(2010) 2:129154
DOI 10.1007/s12095-010-0032-0
Hadamard matrices and their applications:
Progress 20072010
K. J. Horadam
Received: 27 August 2009 / Accepted: 2 June 2010 / Published online: 26 June 2010
Springer Science+Business Media, LLC 2010
Abstract We survey research progress in Hadamard matrices, especially cocyclic
Hadamard matrices, their generalisations and applications, made over the past three
years. Advances in 20 specific problems and several new research directions are
outlined. Two new problems are presented.
Keywords Hadamard matrix Cocyclic matrix Generalised Hadamard matrix
Relative difference set Hadamard code Presemifield APN function
1 Introduction
The purpose of this paper is to outline some of the rapid progress made over the
past three years in research into Hadamard matrices, especially cocyclic Hadamard
matrices, their generalisations and applications. Much of this recent progress is due
to Warwick de Launey and his collaborators and their students. The paper covers
20 of the 90 numbered Research Problems (RP 1RP 90) listed in the authors book
Hadamard Matrices and Their Applications [34], and significant other work.
The paper arises from an invited talk presented at the International Conference
on Design Theory and Applications, Galway, Ireland, July 13, 2009, which incor-
porated the 2nd International Workshop on Hadamard and Cocyclic Matrices and
Applications. As well as providing the first detailed survey of progress for three years
it contains new and unpublished results on Generalised Hadamard matrices, the
Five-fold Constellation and equivalence classes of nonlinear functions over groups.
Dedicated to Warwick de Launey for his 50th birthday.
K. J. Horadam (B)
RMIT University, Melbourne, VIC 3001, Australia
e-mail: kathy.horadam@rmit.edu.au
130 Cryptogr. Commun. (2010) 2:129154
Discussion of progress on RPs 1 and 7, 9, 16 and 21, 30, 33, 3844, 50, 53, 66, and
7375 is interleaved with interesting developments in other directions. The tightly
focussed RPs 16, 39, 53, 74 and 75 have been solved, and RP 30 has been solved
up to a coarser equivalence. RP 21 is effectively solved here. Allied to the solution
of RPs 16 and 21 are corrections to two lemmas on generalised Hadamard matrices
in [34] (Lemmas 4.10.1 and 7.26.2). Particular cases of the broader framework RPs
43, 50, 66 are solved, and RPs 33 and 73 are solved in some cases and have been
revised.
Although there are still no orders known in which no cocyclic Hadamard matrix
exists, many examples of non-cocyclic constructions of Hadamard matrices have
been found. An extension of the Five-fold Constellation to distance-regular graphs is
proposed as a new RP (RP 91). We clarify the definition of equivalence for relative
difference sets (RDSs), and so correct minor errors in [34, Chapters 8.2, 9.2.2]. We
close with new work, including a new RP (RP 92), on partitioning CCZ equivalence
classes of functions into EA classes.
Organisation is as follows. Section 2 covers progress made on various forms of the
Hadamard Conjecture, applications to binary Hadamard codes, and generalisations
to multilevel and higher-dimensional Hadamard matrices. Generalised Hadamard
matrices receive the most detailed treatment: Craigen and de Launeys solution of
RP 16 and of the allied problems presented here leads us to effective solution of
RP 21.
Section 3 covers progress made on cocyclic Hadamard matrices, their extensions
to coupled G-cocyclic Hadamard matrices and the four other equivalent combinato-
rial and algebraic objects of the Five-fold Constellation. We propose an enlargement
of the Constellation to include equivalent graphs. Section 4 is devoted to our
improved understanding of equivalence of semiregular RDSs and how it propagates
around the Constellation. The way this equivalence relation interacts with coarser
equivalences, such as presemifield isotopism and CCZ equivalence of cryptographic
functions, has proved very exciting, as well as being of considerable practical
interest.
Terminology and notation follows that of [34]. Throughout, we will use the
abbreviations HM, CHM, GHM and HDHM for a Hadamard matrix, cocyclic
Hadamard matrix, generalised Hadamard matrix and higher-dimensional Hadamard
matrix, respectively.
2 Hadamard matrices, applications and generalisations
2.1 Hadamard matrices
A HM of order k is a k k matrix H with entries from {1} such that HH
= kI
k
;
that is, for which the dot product of any pair of distinct rows is 0. The order is
necessarily 1, 2 or a multiple of 4.
2.1.1 The Hadamard conjecture: RP 1 and RP 7
The Hadamard Conjecture is that HMs of all orders 4n exist. There is still no reason
to believe it does not hold, and further existence results, dealing both with specific
Cryptogr. Commun. (2010) 2:129154 131
orders and with asymptotic existence (as n ) and density of existence of HMs,
have emerged recently.
Asymptotic results give, for each odd natural number m, a value t
0
for t in terms of
m such that HMs of orders m2
t
exist for all t t
0
. The Hadamard Conjecture would
be confirmed by showing t
0
= 2 for all m, but only values of t
0
growing logarithmically
with m are as yet known. The current lowest known value of t
0
, due to Craigen
[20], is t
0
= 2 +6
1
16
log
2
((m1)/2). In terms of logarithmic lower bounds, we may
rephrase this asymptotic approach to confirmation of the Hadamard Conjecture as:
show that for any > 0, there is an integer M such that for all m > M, there exist
HMs of order m2
2+ log
2
m
.
The associated density results aim to show that, for x Z
+
, the number of orders
less than x in which HMs are known to exist, as a fraction of the number of positive
integers 1, 2, 4n less than x, approaches 1 as x . If S(x) is the number of k
x Z
+
such that a HM of order k exists, the Hadamard Conjecture is equivalent
to the conjecture S(x) =
x
4
+2 for every x 2. Again, this may be rephrased in
terms of logarithmic lower bounds. Let > 0 and let H(x) denote the number of
odd m Z
+
, m x for which there is a HM of order 2
=
H
H = (
n
i=1
a
2
i
)I
n
. (If a
1
= = a
n
= 1, a MHM is a HM. If the a
i
are instead
required to be real variables, these are real orthogonal designs. )
MHMs were introduced by Trinh et al. [51] in 2006 and restricted to integer
entries, as a way to construct multilevel zero-correlation zone sequences, which have
Cryptogr. Commun. (2010) 2:129154 133
been studied for use in approximately synchronized code division multiple access
systems.
