions. In Section 4, we prove the main theorem: a series of equivalences between cocyclic Butson Hadamard matrices, generalized perfect arrays, non-splitting relative difference sets, generalized plateaued functions, and generalized partially bent functions. (For certain parameters, the equivalences that we exhibit have those in [16] as special cases.) In Section 5we give some examples illustrating the main theorem. 2 Background We adopt the following definition from [16]. For integers q,m,h>0, and ζkthe complex kth root of unity exp (2π√−1/k),amap f:Zm q→Zhis a generalized bent function (GBF) if  x∈Zm q ζf(x) hζ−w·x q 2=qm∀w∈Zm q, |z|as usual denoting the modulus of z∈C. Thus, a GBF for q=h=2andevenmis a bent function. For h=q, Kumar, Scholtz, and Welch [9] prove that GBFs exist if mis even or q≡ 2 mod 4. However, no GBF with h=q,modd, and q≡2 mod 4 is known [10,p.2]. A further generalization is relevant to our paper. If the values of  x∈Zm q ζf(x) hζ−w·x q 2 123 Cryptography and Communications as wranges over Zm qlie in {0,α}for a single non-zero α,then fis a generalized plateaued function (cf. the definition of plateaued Walsh–Hadamard transform). Mesnager, Tang, and Qi [14] discuss such functions under the conditions that qis prime and his a q-power. They call fan s-generalized plateaued function when αhas the form qm+s. We examine the role of GBFs and generalized plateaued functions in cocyclic design theory [3,6]. Some requisite definitions follow. Let Gand Ube finite groups, withUabelian. Amapψ:G×G→Usuch that ψ(a,b)ψ(ab,c)=ψ(a,bc)ψ(b,c)∀a,b,c∈G is a cocycle (over G,with coefficients in U). Cocycles ψareassumedtobenormalized, meaning that ψ(1,1)=1. For any (normalized) map φ:G→U, the cocycle ∂φ defined by ∂φ(a,b)=φ(a)−1φ(b)−1φ(ab)is a coboundary. The set of cocycles ψ:G×G→ Uequipped with pointwise multiplication is an abelian group, Z2(G,U). Factoring out Z2(G,U)by the subgroup B2(G,U)of coboundaries gives the second cohomology group, H2(G,U). The elements of H2(G,U), namely cosets of B2(G,U),arecohomology classes. Each ψ∈Z2(G,U)is displayed as a cocyclic matrix Mψ. That is, under an indexing of rows and columns by the elements of G,the|G|×|G|matrix Mψhas entry ψ(a,b)in position (a,b). We focus on abelian Gand cyclic U;sayG=Zs1×···×Zsmand U=ζh∼ =Zh, where ζh:={ζi h|0≤i≤h−1}is generated (multiplicatively) by ζh. Denote the set of n×nmatrices with entries in a set Sby Mn(S). A matrix M∈Mn(ζk) is a Butson (Hadamard) matrix if MM∗=nIn,whereInis the n×nidentity matrix and M∗ is the complex conjugate transpose of M. We write BH(n,k)to denote the (possibly empty) set of all Butson matrices in Mn(ζk). For example, at every order nwe have the Fourier matrix ζ(i−1)( j−1) nn i,j=1∈BH(n,n). Hadamard matrices of order nare the elements of BH(n,2). We quote a number-theoretic