# Exploring the Set of APN Functions

Jules Baudrin, Pierre Galissant, Léo Perrin

► To cite this version:

Jules Baudrin, Pierre Galissant, Léo Perrin. Exploring the Set of APN Functions. BFA 2025 - 10th International Workshop on Boolean Functions and their Applications, Sep 2025, Larnaca, Cyprus. hal-05376704v1

HAL Id: hal-05376704

https://hal.science/hal-05376704v1

Submitted on 21 Nov 2025 (v1), last revised 21 Nov 2025 (v2)

HAL is a multi-disciplinary open access
archive for the deposit and dissemination of sci-
entific research documents, whether they are pub-
lished or not. The documents may come from
teaching and research institutions in France or
abroad, or from public or private research centers.

L'archive ouverte pluridisciplinaire HAL, est
destinée au dépôt et à la diffusion de documents
scientifiques de niveau recherche, publiés ou non,
émanant des établissements d'enseignement et de
recherche français ou étrangers, des laboratoires
publics ou privés.

<figure><img src="image_1.png" /></figure>

Distributed under a Creative Commons Attribution 4.0 International License
# Exploring the Set of APN Functions

Jules Baudrin<fnref n="1" />, Pierre Galissant<fnref n="2" /> and Léo Perrin<fnref n="2" />

## 1 Introduction

In this paper, we investigate known structures in the set of APN functions by establishing new results about the structure of the CCZ-equivalence class of APN functions, in particular quadratic (Section 2). These advances allow us to build a database containing exactly one representative of each extended-affine class of APN function over 6 bits, which in turn allows us to experimentally investigate where their switching neighbours are (Section 3).

### Preliminaries

We reserve caligraphic notation to affine mappings defined from $(\mathbb{F}_2^n)^2$ to itself, while we use uppercases for affine mappings defined from $\mathbb{F}_2^n$ to itself. The linear part of an affine mapping $\mathcal{A}$ (resp. $\mathcal{A}$) is denoted by $\mathcal{L}_\mathcal{A}$ (resp. $L_\mathcal{A}$). When it is clear from context, the subscript may be omitted.

The graph of a $F: \mathbb{F}_2^n \to \mathbb{F}_2^n$ is denoted by $\Gamma_F$ and defined by:

$$ \Gamma_F = \{(x, F(x)), x \in \mathbb{F}_2^n\}. $$

Two such functions $F$ and $G$ are *CCZ-equivalent* [CCZ98] if there exists an affine permutation $\mathcal{A}$ over $\mathbb{F}_2^{2n}$ such that $\Gamma_G = \mathcal{A}(\Gamma_F)$. The affine mappings such that $\mathcal{A}(\Gamma_F)$ is indeed the graph of another function are called *admissible for* $F$, and are in practice very rare.

*Extended-Affine equivalence* is a particular case of CCZ-equivalence that corresponds to the case where the matrix representation of the linear part of $\mathcal{A}$ has the form

$$ \mathcal{L} = \begin{bmatrix} A & 0 \\ B & C \end{bmatrix}, $$

where $A$, $B$ and $C$ are $n \times n$ matrices, so that both $A$ and $B$ are of maximum rank $n$. Following [CP19], affine bijections where the linear part has such a structure are called *EA-mappings*. An affine bijection $\mathcal{A}$ satisfying $\mathcal{A}(\Gamma_F) = \Gamma_F$ is an *automorphism* of $F$. The group of automorphism is denoted by $\text{Aut}(F)$, while the subgroup of automorphisms that are EA-mappings is denoted by $\text{Aut}_{\text{EA}}(F)$. The subgroup $\text{Aut}_{\text{LE}}(F)$ corresponds to the subgroup of linear automorphisms of the form $\begin{pmatrix} A & 0 \\ 0 & B \end{pmatrix}$. Finally, we denote by $\text{Aut}_0(F)$ the group of the linear parts of automorphisms, that is $\text{Aut}_0(F) := \{\mathcal{L}_\mathcal{A}: \mathcal{A} \in \text{Aut}(F)\}$.

## 2 Partitioning a CCZ-Equivalence Class

EA-equivalence being a particular case of CCZ-equivalence, it is possible to partition a CCZ-equivalence class into EA-equivalence classes. This nested structure corresponds to a form of equivalence among admissible mappings.