Adams et al. [1] have solved the open question concerning the maximum number
of distinct elements permissible in an order n MHM by proving the existence of a
full rate order n MHM (i.e. with n elements of distinct absolute value) for all n. They
give a construction of full rate circulant MHMs for all n = 4, and prove that no full
rate circulant MHM is possible if n = 4.
2.3 Generalised Hadamard matrices
A GHM GH(w, v/w)
1
over a group N of order w, where w|v, is a v v matrix H
with entries from N such that in the integral group ring ZN,
HH
= vI
v
+v/w
_
uN
u
_
(J
v
I
v
) . (1)
Here M
= (M
(1)
)
= (M
)
(1)
, where [m
ij
]
(1)
=
[(m
ij
)
1
].
Equivalently, H is a GHM over N if and only if HH
= vI
v
over the quotient ring
ZN/
uN
u. The only if direction is immediate. The converse follows from the
fact that for distinct rows i, j of H,
v
k=1
h
ik
(h
jk
)
1
is a sum of elements of N, so if it is
of the form g(
uN
u) for some g ZN then g can be replaced by a positive integer
with no loss of generality. A counting argument shows this integer is the constant
v/w.
The number of equivalence classes of GHMs of order 16 has only recently been
determined.
Example 3 (Gibbons and Mathon [32, Table V]) The numbers of inequivalent
GH(2
i
, 2
4i
) of order 16 up to duality (and, including duals) over all N.
N i = 1 i = 2 i = 3 i = 4
Z
i
2
4(5) 130(226) 53(86) 18(32)
Z
4
13(13)
D
8
1(1)
Total 4(5) 143(239) 54(87) 18(32)
Case i = 1 is all HMs of order 16. Case i = 4 is all GH(16, 1), which exist only over
the elementary abelian group Z
4
2
. Up to duality, the corresponding divisible designs
can be extended to 10 of the 13 known projective planes of order 16.
2.3.1 The transpose of a GHM: RP 16
RP 16 [34, p. 72] asks if we can find a GHM (necessarily over a nonabelian group N)
whose transpose is not a GHM, or prove that no such matrix exists. This turns out
to be very easy: the answer was known much earlier to Craigen and de Launey, and
possibly others. In [17] they show every GHM with entries in a nonabelian group
1
Also denoted GH(v, N), or GH(v, m) when N is a group of m
th
roots of unity.
134 Cryptogr. Commun. (2010) 2:129154
N has either a transpose which is not a GHM or its transpose is a GHM but it is
equivalent (by left multiplication on a single row) to a GHM whose transpose is
not a GHM. They describe small examples of group developed GH(8, 8) over the
dihedrals D
8
or quaternions Q
8
to show the result is not vacuous. The GH(8, 2) over
D
8
of Example 1 will also suffice.
Craigen and de Launey propose the following revision of the problem.
Research Problem 16
= vI
v
+v/w
_
uN
u
_
(J
v
I
v
) ,
so that H
(1)
is a GHM whenever H is. For nonabelian N this is not the case, so
Lemma 4.10.1 of [34] (which states that it is true for all N) is incorrect.
Lemma 4 (Craigen and de Launey [18]) For every GHM H with entries in a non-
abelian group N, either H
(1)
is not a GHM or H
(1)
is a GHM but H is equivalent
(by right multiplication on a single column) to a GHM K for which K
(1)
is not a
GHM.
Proof Let x, y be elements of N that do not commute, so x
1
yx = y. Let H be a
GHM over N such that H
(1)
is also a GHM and let (h
1
il
)
1lv
and (h
1
jl
)
1lv
be
distinct rows of H
(1)
. Then
v
l=1
(h
il
)
1
h
jl
has every element of N as a term v/w
times. In particular, there is a term equal to y. Without loss of generality, we can
assume this term is the first one, i.e. h
1
i1
h
j1
= y.
Let K be the matrix obtained by postmultiplying the entries of the first column
of H by x, so K is a GHM equivalent to H. Thus in K
(1)
(K
(1)
)
,
v
l=1
(k
il
)
1
k
jl
=
(x
1
yx) +
v
l=2
(h
il
)
1
h
jl
.
Therefore y does not appear as a term in this entry of K
(1)
(K
(1)
)
the same
number of times as the other elements of N, and K
(1)
is not a GHM.
2.3.3 The transinverse of a GHM
In [17] Craigen and de Launey state that a v v matrix H over N is a GHM if and
only if H
d
i=2
c
i
x
i
and c, c
i
F.
If f (0) = 0 then a is a (right) zero-divisor (by minimality of the degree of f (x)),
which contradicts ab = e. So ce = 0 A, ce = g(a)a = a(g(a)) and g(a)ab =
cb = g(a). It follows that b = c
1
g(a) and ba = e.
Theorem 6 (Craigen and de Launey [17, 18]) Let H be a v v matrix over N. Then
H is a GHM if and only if H
is a GHM.
Proof The group algebra QN is a w-dimensional Q-algebra and therefore the
quotient ring R = QN/
uN
u is a (w 1)-dimensional Q-algebra. The ring A of
all v v matrices over R is a (w 1)v
2
-dimensional Q-algebra (with identity I
v
).
Let H be a GHM. By the remarks following (1),
1
v
H
is a right inverse of H
in A. By Lemma 5 it is a two-sided inverse. Since H
H = vI
v
mod R, the argument
following (1) applies, and H
H = vI
v
mod ZN/
uN
u as required.
2.3.4 Generalised Butson HMs: RP 21
The results above for GHMs have implications for Generalised Butson Hadamard
Matrices (GBHMs). These are defined [34, Denition 4.35] to be v v matrices M
over N, where N is a subgroup of the group of units R
= M
M = vI
v
, where M
is the
transinverse of M.
RP 21 [34, p. 85] asks, for a ring Rwith unity 1, group of units R
and characteristic
not dividing v, if there is a v v matrix M with entries from a subgroup N R
such
that MM
= vI
v
, must it follow that M
M = vI
v
?
We note that if R is a k-dimensional S-algebra for some commutative ring S
with unity, and v is invertible in S, then v
1
M
) =
(cM
)M = v(cI
v
). Consequently we have a positive answer to RP 21 in a sufficiently
general case to consider it effectively solved.
Corollary 7 Suppose MM
= vI
v
as in RP 21. If R is a k-dimensional S-algebra for
some commutative ring S with unity, and v is invertible in S, there exists c S such
that c1 = 0 R and cM
M = v(cI
v
). If c1 is not a zero divisor in R then M
M = vI
v
.
The corresponding questions for the transpose and the matrix of inverses of M are
solved in the negative in the same way as RP 16 and Lemma 4, respectively.
