Cryptogr. Commun.

(2010) 2:129154
DOI 10.1007/s12095-010-0032-0
Hadamard matrices and their applications:
Progress 20072010
K. J. Horadam
Received: 27 August 2009 / Accepted: 2 June 2010 / Published online: 26 June 2010
Springer Science+Business Media, LLC 2010
Abstract We survey research progress in Hadamard matrices, especially cocyclic
Hadamard matrices, their generalisations and applications, made over the past three
years. Advances in 20 specific problems and several new research directions are
outlined. Two new problems are presented.
Keywords Hadamard matrix Cocyclic matrix Generalised Hadamard matrix
Relative difference set Hadamard code Presemifield APN function
1 Introduction
The purpose of this paper is to outline some of the rapid progress made over the
past three years in research into Hadamard matrices, especially cocyclic Hadamard
matrices, their generalisations and applications. Much of this recent progress is due
to Warwick de Launey and his collaborators and their students. The paper covers
20 of the 90 numbered Research Problems (RP 1RP 90) listed in the authors book
Hadamard Matrices and Their Applications [34], and significant other work.
The paper arises from an invited talk presented at the International Conference
on Design Theory and Applications, Galway, Ireland, July 13, 2009, which incor-
porated the 2nd International Workshop on Hadamard and Cocyclic Matrices and
Applications. As well as providing the first detailed survey of progress for three years
it contains new and unpublished results on Generalised Hadamard matrices, the
Five-fold Constellation and equivalence classes of nonlinear functions over groups.
Dedicated to Warwick de Launey for his 50th birthday.
K. J. Horadam (B)
RMIT University, Melbourne, VIC 3001, Australia
e-mail: kathy.horadam@rmit.edu.au
130 Cryptogr. Commun. (2010) 2:129154
Discussion of progress on RPs 1 and 7, 9, 16 and 21, 30, 33, 3844, 50, 53, 66, and
7375 is interleaved with interesting developments in other directions. The tightly
focussed RPs 16, 39, 53, 74 and 75 have been solved, and RP 30 has been solved
up to a coarser equivalence. RP 21 is effectively solved here. Allied to the solution
of RPs 16 and 21 are corrections to two lemmas on generalised Hadamard matrices
in [34] (Lemmas 4.10.1 and 7.26.2). Particular cases of the broader framework RPs
43, 50, 66 are solved, and RPs 33 and 73 are solved in some cases and have been
revised.
Although there are still no orders known in which no cocyclic Hadamard matrix
exists, many examples of non-cocyclic constructions of Hadamard matrices have
been found. An extension of the Five-fold Constellation to distance-regular graphs is
proposed as a new RP (RP 91). We clarify the definition of equivalence for relative
difference sets (RDSs), and so correct minor errors in [34, Chapters 8.2, 9.2.2]. We
close with new work, including a new RP (RP 92), on partitioning CCZ equivalence
classes of functions into EA classes.
Organisation is as follows. Section 2 covers progress made on various forms of the
Hadamard Conjecture, applications to binary Hadamard codes, and generalisations
to multilevel and higher-dimensional Hadamard matrices. Generalised Hadamard
matrices receive the most detailed treatment: Craigen and de Launeys solution of
RP 16 and of the allied problems presented here leads us to effective solution of
RP 21.
Section 3 covers progress made on cocyclic Hadamard matrices, their extensions
to coupled G-cocyclic Hadamard matrices and the four other equivalent combinato-
rial and algebraic objects of the Five-fold Constellation. We propose an enlargement
of the Constellation to include equivalent graphs. Section 4 is devoted to our
improved understanding of equivalence of semiregular RDSs and how it propagates
around the Constellation. The way this equivalence relation interacts with coarser
equivalences, such as presemifield isotopism and CCZ equivalence of cryptographic
functions, has proved very exciting, as well as being of considerable practical
interest.
Terminology and notation follows that of [34]. Throughout, we will use the
abbreviations HM, CHM, GHM and HDHM for a Hadamard matrix, cocyclic
Hadamard matrix, generalised Hadamard matrix and higher-dimensional Hadamard
matrix, respectively.
2 Hadamard matrices, applications and generalisations
2.1 Hadamard matrices
A HM of order k is a k k matrix H with entries from {1} such that HH

= kI
k
;
that is, for which the dot product of any pair of distinct rows is 0. The order is
necessarily 1, 2 or a multiple of 4.
2.1.1 The Hadamard conjecture: RP 1 and RP 7
The Hadamard Conjecture is that HMs of all orders 4n exist. There is still no reason
to believe it does not hold, and further existence results, dealing both with specific
Cryptogr. Commun. (2010) 2:129154 131
orders and with asymptotic existence (as n ) and density of existence of HMs,
have emerged recently.
Asymptotic results give, for each odd natural number m, a value t
0
for t in terms of
m such that HMs of orders m2
t
exist for all t t
0
. The Hadamard Conjecture would
be confirmed by showing t
0
= 2 for all m, but only values of t
0
growing logarithmically
with m are as yet known. The current lowest known value of t
0
, due to Craigen
[20], is t
0
= 2 +6
1
16
log
2
((m1)/2). In terms of logarithmic lower bounds, we may
rephrase this asymptotic approach to confirmation of the Hadamard Conjecture as:
show that for any > 0, there is an integer M such that for all m > M, there exist
HMs of order m2
2+ log
2
m
.
The associated density results aim to show that, for x Z
+
, the number of orders
less than x in which HMs are known to exist, as a fraction of the number of positive
integers 1, 2, 4n less than x, approaches 1 as x . If S(x) is the number of k
x Z
+
such that a HM of order k exists, the Hadamard Conjecture is equivalent
to the conjecture S(x) =
x
4
+2 for every x 2. Again, this may be rephrased in
terms of logarithmic lower bounds. Let > 0 and let H(x) denote the number of
odd m Z
+
, m x for which there is a HM of order 2

m, for some 2 + log

2
m,
Z
+
. de Launey has shown that H(x) has positive density in Z
+
.
Theorem 1 (de Launey [22, Theorem 1.1]) There exists c
1
() > 0 (dependent only
on ) such that for all suf f iciently large x, H(x) > c
1
()x.
If the Hadamard Conjecture is correct then c
1
() may be taken to equal 1/2.
de Launeys proof adapts a number-theoretic argument of Erdos and Odlyzko to
show that there are enough Paley HMs that their Kronecker product with Sylvester
HMs will give the result.
He suggested that more complicated arguments counting product constructions of
Paley HMs would result in a greater density, and possibly that c
1
() can be taken very
close to 1/2. Subsequently, he and Gordon [23], using results of Kevin Ford, showthis
does result in greater density, but only by a factor of exp(c log log log x)
2
. The density
of the Paley and Sylvester HMs alone imply S(x) (x/ log x) (3/2 +o(1)).
Theorem 2 [23, Theorem 1.3] For all > 0, there is an element x

N such that, for

all x > x

, S(x) (x/ log x) exp{(c )(log log log x)

2
} for c = 0.8178 . . . .
RP 7 [34, p. 25] asks if HMs exist for the 4 orders then unknown (in 2006) less than
1,000. In 2007 Dragomir Djokovic [28] constructed several HMs of order 764 = 4
191 of GoethalsSeidel type, leaving existence in orders 668, 716 and 892 unknown.
He lists the 13 orders less than 2,000 for which existence of HMs is unknown, which
suggests that, to provide a greater computational challenge, RP 7 should be replaced
by the corresponding problem for unknown orders less than 2,000.
Research Problem 7

Do Hadamard matrices of orders 4n exist, for n = 167,

179, 223, 251, 283, 311, 347, 359, 419, 443, 479, 487 and 491?
Note that these n are all primes congruent to 3 (mod 4), so that we might also ask
the following more general question.
132 Cryptogr. Commun. (2010) 2:129154
Research Problem 7

Do Hadamard matrices of orders 4p exist for all primes p 3

(mod 4)?
2.1.2 The cocyclic Hadamard conjecture: RP 38
The cocyclic Hadamard Conjecture is that there exists a cocyclic HM (see Section 3
for the definition) of every order 4n Z
+
. Its confirmation would automatically
confirm the Hadamard Conjecture.
de Launey and Kharaghani [24] show that for m an odd positive integer, a cocyclic
HM of order m2
t
exists whenever t t
0
= 10 +8
log
2
m
10
, compared to the earlier
t 8 log
2
m found by de Launey and Smith [25]. This exponent t
0
is only twice the
value 5 +4
log
2
m
10
found by Craigen et al. [19] for HMs in general.
Their proof involves modifying the method which gave the asymptotic bound in
[19], to ensure that in each step a cocyclic complex HM can replace the complex HM.
The most difficult step requires all the machinery of [25]. While this is a substantial
improvement on the value found in [25], it is still a long way from Craigens current
best t
0
for HMs in general.
Nonetheless, de Launey [22] notes that his first density theorem (Theorem 1)
applies equally to cocyclic Hadamard matrices, because he uses Paley HMs and
Sylvester HMs in his construction; these are cocyclic; and the Kronecker product
preserves the cocyclic property.
2.2 Applications
2.2.1 Binary Hadamard codes: RP 9
RP 9 [34, p. 41] asks for the F
2
-rank to be determined for the codes consisting of the
rows of binarised HMs, for HMs from well-known families.
Phelps et al. [46, 47] have concentrated instead on determining invariants, includ-
ing the rank, of the binary codes C
m
consisting of the 2m codewords formed from the
rows and their complements, of an arbitrary binarised HM of order m. This rank is 1
more than the rank sought in RP 9.
They introduce the kernel of a binary code C as K(C) = {x F
m
2
| x +C = C}.
The F
2
-dimension of K(C) is denoted ker(C). When m = 16 these invariants dis-
tinguish between 5 inequivalent codes, one for each equivalence class of HMs:
(rank(C
16
), ker(C
16
)) = (5, 5), (6, 3), (7, 2), (8, 2), (8, 1). The last two derive from the
two inequivalent transpose HMs, showing that the column behaviour of a HM can
be essentially different from its row behaviour.
Given a HM of order 4s, s > 1 odd, they construct Hadamard codes of length
m = 2
t
s, t 3, with any rank, r {4s +t 3, ..., m/2}, and any possible ker k
{1, ..., t 1}.
2.2.2 Multilevel Hadamard matrices
A multilevel Hadamard matrix (MHM) of order n is an n n matrix H consisting
of real elements {a
i
, 1 i n} (not necessarily all distinct), for which HH