constraint on the existence of elements of BH(n,k). Theorem 1 ([3, Theorem 2.8.4]) If BH(n,k)=∅and p1,...,prare the primes dividing k, then n =a1p1+···+arprfor non-negative integers a1,...,ar. Two matrices H,H∈Mn(ζk)are equivalent if PHQ∗=Hfor monomials P,Q∈ Mn(ζk∪{0}). This equivalence relation induces a partition of BH(n,k). Our interest is in cocyclic Butson matrices. Let Gbe a group of order n. A cocycle ψ∈Z2(G,ζk)such that Mψ∈BH(n,k)is orthogonal. In particular, group invariant Butson matrices are cocyclic. The orthogonal cocycles involved here are coboundaries, as we now explain. A matrix X∈Mn(ζk)is group invariant, over G,ifX=[xa,b]a,b∈G and xac,bc =xa,bfor all a,b,c∈G.SuchanXis equivalent to a group-developed matrix [χ(ab)]a,b∈Gfor some map χ:G→ζk(see, e.g., [3, 10.2.2]). In turn [χ(ab)]and M∂χ are equivalent: setting Pto be the G-indexed diagonal matrix with χ(a)in row a,wehave P[χ(ab)]P∗=M∂χ. A group-developed Butson matrix has constant row and column sum (in C). Together with Theorem 1, there are strong restrictions on group-developed elements of BH(n,k). Lemma 1 ([4, Lemma 5.2]) Set r j=Re(ζ j k)and sj=Im(ζ j k). A matrix in BH(n,k)with constant row and column sums exists only if there are x0,...,xk−1∈{0,1,...,n}such that k−1 j=0rjxj2+k−1 j=0sjxj2=n and k−1 j=0xj=n. It follows from Lemma 1that if k=2thennis an integer square, and if k=4thennis the sum of two integer squares. 123 Cryptography and Communications Cocyclic designs give rise to relative difference sets, and vice versa [3, Sections 10.4, 15.4]. Let Ebe a group with normal subgroup N,where|N|=nand |E:N|=v.A (v,n,k,λ)-relative difference set in E relative to N (the forbidden subgroup)isak-subset Rof a transversal for Nin Esuch that |R∩xR|=λfor all x∈E\N. We call R abelian if Eis abelian, and splitting if Nis a direct factor of E. The final piece of background concerns arrays. Let s=(s1,...,sm)be an m-tuple of integers si>1, and let G=Zs1×···×Zsm.Ah-ary s-array is just a set map φ:G→Zh (normalized when necessary). If h=2, then the array is binary.Forw∈G,theperiodic autocorrelation of φat shift w, denoted ACφ(w),isdefinedby ACφ(w) = g∈G ζφ(g)−φ(g+w) h. If ACφ(w) =0forallw= 0, then φis perfect. Lemma 2 Let Dmbe the mth Kronecker power of the q ×q Fourier matrix, i.e., (Dm)i,j= ζαi−1·αj−1 q,whereα0=(0,...,0), α1=(0,0,...,1),...,α qm−1=(q−1,...,q−1). Then, for any map φ:Zm q→Zh, (ACφ(α0),...,ACφ(αqm−1))Dm= x∈Zm q ζφ(x) hζ−α0·x q 2 ,..., x∈Zm q ζφ(x) hζ−αqm−1·x q 2. Proof We adapt the proof of the lemma (for Boolean functions) in [2, Section 2]. First,  i≥0 ACφ(αi)ζ αi·αj q= i≥0 k≥0 ζφ(αk)−φ(αk+αi) hζαi·αj q. After replacing αiby αi−αk, the double summation becomes  i≥0 k≥0 ζφ(αk)−φ(αi) hζαi·αj−αk·αj q= k≥0 ζφ(αk) hζ−αk·αj q i≥0 ζ−φ(αi) hζαi·αj q = x∈Zm q ζφ(x) hζ−αj·x q 2 , as required.  