**Theorem 1.** Let $F: \mathbb{F}_2^n \to \mathbb{F}_2^n$ be a function, $\mathcal{A}$ and $\mathcal{A}'$ be admissible mappings for $F$, and $G$ and $G'$ be the functions such that $\Gamma_G = \mathcal{A}(\Gamma_F)$, and $\Gamma_{G'} = \mathcal{A}'(\Gamma_F)$. The functions $G$ and $G'$ are EA-equivalent if and only if there exists an EA-mapping $B$ such that $\mathcal{A}^{-1} \circ B \circ \mathcal{A}' \in \text{Aut}(F)$.

<footnote n="1">¹ UCLouvain, Louvain-la-Neuve, Belgium
name.surname@uclouvain.be</footnote>

<footnote n="2">² Inria, Paris, France
name.surname@inria.fr</footnote>
*Proof.* By definition, the functions $G$ and $G'$ are EA-equivalent if and only if there exists an EA-mapping $\mathcal{B}$ such that $\mathcal{B}(\Gamma_{G'}) = \Gamma_G$. However, $\mathcal{B}$ satisfies such an equality if and only if $\mathcal{B} \circ \mathcal{A}'(\Gamma_F) = \mathcal{A}(\Gamma_F)$, or equivalently if and only if $\mathcal{A}^{-1} \circ \mathcal{B} \circ \mathcal{A}'(\Gamma_F) = \Gamma_F$. $\square$

This previous theorem provides a natural equivalence relation on the admissible mappings of $F$ known as *EA-similarity* [CP19].

**Definition 1** ([CP19, Definition 14 & Lemma 9]). Let $F: \mathbb{F}_2^n \to \mathbb{F}_2^n$ be a function, and $\mathcal{A}$ and $\mathcal{A}'$ be admissible mappings for $F$. The mappings $\mathcal{A}$ and $\mathcal{A}'$ are EA-similar if there exists an EA-mapping $\mathcal{B}$ such that $\mathcal{A}^{-1} \circ \mathcal{B} \circ \mathcal{A}' \in \mathrm{Aut}(F)$. EA-similarity is an equivalence relation.

## 2.1 The number of EA-equivalence classes in a CCZ-equivalence class

In [CP19], Canteaut & Perrin characterize CCZ-equivalence as the composition of EA-equivalence together with the so-called twist-equivalence. In particular, they rely on a spectral characterization of admissible mappings. In the following, let $\mathcal{V} = \{(x, 0), x \in \mathbb{F}_2^n\}$ and let $\mathcal{Z}_F := \{(\alpha, \beta) | W_F(\alpha, \beta) = 0\} \cup \{(0, 0)\}$.

**Proposition 1** ([CP19, Lemma 1 & Theorem 1]). Let $F: \mathbb{F}_2^n \to \mathbb{F}_2^n$ and let $\mathcal{A}$ be an affine bijection over $(\mathbb{F}_2^n)^2$ with linear part $\mathcal{L}$. Then:

(i) $\mathcal{A}$ is admissible for $F$ if and only if $\mathcal{L}^\top(\mathcal{V}) \subset \mathcal{Z}_F$.

(ii) $\mathcal{A}$ is an EA-mapping if and only if $\mathcal{L}^\top(\mathcal{V}) = \mathcal{V}$.

*Remark 1.* As for any $F$ it holds that $\mathcal{V} \subset \mathcal{Z}_F$, this provides yet-another proof of why all EA-mappings are admissible for all functions.

Based on Theorem 1, we can refine [CP19, Lemma 3].

**Proposition 2.** Let $F, G, G'$ be three CCZ-equivalent functions from $\mathbb{F}_2^n$ to itself. Let $\mathcal{A}, \mathcal{A}'$ be admissible mappings for $F$ such that $\Gamma_G = \mathcal{A}(\Gamma_F)$ and $\Gamma_{G'} = \mathcal{A}'(\Gamma_F)$. Let $V = \mathcal{L}_{\mathcal{A}}^\top(\mathcal{V})$ and $V' = \mathcal{L}_{\mathcal{A}'}^\top(\mathcal{V})$. Then $G$ and $G'$ are EA-equivalent if and only if there exists $\mathcal{B} \in \mathrm{Aut}(F)$ such that $\mathcal{L}_{\mathcal{B}}^\top(\mathcal{V}) = V'$.