=
H

H = (

n
i=1
a
2
i
)I
n
. (If a
1
= = a
n
= 1, a MHM is a HM. If the a
i
are instead
required to be real variables, these are real orthogonal designs. )
MHMs were introduced by Trinh et al. [51] in 2006 and restricted to integer
entries, as a way to construct multilevel zero-correlation zone sequences, which have
Cryptogr. Commun. (2010) 2:129154 133
been studied for use in approximately synchronized code division multiple access
systems.
Adams et al. [1] have solved the open question concerning the maximum number
of distinct elements permissible in an order n MHM by proving the existence of a
full rate order n MHM (i.e. with n elements of distinct absolute value) for all n. They
give a construction of full rate circulant MHMs for all n = 4, and prove that no full
rate circulant MHM is possible if n = 4.
2.3 Generalised Hadamard matrices
A GHM GH(w, v/w)
1
over a group N of order w, where w|v, is a v v matrix H
with entries from N such that in the integral group ring ZN,
HH

= vI
v
+v/w
_

uN
u
_
(J
v
I
v
) . (1)
Here M

is the transpose of the matrix of inverse elements of M, also called

the transinverse or conjugate, that is, M

= (M
(1)
)

= (M

)
(1)
, where [m
ij
]
(1)
=
[(m
ij
)
1
].
Equivalently, H is a GHM over N if and only if HH

= vI
v
over the quotient ring
ZN/

uN
u. The only if direction is immediate. The converse follows from the
fact that for distinct rows i, j of H,

v
k=1
h
ik
(h
jk
)
1
is a sum of elements of N, so if it is
of the form g(

uN
u) for some g ZN then g can be replaced by a positive integer
with no loss of generality. A counting argument shows this integer is the constant
v/w.
The number of equivalence classes of GHMs of order 16 has only recently been
determined.
Example 3 (Gibbons and Mathon [32, Table V]) The numbers of inequivalent
GH(2
i
, 2
4i
) of order 16 up to duality (and, including duals) over all N.
N i = 1 i = 2 i = 3 i = 4
Z
i
2
4(5) 130(226) 53(86) 18(32)
Z
4
13(13)
D
8
1(1)
Total 4(5) 143(239) 54(87) 18(32)
Case i = 1 is all HMs of order 16. Case i = 4 is all GH(16, 1), which exist only over
the elementary abelian group Z
4
2
. Up to duality, the corresponding divisible designs
can be extended to 10 of the 13 known projective planes of order 16.
2.3.1 The transpose of a GHM: RP 16
RP 16 [34, p. 72] asks if we can find a GHM (necessarily over a nonabelian group N)
whose transpose is not a GHM, or prove that no such matrix exists. This turns out
to be very easy: the answer was known much earlier to Craigen and de Launey, and
possibly others. In [17] they show every GHM with entries in a nonabelian group
1
Also denoted GH(v, N), or GH(v, m) when N is a group of m
th
roots of unity.
134 Cryptogr. Commun. (2010) 2:129154
N has either a transpose which is not a GHM or its transpose is a GHM but it is
equivalent (by left multiplication on a single row) to a GHM whose transpose is
not a GHM. They describe small examples of group developed GH(8, 8) over the
dihedrals D
8
or quaternions Q
8
to show the result is not vacuous. The GH(8, 2) over
D
8
of Example 1 will also suffice.
Craigen and de Launey propose the following revision of the problem.
Research Problem 16

Is every GHM equivalent to one whose transpose is also a

GHM?
2.3.2 The matrix of inverses of a GHM
A variant of their solution to RP 16 may be applied to the corresponding question
about H
(1)
. When N is abelian, transposing both sides of (1) gives
H
(1)
_
H
(1)
_

= vI
v
+v/w
_

uN
u
_
(J
v
I
v
) ,
so that H
(1)
is a GHM whenever H is. For nonabelian N this is not the case, so
Lemma 4.10.1 of [34] (which states that it is true for all N) is incorrect.
Lemma 4 (Craigen and de Launey [18]) For every GHM H with entries in a non-
abelian group N, either H
(1)
is not a GHM or H
(1)
is a GHM but H is equivalent
(by right multiplication on a single column) to a GHM K for which K
(1)
is not a
GHM.
Proof Let x, y be elements of N that do not commute, so x
1
yx = y. Let H be a
GHM over N such that H
(1)
is also a GHM and let (h
1
il
)
1lv
and (h
1
jl
)
1lv
be
distinct rows of H
(1)
. Then

v
l=1
(h
il
)
1
h
jl
has every element of N as a term v/w
times. In particular, there is a term equal to y. Without loss of generality, we can
assume this term is the first one, i.e. h
1
i1
h
j1
= y.
Let K be the matrix obtained by postmultiplying the entries of the first column
of H by x, so K is a GHM equivalent to H. Thus in K
(1)
(K
(1)
)

,

v
l=1
(k
il
)
1
k
jl
=
(x
1
yx) +

v
l=2
(h
il
)
1
h
jl
.
Therefore y does not appear as a term in this entry of K
(1)
(K
(1)
)

the same
number of times as the other elements of N, and K
(1)
is not a GHM.
2.3.3 The transinverse of a GHM
In [17] Craigen and de Launey state that a v v matrix H over N is a GHM if and
only if H

is a GHM. As this is a basic result, of which I was unaware, details of their

proof are provided for the readers convenience. They use the following elementary
result.
Lemma 5 Let A be an m-dimensional unital algebra, with identity e, over the f ield F.
If a A and ab = e then b is a two-sided inverse of a.
Cryptogr. Commun. (2010) 2:129154 135
Proof The set {e, a, a
2
, . . . , a
m
} is linearly dependent over F, so a satisfies some
nonzero polynomial f (x) with coefficients in F of minimal degree d (no greater
than m). We can write f (x) = ce + g(x)x, where g(x) = c
1
e +

d
i=2
c
i
x
i
and c, c
i
F.
If f (0) = 0 then a is a (right) zero-divisor (by minimality of the degree of f (x)),
which contradicts ab = e. So ce = 0 A, ce = g(a)a = a(g(a)) and g(a)ab =
cb = g(a). It follows that b = c
1
g(a) and ba = e.
Theorem 6 (Craigen and de Launey [17, 18]) Let H be a v v matrix over N. Then
H is a GHM if and only if H

is a GHM.
Proof The group algebra QN is a w-dimensional Q-algebra and therefore the
quotient ring R = QN/

uN
u is a (w 1)-dimensional Q-algebra. The ring A of
all v v matrices over R is a (w 1)v
2
-dimensional Q-algebra (with identity I
v
).
Let H be a GHM. By the remarks following (1),
1
v
H

is a right inverse of H
in A. By Lemma 5 it is a two-sided inverse. Since H

H = vI
v
mod R, the argument
following (1) applies, and H

H = vI
v
mod ZN/

uN
u as required.
2.3.4 Generalised Butson HMs: RP 21
The results above for GHMs have implications for Generalised Butson Hadamard
Matrices (GBHMs). These are defined [34, Denition 4.35] to be v v matrices M
over N, where N is a subgroup of the group of units R

of a ring R with unity 1

and characteristic not dividing v, which satisfy MM

= M

M = vI
v
, where M

is the
transinverse of M.
RP 21 [34, p. 85] asks, for a ring Rwith unity 1, group of units R

and characteristic
not dividing v, if there is a v v matrix M with entries from a subgroup N R

such
that MM

= vI
v
, must it follow that M

M = vI
v
?
We note that if R is a k-dimensional S-algebra for some commutative ring S
with unity, and v is invertible in S, then v
1
M

is a right inverse of M in the kv

2
-
dimensional unital S-algebra A of v v matrices over R. The proof of Lemma 5
carries through to show there exists c S such that c1 = 0 R and M(cM

) =
(cM

)M = v(cI
v
). Consequently we have a positive answer to RP 21 in a sufficiently
general case to consider it effectively solved.
Corollary 7 Suppose MM

= vI
v
as in RP 21. If R is a k-dimensional S-algebra for
some commutative ring S with unity, and v is invertible in S, there exists c S such
that c1 = 0 R and cM

M = v(cI
v
). If c1 is not a zero divisor in R then M

M = vI
v
.
The corresponding questions for the transpose and the matrix of inverses of M are
solved in the negative in the same way as RP 16 and Lemma 4, respectively.
We need only show there exist matrices M with entries from a nonabelian
subgroup N R

such that MM

= vI
v
. For instance, for D
8
= a, b : a
4
= b
2
=
e, ba = a
3
b, set R = ZD
8
/P, where P is the two-sided ideal P = 1a
2
+1e. The
subset N = {1e + P, 1a + P, 1b + P, 1ab + P} in R is an isomorphic copy of
D
8
and

uN
u = 0 in R. Let H be a GH(8, 8) over D
8
, so by Theorem 6, so is H

.
Let M be the image of H under this isomorphism, so by (1), M is both a GHM and a
GBHM.
136 Cryptogr. Commun. (2010) 2:129154
Then M is equivalent to a matrix K which satisfies KK

