Keep this fact.

By linear algebra, we can know that $M'_{1} \times M=M'_{2}$.

Let $\beta _i$ be a row of $M'_{1}$ which is correspond to $M'_2$ 's $[0,0,...,0]$ row

and let $\beta_i=[\beta_{0,i},\beta_{1,i},...,\beta_{2^n-1,i}]$

Then we can know that $\beta_{i} \times M=[0,0,...,0] $ by above fact.

So, if we define $b_i(x)=\beta_{0,i}x^0 \oplus \beta_{1,i}x^1 \oplus \cdot\cdot\cdot \oplus \beta_{2^n-1,i}x^{2^n-1}$.

Then, $$b_i(x)\oplus b_i(S(x))=\bigoplus_{u\in\mathbb{F}_2^n}\beta_{u,i}(x^u \oplus S(x)^u) $$

$$=\bigoplus_{u\in\mathbb{F}_2^n} \beta_{u,i}(\bigoplus_{v\in\mathbb{F}_2^n} \lambda_{u,v}x^v )$$

$$=\bigoplus_{u\in\mathbb{F}_2^n}(\bigoplus_{v\in\mathbb{F}_2^n}\beta_{u,i}\lambda_{u,v})x^v $$

$$=0$$

We can apply this formula similary to the case of $[1,0,...,0]$.

Keep this fact.

By linear algebra, we can know that $M'_{1} \times M=M'_{2}$.

Let $\beta _i$ be a row of $M'_{1}$ which is correspond to $M'_2$ 's $[0,\ldots,0]$ row

and let $\beta_i=[\beta_{0,i},\beta_{1,i},\ldots,\beta_{2^n-1,i}]$

Then we can know that $\beta_{i} \times M=[0,\ldots,0] $ by above fact.

So, if we define $b_i(x)=\beta_{0,i}x^0 \oplus \beta_{1,i}x^1 \oplus \cdot\cdot\cdot \oplus \beta_{2^n-1,i}x^{2^n-1}$.

Then,

\begin{align} b_i(x)\oplus b_i(S(x))= & \bigoplus_{u\in\mathbb{F}_2^n}\beta_{u,i}\big(x^u \oplus S(x)^u\big)\\ = & \bigoplus_{u\in\mathbb{F}_2^n} \beta_{u,i}\big(\bigoplus_{v\in\mathbb{F}_2^n} \lambda_{u,v}x^v \big)\\ = & \bigoplus_{u\in\mathbb{F}_2^n}\big(\bigoplus_{v\in\mathbb{F}_2^n}\beta_{u,i}\lambda_{u,v}\big)x^v\\ =& 0 \end{align}

We can apply this formula similarly to the case of $[1,0,\ldots,0]$.

By linear algebra, we can know that $M'_{1} \times M=M'_{2}$.

Using this fact, we can get such conclusion.

Keep this fact.

By linear algebra, we can know that $M'_{1} \times M=M'_{2}$.

Let $\beta _i$ be a row of $M'_{1}$ which is correspond to $M'_2$ 's $[0,0,...,0]$ row

and let $\beta_i=[\beta_{0,i},\beta_{1,i},...,\beta_{2^n-1,i}]$

Then we can know that $\beta_{i} \times M=[0,0,...,0] $ by above fact.

So, if we define $b_i(x)=\beta_{0,i}x^0 \oplus \beta_{1,i}x^1 \oplus \cdot\cdot\cdot \oplus \beta_{2^n-1,i}x^{2^n-1}$.

Then, $$b_i(x)\oplus b_i(S(x))=\bigoplus_{u\in\mathbb{F}_2^n}\beta_{u,i}(x^u \oplus S(x)^u) $$

$$=\bigoplus_{u\in\mathbb{F}_2^n} \beta_{u,i}(\bigoplus_{v\in\mathbb{F}_2^n} \lambda_{u,v}x^v )$$

$$=\bigoplus_{u\in\mathbb{F}_2^n}(\bigoplus_{v\in\mathbb{F}_2^n}\beta_{u,i}\lambda_{u,v})x^v $$

$$=0$$

We can apply this formula similary to the case of $[1,0,...,0]$.