*Proof.* By Theorem 1, if $G$ and $G'$ are EA-equivalent, then there exists an EA-mapping $\mathcal{C}$ such that $\mathcal{A}^{-1}\mathcal{C}\mathcal{A}' \in \mathrm{Aut}(F)$ and its linear part satisfies:

$$ (\mathcal{L}_{\mathcal{A}}^{-1} \circ \mathcal{L}_{\mathcal{C}} \circ \mathcal{L}_{\mathcal{A}'}^{\top})(V') = \mathcal{L}_{\mathcal{A}'}^{\top} \circ \mathcal{L}_{\mathcal{C}}^{\top} \circ (\mathcal{L}_{\mathcal{A}}^{-1})^{\top}(V') = \mathcal{L}_{\mathcal{A}'}^{\top} \circ \mathcal{L}_{\mathcal{C}}^{\top}(\mathcal{V}) = \mathcal{L}_{\mathcal{A}'}^{\top}(\mathcal{V}) = V, $$

where we use the fact that $\mathcal{V}$ is invariant under $\mathcal{L}_C$ as it is an EL-mapping. Conversely, let $\mathcal{B} \in \mathrm{Aut}(F)$ such that $\mathcal{L}_{\mathcal{B}}^\top(\mathcal{V}) = V'$. Then $\mathcal{A}\mathcal{B}\mathcal{A}'^{-1}(\Gamma_{G'}) = \mathcal{L}\mathcal{B}(\Gamma_F) = \mathcal{A}(\Gamma_F) = \Gamma_G$. Furthermore,

$$ \mathcal{L}_{\mathcal{A}\mathcal{B}\mathcal{A}'^{-1}}^{\top}(\mathcal{V}) = (\mathcal{L}_{\mathcal{A}'}^{-1})^{\top} \circ \mathcal{L}_{\mathcal{B}}^{\top} \circ \mathcal{L}_{\mathcal{A}}^{\top}(\mathcal{V}) = (\mathcal{L}_{\mathcal{A}'}^{-1})^{\top} \circ \mathcal{L}_{\mathcal{B}}^{\top}(\mathcal{V}) = (\mathcal{L}_{\mathcal{A}'}^{-1})^{\top}(V') = \mathcal{V}. $$

Therefore $\mathcal{A}\mathcal{B}\mathcal{A}'^{-1}$ is an EA-mapping. $\square$

The case described in [CP19, Lemma 3] corresponds to the sufficient condition where $V = V'$. In that case, as $\mathrm{Id} \in \mathrm{Aut}(F)$, and as any subspace $V$ is invariant under $\mathrm{Id}, G$ and $G'$ are necessarily EA-equivalent. The authors also provide the example of involutive mappings to prove that their condition was not necessary. In that case if $\mathcal{A} = \mathrm{Id}$ and $\mathcal{A}' = \begin{pmatrix} 0 & \mathrm{Id} \\ \mathrm{Id} & 0 \end{pmatrix}$, it is clear that $\mathcal{A}(\Gamma_F) = \Gamma_F = \mathcal{A}'(\Gamma_F)$, despite the fact that $\mathcal{L}_{\mathcal{A}}(\mathcal{V}) = \mathcal{V} \neq \mathcal{V}^{\top} = \mathcal{L}_{\mathcal{A}'}(\mathcal{V})$. However, as $F$ is involutive $\mathcal{B} = \begin{pmatrix} 0 & \mathrm{Id} \\ \mathrm{Id} & 0 \end{pmatrix} \in \mathrm{Aut}(F)$ and $\mathcal{B}(\mathcal{V}) = \mathcal{V}^{\top}$, which is the reason why $\mathcal{A}$ and $\mathcal{A}'$ still maps $F$ to EA-equivalent mappings.