= 8I
8
but whose
transpose and matrix of inverses do not satisfy this equation (in both cases because a
single term in

uN
u is varied so the sum cannot equal 0).
2.3.5 Butson matrices and codes
Over the past few years a considerable volume of work dealing with signals over
non-binary alphabets has been published in the engineering literature. Some of it,
mentioned only briefly here, derives from application or modification of Butson
matrices. These Butson matrices are also GBHMs, with R = C and N C

, the
group of the complex unit circle.
In [42], McGuire and Ward provide a general construction of Butson matrices
from finite Frobenius rings, which generalises those of Pinnawala and Rao cited in
[34, Section 9.1.4.2], though it does not produce any new equivalence classes.
Theorem 8 [42, Theorem 13] Let A be a f inite Frobenius ring with generating
character and let B be a nondegenerate pairing of a f inite left A-module L and a
f inite right A-module R. Then H(B) = [(B(x, y))]
LR
is a Butson matrix equivalent
to the Fourier Transform matrix F
C
, where C = (R, +). Two such matrices (possibly
from dif ferent rings) are equivalent if and only if the additive groups of the right
modules are isomorphic.
They then obtain codes meeting the Plotkin bound from the rows of the Butson
matrix in the usual fashion [42, Theorem 14]. They observe that if a two-sided
module is used, (B(x, y)) is a cocycle (see (2) below) and so is ( f (x)(y)) for any
additive isomorphism f : R Hom
A
(R, A). Then the resulting matrices and codes
are cocyclic.
Stepanov has written a sequence of papers, starting with the Fourier Transform
matrix F
n
for each of n = 3, 4, 6, and finding a suitable smaller k l matrix with
entries from the same group of roots of unity with which to repeatedly tensor it. He
then analyses the error-correcting and decoding performance of codes derived from
the rows of the iterated tensor products (which are not GHMs). See for instance [50].
Rifa and co-authors [8, 49] have also been working on the ranks, kernels and
intersection numbers of what they call Z
2
Z
4
-additive Hadamard codes, which are the
additive dual codes of the Z
2
Z
4
-additive extended perfect codes (see for example
[8, 49]). These include the quaternary or Z
4
-additive Hadamard codes (cf. [34,
Chapter 4.4.3]).
I misinterpreted earlier work by M. H. Lee and co-authors, and in [34, Section
4.5.1] I called a normalised GBHM a jacket matrix if it was permutation equivalent
to a GBHM with last row and column each consisting of 1. Those authors now
describe a jacket matrix loosely as an n n matrix J with entries from an unspecified
set of (necessarily invertible) elements, such that J
1
=
1
c
J

for some (invertible)

constant c. The particular jacket matrices they introduce and prove to be cocyclic are
already known. They are (tensor products of) Fourier Transform matrices F
C
over
abelian groups C (cf. [34, Example 6.2.5]).
To avoid confusion, in future I will use the termbordered GBHMs for the matrices
defined in [34, Section 4.5.1].
Cryptogr. Commun. (2010) 2:129154 137
2.4 Higher dimensional Hadamard matrices
A proper HDHM of order v and dimension n is an n-coordinate v v v array
A = [a(i
1
, . . . , i
n
)] of 1s such that every (two-dimensional) v v submatrix is a HM.
The study of proper HDHMs, more general HDHMs, their properties and their
applications, remains seriously under-developed. However, there has been more
interest recently. The second edition of Yangs specialist text [52] has just appeared,
while Adams et al. [1] have constructed higher dimensional MHMs from MHMs (see
Section 2.2.2).
2.4.1 Equivalence of HDHMs: RP 30
The original definition of equivalence of HDHMs, due to Ma [41], mimics the
definition of equivalence of HMs by allowing negation of hyperplanes (subarrays
of dimension n 1) and swapping pairs of parallel hyperplanes.
RP 30 [34, p. 100] is to determine the number of equivalence classes of proper
n-dimensional Hadamard matrices of order 2.
de Launey and Stafford [26] have revisited and coarsened Mas definition of equiv-
alence of HDHMs. Call their definition DS equivalence, for ease of reference. They
allowMas operations, and also allowswapping pairs of indexes. In the 2-dimensional
case this would correspond to allowing H H

, which is unconventional. It would

also cause problems with the definition of equivalence for error-correcting codes,
which fits naturally with the standard definition of equivalence of HMs (and of
GHMs for non-binary codes). For example, the binary codes derived from the two
order 16 inequivalent transpose HMs have kernels with different dimensions (see
Section 2.2.1).
However, using DS equivalence, they solve RP 30. They show there is only 1 DS
equivalence class. All proper n-dimensional Hadamard matrices of order 2 are DS-
equivalent to the matrix obtained by applying the construction
a(i
1
, . . . , i
n
) =

1j<kn
h
_
i
j
, i
k
_
(the Product Construction) to H = [h(i
1
, i
2
)] for H the Sylvester HM of order 2.
They then prove this result does not extend above order 2. They show there is
a constant c > 1 such that any Hadamard matrix H of order v > 2 gives rise via
the Product Construction to c
v
inequivalent proper three-dimensional Hadamard
matrices of order v. For v = 4, they exhibit three pairwise inequivalent families of
Product Construction matrices, one for each of three distinct H equivalent to the
Sylvester HM of order 4. This corrects Ma [41, Corollary 4.4] (quoted as Corollary
5.20 in [34]) which claims the number of equivalence classes is the same as for H, in
any higher dimension.
In spite of these results, a different approach to classifying HDHMs may well be
needed, as there are real problems surfacing with the computational complexity of
the classification of HDHMs by equivalence class, as there is for HMs. de Launey and
Stafford argue that a classification program based on automorphism groups rather
than equivalence classes may provide more insight, and propose a research problem
for HDHMs [26, Research Project 2, p. 38] with this in mind.
138 Cryptogr. Commun. (2010) 2:129154
3 Cocyclic Hadamard matrices
If N is a (left) G-module with G-action given by the homomorphism
2
: G
Aut(N), a cocycle is a map : G G N satisfying
(g, h)(gh, k) = (h, k)
(g)
(g, hk), (2)
for all g, h, k G. We always assume is normalised, ie. (g, 1) = 1 = (1, g). A
coboundary is a cocycle of the form
3
(g, h) = (g)(h)
(g)
(gh)
1
(3)
for some mapping : G N which has (1) = 1. If is trivial it is usually sup-
pressed. If N

= {1}, is necessarily trivial.
If C is a trivial G-module, the cocycles form a finite abelian group Z
2
(G, C) under
pointwise multiplication, and the coboundaries form a subgroup B
2
(G, C). The
quotient group H
2
(G, C) = Z
2
(G, C)/B
2
(G, C) is the second cohomology group.
If C is a trivial G-module, a v v matrix M with entries in C is a G-cocyclic matrix
over C if there is a cocycle : G G C and an ordering G = {1 = g
1
, g
2
, . . . , g
v
}
such that M is Hadamard equivalent to the matrix
M

=
_
(g
i
, g
j
)
_
1i, jv
. (4)
If C is a trivial G-module, a G-cocyclic GHM over C is any matrix M for which
there exists a cocycle Z
2
(G, C) such that M

in (4) is a GHM. This happens if

and only if, for each g = 1, M

is uniformly distributed over C on each row:

|h G : (g, h) = u| = v/w, u C. (5)
In this case, is termed orthogonal. When C = {1} and is orthogonal, any such
M is a cocyclic Hadamard matrix (CHM).
There are more complicated definitions for cocycles over arbitrary left modules N
and for the more general factor pairs. See [34] for details.
In this most general case the corresponding matrices are called coupled G-
cocyclic. As a consequence of Lemma 4 it is still not known if the transpose of a
coupled G-cocyclic GHM over a nonabelian group N is itself a GHM, since the
argument given in Lemma 7.26.2 of [34] to show this, is incorrect.
3.1 Cocyclic HMs and GHMs
Theoretical progress on the Cocyclic Hadamard Conjecture (RP 38) has been
discussed in Section 2.1.2.
From the computational point of view the existence question for cocyclic GHMs
has two parts. The first is whether a cocyclic GHM exists in a particular order (and,
if so, indexed by which groups G of that order); and the second is, if a cocyclic GHM
2
The opposite multiplication in Aut(N) is needed:
1

2
=
1

2
.
3
The formula in [34, Def. 6.2] is (g, h) = (g)
1
((h)
(g)
)
1
(gh); that is, the coboundary (
1
)
according to (3). Both definitions of are in use. Each is correct, if applied consistently.
Cryptogr. Commun. (2010) 2:129154 139
exists, how many cocyclic GHMs exist, either in total or up to Hadamard equiva-
lence class or some other classification, such as by index group or automorphism
group.
One approach to these questions is to begin with a cocycle and decide if the
resulting matrix (4) is Hadamard. For this we need to know how to compute cocycles.
3.1.1 Computation of cocycles: RP 33
RP 33 [34, p. 128] fixes a finite group G of order v and asks for more computationally
efficient algorithms for listing a minimal set of generators for its universal coefficient
group. The intention behind the question is to provide, for any finite abelian group C,
a minimal set of generators of the finite abelian group Z
2
(G, C) of cocycles over G
with coefficients in C and trivial action, or else algorithms for listing such a set which
permit computation in higher order groups, or have lower computational complexity,
than the three algorithms described in [34, 6.3].
In practice, researchers have reversed the rles of the groups involved. They have
fixed C and studied generators of Z
2
(G, C) for families of groups G. Therefore it
makes sense at this point to revise RP 33.
Research Problem 33