Our fundamental motivating result is extracted mostly from [16]. Theorem 2 Let f :Zm q→Zhbe a map. The following are equivalent: 1. f is a GBF; 2. M∂f∈BH (qm,h); 3. f is a perfect h-ary (q,...,q)-array. Additionally, if h is prime and divides qm,then(1)–(3)are equivalent to 4. {(f(x), x)|x∈Zm q}is a splitting (qm,h,qm,qm/h)-relative difference set in Zh×Zm q. Proof The equivalences (1)⇔(2)⇔(4)come from Propositions 2.3 and 2.7 of [16](h prime is a sufficient condition to ensure (2)⇒(4)). Lemma 2implies (1)⇔(3). We investigate the effect on Theorem 2when non-coboundary cocyclic Butson matrices, generalized perfect arrays, and non-splitting abelian relative difference sets are considered in (2), (3), (4), respectively. To this end, we need some material of a more specialized nature, which is presented over the next two sections. 123 Cryptography and Communications 3 More on arrays and bent functions There is an equivalence between binary arrays and non-splitting abelian relative difference sets, as set out in [8]. Subsequently, a bridge to the theory of cocyclic Hadamard matrices was identified [7]. The main tool here is the notion of a generalized perfect binary array (GPBA). Guided by [1, Section 3], we extend the notion of GPBA from binary to h-ary arrays, h≥2, and show how this conforms with a variant of bent functions. Definition 1 Let φ:G→Zhbe an s-array, where s=(s1,...,sm)and G=Zs1×···×Zsm. Let z=(z1,...,zm)∈{0,1}m.Theexpansion of φof type zis the map φfrom E:= Z(z1(h−1)+1)s1×···×Z(zm(h−1)+1)smto Zhdefined by φ:(g1,...,gm)→ φ(a)+bmod h, where b=m i=1gi/siand a≡(g1,...,gm)mod s, i.e., a=(g1mod s1,...,gmmod sm). We distinguish two subgroups of the extension group Ein Definition 1: L={(g1,...,gm)∈E|gi=yisiwith 0 ≤yi<hif zi=1,and yi=0ifzi=0}, K={(g1,...,gm)∈L|i(gi/si)≡0modh}. Note that L∼ =Zn hwhere n=wt(z)=izi; E/L∼ =G; if z= 0then L/K=(0,...,0,si,0,...,0)+K∼ =Zh,foranyisuch that zi=1. With these subgroups of Enow defined, we will be able to see how the expansion of an s-array is natural, and how it allows us to generalize the notion of perfect array. Lemma 3 Let φbe a h-ary (s1,...,sm)-array with expansion φ:E→Zh.Ife∈E and g=(g1,...,gm)∈L, then φ(e+g)≡φ(e)+bmod hwhereb=igi/si. Proof This is routine, from the definitions.  Corollary 1 Under the hypotheses of Lemma 3,AC φ(g)=ζ−b h|E|for any g ∈L. Definition 2 Ah-ary s-array φwith expansion φ:E→Zhof type zis generalized perfect if ACφ(g)=0forallg∈E\L; in short, φis a GPhA(s)of type z. We write GPhA(cm) when sis the vector (c,...,c)of length mfor a constant c. So a GPhA(s)of type 0is exactly a perfect h-ary s-array. Definition 3 (cf. [18, Definition 2.2]) A map f:Zm q→Zhsuch that |AC f(x)|∈{0,qm} for all x∈Zm qis a generalized partially bent function (GPBF). Let φbe a h-ary (q,...,q)-array of type 1. By Corollary 1,|φ(g)|=(hq)m∀g∈L.If φis generalized perfect, then by definition |φ(g)|=0∀x∈Zm hq \L,soφis generalized partially bent. However, the converse does not hold, as evidenced by the following simple example. Define φ:Z2 2→Z2by φ(0,1)=1andφ(0,0)=φ(1,0)=φ(1,1)=0. The expansion of φof type 1is a GPBF, but φis not a GP2A(22)of type 1(writing 1for the all 1s vector). We obtain the converse by imposing more conditions. 