More importantly, Proposition 2 points out that we are interested in the action of the group $\mathrm{Aut}_0(F)$ (composed of the linear parts of automorphisms in $\mathrm{Aut}(F)$) on the set $\Sigma_F$ of $n$-dimensional subspaces in $\mathcal{Z}_F$. We define it as follows:

$$ \rho: \mathrm{Aut}_0(F) \times \Sigma_F \to \Sigma_F \qquad (1) \\ (\mathcal{L}, V) \mapsto \mathcal{L}^{\top}(V). $$

By construction and according to Proposition 2, the number of EA-equivalence classes in the CCZ-equivalence class of $F$ is the number of orbits for this action. By using Burnside's lemma, we obtain the following refinement of [CP19, Theorem 4].
**Theorem 2** (Number of EA-classes in a CCZ class). Let $F: \mathbb{F}_2^n \to \mathbb{F}_2^n$. Let $e_F$ be the number of EA-equivalence classes in the CCZ-equivalence class of $F$. Then:

$$e_F = \frac{1}{|\mathrm{Aut}_0(F)|} \sum_{\mathcal{L} \in \mathrm{Aut}_0(F)} |\mathrm{Fix}(\mathcal{L})|,$$

where $\mathrm{Fix}(\mathcal{L})$ is the set of $n$-dimensional subspaces of $\Sigma_F$ that are invariant under $\mathcal{L}$. In particular it holds that:

$$\frac{|\Sigma_F|}{|\mathrm{Aut}_0(F)|} \le e_F \le |\Sigma_F|.$$

The lower bound is obtained by only considering $\mathrm{Id} \in \mathrm{Aut}_0(F)$ in the sum, while the upper bound is obtained by using $|\mathrm{Fix}(\mathcal{L})| \le |\Sigma_F|$ for all $\mathcal{L} \in \mathrm{Aut}_0(F)$. This matches the bounds given in [CP19, Theorem 4] whenever $|\mathrm{Aut}_0(F)| = |\mathrm{Aut}(F)|$ which, in the study of APN functions, is the only interesting case. Indeed, the condition $|\mathrm{Aut}_0(F)| \ne |\mathrm{Aut}(F)|$ is equivalent to $F$ having a non-trivial constant derivative.

*Remark 2.* While we focused on the case where input and output sets are the same, this could easily adapted to functions mapping $\mathbb{F}_2^n$ to $\mathbb{F}_2^m$.

## 2.2 The Particular Case of Quadratic APN Function

If $F: \mathbb{F}_2^n \to \mathbb{F}_2^n$ is a quadratic APN function, then partitioning its CCZ-equivalence class turns out to be feasible in practice. To do so, we rely on the fact that the automorphisms of quadratic APN functions are necessarily EA-mappings. This is recalled in Section 2.2.1. We also use the fact (recalled in Section 2.2.2) that the study of $\mathrm{Aut}_{\mathrm{EA}}(F)$ can be reduced to study of $\mathrm{Aut}_{\mathrm{LE}}(\pi_F)$ where $\pi_F$ is the *ortho-derivative* of $F$.

### 2.2.1 CCZ-equivalence between quadratic APN functions

It is well-known that two quadratic APN functions are CCZ-equivalent if and only if they are EA-equivalent [Yos12]. As observed by Kaspers & Zhou [KZ21, Lemma 2.4] the results of Yoshiara [Yos12] and the ones of Dempwolff & Edel [DE14] are actually more precise : if $\mathcal{A}(\Gamma_F) = \Gamma_G$ where $F, G$ are both quadratic APN functions, then $\mathcal{A}$ is necessarily an EA-mapping.

**Proposition 3** (CCZ equivalence of quadratic APN mappings). Let $n \ge 4$. Let $F, G: \mathbb{F}_2^n \to \mathbb{F}_2^n$ be quadratic APN mappings. Then:

(i) [KZ21, Lemma 2.4] any automorphism of $F$ is an EA-mapping: $\mathrm{Aut}(F) = \mathrm{Aut}_{\mathrm{EA}}(F)$, and

(ii) if $\mathcal{A}$ is an admissible mapping satisfying $\mathcal{A}(\Gamma_F) = \Gamma_G$, then $\mathcal{A}$ is an EA-mapping.