Let C be a family of finite abelian groups and G a family

of finite groups. Determine a minimal set of generators for the group of cocycles
Z
2
(G, C), for C C, G G, or else find algorithms for listing such a set which permit
computation in higher order groups, or have lower computational complexity, than
the three algorithms described in [34, 6.3].
Good progress has been made on RP 33

when C = {Z
n
p
}, the family of elementary
abelian groups. As we see next, the cases C = G {Z
n
2
} and C = Z
2
, G {D
4t
, Z
2
2

Z
t
} have been solved.
When G = {Z
n
p
}, Farmer [30, Theorems 3.1, 3.2] has recently identified a basis
of two-variable polynomials over GF( p
n
) for the subgroup B
2
(Z
n
p
, Z
n
p
) of cobound-
aries, and a recursive derivation in terms of that for B
2
(Z
n1
p
, Z
n1
p
).
We give the coboundary recursion for p = 2. This means the case G = C {Z
n
2
}
of RP 33

is solved, as we have a complete description of a polynomial basis for the

group of cocycles Z
2
(Z
n
2
, Z
n
2
) [30, Theorem 4.5].
Theorem 9 [30, Theorem 3.4] Let w
2
(k) denote the binary weight of k. For n > 1
and 2
n1
< k < 2
n
, the coboundaries c
k
= c
k
(x, y) over Z
n
2
can be def ined recursively:
c
k
=

_
x
k2
n1
+c
k2
n1
_
y
2
n1
+ x
2
n1
_
y
k2
n1
+c
k2
n1
_
, w
2
(k) 3
x
2
r
y
2
n1
+ x
2
n1
y
2
r
, k = 2
n1
+2
r
, r = 0, . . . , n 2.
The second cohomology group H
2
(G, C) = Z
2
(G, C)/B
2
(G, C) has been more
studied in other application areas than has the group of cocycles Z
2
(G, C). To take
advantage of this, RP 33

can be split into two parts: computation of a full set of

representatives of H
2
(G, C), and computation of a minimal set of generators of
B
2
(G, C).
The Sevilla Group (Alvarez, Armario, Frau, Gudiel, Guemes, Osuna, Martin,
Real) have concentrated on C = {1}

= Z
2
.
140 Cryptogr. Commun. (2010) 2:129154
Alvarez et al. [4] have proved for groups G of small orders, that their homological
reduction technique (Algorithm 3 in Chapter 6.3 of [34]), implemented in Mathe-
matica, computes a full set of representatives of H
2
(G, Z
2
) faster than the Flannery-
OBrien module in Magma does (Algorithm 2 in Chapter 6.3 of [34]).
To find a minimal set of generators of B
2
(G, Z
2
), they use the v 1 normalised
delta functions
i
: G = {g
1
= 1, g
2
, . . . , g
v
} {1}, where
i
(g
j
) = (1)

ij
, i =
2, . . . , v, which generate the group of normalised functions from G to {1}. The cor-
responding coboundaries
i
(g, h) =
i
(g)
i
(h)
i
(gh)
1
, which can then be computed
from the group multiplication in G, form a generating set of size v 1 for B
2
(G, Z
2
).
After writing each coboundary as a length v
2
row vector, row reduction of these v 1
rows gives a minimal set of generators [4, Lemma 1].
This means the cases G {D
4t
} and G {Z
2
2
Z
t
} (amongst others) are solved,
as in both cases they can find a minimal set of v 3 generators of B
2
(G, Z
2
) and 3
representatives of H
2
(G, Z
2
) efficiently [3, 4].
3.1.2 Computational search for CHMs: RPs 2(a), 6 and 38
From their minimal generating set for B
2
(G, Z
2
), the Sevilla Group derive a basis
of coboundary matrices. They have concentrated on the families {D
4t
, t odd} of
dihedral groups, from which the Ito CHMs arise (RP 6, [34, p. 24]), and {Z
2
2

Z
t
, t odd}, from which the Williamson CHMs arise (RP 2(a), [34, p. 16]).
Their approach is to analyse the distribution of 1s in these basis matrices
compared with those in the fixed inflation and transgression matrices, to provide
formal reductions of the number of basis elements which can contribute to a CHM.
This then cuts down the search space for CHMs, in some cases quite dramatically.
This allows them to design better search algorithms such as guided reproduction
genetic algorithms [5], and to isolate centrally distributed subtypes of coboundaries
[2] with higher likelihood (experimentally confirmed) of forming CHMs, and thus
of providing experimental evidence supporting the Cocyclic Hadamard Conjecture
(RP 38).
3.1.3 Non-cocyclic constructions of HMs: RPs 39,40,41,42 and 43
RPs 39, 40, 41 and 42 [34, Chapter 6.5.1] each ask if a specific construction technique
which gives HMs is cocyclic. We discuss them in turn, below. Cathin [43] has
partial solutions to RPs 4042, and, with Stafford [45], has solved RP 39. He takes
the automorphism group approach to finding CHMs, championed by de Launey,
which is a consequence of a relationship between each CHM and a regular group
action on its associated design (part of the Five-fold Constellation of Subsection 3.2
following). Given a construction of a HM, he enumerates and analyses the subgroups
of its automorphism group which act regularly on an associated design and contain
a specified central involution. This is sufficient to determine whether the HM is
cocyclic.
Because the automorphism group of a HM is the same as that of its transpose
as well as of any equivalent matrix, this characterises cocyclicity, up to transpose
equivalence. Note that if the cocyclic matrix M

in (4) is a HM then its transpose

(M

is a HM which is Hadamard equivalent to the CHM M

where

is the dual
of . The transpose of a CHM found this way can then be checked for Hadamard
inequivalence.
Cryptogr. Commun. (2010) 2:129154 141
Cathin distinguishes between constructions of Hadamard matrices that always
produce cocyclic matrices, those which produce a mixture of cocyclic and non-
cocyclic matrices and those which never produce cocyclic matrices, which he refers
to as strongly cocyclic, weakly cocyclic, and non-cocyclic, respectively.
RP 39 asks if the twin prime power difference set construction of HMs (which is
cocyclic in order 16) is cocyclic for higher orders. Cathin shows in [43] it is non-
cocyclic for all 9 higher orders < 1000, and remarks that this is surprising, as the
Paley constructions, which use single prime powers in a similar fashion, are strongly
cocyclic. He and Stafford [45] have just succeeded in proving the twin prime power
construction is non-cocyclic in all orders > 16.
RP 40 asks if the Goethals-Seidel construction of HMs is cocyclic, and in [43]
Cathin shows it is not cocyclic in order 28, and in a partial search of orders 36,
44 and 52 none of the Goethals-Seidel HMs he found were cocyclic. He concludes
that the Goethals-Seidel construction is at best weakly cocyclic and conjectures it is
non-cocyclic.
For RP 41, he shows the Kimura construction of HMs, when generated from
dihedral groups of small order, gives no cocyclic HMs, so this construction is at best
weakly cocyclic. He conjectures it is non-cocyclic..
By way of contrast, for RP 42, Cathin finds the twin circulant cores con-
struction of HMs has the weak cocyclic property for all the orders (24 to 40) he
investigated.
RP 43 (also in [34, Chapter 6.5.1]) asks if there are CHMs in each equivalence
class of HMs of order > 20, and if not, what proportion of the equivalence classes are
cocyclic. Cathin [43, 44] has shown that the answer to the first part is no, for orders
24, 28, 32 and 36. He classifies all CHMs of order at most 36. His computational
evidence is that 20 is probably the highest order for which each equivalence class
of HMs contains a CHM, and as the order increases, the proportion of equivalence
classes containing a CHM drops dramatically. The following table appears in [44]. In
it, column 2 gives the number of equivalence classes of CHMs (where appropriate as
a fraction of the number of equivalence classes of HMs of that order). Column 3 gives
the number of isomorphism types of index groups G of CHMs (where appropriate
as a fraction of the number of isomorphism types of that order) and column 4 gives
the number of isomorphism types E appearing in extensions Z
2

E

G (where
appropriate as a fraction of the number of isomorphism types of extensions of Z
2
by
groups G of that order).
Equivalence classes of CHMs [44]
Order Cocyclic Index groups Extension groups
2 1 1 2
4 1 2 3/5
8 1 3/5 9/14
12 1 3/5 3/15
16 5 13/14 45/51
20 3 2/5 3/14
24 16/60 8/15 14/52
28 6/487 2/4 2/13
32 100/> 3 10
6
49/51 261/267
36 35/> 18 10
6
12/14 21/50
142 Cryptogr. Commun. (2010) 2:129154
Cathins results confirm the approach of the Sevilla Group: that to find CHMs
it is more productive to focus on those index groups G {D
4t
} and G {Z
2
2
Z
t
}
which are represented in all small orders.
3.1.4 Tensor products and orthogonality: RP 44
The tensor product cocycle is defined for two cocycles with trivial action from the
Kronecker product of their respective cocyclic matrices, by using (4). A decade
ago Hughes, Perera and the author (see [34, Theorem 6.9]) showed that this tensor
product cocycle is orthogonal if and only if the factors are orthogonal. However no
tensor product construction of more general cocycles which preserved this result had
been found.
RP 44 [34, p. 151] is to extend the tensor product construction to cocycles with
nontrivial action, or to the more general factor pairs in such a way as to preserve this
result.
Galati [31] had found a particular solution: a skew tensor square of a factor pair
over an abelian group with itself, which is orthogonal if and only if the factor pair is
orthogonal.
In 2008 Chen [14] found a generalisation of the tensor product (for cocycles with
trivial action) which also has the necessary property and may be extensible.
Definition 10 Let G
i
, i = 1, 2 be finite groups and C a finite abelian group. Let
i

