The NSUCRYPTO 2019 conjecture on the Kasami APN function: exhaustive verification for n ≤ 18, an equidistribution of cubes at even n, and the weight distributions computed along the way

The field model is checked, not assumed: F₂[x]/(redPoly n) is a field of order 2ⁿ for 3 <= n <= 20, the tabulated generator generates F_(2ⁿ)^*, the trace equals the parity-of-a-mask formula the fast evaluation of S uses, and the shift-and-xor product is commutative, associative and distributive on all 2³ⁿ triples for n <= 7

Table 2 of arXiv:2608.18584 in full: |supp S 0| and the value histogram of S on a!= 0 for all thirty-two (n,k) cells of its thirteen listed rows, together with the two sanity sums sum_(a!=0) S(a) = 2ⁿ⁻¹ and sum_(a!=0) S(a)² = 2²ⁿ⁻²

The two evaluations of S(a) = sum_(t in Delta) (-1)^(Tr(at)) agree for every a: the parity-table form Tr(at) = parity(phi(a) AND t) used by the sweeps, and the honest form that multiplies a by t in the field and takes the full trace of the product

The term-skipping sum the sweeps evaluate is the plain sum: zAcc = zAccPlain and hence zSweepOK n k = zSweepPlainOK n k, for every n and k, by induction

The conjecture verified at the level of its own definition, with no character sum anywhere: N(1,rho) = 2²ⁿ⁻³ counted directly over Delta³ for every rho in F_(2ⁿ) 0,1 and every admissible k, for every 3 <= n <= 12; plus sampled rho at n = 13

The source's own top verified range redone here: the conjecture at n = 13 for all twelve admissible k, exhaustively over all 8190 rho, through the character reduction

The conjecture at n = 14: N(v1,v2) = 2²ⁿ⁻³ for every admissible k (1,3,5,9,11,13) and every pair of distinct nonzero (v1,v2), exhaustively over all 2ⁿ - 2 values of rho = v2/v1

The conjecture at n = 15: N(v1,v2) = 2²ⁿ⁻³ for every admissible k (1,2,4,7,8,11,13,14) and every pair of distinct nonzero (v1,v2), exhaustively over all rho

The conjecture at n = 16: N(v1,v2) = 2²ⁿ⁻³ for every admissible k (1,3,5,7,9,11,13,15) and every pair of distinct nonzero (v1,v2), exhaustively over all rho

The conjecture at n = 17: N(v1,v2) = 2²ⁿ⁻³ for all sixteen admissible k and every pair of distinct nonzero (v1,v2), exhaustively over all rho

N(1,rho) = 2²ⁿ⁻³ counted from the definition, with no character sum, at sampled rho for n = 14, 15, 16 (every admissible k) and n = 17

The spectrum of S continued past the last row of the source's Table 2: |supp S 0| and the full value histogram of S on a!= 0 for n = 14, 15, 16 (every admissible k) and n = 17 (k = 1,2,3,5), with both of the source's sanity sums – equivalently, the complete weight distribution of the code C_(D(f)) of arXiv:1511.00321 for the Kasami defining set at those m (2026-08-28: also binds 16 SpectrumOdd fill-in theorems for odd n <= 13 cells missing from the source Table 2)

The source's Proposition 4.1 tested against the definition where it has content: 2ⁿ N(1,rho) = |Delta|³ + Z(rho) at ten (n,k) with gcd(k,n) > 1, where |Delta|!= 2ⁿ⁻¹ and Z(rho) is a large nonzero number varying with rho, and at seven admissible (n,k)

Negative controls: the constant 2²ⁿ⁻³ is refuted from both sides and off by one; gcd(k,n) = 1 is not idle (at every tested (n,k) with gcd > 1 both |Delta| = 2ⁿ⁻¹ and the conjecture fail, with explicit nonzero values of Z); 'distinct nonzero v1,v2' is not idle (at v1 = v2 and at v2 = 0 the count is 2²ⁿ⁻², twice the conjectured value); and the field check rejects reducible moduli

The conjecture at n = 18: N(v1,v2) = 2²ⁿ⁻³ for every admissible k (1,5,7,11,13,17) and every pair of distinct nonzero (v1,v2), exhaustively over all 262142 values of rho = v2/v1

The spectrum of S at the whole n = 18 cell: |supp S 0| and the value histogram of S on a!= 0 for all six admissible k, with both of the source's sanity sums – equivalently the complete weight distribution of the code C_(D(f)) of arXiv:1511.00321 at m = 18, a fifteen-weight [131072, 18, 64384] binary code

A rho-sweep split into two consecutive ranges is the whole sweep: zLoop is additive in its fuel, zLoop T2 L M tgt (a+b) rho = zLoop... a rho && zLoop... b (rho+a), by induction; hence zSweepOK n k = zSweepChunk n k 2 c1 && zSweepChunk n k (2+c1) c2 whenever c1 + c2 = 2ⁿ - 2

N(1,rho) = 2³³ counted from the definition over Delta³, with no character sum anywhere, at sampled rho for n = 18 (k = 5 and k = 7)

Negative controls for the n = 18 work: a chunk is exactly its range and no more (a chunk true, the whole sweep false, at an inadmissible cell); the split arithmetic is a real constraint; the split lemma reproduces an independently checked sweep at (10,3); and the constant 0 is pinned at (18,5) from both sides

The Dillon-Dobbertin invariant of Delta, checked from the definition: |Delta* ∩ mu Delta*| = 2ⁿ⁻² - 1 for every mu!= 1, at every admissible (n,k) with 5 <= n <= 15 and at (16,3), (16,7)

The twelve n = 17 spectrum cells that Spectrum17.lean left out (k = 4,6,7,8,9,10,11,12,13,14,15,16), completing all sixteen – hence every admissible (n,k) with n odd and 5 <= n <= 17

Delta is closed under squaring (at every admissible (n,k) with 5 <= n <= 16 and all six cells at n = 18) and S is Frobenius-invariant: S(a²) = S(a) for every a (at every admissible (n,k) with 5 <= n <= 16 and at (18,5)); hence every level set of S is a union of cyclotomic cosets, and a level set of size 1 must be 1. At (15,4) and (18,5) the unique extreme value of S is therefore S(1) = 1024 and S(1) = -2560

The cube-refined triple counts that Carlet names as what the even-n case needs, and their three-coset refinement: for gcd(k,n) = 1, n even and every pair of distinct nonzero v1,v2, writing s = v1x+v2y+(v1+v2)z and C for the cubes, #(x,y,z) in Delta³: s in C = #s in wC = #s in w²C = (2³ⁿ⁻³ - 2²ⁿ⁻³)/3, hence #s a nonzero cube = (2³ⁿ⁻³ - 2²ⁿ⁻³)/3 and #s a non-cube = 2(2³ⁿ⁻³ - 2²ⁿ⁻³)/3 – equivalently the cubic multiplicative character sum over the triples with s!= 0 vanishes. Exhaustively over all rho at n = 4, 6, 8 (every admissible k, both cosets) and at (10,3), and at sampled rho for (10,7), (12,5), (12,7)