*Sketch of Proof.* Let us assume that $\mathcal{A}(\Gamma_F) = \Gamma_G$. In that case, $\mathrm{Aut}(F) = \mathcal{A}^{-1}\mathrm{Aut}(G)\mathcal{A}$. $\mathrm{Aut}(F)$ admits a (2-elementary regular Abelian) subgroup $T_F = \left\{ \begin{pmatrix} \mathrm{Id} + \alpha & 0 \\ D_\alpha F & \mathrm{Id} \end{pmatrix}, \alpha \in \mathbb{F}_2^n \right\}$ which corresponds to the group of $2^n$ affine derivatives of $F$. Similarly, it holds that $\mathcal{A}^{-1}T_G\mathcal{A} \subset \mathrm{Aut}(F)$. The fact that $F$ and $G$ are EA-equivalent [Yos12] comes from the fact that $T_F$ and $\mathcal{A}^{-1}T_G\mathcal{A}$ are necessarily conjugate in $\mathrm{Aut}(F)$, see for instance [DE14, Theorems 3.11 & 3.12]. The fact that $\mathcal{A}$ is an EA-mapping comes from the fact that $T_F$ is actually a normal subgroup of $\mathrm{Aut}(F)$, see [DE14, Theorems 4.10], which implies that $\mathcal{A}^{-1}T_G\mathcal{A} = T_F$. We then proceed just as in the proof of [DE14, Theorem 3.12] by considering the set of points that are fixed by all elements in $T_F$, that we denote by $S_F = \{x \in (\mathbb{F}_2^n)^2 : t(x) = x, \forall t \in T_F\}$. It is clear that $S_F = \{0\} \times \mathbb{F}_2^n = S_G$. But the equality $\mathcal{A}^{-1}T_G\mathcal{A} = T_F$ also shows that $S_F = \mathcal{A}(S_G)$, which proves that $\mathcal{A}$ preserves $\{0\} \times \mathbb{F}_2^n$ and is therefore an EA-mapping. $\square$

**Corollary 1.** Let $n \ge 4$. Let $F: \mathbb{F}_2^n \to \mathbb{F}_2^n$ be a quadratic APN mapping. Then:

(i) [Yos12] There exists a single EA-equivalence class with quadratic mappings in the CCZ-equivalence of $F$.

(ii) Let $G$ be non-trivially $t$-twist equivalent to $F$. Then $\mathrm{deg}(G) \ge 3$. In particular, if $G$ is 1-twist equivalent to $F$ then $\mathrm{deg}(G) = 3$.
(iii) There exists a function of degree 3 which is CCZ-equivalent to F.

(iv) F is not t-twist self-equivalent. In particular F is not involutive.

Proof. Item (i) is a direct corollary of the previous proposition. A twist-equivalence is a particular kind of CCZ-equivalence which is not an EA-equivalence. By the second item of Proposition 3, a function which is twist-equivalent to F must have degree at least 3. The 1-twist case is a consequence of the fact that a function derived from a quadratic function by a 1-twist has degree at most 3 [CP19, Section 6.3.1]. Item (iii) is implied by the previous point, together with the fact that a quadratic APN function is necessarily 1-twistable [CP19, Corollary 2]. Item (iv) is a consequence of (ii). □

Note that a result similar to Items (ii) and (iii) was recently proven [JKK25, Theorem 6.7] with an explicit formula for a CCZ-equivalent function of degree 3.

### 2.2.2 EA-equivalence of quadratic APN functions & ortho-derivatives

As already mentioned, in the case of quadratic APN functions, the study of Aut<sub>EA</sub>(F) can be reduced to study of Aut<sub>LE</sub>(π<sub>F</sub>) where π<sub>F</sub> is the ortho-derivative of F.

**Definition 2 (Ortho-derivative).** Let $F: \mathbb{F}_2^n \to \mathbb{F}_2^n$ be a quadratic APN function. The *ortho-derivative* of F is the function $\pi_F: \mathbb{F}_2^n \to \mathbb{F}_2^n$ where $\pi_F(0) = 0$ and where for any $a \in (\mathbb{F}_2^n)^*$, $\pi_F(a)$ is the only non-zero element satisfying:

$$ \pi_F(a) \cdot (F(x+a) + F(x) + F(a) + F(0)) = 0 \quad \forall x \in \mathbb{F}_2^n. \qquad (2) $$

**Lemma 1.** Let $F: \mathbb{F}_2^n \to \mathbb{F}_2^n$ be a quadratic APN function, and let $A, B$ be affine bijections, and $C$ be a linear function mapping $\mathbb{F}_2^n$ to itself. Let $G = B \circ F \circ A + C$. Then:

(i) [CCP22, Proposition 36] $\pi_G = L_B^T \circ \pi_F \circ L_A^{-1}$.

(ii) Furthermore if $F = B \circ F \circ A + C$ then $\pi_F$ satisfies $\pi_F = L_B^T \circ \pi_F \circ L_A^{-1}$.