We need only show there exist matrices M with entries from a nonabelian
subgroup N R
such that MM
= vI
v
. For instance, for D
8
= a, b : a
4
= b
2
=
e, ba = a
3
b, set R = ZD
8
/P, where P is the two-sided ideal P = 1a
2
+1e. The
subset N = {1e + P, 1a + P, 1b + P, 1ab + P} in R is an isomorphic copy of
D
8
and
uN
u = 0 in R. Let H be a GH(8, 8) over D
8
, so by Theorem 6, so is H
.
Let M be the image of H under this isomorphism, so by (1), M is both a GHM and a
GBHM.
136 Cryptogr. Commun. (2010) 2:129154
Then M is equivalent to a matrix K which satisfies KK
= 8I
8
but whose
transpose and matrix of inverses do not satisfy this equation (in both cases because a
single term in
uN
u is varied so the sum cannot equal 0).
2.3.5 Butson matrices and codes
Over the past few years a considerable volume of work dealing with signals over
non-binary alphabets has been published in the engineering literature. Some of it,
mentioned only briefly here, derives from application or modification of Butson
matrices. These Butson matrices are also GBHMs, with R = C and N C
, the
group of the complex unit circle.
In [42], McGuire and Ward provide a general construction of Butson matrices
from finite Frobenius rings, which generalises those of Pinnawala and Rao cited in
[34, Section 9.1.4.2], though it does not produce any new equivalence classes.
Theorem 8 [42, Theorem 13] Let A be a f inite Frobenius ring with generating
character and let B be a nondegenerate pairing of a f inite left A-module L and a
f inite right A-module R. Then H(B) = [(B(x, y))]
LR
is a Butson matrix equivalent
to the Fourier Transform matrix F
C
, where C = (R, +). Two such matrices (possibly
from dif ferent rings) are equivalent if and only if the additive groups of the right
modules are isomorphic.
They then obtain codes meeting the Plotkin bound from the rows of the Butson
matrix in the usual fashion [42, Theorem 14]. They observe that if a two-sided
module is used, (B(x, y)) is a cocycle (see (2) below) and so is ( f (x)(y)) for any
additive isomorphism f : R Hom
A
(R, A). Then the resulting matrices and codes
are cocyclic.
Stepanov has written a sequence of papers, starting with the Fourier Transform
matrix F
n
for each of n = 3, 4, 6, and finding a suitable smaller k l matrix with
entries from the same group of roots of unity with which to repeatedly tensor it. He
then analyses the error-correcting and decoding performance of codes derived from
the rows of the iterated tensor products (which are not GHMs). See for instance [50].
Rifa and co-authors [8, 49] have also been working on the ranks, kernels and
intersection numbers of what they call Z
2
Z
4
-additive Hadamard codes, which are the
additive dual codes of the Z
2
Z
4
-additive extended perfect codes (see for example
[8, 49]). These include the quaternary or Z
4
-additive Hadamard codes (cf. [34,
Chapter 4.4.3]).
I misinterpreted earlier work by M. H. Lee and co-authors, and in [34, Section
4.5.1] I called a normalised GBHM a jacket matrix if it was permutation equivalent
to a GBHM with last row and column each consisting of 1. Those authors now
describe a jacket matrix loosely as an n n matrix J with entries from an unspecified
set of (necessarily invertible) elements, such that J
1
=
1
c
J
1j<kn
h
_
i
j
, i
k
_
(the Product Construction) to H = [h(i
1
, i
2
)] for H the Sylvester HM of order 2.
They then prove this result does not extend above order 2. They show there is
a constant c > 1 such that any Hadamard matrix H of order v > 2 gives rise via
the Product Construction to c
v
inequivalent proper three-dimensional Hadamard
matrices of order v. For v = 4, they exhibit three pairwise inequivalent families of
Product Construction matrices, one for each of three distinct H equivalent to the
Sylvester HM of order 4. This corrects Ma [41, Corollary 4.4] (quoted as Corollary
5.20 in [34]) which claims the number of equivalence classes is the same as for H, in
any higher dimension.
In spite of these results, a different approach to classifying HDHMs may well be
needed, as there are real problems surfacing with the computational complexity of
the classification of HDHMs by equivalence class, as there is for HMs. de Launey and
Stafford argue that a classification program based on automorphism groups rather
than equivalence classes may provide more insight, and propose a research problem
for HDHMs [26, Research Project 2, p. 38] with this in mind.
138 Cryptogr. Commun. (2010) 2:129154
3 Cocyclic Hadamard matrices
If N is a (left) G-module with G-action given by the homomorphism
2
: G
Aut(N), a cocycle is a map : G G N satisfying
(g, h)(gh, k) = (h, k)
(g)
(g, hk), (2)
for all g, h, k G. We always assume is normalised, ie. (g, 1) = 1 = (1, g). A
coboundary is a cocycle of the form
3
(g, h) = (g)(h)
(g)
(gh)
1
(3)
for some mapping : G N which has (1) = 1. If is trivial it is usually sup-
pressed. If N
= {1}, is necessarily trivial.
If C is a trivial G-module, the cocycles form a finite abelian group Z
2
(G, C) under
pointwise multiplication, and the coboundaries form a subgroup B
2
(G, C). The
quotient group H
2
(G, C) = Z
2
(G, C)/B
2
(G, C) is the second cohomology group.
If C is a trivial G-module, a v v matrix M with entries in C is a G-cocyclic matrix
over C if there is a cocycle : G G C and an ordering G = {1 = g
1
, g
2
, . . . , g
v
}
such that M is Hadamard equivalent to the matrix
M
=
_
(g
i
, g
j
)
_
1i, jv
. (4)
If C is a trivial G-module, a G-cocyclic GHM over C is any matrix M for which
there exists a cocycle Z
2
(G, C) such that M
2
=
1
2
.
3
The formula in [34, Def. 6.2] is (g, h) = (g)
1
((h)
(g)
)
1
(gh); that is, the coboundary (
1
)
according to (3). Both definitions of are in use. Each is correct, if applied consistently.
Cryptogr. Commun. (2010) 2:129154 139
exists, how many cocyclic GHMs exist, either in total or up to Hadamard equiva-
lence class or some other classification, such as by index group or automorphism
group.
One approach to these questions is to begin with a cocycle and decide if the
resulting matrix (4) is Hadamard. For this we need to know how to compute cocycles.