123 Cryptography and Communications Proposition 1 Let φbe an array Zm h→Zhsuch that for each y =(y1,...,ym)∈Zm h\{0} with iyi≡0modh, there exists x =(x1,...,xm)∈Zm hsatisfying φ(x+y)+ i(xi+yi)/h≡ φ(x)+φ(y)mod h.(1) Then the expansion φof φof type 1is a GPBF if and only if φis a GPhA(hm)of type 1. Proof In this proposition, E=Zm h2and L={0,h,...,(h−1)h}m∼ =Zm h. Suppose that φ is a GPBF. Then φis a GPhA(hm)if |ACφ(g)|<h2mfor all g∈E\L.Soweprovethat φ(w) −φ(w +g)≡ φ(x)−φ(x+g)mod hfor some w, x∈E.Takingw=0, and assuming that φis normalized, this non-congruence becomes φ(x+g)≡ φ(x)+φ(g). Suppose that φ(0)−φ(g), φ(g)−φ(2g), ..., φ((h−1)g)−φ(hg) are all congruent modulo h(otherwise, the required xmay be found as a multiple of g). Adding these hterms gives φ(0)−φ(hg)≡0modh⇒φ(hg)≡0modh. Consequently igi≡0modh. If g=(g1,...,gm)with 0 ≤gi<h, then the right-hand side of (1)fory=gis φ(x)+φ(g), and the left-hand side is φ(x+g); so we are done. Now let g=a+lwith a=(g1mod h,...,gmmod h)and l∈L.Theniai≡0, because hg =ha in E. Using Lemma 3, and adding b=ili/hto both sides of (1)for y=a,weseethatφ(x+g)≡ φ(x)+φ(g). This completes the proof.  4 Equivalences between arrays, bent functions, and associated combinatorial objects Let s,z,G,K,L,Ebe as in Section 3, with z= 0. We have a short exact sequence 1−→ ζhι −→ E/Kβ −→ G−→ 0,(2) where β(g+K)≡gmod sand ιsends ζhto a generator of L/K∼ =Zh. In the standard way we extract a cocycle μz∈Z2(G,ζh)from (2), depending on the choice of a transversal map τ:G→E/K(see, e.g., [3,§12.1.3]). Set τ(x)=x+K(a mild abuse of notation), so that β◦τ=idG;thenμz(x,y)=ι−1(τ(x)+τ(y)−τ(x+y)). Proposition 2 (cf. [7, Lemma 3.1]) Define γt∈Z2(Zt,ζh)by γt(j,k)=ζ(j+k)/t h.Then (i) μz(x,y)=i with zi=1γsi(xi,yi); (ii) μz∈B2(G,ζh)if and only if siis coprime to h whenever zi=1. In the opposite direction, each cocycle ψ∈Z2(G,ζh)determines a central extension Eψof ζhby G: namely, the group with elements {(ζ j h,g)|0≤j<h,g∈G}and multiplication defined by (u,g)(v, h)=(uvψ(g,h), gh). More properly, the central extension is the short exact sequence 1−→ ζhι −→ Eψ β −→ G−→ 0,(3) where ι(u)=(u,0)and β(u,x)=x. The next two results mimic Proposition 4 and Lemma 3 of [1], respectively. 