## 3 Towards a Practical Classification of all Known APN Functions

At the time of writing, many APN functions are known. Some of them lie in infinite families defined by polynomial forms, which in particular can be instanciated for smaller field sizes. On the other hand, in recent years, computer-aided searches have yielded litteral tens of thousands of other APN functions: all EA-classes of quadratic APN functions are known in $\mathbb{F}_{64}$ (there are 13), and in $\mathbb{F}_{128}$ (there are 488). Over $\mathbb{F}_{256}$, over 20,000 such classes are known.

Of course, all these functions come with their CCZ-equivalence classes which, as we established in Corollary 1, are non-trivial. It is now easy to go through said CCZ-equivalence class using e.g. sboxU [ABB+25] by generating all admissible mappings up to composition with EA-mappings. However, because of the existence of automorphisms, these admissible mappings may (and, in practice, very often are) EA-similar.

### 3.1 An Exact Representation of a CCZ-Equivalence Class

Fortunately, in the case of quadratic APN functions, it is in fact possible to solve this problem. To this end, we first find all the automorphisms of a quadratic APN function F using the following approach.

1. Compute the ortho-derivative $\pi_F$ of the target function F.

2. Find all the pairs of linear permutations $L_B^T$ and $L_A^{-1}$ such that $L_B^T \circ \pi_F \circ L_A^{-1} = \pi_F$. This can be done using straight-forward techniques relying on the fact that the DDT and LAT of ortho-derivatives are not nearly as structured as those of quadratic APN functions, for instance in the spirit of the work of Heggebakk & Kaleyski [HK22].

3. For all $\delta \in \mathbb{F}_2^n$, compute the values of the function $C$ such that $C(x) = F(x+\delta) + L_B \circ F \circ L_A(x)$. If $C$ is affine, then we have just deduced an automorphism $\mathcal{A}$ of F.
The function graph_automorphisms_of_apn_quadratic we added to sboxU<fnref n="1" /> implements this whole process. Once we have obtained all the automorphisms {$\mathcal{A}_i$}$_{0\le i<|\text{Aut}_{\text{EA}}(F)|}$, we proceed as follows to obtain exactly one representative of each EA-equivalence class in the CCZ-class of $F$.

1. Obtain all the vector spaces $V_i$ of dimension $n$ that are contained in the Walsh Zeroes of $F$.

2. For all $V_i$ and for all $\mathcal{A}_j$, check if there exists $k$ such that $\mathcal{A}_j^T(V_i) = V_k$. If it is the case, then remove $V_k$ from the list of vector spaces. In other words, we keep a single representative of the orbits for the action defined in Equation (1).

3. Loop over all remaining spaces $V_i$, build a corresponding admissible mapping, i.e. satisfying $\mathcal{L}^T(\mathcal{V}) = V_i$, and deduce a new CCZ-equivalent function. By construction, the functions obtained in this way form a system of representatives of the EA-equivalence classes that partition the CCZ-equivalence class of $F$.

## 3.2 Implementation and Results

We have implemented this approach, and stored the corresponding results in a tinySQL database that will be made available.

**6-bit Case.** We have established the following facts:

* The 13 quadratic APN functions of $\mathbb{F}_{64}$ contain, in total, 691 EA-classes in the union of their CCZ-equivalence classes. This exactly matches the results of Calderini [Cal20] that he found using a different approach.

* Adding the only known class of APN functions that are not CCZ-equivalent to quadratic functions yields 25 new EA-classes (as in [Cal20]), for a total of 716 EA-classes.

* These 716 EA-classes have the following algebraic degrees: 13 are quadratic, 521 are cubic, and 182 are of degree 4. None are of degree 5. Unsurprisignly, we recover the 534 classes containing quadratic and cubic functions mentioned by Langevin, Saygi & Saygi [LSS12].

* The CCZ-equivalence class of the function $x^3$ contains exactly 3 EA-classes for $n=6$.

Having a representative of all known EA-classes means it becomes practical to test if a new function is actually new. Thus, we were able to check if new functions could be found in the switching neighbours [EP09] of all known EA-classes. For $n=6$, we could not find any. On the other hand, a lot of quadratic APN functions are switching neighbours, and in fact we could generate all known EA-classes of APN functions over 6 bits by exploring all switching neighbours of $x^3$ and $x^3+u^{11}x^6+ux^9$ (where $u$ is a root of $x^6+x^4+x^3+x+1$), exploring the CCZ-classes of all resulting functions, then computing their switching neighbours, etc. However, at this stage, our partial exploration<fnref n="2" /> has not yielded any new function. This leads us to the following conjecture.