3.1.1 Computation of cocycles: RP 33
RP 33 [34, p. 128] fixes a finite group G of order v and asks for more computationally
efficient algorithms for listing a minimal set of generators for its universal coefficient
group. The intention behind the question is to provide, for any finite abelian group C,
a minimal set of generators of the finite abelian group Z
2
(G, C) of cocycles over G
with coefficients in C and trivial action, or else algorithms for listing such a set which
permit computation in higher order groups, or have lower computational complexity,
than the three algorithms described in [34, 6.3].
In practice, researchers have reversed the rles of the groups involved. They have
fixed C and studied generators of Z
2
(G, C) for families of groups G. Therefore it
makes sense at this point to revise RP 33.
Research Problem 33
when C = {Z
n
p
}, the family of elementary
abelian groups. As we see next, the cases C = G {Z
n
2
} and C = Z
2
, G {D
4t
, Z
2
2
Z
t
} have been solved.
When G = {Z
n
p
}, Farmer [30, Theorems 3.1, 3.2] has recently identified a basis
of two-variable polynomials over GF( p
n
) for the subgroup B
2
(Z
n
p
, Z
n
p
) of cobound-
aries, and a recursive derivation in terms of that for B
2
(Z
n1
p
, Z
n1
p
).
We give the coboundary recursion for p = 2. This means the case G = C {Z
n
2
}
of RP 33
_
x
k2
n1
+c
k2
n1
_
y
2
n1
+ x
2
n1
_
y
k2
n1
+c
k2
n1
_
, w
2
(k) 3
x
2
r
y
2
n1
+ x
2
n1
y
2
r
, k = 2
n1
+2
r
, r = 0, . . . , n 2.
The second cohomology group H
2
(G, C) = Z
2
(G, C)/B
2
(G, C) has been more
studied in other application areas than has the group of cocycles Z
2
(G, C). To take
advantage of this, RP 33
ij
, i =
2, . . . , v, which generate the group of normalised functions from G to {1}. The cor-
responding coboundaries
i
(g, h) =
i
(g)
i
(h)
i
(gh)
1
, which can then be computed
from the group multiplication in G, form a generating set of size v 1 for B
2
(G, Z
2
).
After writing each coboundary as a length v
2
row vector, row reduction of these v 1
rows gives a minimal set of generators [4, Lemma 1].
This means the cases G {D
4t
} and G {Z
2
2
Z
t
} (amongst others) are solved,
as in both cases they can find a minimal set of v 3 generators of B
2
(G, Z
2
) and 3
representatives of H
2
(G, Z
2
) efficiently [3, 4].
3.1.2 Computational search for CHMs: RPs 2(a), 6 and 38
From their minimal generating set for B
2
(G, Z
2
), the Sevilla Group derive a basis
of coboundary matrices. They have concentrated on the families {D
4t
, t odd} of
dihedral groups, from which the Ito CHMs arise (RP 6, [34, p. 24]), and {Z
2
2
Z
t
, t odd}, from which the Williamson CHMs arise (RP 2(a), [34, p. 16]).
Their approach is to analyse the distribution of 1s in these basis matrices
compared with those in the fixed inflation and transgression matrices, to provide
formal reductions of the number of basis elements which can contribute to a CHM.
This then cuts down the search space for CHMs, in some cases quite dramatically.
This allows them to design better search algorithms such as guided reproduction
genetic algorithms [5], and to isolate centrally distributed subtypes of coboundaries
[2] with higher likelihood (experimentally confirmed) of forming CHMs, and thus
of providing experimental evidence supporting the Cocyclic Hadamard Conjecture
(RP 38).
3.1.3 Non-cocyclic constructions of HMs: RPs 39,40,41,42 and 43
RPs 39, 40, 41 and 42 [34, Chapter 6.5.1] each ask if a specific construction technique
which gives HMs is cocyclic. We discuss them in turn, below. Cathin [43] has
partial solutions to RPs 4042, and, with Stafford [45], has solved RP 39. He takes
the automorphism group approach to finding CHMs, championed by de Launey,
which is a consequence of a relationship between each CHM and a regular group
action on its associated design (part of the Five-fold Constellation of Subsection 3.2
following). Given a construction of a HM, he enumerates and analyses the subgroups
of its automorphism group which act regularly on an associated design and contain
a specified central involution. This is sufficient to determine whether the HM is
cocyclic.
Because the automorphism group of a HM is the same as that of its transpose
as well as of any equivalent matrix, this characterises cocyclicity, up to transpose
equivalence. Note that if the cocyclic matrix M
where
is the dual
of . The transpose of a CHM found this way can then be checked for Hadamard
inequivalence.
Cryptogr. Commun. (2010) 2:129154 141
Cathin distinguishes between constructions of Hadamard matrices that always
produce cocyclic matrices, those which produce a mixture of cocyclic and non-
cocyclic matrices and those which never produce cocyclic matrices, which he refers
to as strongly cocyclic, weakly cocyclic, and non-cocyclic, respectively.
RP 39 asks if the twin prime power difference set construction of HMs (which is
cocyclic in order 16) is cocyclic for higher orders. Cathin shows in [43] it is non-
cocyclic for all 9 higher orders < 1000, and remarks that this is surprising, as the
Paley constructions, which use single prime powers in a similar fashion, are strongly
cocyclic. He and Stafford [45] have just succeeded in proving the twin prime power
construction is non-cocyclic in all orders > 16.
RP 40 asks if the Goethals-Seidel construction of HMs is cocyclic, and in [43]
Cathin shows it is not cocyclic in order 28, and in a partial search of orders 36,
44 and 52 none of the Goethals-Seidel HMs he found were cocyclic. He concludes
that the Goethals-Seidel construction is at best weakly cocyclic and conjectures it is
non-cocyclic.
For RP 41, he shows the Kimura construction of HMs, when generated from
dihedral groups of small order, gives no cocyclic HMs, so this construction is at best
weakly cocyclic. He conjectures it is non-cocyclic..
By way of contrast, for RP 42, Cathin finds the twin circulant cores con-
struction of HMs has the weak cocyclic property for all the orders (24 to 40) he
investigated.