123 Cryptography and Communications Proposition 3 If μzand ψ∈Z2(G,ζh)are in the same cohomology class, say ψ=μz∂φ, then (2)and (3)are equivalent as short exact sequences. Specifically, for the transversal map τ as defined before Proposition 2,themapsending (u,x)∈Eψto ι(uφ(x)−1)+τ(x)∈E/K is an isomorphism that makes the diagram 1−→ ζhι −→ Eψ β −→ G−→ 0 ⏐  1−→ ζhι −→ E/Kβ −→ G−→ 0 commute. Remark 1 In Proposition 3,theφhas multiplicative target group ζh. When considering φ as an array, we may replace the multiplicative group ζhby the additive group Zh, without bothering to change notation. Likewise, note that Eψis treated multiplicatively, whereas E and its subgroups and quotients are treated additively. Lemma 4 Assuming the set-up of Proposition 3,maps the subset {(1,x)|x∈G}of Eψ onto {g+K∈E/K|φ(g)≡0modh}. Proof Asφis constant on each coset of Kin Eby Lemma3,thestatedsubset of E/Kis welldefined. If φ(x)=ζj hthen ((1,x)) =−jy+x+Kwhere ι(ζh)=y+Kgenerates L/K. Remember that ymay be chosen as (0,...,0,si,0,...,0)for some i. Again by Lemma 3, φ(−jy +x)=j−ji(yi/si)≡0modh. Conversely, suppose that φ(g)=0. Put a≡gmod sand b≡igi/simod h;soφ(a)=φ(g)−b≡−bmod h. Therefore, because g−a−(0,...,0,bsi,0,...,0)∈K, we get that g+K=ι(φ(a)−1)+a+K= ((1,a)). Remark 2 {(1,x)|x∈G}is a full transversal for the cosets of ζhin Eψ. Next we present two lemmas about special subsets of E, to be used in the proof of the impending theorem. For 0 ≤i≤h−1, define Ni φ={g∈E|φ(g)≡imod h}and Li={g∈L|k(gk/sk)≡imod h}. Lemma 5 Ni φ+Lj=Ni+j φ(elementwise sum in E), reading indices modulo h. Proof If x∈Ni φand g∈Lj,thenφ(x+g)≡φ(x)+k(gk/sk)≡i+jby Lemma 3. Hence Ni φ+Lj⊆Ni+j φ.Since−Lj=Lh−j, this containment implies that Ni+j φ−Lj⊆ Ni φ,andsoNi+j φ=Ni φ+Lj. Lemma 6 For all i ,j and e ∈E, |Ni φ∩(e+Ni φ)|=|Nj φ∩(e+Nj φ)|. Proof Theequation x−y=ehas precisely |Ni φ∩(e+Ni φ)|solutions(x,y)∈Ni φ×Ni φ.By Lemma 5,forg∈Lj−ieach such (x,y)gives a solution (˜x,˜y)=(x+g,y+g)∈Nj φ×Nj φ of the equation ˜x−˜y=e. Thus |Ni φ∩(e+Ni φ)|≤|Nj φ∩(e+Nj φ)|. The equality follows after swapping iand j. We also need a fact about vanishing sums of roots of unity (see, e.g., [3, Lemma 2.8.5]). Lemma 7 For prime h, if h−1 i=0αiζi h=0with αi∈Z,thenα0=α1=···=αh−1. 123 Cryptography and Communications Theorem 3 Let φbe a h-ary s-array of type z= 0, where h is a prime dividing v:= |G|= isi(Definition 1), and let R={g+K∈E/K|φ(g)≡0modh}. Then φis a GPhA(s)of type zif and only if R is a (v, h,v,v/h)-relative difference set in E/K with forbidden subgroup L/K. Proof For e∈Eand 0 ≤k<h,defineB(e) k=h−1 i=0|Ni φ∩(Ni−k φ−e)|. We readily see that ACφ(e)= g∈E ζφ(g)−φ(g+e) h= h−1  k=0 B(e) kζk h. If e/∈Lthen we use Lemma 7and h−1 k=0B(e) k=|E|to infer ACφ(e)=0⇔B(e) k=|E|/h∀k.