Z
2
(G
i
, C), i = 1, 2. Let b : G
1
G
2
C be a homomorphism in each coordinate.
The twisted Kronecker product
1

b

2
: (G
1
G
2
) (G
1
G
2
) C of
1
and

2
twisted by b is

1

b

2
((h
1
, k
1
) , (h
2
, k
2
)) =
1
(h
1
, h
2
) b(h
2
, k
1
)
2
(k
1
, k
2
) .
When b is the trivial map the construction is the tensor product
1

2
and when
G
1
= G
2
is abelian,
1
=
2
and b =
1
(

1
)
1
the construction is Galatis skew
tensor square
1

1
.
Theorem 11 [14, Theorem 3.2] The twisted Kronecker product cocycle
1

b

2
is
orthogonal if and only if both cocycles
1
,
2
are orthogonal.
3.1.5 Orthogonality and multiplicative cocycles: RP 73
A cocycle which is a homomorphism in either (and hence the other) coordinate is
termed multiplicative. If a multiplicative cocycle is orthogonal, then C and G are
both elementary abelian p-groups for the same prime p. For p = 2, LeBel (see [34,
9.3.1.1]) showed that all orthogonal cocycles in Z
2
(Z
t
2
, Z
n
2
) are multiplicative for 2
n t 3, and claimed to show the same for t = 4. This was the basis of RP 73, which
asks, for 2 n t < , if all orthogonal cocycles in Z
2
(Z
t
2
, Z
n
2
) are multiplicative.
Dillon [27] has since informed me that he has found examples computationally
which contradict LeBels argument for the case n < t = 4, but he has also established
computationally that the claim is correct for n = t = 4. That is, for p = 2 and 2 n =
t 4, there are no non-multiplicative orthogonal cocycles.
More generally, Dillon has solved RP 73 in the negative as follows. Let t = 2n,
let K = GF(2
n
) and let L = K[] be a quadratic extension of K. Let be a
Cryptogr. Commun. (2010) 2:129154 143
normalised permutation of K and consider the coboundary defined by the function
f : L K, f (x + y) = (x)y. The mapping Tr(b (x)y) : L Z
2
is bent for any
b = 0 K and any . Therefore (see [34, 9.2.2], for instance) f is vectorial bent (i.e.
Perfect Nonlinear) and f is orthogonal. By setting to be a suitable non-quadratic
permutation, such as the inversion function (x) = x
2
n
2
for any n > 2, we get a non-
multiplicative orthogonal coboundary.
Therefore it makes sense at this point to revise RP 73.
Research Problem 73

Are all orthogonal cocycles in Z

2
(Z
n
2
, Z
n
2
) multiplicative, for
all n 2?
3.2 The Five-fold Constellation
For finite groups G and N there are always 3 correspondences, between an extension
N

E

G of N by G, a factor pair (, ) of N by G (that is, a two-variable
function : G G N and an action of G on N by automorphisms, satisfying
additional conditions), and a transversal {t
g
: g G} of the normal subgroup (N)
in E with respect to (that is, a complete set of coset representatives of (N) in E
satisfying (t
g
) = g, g G). If N is abelian, the factor pair is a cocycle as in (2). Full
details appear in [34, Chapter 7].
A factor pair is constructed from a transversal as follows.
If N

E

G is an extension of N by G and T = {t
x
: x G} is a transversal of
(N) in E with respect to , then (
T
,
T
) defined by

T
(x) =
1
t
x
, (6)

T
(x, y) =
1
_
t
x
t
y
t
1
xy
_
, (7)
for all x, y G, is a factor pair of N by G.
Of particular interest are extensions N

E

G satisfying an additional combi-
natorial property: that a transversal of (N) in E with respect to is a semiregular
relative difference set in E relative to (N) (which requires |N| to divide |G|). A
relative difference set ((v, w, k, )-RDS) in a finite group E of order vw relative to a
normal subgroup K of order w, is a k-element subset R = {r
1
, . . . , r
k
} of E such that
the sequence of quotients
r
i
r
1
j
, r
i
, r
j
R, i = j (8)
lists each element of E\K exactly times and lists no element from K. The subgroup
K is called the forbidden subgroup. An RDS R is normalised if R contains the
identity of E, central if K lies in the centre (E) of E and semiregular when k = v.
In this case there are mutual equivalences [34, Theorems 7.29, 7.40] between
five objects, which we call the Five-fold Constellation and visualise as a complete
graph on 5 vertices. Suppressing the inner pentagram for simplicity, these vertices
are pictured in Fig. 1 [34, Fig. 7.1]. They represent:
1. a coupled G-cocyclic GHM over N
2. an orthogonal factor pair of N by G
3. a semiregular RDS in E relative to (N)
144 Cryptogr. Commun. (2010) 2:129154
Fig. 1 The Five-fold
Constellation
1
2
3
4
5
bs
b
cs
c
ns
n
4. a semiregular divisible design with regular group E and class regular normal
subgroup (N)
5. a base sequence (a generalised form of Perfect Nonlinear function) : G N.
The outer pentagon (labelled n, for N normal in E) is the most general case. The
inner pentagons represent the case N is (c) central in E and N is (b) binary (

= Z
2
).
The shadow pentagons (dashed lines labelled s, for splitting) refer to the special case
that the extension is split, that is, E is a semidirect product N

G.
3.2.1 Orthogonal cocycles and relative dif ference sets
As a consequence of the equivalences we have in the Constellation, many new
existence and construction techniques for these objects have been found. We list just
a few which result from the work in earlier sections.
1. de Launey [22] notes that his first density theorem (Theorem 1) for cocyclic
Hadamard matrices is an asymptotic existence result for central (4t, 2, 4t, 2t)-
RDSs.
2. Chen rewrites his factorisation theorem (Theorem 11) using the Constellation
[14, Theorem 1.2].
Let N be central in E; let G
1
, G
2
be subgroups of E such that G
1
, G
2
=
E, [G
1
, G
2
] N and G
1
G
2
= N; and let R
i
be a transversal of N in G
i
, i =
1, 2.
Then R
1
R
2
is a semiregular RDS in E relative to N if and only if R
i
is a
semiregular RDS in G
i
, i = 1, 2, relative to N.
Cryptogr. Commun. (2010) 2:129154 145
3.2.2 A Six-fold Constellation? RP 91
There need be nothing canonical about having 5 equivalent objects in the Constella-
tion. As Craigen [16] says perhaps we will see several other stars added to those
of the present constellation, which may be merely the most visible points of light in a
larger galaxy.
For instance, there are several ways of relating HMs to graphs, with applications
in statistical mechanics, quantum cryptography and graph complexity.
In particular, it is known (see [9, 1.8]) that a HM of order 4n is equivalent
to a Hadamard graph
4
(that is, a distance-regular graph with intersection array
{4n, 4n 1, 2n, 1; 1, 2n, 4n 1, 4n}; or, equally, an antipodal distance-regular graph
of diameter 4 whose antipodal quotient is complete bipartite).
In [36] I asked how this equivalence could be specialised to CHM. In answer,
Peter Cameron [12] says a HM is a CHM if and only if the equivalent Hadamard
graph admits a group of automorphisms acting regularly on each bipartite block.
In [21] antipodal distance-regular graphs are constructed which are equivalent to
certain GHMs, and the extended Preparata codes are found fromwalks on the graphs
in this family.
This leads me to formalise the following new problem.
Research Problem 91 Generalise the equivalence between a CHMand a Hadamard
graph admitting a group of automorphisms acting regularly on each bipartite block,
to coupled G-cocyclic GHMs over N. Are there natural applications of these graphs
in coding, cryptography or complexity?
4 Bundles: propagating equivalence classes of RDSs
There are natural definitions of equivalence for each type of object in the Constella-
tion which arise from their individual contexts, and they do not all match. For GHMs
it is Hadamard equivalence; for extensions it is equivalence of short exact sequences;
and for cocycles it is cohomology.
It has proved remarkably profitable to study the matching equivalence classes
of each type of object in the Constellation that are found by propagating the
equivalence classes of RDSs around it. A few subtle errors have persisted in this
analysis, so more detailed background and clarification is presented next.
Equivalence for RDSs was originally defined by Pott [48, p. 198]. Observe that
a translate eRd of an RDS R in E relative to K by fixed elements e, d of E is an
RDS relative to K with the same parameters, and in fact we need only consider one-
sided translation. Similarly, an automorphism of E takes a normal subgroup K
of E to (K) and an RDS R in E relative to K to an RDS (R) relative to the
normal subgroup (K), with the same parameters. Moreover, (R) cannot be an
RDS relative to any other normal subgroup K

= (K) since if k

\ (K) then
k

E \ (K) and so is a difference of elements in (R) times.