RP 43 (also in [34, Chapter 6.5.1]) asks if there are CHMs in each equivalence
class of HMs of order > 20, and if not, what proportion of the equivalence classes are
cocyclic. Cathin [43, 44] has shown that the answer to the first part is no, for orders
24, 28, 32 and 36. He classifies all CHMs of order at most 36. His computational
evidence is that 20 is probably the highest order for which each equivalence class
of HMs contains a CHM, and as the order increases, the proportion of equivalence
classes containing a CHM drops dramatically. The following table appears in [44]. In
it, column 2 gives the number of equivalence classes of CHMs (where appropriate as
a fraction of the number of equivalence classes of HMs of that order). Column 3 gives
the number of isomorphism types of index groups G of CHMs (where appropriate
as a fraction of the number of isomorphism types of that order) and column 4 gives
the number of isomorphism types E appearing in extensions Z
2
E
G (where
appropriate as a fraction of the number of isomorphism types of extensions of Z
2
by
groups G of that order).
Equivalence classes of CHMs [44]
Order Cocyclic Index groups Extension groups
2 1 1 2
4 1 2 3/5
8 1 3/5 9/14
12 1 3/5 3/15
16 5 13/14 45/51
20 3 2/5 3/14
24 16/60 8/15 14/52
28 6/487 2/4 2/13
32 100/> 3 10
6
49/51 261/267
36 35/> 18 10
6
12/14 21/50
142 Cryptogr. Commun. (2010) 2:129154
Cathins results confirm the approach of the Sevilla Group: that to find CHMs
it is more productive to focus on those index groups G {D
4t
} and G {Z
2
2
Z
t
}
which are represented in all small orders.
3.1.4 Tensor products and orthogonality: RP 44
The tensor product cocycle is defined for two cocycles with trivial action from the
Kronecker product of their respective cocyclic matrices, by using (4). A decade
ago Hughes, Perera and the author (see [34, Theorem 6.9]) showed that this tensor
product cocycle is orthogonal if and only if the factors are orthogonal. However no
tensor product construction of more general cocycles which preserved this result had
been found.
RP 44 [34, p. 151] is to extend the tensor product construction to cocycles with
nontrivial action, or to the more general factor pairs in such a way as to preserve this
result.
Galati [31] had found a particular solution: a skew tensor square of a factor pair
over an abelian group with itself, which is orthogonal if and only if the factor pair is
orthogonal.
In 2008 Chen [14] found a generalisation of the tensor product (for cocycles with
trivial action) which also has the necessary property and may be extensible.
Definition 10 Let G
i
, i = 1, 2 be finite groups and C a finite abelian group. Let
i
Z
2
(G
i
, C), i = 1, 2. Let b : G
1
G
2
C be a homomorphism in each coordinate.
The twisted Kronecker product
1
b
2
: (G
1
G
2
) (G
1
G
2
) C of
1
and
2
twisted by b is
1
b
2
((h
1
, k
1
) , (h
2
, k
2
)) =
1
(h
1
, h
2
) b(h
2
, k
1
)
2
(k
1
, k
2
) .
When b is the trivial map the construction is the tensor product
1
2
and when
G
1
= G
2
is abelian,
1
=
2
and b =
1
(
1
)
1
the construction is Galatis skew
tensor square
1
1
.
Theorem 11 [14, Theorem 3.2] The twisted Kronecker product cocycle
1
b
2
is
orthogonal if and only if both cocycles
1
,
2
are orthogonal.
3.1.5 Orthogonality and multiplicative cocycles: RP 73
A cocycle which is a homomorphism in either (and hence the other) coordinate is
termed multiplicative. If a multiplicative cocycle is orthogonal, then C and G are
both elementary abelian p-groups for the same prime p. For p = 2, LeBel (see [34,
9.3.1.1]) showed that all orthogonal cocycles in Z
2
(Z
t
2
, Z
n
2
) are multiplicative for 2
n t 3, and claimed to show the same for t = 4. This was the basis of RP 73, which
asks, for 2 n t < , if all orthogonal cocycles in Z
2
(Z
t
2
, Z
n
2
) are multiplicative.
Dillon [27] has since informed me that he has found examples computationally
which contradict LeBels argument for the case n < t = 4, but he has also established
computationally that the claim is correct for n = t = 4. That is, for p = 2 and 2 n =
t 4, there are no non-multiplicative orthogonal cocycles.
More generally, Dillon has solved RP 73 in the negative as follows. Let t = 2n,
let K = GF(2
n
) and let L = K[] be a quadratic extension of K. Let be a
Cryptogr. Commun. (2010) 2:129154 143
normalised permutation of K and consider the coboundary defined by the function
f : L K, f (x + y) = (x)y. The mapping Tr(b (x)y) : L Z
2
is bent for any
b = 0 K and any . Therefore (see [34, 9.2.2], for instance) f is vectorial bent (i.e.
Perfect Nonlinear) and f is orthogonal. By setting to be a suitable non-quadratic
permutation, such as the inversion function (x) = x
2
n
2
for any n > 2, we get a non-
multiplicative orthogonal coboundary.
Therefore it makes sense at this point to revise RP 73.
Research Problem 73
T
(x) =
1
t
x
, (6)
T
(x, y) =
1
_
t
x
t
y
t
1
xy
_
, (7)
for all x, y G, is a factor pair of N by G.
Of particular interest are extensions N
E
G satisfying an additional combi-
natorial property: that a transversal of (N) in E with respect to is a semiregular
relative difference set in E relative to (N) (which requires |N| to divide |G|). A
relative difference set ((v, w, k, )-RDS) in a finite group E of order vw relative to a
normal subgroup K of order w, is a k-element subset R = {r
1
, . . . , r
k
} of E such that
the sequence of quotients
r
i
r
1
j
, r
i
, r
j
R, i = j (8)
lists each element of E\K exactly times and lists no element from K. The subgroup
K is called the forbidden subgroup. An RDS R is normalised if R contains the
identity of E, central if K lies in the centre (E) of E and semiregular when k = v.
In this case there are mutual equivalences [34, Theorems 7.29, 7.40] between
five objects, which we call the Five-fold Constellation and visualise as a complete
graph on 5 vertices. Suppressing the inner pentagram for simplicity, these vertices
are pictured in Fig. 1 [34, Fig. 7.1]. They represent:
1. a coupled G-cocyclic GHM over N
2. an orthogonal factor pair of N by G
3. a semiregular RDS in E relative to (N)
144 Cryptogr. Commun. (2010) 2:129154
Fig. 1 The Five-fold
Constellation
1
2
3
4
5
bs
b
cs
c
ns
n
4. a semiregular divisible design with regular group E and class regular normal
subgroup (N)
5. a base sequence (a generalised form of Perfect Nonlinear function) : G N.