(4) Suppose that φis generalized perfect. If e/∈Lthen |Ni φ∩(e+Ni φ)|=|E|/h2by (4)and Lemma 6. On the other hand, |Ni φ∩(e+Ni φ)|=0ife∈L\K, by Lemma 3. Hence the number of solutions (x+K,y+K)∈R×Rof x+K−(y+K)=e+Kis 0 if e∈L\Kand |E|/|K|h2if e/∈L. Accordingly Ris an |E:L|,|L:K|,|R|,|E|/(|K|h2)-relative difference set in E/K, with forbidden subgroup L/K. Also |E:L|=|G|,|L:K|=h,and |R|=|G|by Lemma 4. Thus Rhas the claimed parameters. Now suppose that Ris a (v, h,v,v/h)-relative difference set in E/Kwith forbidden subgroup L/K.Then|Ni φ∩(Ni φ−e)|=|E|/h2for any e∈E\L; thus B(e) 0=|E|/h. Further, if z∈Lkthen Ni−k φ−e+z=Ni φ−eby Lemma 5,givingB(e) 0=B(e−z) k.Since B(e) 0is constant as eranges over E\L, this means that B(e) 0=B(e) i=|E|/h∀iand ∀e/∈L. By (4), φis a GPhA(s). Remark 3 For an equivalence between difference sets and almost perfect arrays, see [15]. Proposition 4 ([4, Theorem 4.1]) Let H be a finite group whose order is divisible by a prime h. Then ψ∈Z2(H,ζh)is orthogonal if and only if {(1,x)|x∈H}is a (|H|,h,|H|,|H|/h)- relative difference set in Eψwith forbidden subgroup (ζh,1). Theorem 4 For prime h, a (normalized) h-ary s-array φis a GPhA(s)of type z= 0if and only if μz∂φ is orthogonal. Proof This is a consequence of Theorem 3, Proposition 4, and Lemma 4. The next theorem connects generalized plateaued functions to GPhAs. Theorem 5 Let φ:Zm q→Zhbe a map, where h is a prime dividing q. The following are equivalent: 1. φis a GPhA(qm)of type 1; 123 Cryptography and Communications 2. The expansion φ:Zm hq →Zhof φof type 1is a generalized plateaued function, i.e.,  x∈Zm hq ζφ(x) hζ−v·x hq  2=(h2q)mv∈F 0v∈Zm hq \F, where F={v∈Zm hq |v≡1mod h}. Proof Let u=(y1q,...,ymq)∈Land v=(y 1q+a1,...,y mq+am)∈E=Zm hq where 0≤yj,yj≤h−1and0≤aj≤q−1. Then u·v≡(a1y1+···+amym)qmod hq. Hence, if φis a GPhA(qm)of type 1,thenbyLemma2and Corollary 1,  x∈Zm hq ζφ(x) hζ−v·x hq  2= u∈L ACφ(u)ζ u·v hq =(hq)m 0≤y1,...,ym≤h−1 ζ−(y1+···+ym)q+u·v hq The rightmost displayed summation is equal to (hq)m 0≤y1,...,ym≤h−1 ζ(a1−1)y1+···+(am−1)ym h=(h2q)mak≡1modh∀k 0 otherwise. This proves (1) ⇒(2). We get (2)⇒(1)similarly, appealing once more to Lemma 2and taking into account that DmD∗ m=(hq)mIm. Now we can fulfil our intention as stated just after Theorem 2. Theorem 6 Let h be a prime divisor of q, and let φ:Zm q→Zhbe an array with expansion φof type z= 0. (a) The following are equivalent: (i) μz∂φ is symmetric and orthogonal, i.e., Mμz∂φ is a symmetric Butson Hadamard matrix; (ii) φis a GPhA(qm)of type z; (iii) {g+K∈E/K|φ(g)=0}is a non-splitting (qm,h,qm,qm/h)-relative difference set in E/K with forbidden subgroup L/K. (b) If z=1then (i)–(iii) are equivalent to (iv) φis a generalized plateaued function, i.e.,  x∈Zm hq ζφ(x) hζ−v·x hq  2=(h2q)mv∈F 0otherwise, where F={v∈Zm hq |v≡1mod h}. (c) Let h =q and z=1. Suppose that, for all y ∈Zm h\{0}with yi≡0modh, there exists x ∈Zm hsatisfying (1). Then (i)–(iv) are equivalent to (v) φis a GPBF. Proof The equivalences (i)⇔(ii),(ii)⇔(iii),(ii)⇔(iv),and(ii)⇔(v)follow from Theorems 4,3,5, and Proposition 1. (Proposition 2(ii) justifies non-splitting in (iii).)  123