A function f : Z n → C can be represented as a linear combination f (where f is the (discrete) Fourier transform of f . Clearly, the basis {χ α,n (x) := exp(2πiαx/n)} depends on the value n.We show that if f has "large" Fourier coefficients, then the function f : Z m → C, given byalso has "large" coefficients. Moreover, they are all contained in a "small" interval around ⌊ m n α⌉ for each α ∈ Z n such that f (α) is large. One can use this result to recover the large Fourier coefficients of a function f by redefining it on a convenient domain. One can also use this result to reprove a result by Morillo and Ràfols: single-bit functions, defined over any domain, have a small set of large coefficients.

Ideas from Fourier analysis have been used in cryptography for the last three decades. Akavia, Goldwasser and Safra unified some of these ideas to give a complete algorithm that finds significant Fourier coefficients of functions on any finite abelian group. Their algorithm stimulated a lot of interest in the cryptography community, especially in the context of "bit security". This manuscript attempts to be a friendly and comprehensive guide to the tools and results in this field. The intended readership is cryptographers who have heard about these tools and seek an understanding of their mechanics and their usefulness and limitations. A compact overview of the algorithm is presented with emphasis on the ideas behind it. We show how these ideas can be extended to a "modulus-switching" variant of the algorithm. We survey some applications of this algorithm, and explain that several results should be taken in the right context. In particular, we point out that some of the most important bit security problems are still open. Our original contributions include: a discussion of the limitations on the usefulness of these tools; an answer to an open question about the modular inversion hidden number problem.

No abstract