The outer pentagon (labelled n, for N normal in E) is the most general case. The
inner pentagons represent the case N is (c) central in E and N is (b) binary (
= Z
2
).
The shadow pentagons (dashed lines labelled s, for splitting) refer to the special case
that the extension is split, that is, E is a semidirect product N
G.
3.2.1 Orthogonal cocycles and relative dif ference sets
As a consequence of the equivalences we have in the Constellation, many new
existence and construction techniques for these objects have been found. We list just
a few which result from the work in earlier sections.
1. de Launey [22] notes that his first density theorem (Theorem 1) for cocyclic
Hadamard matrices is an asymptotic existence result for central (4t, 2, 4t, 2t)-
RDSs.
2. Chen rewrites his factorisation theorem (Theorem 11) using the Constellation
[14, Theorem 1.2].
Let N be central in E; let G
1
, G
2
be subgroups of E such that G
1
, G
2
=
E, [G
1
, G
2
] N and G
1
G
2
= N; and let R
i
be a transversal of N in G
i
, i =
1, 2.
Then R
1
R
2
is a semiregular RDS in E relative to N if and only if R
i
is a
semiregular RDS in G
i
, i = 1, 2, relative to N.
Cryptogr. Commun. (2010) 2:129154 145
3.2.2 A Six-fold Constellation? RP 91
There need be nothing canonical about having 5 equivalent objects in the Constella-
tion. As Craigen [16] says perhaps we will see several other stars added to those
of the present constellation, which may be merely the most visible points of light in a
larger galaxy.
For instance, there are several ways of relating HMs to graphs, with applications
in statistical mechanics, quantum cryptography and graph complexity.
In particular, it is known (see [9, 1.8]) that a HM of order 4n is equivalent
to a Hadamard graph
4
(that is, a distance-regular graph with intersection array
{4n, 4n 1, 2n, 1; 1, 2n, 4n 1, 4n}; or, equally, an antipodal distance-regular graph
of diameter 4 whose antipodal quotient is complete bipartite).
In [36] I asked how this equivalence could be specialised to CHM. In answer,
Peter Cameron [12] says a HM is a CHM if and only if the equivalent Hadamard
graph admits a group of automorphisms acting regularly on each bipartite block.
In [21] antipodal distance-regular graphs are constructed which are equivalent to
certain GHMs, and the extended Preparata codes are found fromwalks on the graphs
in this family.
This leads me to formalise the following new problem.
Research Problem 91 Generalise the equivalence between a CHMand a Hadamard
graph admitting a group of automorphisms acting regularly on each bipartite block,
to coupled G-cocyclic GHMs over N. Are there natural applications of these graphs
in coding, cryptography or complexity?
4 Bundles: propagating equivalence classes of RDSs
There are natural definitions of equivalence for each type of object in the Constella-
tion which arise from their individual contexts, and they do not all match. For GHMs
it is Hadamard equivalence; for extensions it is equivalence of short exact sequences;
and for cocycles it is cohomology.
It has proved remarkably profitable to study the matching equivalence classes
of each type of object in the Constellation that are found by propagating the
equivalence classes of RDSs around it. A few subtle errors have persisted in this
analysis, so more detailed background and clarification is presented next.
Equivalence for RDSs was originally defined by Pott [48, p. 198]. Observe that
a translate eRd of an RDS R in E relative to K by fixed elements e, d of E is an
RDS relative to K with the same parameters, and in fact we need only consider one-
sided translation. Similarly, an automorphism of E takes a normal subgroup K
of E to (K) and an RDS R in E relative to K to an RDS (R) relative to the
normal subgroup (K), with the same parameters. Moreover, (R) cannot be an
RDS relative to any other normal subgroup K
= (K) since if k
\ (K) then
k
in E, respectively, R R
Aut(E), e E : (K) = K
and (R) = e R
.
Given any normal subgroup K in E, there is an extension K E
E/K,
where is the natural quotient map. Any Aut(E) which maps K to K
also
defines the commuting isomorphism : E/K E/K
, d E,
which ensures the natural extensions K E
E/K and K
E/K
are
equivalent.
A normalised semiregular RDS R relative to K is a normalised transversal of K in
E relative to , with (r) = rK, r R. Although not all such transversals are RDSs,
we apply the same conditions to define equivalence of normalised transversals.
Definition 12 [34, Def. 8.1] Let T, T
to be equivalent, written
T T
and (T) = e T
.
For transversals as well as RDSs, it is sufficient to consider left-sided translation
only, since Td = d d
1
(T), where d
1
is the inner automorphism d
1
(e) = d
1
ed of
E. If N
= K
= K
and G
= E/K
= E/K
_
N
G
(9)
to see that Aut(E) induces Aut(N) and Aut(G), where
= and
= .
Equivalence between the transversals T, T
,
T
) of N by G, constructed using
(6) and (7). The equivalence classes of factor pairs are called bundles and the bundle
containing (, ) is denoted B((, )) (or B() when is trivial).
4.1 Bundles and equivalence classes of RDSs
When N is abelian, a great deal of progress has been made using the reverse equiva-
lence between bundles of cocycles and equivalence classes of semiregular RDSs. The
reader should keep in mind that bundles are not the same as cohomology classes;
indeed, the partitions of the group of cocycles induced by transversal equivalence
and by cohomology cut across each other. Cohomology classes, being cosets, all have
the same cardinality, but this is not in general true of bundles.
Cryptogr. Commun. (2010) 2:129154 147
When further, 1, so N = C is central in the extension group E, the bundle
B() = B((, 1)) of Z
2
(G, C) is
B() = { ( s) ( ) : Aut(C), Aut(G), s G},
where s(x, y) = (s, y)
1
(sx, y) is the shift action of s on (which effects
multiplication by e in Definition 12).
RP 50 [34, p. 177] is a general classification program for equivalence classes
of central semiregular RDSs based on identifying the corresponding bundle of
orthogonal cocycles.
One special case occurs when we restrict to the multiplicative cocycles, which
are precisely those for which the shift action is trivial, i.e. s = , s G. This
property of cocycles is preserved by equivalence and the corresponding transversals
are also termed multiplicative.
If a multiplicative cocycle is orthogonal, then C and G are both elementary abelian
p-groups for the same prime p. So each bundle of orthogonal multiplicative cocy-
cles determines an equivalence class of multiplicative semiregular RDSs, and vice
versa.