4
A different definition of Hadamard graph (due to Ito [39]) is the graph with vertex set V
4n
= {0, 1}
4n
and edge set E
4n
= {(u, v) V
2
4n
| d
H
(u, v) = 2n}, where d
H
(u, v) is the Hamming distance between
u and v.
146 Cryptogr. Commun. (2010) 2:129154
Though [48] does not state explicitly that the forbidden subgroup for (R) is (K),
this condition is necessary to the definition of equivalence of RDSs. That is, if R, R

are RDSs relative to normal subgroups K, K

in E, respectively, R R

Aut(E), e E : (K) = K

and (R) = e R

.
Given any normal subgroup K in E, there is an extension K E

E/K,
where is the natural quotient map. Any Aut(E) which maps K to K

also
defines the commuting isomorphism : E/K E/K

with (dK) = (d)K

, d E,
which ensures the natural extensions K E

E/K and K

E/K

are
equivalent.
A normalised semiregular RDS R relative to K is a normalised transversal of K in
E relative to , with (r) = rK, r R. Although not all such transversals are RDSs,
we apply the same conditions to define equivalence of normalised transversals.
Definition 12 [34, Def. 8.1] Let T, T

be normalised transversals of the isomorphic

normal subgroups K, K

, respectively, in E. Define T and T

to be equivalent, written
T T

, if there exist Aut(E) and e E such that (K) = K

and (T) = e T

.
For transversals as well as RDSs, it is sufficient to consider left-sided translation
only, since Td = d d
1
(T), where d
1
is the inner automorphism d
1
(e) = d
1
ed of
E. If N

= K

= K

and G

= E/K

= E/K

, consider the commuting diagram

N

K

E

G

_
N

G
(9)
to see that Aut(E) induces Aut(N) and Aut(G), where

= and

= .
Equivalence between the transversals T, T

defines an equivalence relation be-

tween the corresponding factor pairs (
T
,
T
), (
T

,
T

) of N by G, constructed using
(6) and (7). The equivalence classes of factor pairs are called bundles and the bundle
containing (, ) is denoted B((, )) (or B() when is trivial).
4.1 Bundles and equivalence classes of RDSs
When N is abelian, a great deal of progress has been made using the reverse equiva-
lence between bundles of cocycles and equivalence classes of semiregular RDSs. The
reader should keep in mind that bundles are not the same as cohomology classes;
indeed, the partitions of the group of cocycles induced by transversal equivalence
and by cohomology cut across each other. Cohomology classes, being cosets, all have
the same cardinality, but this is not in general true of bundles.
Cryptogr. Commun. (2010) 2:129154 147
When further, 1, so N = C is central in the extension group E, the bundle
B() = B((, 1)) of Z
2
(G, C) is
B() = { ( s) ( ) : Aut(C), Aut(G), s G},
where s(x, y) = (s, y)
1
(sx, y) is the shift action of s on (which effects
multiplication by e in Definition 12).
RP 50 [34, p. 177] is a general classification program for equivalence classes
of central semiregular RDSs based on identifying the corresponding bundle of
orthogonal cocycles.
One special case occurs when we restrict to the multiplicative cocycles, which
are precisely those for which the shift action is trivial, i.e. s = , s G. This
property of cocycles is preserved by equivalence and the corresponding transversals
are also termed multiplicative.
If a multiplicative cocycle is orthogonal, then C and G are both elementary abelian
p-groups for the same prime p. So each bundle of orthogonal multiplicative cocy-
cles determines an equivalence class of multiplicative semiregular RDSs, and vice
versa.
Multiplicative RDSs and presemif ields: RP 50, RP 53, RP 74 and RP 75 When C =
G = Z
n
p
, every orthogonal multiplicative cocycle on Z
n
p
is a multiplication function on
a presemifield of order p
n
with underlying abelian group

= Z
n
p
, and vice versa. Each
equivalence class of multiplicative central ( p
n
, p
n
, p
n
, 1)-RDSs relative to Z
n
p
in E
with E/Z
n
p

= Z
n
p
corresponds exactly to a strong isotopism class of presemifields of
order p
n
.
RP 53 [34, p. 181] asks if the number of equivalence classes of central ( p
n
, p
n
,
p
n
, 1)-RDS, when C = G = Z
n
p
, is always a power of p. RP 53 is true for n = 1: there
is only one isotopism class of presemifields (of GF( p)), containing p
0
= 1 bundle;
and RP 53 is supported by computational evidence for p
n
< 16.
RP 74 [34, p. 219] asks for the number of bundles when n = 2, and if it is always at
least p. When n = 2 the only presemifield isotopism class is again that of GF( p
2
).
Horadam and Farmer [38] solve RP 74 and prove that RP 53 is true for n = 2.
There are exactly p bundles (presemifield strong isotopism classes) over GF( p
2
),
only one of which is commutative. Representatives of each class are listed. Further,
in [29] it is shown that there are always at least 3( p 1) bundles over GF( p
3
).
However RP 53 is solved in the negative for p = 2. In [37] Horadam and Farmer
also show there are 1446 equivalence classes of central (16, 16, 16, 1)-RDSs relative
to Z
4
2
; this is not a power of 2. Even if RP 53 is restricted to isotopism classes of fields,
the number of RDS equivalence classes is not a power of 2, as even though there are
1, 2, 4, 32 bundles over GF(2), GF(4), GF(8), GF(16), respectively, there are 2094
bundles over GF(32).
RP 75 [34, p. 221] asks for the number of bundles in the presemifield isotopism
class of each of the non-commutative semifields V and W of order 16.
RP 75 is solved in [37], as part of the computation of all bundles over all three
semifields of order 16 (including GF(16)). There are 224 bundles in the presemifield
isotopism class of semifield W and 1190 in that of semifield V. Representative
presemifield multiplications are computed for each bundle.
148 Cryptogr. Commun. (2010) 2:129154
RP 50 is solved for the taxonomic class 16, 16, Z
4
2
, E, Z
4
2
, i, j with i =
GF(16), W, V and for each i, the representative 32, 224, 1190 presemifield multi-
plications, respectively.
4.2 Bundles in the splitting case
In [33] I initiated a study of splitting factor pairs. In the case of most interest to us, a
splitting factor pair has the form (, ) for some in the set C
1
(G, N) of normalised
functions G N, i.e. (1) = 1. Here
(x, y) = (x)(y)(xy)
1
, x, y G, (10)
which measures how much differs from a homomorphism, while : G Aut(N)
is the G-action induced by on N by inner automorphisms:
(x)(a) = a
(x)
= (x)a(x)
1
, a N, x G, (11)
so if N is abelian, the action is trivial and we have the case = 1 of (3).
Then two functions , C
1
(G, N) are (bundle) equivalent, written
b
, if
their corresponding splitting factor pairs are equivalent, i.e.

b
B
__
,
__
= B((, )) . (12)
The equivalence class b() of is also called a bundle.
Correction to [34, 8.2, 9.2.2] A minor error was made in [33] in the fundamental
definition of the bundle of a function, which has been repeated in [34, 37]. The error
matters only if N is nonabelian. We correct it here.
In [33, p. 90] and [34, p.170] it is stated that the group Hom
1
(G, N) of 1-crossed
mappings; that is, the normalised mappings : G N for which the splitting factor
pair (, ) equals the trivial factor pair (1, 1), is Hom(G, N). However, Hom(G, N)
consists of the functions which satisfy equality on the first coordinate only. Equality
on the second coordinate forces : G (N), where (N) is the centre of N.
Therefore Hom
1
(G, N) = Hom(G, (N)).
Hence the formula for the bundle of must be amended.
Definition 13 Let C
1
(G, N). The bundle of is b() =
_
( ( s) ) f : f Hom(G, (N)), Aut(G), Aut(N), s G
_
,
where s(x) = (s)
1
(sx) is the shift action of s on .
In [33, Eq. (21) and Theorem 3.3], [34, Denition 8.18 and Theorem 9.22.3] and
[37, Def. 1], Hom(G, N) must be replaced by Hom(G, (N)).
Un-normalised functions are in the same affine bundle

b( f ) if their normalisations
are in the same bundle; that is, for f, f

: G N,
f
b
f

b( f ) =

b( f

) b( f 1) = b( f

1). (13)
I argue that affine bundles are the most appropriate equivalence classes for functions
between groups.
The first reason for this is the Constellation (Fig. 1): the splitting case s gives
a suite of correspondences between generalised Perfect Nonlinear (PN) functions
Cryptogr. Commun. (2010) 2:129154 149
[34, Theorem 7.35] and four other stars [34, Theorem 7.30]. The second is that sub-
optimal measures of nonlinearity, such as the difference distribution of a function,
are also preserved by bundles. The third is that affine bundle equivalence coarsens
types of function equivalence which have arisen in other contexts: equivalence of
planar functions, affine equivalence of Boolean functions and linear equivalence of
cryptographic functions.
Bundles and EA classes of nonlinear functions: RP 66 In cryptography, we want
to collect functions over GF( p
n
) into equivalence classes which preserve measures
of two types: differential uniformity (a combinatorial and geometric condition) and
nonlinearity (a discrete Fourier spectrum condition). Optimal functions for the
former measure are called PN (Perfect Nonlinear) if p is odd, and APN (Almost
Perfect Nonlinear) if p = 2. When p is odd, PN functions coincide with planar
functions over Z
n
p
.
Two types of measure-preserving equivalence have emerged as most effective
for classifying functions f (x) over GF(2
n
). The first of these is extended affine
(EA) equivalence [10]. The definition generalises immediately to functions over
GF( p
n
), for p any prime. EA equivalence preserves the differential uniformity, the
nonlinearity, the resistance to algebraic cryptanalysis, and the algebraic degree of a
function.
Two functions f, f