**Conjecture 1.** All 6-bit APN functions are now known. They all fit in one of 716 EA-classes, those being further grouped into 14 CCZ-classes. In particular, there is no 6-bit APN function of degree 5 or 6.

**7-bit Case.** For $n=7$, there are 488 EA-classes of quadratic APN functions. The union of their CCZ-classes contains a total of 82,409 EA-classes, with the following algebraic degrees: 488 are quadratic, 60,302 are cubic, 21,619 are of degree 4. None are of degree 5 or 6. A full exploitation of this new database remains to do, but we can already state that the function $x^3$ has exactly 3 EA-classes in its CCZ-class: itself, its inverse (whose components are all of degree 4), and another function obtained by a 1-twist.

<footnote n="1">¹https://github.com/lpp-crypto/sboxU/blob/master/sboxU/ccz.py#L1256C5-L1256C41</footnote>

<footnote n="2">²A given APN function has a lot of switching neighbours, and testing whether they are new involves an expensive code-based CCZ-equivalence test.</footnote>
**Acknowledgements.** The authors are supported by the European Research Council: Pierre Galissant and Léo Perrin through ERC project ReSCALE (grant agreement no. 101041545 "ReSCALE") and Jules Baudrin through ERC project BRIDGE (grant agreement no. 101096871 "BRIDGE"). This work was also supported by the French Agence Nationale de la Recherche through the SWAP project under Contract ANR-21-CE39-0012. The authors thank Marco Calderini and Philippe Langevin for pointing out implementation mistakes in first versions of this work.

## References

[ABB$^{+}$25] Jens Alich, Jules Baudrin, Aurélien Boeuf, Xavier Bonnetain, Alain Couvreur, Mathias Joly, and Léo Perrin. sboxU. Available online https://github.com/lpp-crypto/sboxU, 2025.

[Cal20] Marco Calderini. On the EA-classes of known APN functions in small dimensions. *Cryptogr. Commun.*, 12(5):821–840, 2020.

[CCP22] Anne Canteaut, Alain Couvreur, and Léo Perrin. Recovering or testing extended-affine equivalence. *IEEE Transactions on Information Theory*, 68(9):6187–6206, 2022.

[CCZ98] Claude Carlet, Pascale Charpin, and Victor Zinoviev. Codes, bent functions and permutations suitable for DES-like cryptosystems. *Designs, Codes and Cryptography*, 15(2):125–156, 1998.

[CP19] Anne Canteaut and Léo Perrin. On CCZ-equivalence, extended-affine equivalence, and function twisting. *Finite Fields and Their Applications*, 56:209–246, 2019.

[DE14] Ulrich Dempwolff and Yves Edel. Dimensional dual hyperovals and APN functions with translation groups. *Journal of Algebraic Combinatorics*, 39:457–496, 2014.

[EP09] Yves Edel and Alexander Pott. A new almost perfect nonlinear function which is not quadratic. *Adv. Math. Commun.*, 3(1):59–81, 2009.

[HK22] Marie Heggebakk and Nikolay Kaleyski. Testing linear and affine equivalence. In *BFA 2022: The 7th International Workshop on Boolean Functions and their Applications*, Balestrand, Norway, September 2022. https://boolean.w.uib.no/bfa-2022/.

[JKK25] Jaeseong Jeong, Namhun Koo, and Soonhak Kwon. On the functions which are CCZ-equivalent but not EA-equivalent to quadratic functions over $F_{p^n}$. *Finite Fields and Their Applications*, 103:102574, 2025.

[KZ21] Christian Kaspers and Yue Zhou. The number of almost perfect nonlinear functions grows exponentially. *J. Cryptol.*, 34(1):4, 2021.

[LSS12] Philippe Langevin, Elif Saygi, and Zulfukar Saygi. Classification of APN cubics in dimension 6 over GF(2), February 2012. https://langevin.univ-tln.fr/project/apn-6/apn-6.html.

[Yos12] Satoshi Yoshiara. Equivalences of quadratic apn functions. *Journal of Algebraic Combinatorics*, 35:461–475, 2012.