Multiplicative RDSs and presemif ields: RP 50, RP 53, RP 74 and RP 75 When C =
G = Z
n
p
, every orthogonal multiplicative cocycle on Z
n
p
is a multiplication function on
a presemifield of order p
n
with underlying abelian group
= Z
n
p
, and vice versa. Each
equivalence class of multiplicative central ( p
n
, p
n
, p
n
, 1)-RDSs relative to Z
n
p
in E
with E/Z
n
p
= Z
n
p
corresponds exactly to a strong isotopism class of presemifields of
order p
n
.
RP 53 [34, p. 181] asks if the number of equivalence classes of central ( p
n
, p
n
,
p
n
, 1)-RDS, when C = G = Z
n
p
, is always a power of p. RP 53 is true for n = 1: there
is only one isotopism class of presemifields (of GF( p)), containing p
0
= 1 bundle;
and RP 53 is supported by computational evidence for p
n
< 16.
RP 74 [34, p. 219] asks for the number of bundles when n = 2, and if it is always at
least p. When n = 2 the only presemifield isotopism class is again that of GF( p
2
).
Horadam and Farmer [38] solve RP 74 and prove that RP 53 is true for n = 2.
There are exactly p bundles (presemifield strong isotopism classes) over GF( p
2
),
only one of which is commutative. Representatives of each class are listed. Further,
in [29] it is shown that there are always at least 3( p 1) bundles over GF( p
3
).
However RP 53 is solved in the negative for p = 2. In [37] Horadam and Farmer
also show there are 1446 equivalence classes of central (16, 16, 16, 1)-RDSs relative
to Z
4
2
; this is not a power of 2. Even if RP 53 is restricted to isotopism classes of fields,
the number of RDS equivalence classes is not a power of 2, as even though there are
1, 2, 4, 32 bundles over GF(2), GF(4), GF(8), GF(16), respectively, there are 2094
bundles over GF(32).
RP 75 [34, p. 221] asks for the number of bundles in the presemifield isotopism
class of each of the non-commutative semifields V and W of order 16.
RP 75 is solved in [37], as part of the computation of all bundles over all three
semifields of order 16 (including GF(16)). There are 224 bundles in the presemifield
isotopism class of semifield W and 1190 in that of semifield V. Representative
presemifield multiplications are computed for each bundle.
148 Cryptogr. Commun. (2010) 2:129154
RP 50 is solved for the taxonomic class 16, 16, Z
4
2
, E, Z
4
2
, i, j with i =
GF(16), W, V and for each i, the representative 32, 224, 1190 presemifield multi-
plications, respectively.
4.2 Bundles in the splitting case
In [33] I initiated a study of splitting factor pairs. In the case of most interest to us, a
splitting factor pair has the form (, ) for some in the set C
1
(G, N) of normalised
functions G N, i.e. (1) = 1. Here
(x, y) = (x)(y)(xy)
1
, x, y G, (10)
which measures how much differs from a homomorphism, while : G Aut(N)
is the G-action induced by on N by inner automorphisms:
(x)(a) = a
(x)
= (x)a(x)
1
, a N, x G, (11)
so if N is abelian, the action is trivial and we have the case = 1 of (3).
Then two functions , C
1
(G, N) are (bundle) equivalent, written
b
, if
their corresponding splitting factor pairs are equivalent, i.e.
b
B
__
,
__
= B((, )) . (12)
The equivalence class b() of is also called a bundle.
Correction to [34, 8.2, 9.2.2] A minor error was made in [33] in the fundamental
definition of the bundle of a function, which has been repeated in [34, 37]. The error
matters only if N is nonabelian. We correct it here.
In [33, p. 90] and [34, p.170] it is stated that the group Hom
1
(G, N) of 1-crossed
mappings; that is, the normalised mappings : G N for which the splitting factor
pair (, ) equals the trivial factor pair (1, 1), is Hom(G, N). However, Hom(G, N)
consists of the functions which satisfy equality on the first coordinate only. Equality
on the second coordinate forces : G (N), where (N) is the centre of N.
Therefore Hom
1
(G, N) = Hom(G, (N)).
Hence the formula for the bundle of must be amended.
Definition 13 Let C
1
(G, N). The bundle of is b() =
_
( ( s) ) f : f Hom(G, (N)), Aut(G), Aut(N), s G
_
,
where s(x) = (s)
1
(sx) is the shift action of s on .
In [33, Eq. (21) and Theorem 3.3], [34, Denition 8.18 and Theorem 9.22.3] and
[37, Def. 1], Hom(G, N) must be replaced by Hom(G, (N)).
Un-normalised functions are in the same affine bundle
b( f ) if their normalisations
are in the same bundle; that is, for f, f
: G N,
f
b
f
b( f ) =
b( f
) b( f 1) = b( f
1). (13)
I argue that affine bundles are the most appropriate equivalence classes for functions
between groups.
The first reason for this is the Constellation (Fig. 1): the splitting case s gives
a suite of correspondences between generalised Perfect Nonlinear (PN) functions
Cryptogr. Commun. (2010) 2:129154 149
[34, Theorem 7.35] and four other stars [34, Theorem 7.30]. The second is that sub-
optimal measures of nonlinearity, such as the difference distribution of a function,
are also preserved by bundles. The third is that affine bundle equivalence coarsens
types of function equivalence which have arisen in other contexts: equivalence of
planar functions, affine equivalence of Boolean functions and linear equivalence of
cryptographic functions.
Bundles and EA classes of nonlinear functions: RP 66 In cryptography, we want
to collect functions over GF( p
n
) into equivalence classes which preserve measures
of two types: differential uniformity (a combinatorial and geometric condition) and
nonlinearity (a discrete Fourier spectrum condition). Optimal functions for the
former measure are called PN (Perfect Nonlinear) if p is odd, and APN (Almost
Perfect Nonlinear) if p = 2. When p is odd, PN functions coincide with planar
functions over Z
n
p
.
Two types of measure-preserving equivalence have emerged as most effective
for classifying functions f (x) over GF(2
n
). The first of these is extended affine
(EA) equivalence [10]. The definition generalises immediately to functions over
GF( p
n
), for p any prime. EA equivalence preserves the differential uniformity, the
nonlinearity, the resistance to algebraic cryptanalysis, and the algebraic degree of a
function.
Two functions f, f
: Z
n
p
Z
n
p
are EA equivalent if f
=
1
f
2
+ for some
affine functions
1
,
2
, over Z
n
p
, where
1
,
2
are permutations.
With Farmer, I have shown that over Z
n
2
, EA classes and affine bundles (13)
coincide, and our proof [38, Lemma 1] generalises immediately to odd primes.