: Z
n
p
Z
n
p
are EA equivalent if f

=
1
f
2
+ for some
affine functions
1
,
2
, over Z
n
p
, where
1
,
2
are permutations.
With Farmer, I have shown that over Z
n
2
, EA classes and affine bundles (13)
coincide, and our proof [38, Lemma 1] generalises immediately to odd primes.
Lemma 14 Two functions f, f

: Z
n
p
Z
n
p
are EA-equivalent if and only if

b( f ) =

b( f

).
RP 66 [34, p. 208] asks for new bundles of planar functions (and thus, when G =
N = Z
n
p
, for p odd, for new EA classes of PN functions).
Kyureghyan and Pott [40] list 6 currently known families of EA-inequivalent pla-
nar functions, of which 5 are Dembowski-Ostrom polynomials. If a planar function
on Z
n
p
, p odd, is a Dembowski-Ostrom polynomial, the corresponding coboundaries
are multiplicative, and vice versa, and the classification of EA classes of planar
functions is equivalent to the classification of strong isotopismclasses of commutative
presemifields of order p
n
. Coulter and Henderson [15] have shown this classification
is the same as the classification of isotopism classes of commutative semifields of
order p
n
. We note the 6th (Coulter-Matthews) family is not Dembowski-Ostrom and
does not define semifields.
Zha et al. [53] find a family of new planar functions by generalisation from new
APN functions, thus obtaining the first provably new construction of commutative
semifields in arbitrary odd characteristic. Very recently, Bierbrauer [6, 7] has in-
troduced a large family of functions and a general method which can be used to
prove that parametric subfamilies are PN, and obtains a new construction of planar
functions [7, Theorem 5]. He has informed me that an uncertainty which has surfaced
about interpretation of a result of Menichettis means more detail is needed to
demonstrate the semifields in [6, Theorem 7] are new.
150 Cryptogr. Commun. (2010) 2:129154
4.3 Generalisations of bundles
In this final subsection, we describe two equivalences which are coarser than RDS
and bundle equivalence but which are of independent interest.
4.3.1 Bundles and equivalence classes of (4t, 2, 4t, 2t)-RDS: RP 50
Cathin and Rders results [44] for RP 43 (see Section 3.1.3) have consequences
for the classification of central (4t, 2, 4t, 2t)-RDSs. Such RDSs are equivalent to
CHMs, and by [34, Corollaries 8.12 and 8.13] there is a set surjection from the set
of bundles of central (4t, 2, 4t, 2t)-RDSs to the set of Hadamard equivalence classes
of CHMs.
Their approach to finding all the classes of CHMs is to extend the definition of
equivalence class of RDSs (given at the beginning of Section 4) to allow antiautomor-
phisms (permutations with (xy) = (y)(x)) of E to act as well as automorphisms.
The group AntiAut(E) consisting of the automorphisms and antiautomorphisms
contains Aut(E) as a normal subgroup of index at most 2, and the transpose H

of a CHM H will determine a RDS equivalent under an antiautomorphism to

that determined by H [44, Theorem 9]. They compute all these extended RDS
equivalence classes then check H and H

for Hadamard equivalence, to count all

classes of CHMs. Their counts of extended RDS classes, combined with the number
of inequivalent pairs H, H

should lead to a complete classification of (4t, 2, 4t, 2t)-

RDS classes for t 9.
4.3.2 Bundles and CCZ equivalence classes: RP 92
The second important equivalence for classifying functions for cryptographic value is
Carlet-Charpin-Zinoviev (CCZ) equivalence [13], [10, Denition 1]. The definition
generalises immediately to functions over Z
n
p
, for p any prime. CCZ equivalence
preserves the differential uniformity, the nonlinearity and the resistance to algebraic
cryptanalysis, but not necessarily the algebraic degree of a function.
Two functions f, f

: Z
n
p
Z
n
p
are CCZ equivalent if there exists an automor-
phism : Z
2n
p
Z
2n
p
and an element e Z
2n
p
such that

_
{( f (x), x), x Z
n
p
}
_
= e +{( f

(x), x), x Z
n
p
}. (14)
Kyureghyan and Pott [40] have given a simple proof that each CCZ class of PN
functions over Z
n
p
, p odd, is a single EA class, so the two equivalences coincide in
this particular case.
It is known that EA equivalence implies CCZ equivalence [10, Proposition 3] and
the converse is known not to hold in general. In particular, a permutation over Z
n
2
and its inverse are CCZ equivalent but instances where they are EA-inequivalent are
known. Consequently [33, Corollary 3, p.95] which claim contrary results, repeated
in [34, Corollary 9.23, Theorem 9.24] and [37], are wrong.
It remains very difficult to tell in general when CCZ equivalent functions are EA-
inequivalent. It is known that two CCZ equivalent functions are EA equivalent if
and only if there exists an Aut(Z
2n
p
) of a particularly simple form, but many other
automorphisms not of this form will satisfy (14).
Cryptogr. Commun. (2010) 2:129154 151
The need to make inroads on this problem has become more acute after break-
throughs in the study of APN and PN functions. Until recently, the main focus of
search for such functions was amongst the power functions f (x) = x
d
defined over
GF( p
n
). However, in the past few years there has been a proliferation of discoveries
of new families of APN and PN functions EA-inequivalent to any power functions.
Some of the functions found have very intricate form, so proving EA inequivalence
to known families becomes a very daunting task. Some of the APN functions are also
CCZ-inequivalent to any power functions: recent surveys appear in [11, 40].
We can study the general version of this problem, for arbitrary functions f :
G N. The graph of f is the set S
f
= {( f (x), x), x G} N G. It is normalised
if f (1) = 1. This definition is consistent with the usual definition [10, p. 1143]
provided we switch first and second components. This can be done with no loss of
generality.
We see immediately that the graph S

of a normalised function is a splitting

semiregular RDS relative to N {1} if and only if is PN. We also see that it is a
complete set of coset representatives of N {1} in N G. This additional structure
means we can associate to it at least one transversal in N G. Thus we can use
transversals as a common link between EA and CCZ equivalence.
Definition 15 Two functions , C
1
(G, N) are graph equivalent, written
g
,
if their graphs S

and S

are equivalent; that is, if there exist Aut(N G) and e

N G such that (S

) = e S

. The graph bundle g() of is its graph equivalence

class. Thus g() =
{ C
1
(G, N) : e N G, Aut(N G) : (S

) = e S

} . (15)
Two functions f, f

: G N are affine graph equivalent if their normalisations

f 1, f

1 C
1
(G, N) are graph equivalent. The corresponding equivalence class of
f is its affine graph bundleg( f ). Because S
f
= ( f (1), 1)S
f 1
we see that
f g( f

) f 1 g( f

1), (16)
so restricting to normalised functions does not lead to any loss of information.
Generalising [35, Lemma 2] from p = 2 to any prime, we have:
Example 16 Let G = N = Z
n
p
and let f : G G. Then the affine graph bundleg( f )
of f equals the CCZ-equivalence class of f .
Prima facie, the definition of equivalence for graphs is similar to that for transver-
sals. As we have established, however, transversal equivalence also requires the
commuting diagram (9). Two examples illustrate the difference.
In the first example, a function is equivalent to itself under a nontrivial graph
equivalence but because the extensions are equivalent, the graph equivalence is a
transversal equivalence.
Example 17 In (9) let N = G be abelian and E = G G. Let K = G {1},
(a) = (a, 1) and ((a, x)) = x. Let K

= {(a, a) : a G}

= K,

(a) = (a, a) and

((a, x)) = a
1
x, so K

is normal in G G and ker

= im

. Then S
1
is a transversal
T
1
= {t
x
= (1, x), x G} of K with respect to and since

(t
x
) = (t
x
) = x, S
1
is
also the transversal T
1
of K

with respect to

. The mapping (a, x) = (a, ax) is an

152 Cryptogr. Commun. (2010) 2:129154
automorphism of G G, with ((G)) =

(G) and =id on T

1
. Thus S
1
S
1
and
T
1
T
1
by a nontrivial equivalence.
In Example 17 the identity factor pair (
T
1
,
T
1
) = (1, 1) results from the con-
struction in (6) and (7) whichever subgroup T
1
is transversal to.
In the second example, two graphs are equivalent but are not, in general, equiva-
lent as transversals.
Example 18 In (9) let N = G and E = G G. Let K = G {1}, (a) = (a, 1) and
((a, x)) = x. Let K

= {1} G,

(x) = (1, x) and

((a, x)) = a.
Let : G G be a normalised permutation with inverse inv(). The graphs
S

and S
inv()
are transversals T

= {t
x
= ((x), x), x G} and T
inv()
= {t

x
=
(inv()(x), x), x G}, respectively, of K with respect to . Under the permutation
x (x), S
inv()
is also the transversal T = {t

x
= (x, (x)), x G} of K

with respect
to

. The mapping ((a, x)) = (x, a) is an automorphism of G G with ((G)) =

(G) and (T

) = T. Thus S

S
inv()
but T

T.
In Example 18 the splitting factor pairs for T

and T resulting from

the construction in (6) and (7) both equal (, ) while that for T
inv()
is
((inv()), inv()).
We close with a new RP.
Research Problem 92 Given G, N and a normalised function : G N, charac-
terise the partition of the graph bundle g() into bundles. In particular, for G =
N = Z
n
p
, characterise the partition of the CCZ class g() into EA classes.
Acknowledgements I am most grateful to the referees for comprehensive and expert reviews which
greatly assisted me to clarify and polish this survey.
References
1. Adams, S.S., Crawford, M., Greeley, C., Lee, B., Murugan, M.K.: Multilevel and multidimen-
sional Hadamard matrices. Des. Codes Cryptogr. 51, 245252 (2009)
2. Alvarez, V., Armario, J.A., Frau, M.D., Gudiel, F., Osuna, A.: Rooted trees searching for cocyclic
Hadamard matrices over D
4t
, AAECC-19. In: Bras-Amoros, M., Hoholdt, T. (eds.) LNCS,
vol. 5527, pp. 204214. Springer, Berlin (2009)
3. Alvarez, V., Armario, J.A., Frau, M.D., Real, P.: A system of equations for describing cocyclic
Hadamard matrices. c 16(4), 276290 (2008)
4. Alvarez, V., Armario, J.A., Frau, M.D., Real, P.: J. Symb. Comput. 44, 558570 (2009)
5. Alvarez, V., Frau, M.D., Osuna, A.: A Heuristic Procedure with Guided Reproduction for
Constructing Cocyclic Hadamard Matrices, ICANNGA 2009. In: Kolehmainen, M. et al., (eds.)
LNCS, vol. 5495, pp. 150160. Springer, Berlin (2009)
6. Bierbrauer, J.: New commutative semifields and their nuclei. In: Bras-Amors, M., Hoholdt, T.
(eds.). AAECC 2009. LNCS, vol. 5527, pp. 179185 (2009)
7. Bierbrauer, J.: New semifields, PN and APN functions. Des. Codes Cryptogr. 54, 189200 (2010)
8. Borges, J., Phelps, K.T., Rifa, J.: The rank and kernel of extended 1-perfect Z
4
-linear codes and
additive non-Z
4
-linear codes. IEEE Trans. Inf. Theory 49(8), 20282034 (2003)
9. Brouwer, A.E., Cohen, A.M., Neumaier, A.: Distance-regular Graphs. Springer, Heidelberg,
Berlin (1989)
Cryptogr. Commun. (2010) 2:129154 153
10. Budaghyan, L., Carlet, C., Pott, A.: New classes of almost bent and almost perfect nonlinear
polynomials. IEEE Trans. Inf. Theory 52, 11411152 (2006)
11. Budaghyan, L., Carlet, C., Leander, G.: Another class of quadratic APN binomials over F
2
n : the
case n divisible by 4. In: Proceedings, International Workshop on Coding and Cryptography,
INRIA-Rocquencourt, France, 1620 April 2007, pp. 4958
12. Cameron, P.: Personal Communication. 2 July 2009
13. Carlet, C., Charpin, P., Zinoviev, V.: Codes, bent functions and permutations suitable for
DES-like cryptosystems. Des. Codes Cryptogr. 15, 125156 (1998)
14. Chen, Y.-Q.: Twisted product of cocycles and factorization of semi-regular relative difference
sets. J. Comb. Des. 16, 431441 (2008)
15. Coulter, R.S., Henderson, M.: Commutative presemifields and semifields. Adv. Math. 217,
282304 (2008)
16. Craigen, R.: Mathematical Reviews. MR2265694 (2008d:05036)
17. Craigen, R., de Launey, W.: Generalized Hadamard matrices whose transposes are not general-
ized Hadamard matrices. J. Comb. Des. 17, 456458 (2009)
18. Craigen, R., de Launey, W.: Personal Correspondence. 27 July 2009
19. Craigen, R., Holzmann, W.H., Kharaghani, H.: On the asymptotic existence of complex
Hadamard matrices. J. Comb. Des. 5, 319327 (1997)
20. Craigen, R., Kharaghani, H.: Hadamard matrices and Hadamard designs. In: Colbourn, C.J.,
Dinitz, J.H. (eds.) Handbook of Combinatorial Designs, 2nd edn, pp. 273280. CRC Press, Boca
Raton (2007)
21. de Caen, D., Mathon, R., Moorhouse, G.E.: Afamily of antipodal distance-regular graphs related
to the classical Preparata codes. J. Algebr. Comb. 4, 317327 (1995)
22. de Launey, W.: On the asymptotic existence of Hadamard matrices. J. Comb. Theory, A 116,
10021008 (2009)
23. de Launey, W., Gordon, D.M.: On the density of the set of known Hadamard orders. Cryptogr.
Comm. (2010, CCDS special issue). doi:10.1007/s12095-010-0028-9
24. de Launey, W., Kharaghani, H.: On the asymptotic existence of cocyclic Hadamard matrices.
J. Comb. Theory, A 116, 11401153 (2009)
25. de Launey, W., Smith, M.J.: Cocyclic orthogonal designs and the asymptotic existence of cocyclic
Hadamard matrices and maximal size relative difference sets with forbidden subgroup of size 2.
J. Comb. Theory, A 93, 3792 (2001)
26. de Launey, W., Stafford, R.M.: Automorphisms of higher-dimensional Hadamard matrices.
J. Comb. Des. 16, 507544 (2008)
27. Dillon, J.F.: Personal Correspondence. 27 February and 15 March 2010
28. Djokovic, D.Z.: Hadamard matrices of order 764 exist. Combinatorica 28(4) 487489
(2008)
29. Farmer, D.G., Horadam, K.J.: Presemifield bundles over GF( p
3
). In: Proc. ISIT 2008, pp. 2613
2616. IEEE, Toronto (2008)
30. Farmer, D.G., Horadam, K.J.: A polynomial approach to cocycles over elementary abelian
groups. J. Aust. Math. Soc. 85, 177190 (2008)
31. Galati, J.C.: A group extensions approach to relative difference sets. J. Comb. Des. 12, 279298
(2004)
32. Gibbons, P.B., Mathon, R.: Enumeration of generalised Hadamard matrices of order 16 and
related designs. J. Comb. Des. 17, 119135 (2009)
33. Horadam, K.J.: A theory of highly nonlinear functions, AAECC-16. In: Fossorier, M. et al., (eds.)
LNCS, vol. 3857, pp. 87100. Springer, Berlin (2006)
34. Horadam, K.J.: Hadamard Matrices and Their Applications. Princeton University Press,
Princeton, NJ (2007)
35. Horadam, K.J.: EA and CCZ equivalence of functions over GF(2
n
). In: von zur Gathen, J., et al.
(eds.) Proc. WAIFI 2008. LNCS, vol. 5130, pp. 134143. Springer, Berlin (2008)
36. Horadam, K.J.: Orbiting round the Five-fold Constellation (invited lecture). In: Group Theory,
Combinatorics and Computation 2009. International Conference in Honour of Professor Cheryl
Praegers 60th Birthday, Perth, 5 January 2009
37. Horadam, K.J., Farmer, D.G.: Bundles, presemifields and nonlinear functions. In: Augot, D.,
Sendrier, N., Tillich J.-P. (eds.) Proc. International Workshop on Coding and Cryptography,
pp. 197206. Versailles, France (2007)
38. Horadam, K.J., Farmer, D.G.: Bundles, presemifields and nonlinear functions. Des. Codes
Cryptogr. 49, 7994 (2008)
39. Ito, N.: Hadamard graphs I; II. Graphs Comb. 1, 5764; 331337 (1985)
154 Cryptogr. Commun. (2010) 2:129154
40. Kyureghyan, G.M., Pott, A.: Some theorems on planar mappings. In: von zur Gathen, J., et al.
(eds.) Proc. WAIFI 2008. LNCS, vol. 5130, pp. 117122. Springer, Berlin (2008)
41. Ma, K.: Equivalence classes of n-dimensional proper Hadamard matrices. Australas. J. Combin.
25, 317 (2002)
42. McGuire, G., Ward, H.N.: Cocyclic Hadamard matrices from forms over finite Frobenius rings.
Linear Algebra App. 430, 17301738 (2009)
43. Cathin P.: Group Actions on Hadamard Matrices, M. Litt. Thesis, National University of
Ireland, Galway (2008)
44. Cathin, P., Rder, M.: The cocyclic Hadamard matrices of order less than 40. Des. Codes
Cryptogr. (2010). doi:10.1007/s10623-010-9385-9
45. Cathin, P., Stafford, R.M.: On twin prime power Hadamard matrices. Cryptogr. Comm.
(2010, CCDS special issue). doi:10.1007/s12095-010-0030-2
46. Phelps, K.T., Rifa, J., Villanueva, M.: Rank and kernel of binary Hadamard codes. IEEE Trans.
Inf. Theory 51(11), 39313937 (2005)
47. Phelps, K.T., Rifa, J., Villanueva, M.: Hadamard codes of length 2
t
s (s odd): Rank and kernel,
AAECC-16. In: Fossorier, M., et al. (eds.) LNCS, vol. 3857, pp. 328337. Springer, Berlin (2006)
48. Pott, A.: A survey on relative difference sets. In: Groups, Difference Sets and the Monster,
pp. 195232. de Gruyter, New York (1996)
49. Rifa, J., Soloveva, F.I., Villanueva, M.: On the intersection of Z
2
Z
4
-additive Hadamard codes.
IEEE Trans. Inf. Theory 55(4), 17661774 (2009)
50. Stepanov, S.A.: A new class of nonlinear senary codes. Probl. Inf. Transm. 42(2), 114122 (2006)
51. Trinh, Q.K., Fan, P., Gabidulin, E.M.: Multilevel Hadamard matrices and zero correlation zone
sequences. Electron. Lett. 42(13), 748750 (2006)
52. Yang, Y.X., Niu, X.X., Xu, C.Q.: Theory and Applications of Higher Dimension Hadamard
Matrices, 2nd edn. Chapman and Hall (2010). ISBN: 978-1-4398180-7-7
53. Zha, Z., Kyuraghyan, G., Wang, X.: Perfect nonlinear binomials and their semifields. Finite
Fields Appl. 15, 125133 (2009)