Lemma 14 Two functions f, f
: Z
n
p
Z
n
p
are EA-equivalent if and only if
b( f ) =
b( f
).
RP 66 [34, p. 208] asks for new bundles of planar functions (and thus, when G =
N = Z
n
p
, for p odd, for new EA classes of PN functions).
Kyureghyan and Pott [40] list 6 currently known families of EA-inequivalent pla-
nar functions, of which 5 are Dembowski-Ostrom polynomials. If a planar function
on Z
n
p
, p odd, is a Dembowski-Ostrom polynomial, the corresponding coboundaries
are multiplicative, and vice versa, and the classification of EA classes of planar
functions is equivalent to the classification of strong isotopismclasses of commutative
presemifields of order p
n
. Coulter and Henderson [15] have shown this classification
is the same as the classification of isotopism classes of commutative semifields of
order p
n
. We note the 6th (Coulter-Matthews) family is not Dembowski-Ostrom and
does not define semifields.
Zha et al. [53] find a family of new planar functions by generalisation from new
APN functions, thus obtaining the first provably new construction of commutative
semifields in arbitrary odd characteristic. Very recently, Bierbrauer [6, 7] has in-
troduced a large family of functions and a general method which can be used to
prove that parametric subfamilies are PN, and obtains a new construction of planar
functions [7, Theorem 5]. He has informed me that an uncertainty which has surfaced
about interpretation of a result of Menichettis means more detail is needed to
demonstrate the semifields in [6, Theorem 7] are new.
150 Cryptogr. Commun. (2010) 2:129154
4.3 Generalisations of bundles
In this final subsection, we describe two equivalences which are coarser than RDS
and bundle equivalence but which are of independent interest.
4.3.1 Bundles and equivalence classes of (4t, 2, 4t, 2t)-RDS: RP 50
Cathin and Rders results [44] for RP 43 (see Section 3.1.3) have consequences
for the classification of central (4t, 2, 4t, 2t)-RDSs. Such RDSs are equivalent to
CHMs, and by [34, Corollaries 8.12 and 8.13] there is a set surjection from the set
of bundles of central (4t, 2, 4t, 2t)-RDSs to the set of Hadamard equivalence classes
of CHMs.
Their approach to finding all the classes of CHMs is to extend the definition of
equivalence class of RDSs (given at the beginning of Section 4) to allow antiautomor-
phisms (permutations with (xy) = (y)(x)) of E to act as well as automorphisms.
The group AntiAut(E) consisting of the automorphisms and antiautomorphisms
contains Aut(E) as a normal subgroup of index at most 2, and the transpose H
: Z
n
p
Z
n
p
are CCZ equivalent if there exists an automor-
phism : Z
2n
p
Z
2n
p
and an element e Z
2n
p
such that
_
{( f (x), x), x Z
n
p
}
_
= e +{( f
(x), x), x Z
n
p
}. (14)
Kyureghyan and Pott [40] have given a simple proof that each CCZ class of PN
functions over Z
n
p
, p odd, is a single EA class, so the two equivalences coincide in
this particular case.
It is known that EA equivalence implies CCZ equivalence [10, Proposition 3] and
the converse is known not to hold in general. In particular, a permutation over Z
n
2
and its inverse are CCZ equivalent but instances where they are EA-inequivalent are
known. Consequently [33, Corollary 3, p.95] which claim contrary results, repeated
in [34, Corollary 9.23, Theorem 9.24] and [37], are wrong.
It remains very difficult to tell in general when CCZ equivalent functions are EA-
inequivalent. It is known that two CCZ equivalent functions are EA equivalent if
and only if there exists an Aut(Z
2n
p
) of a particularly simple form, but many other
automorphisms not of this form will satisfy (14).
Cryptogr. Commun. (2010) 2:129154 151
The need to make inroads on this problem has become more acute after break-
throughs in the study of APN and PN functions. Until recently, the main focus of
search for such functions was amongst the power functions f (x) = x
d
defined over
GF( p
n
). However, in the past few years there has been a proliferation of discoveries
of new families of APN and PN functions EA-inequivalent to any power functions.
Some of the functions found have very intricate form, so proving EA inequivalence
to known families becomes a very daunting task. Some of the APN functions are also
CCZ-inequivalent to any power functions: recent surveys appear in [11, 40].
We can study the general version of this problem, for arbitrary functions f :
G N. The graph of f is the set S
f
= {( f (x), x), x G} N G. It is normalised
if f (1) = 1. This definition is consistent with the usual definition [10, p. 1143]
provided we switch first and second components. This can be done with no loss of
generality.
We see immediately that the graph S
and S
) = e S
) = e S
} . (15)
Two functions f, f
1 C
1
(G, N) are graph equivalent. The corresponding equivalence class of
f is its affine graph bundleg( f ). Because S
f
= ( f (1), 1)S
f 1
we see that
f g( f
) f 1 g( f
1), (16)
so restricting to normalised functions does not lead to any loss of information.
Generalising [35, Lemma 2] from p = 2 to any prime, we have:
Example 16 Let G = N = Z
n
p
and let f : G G. Then the affine graph bundleg( f )
of f equals the CCZ-equivalence class of f .
Prima facie, the definition of equivalence for graphs is similar to that for transver-
sals. As we have established, however, transversal equivalence also requires the
commuting diagram (9). Two examples illustrate the difference.
In the first example, a function is equivalent to itself under a nontrivial graph
equivalence but because the extensions are equivalent, the graph equivalence is a
transversal equivalence.
Example 17 In (9) let N = G be abelian and E = G G. Let K = G {1},
(a) = (a, 1) and ((a, x)) = x. Let K
= {(a, a) : a G}
= K,
((a, x)) = a
1
x, so K
= im
. Then S
1
is a transversal
T
1
= {t
x
= (1, x), x G} of K with respect to and since
(t
x
) = (t
x
) = x, S
1
is
also the transversal T
1
of K
with respect to
= {1} G,
((a, x)) = a.
Let : G G be a normalised permutation with inverse inv(). The graphs
S
and S
inv()
are transversals T
= {t
x
= ((x), x), x G} and T
inv()
= {t
x
=
(inv()(x), x), x G}, respectively, of K with respect to . Under the permutation
x (x), S
inv()
is also the transversal T = {t
x
= (x, (x)), x G} of K
with respect
to
(G) and (T
) = T. Thus S
S
inv()
but T
T.
In Example 18 the splitting factor pairs for T