Maximum Distance Separable Matrix Research Articles

Optimizing implementations of linear layers using two and higher input XOR gates.

Maximum distance separable (MDS) matrices are often used in the linear layer of a block cipher due to their good diffusion property. A well-designed lightweight MDS matrix, especially an involutory one, can provide both security and performance benefits to the cipher. Finding the corresponding effective linear straight-line program (SLP) of the circuit of a linear layer is still a challenging problem. In this article, first, we propose a new heuristic algorithm called Superior Boyar-Peralta (SBP) in the computation of the minimum number of two-input Exclusive-OR (XOR) gates with the minimum circuit depth for the SLPs. Contrary to the existing global optimization methods supporting only two-input XOR gates, SBP heuristic algorithm provides the best global optimization solutions, especially for extracting low-latency circuits. Moreover, we give a new 4 × 4 involutory MDS matrix over F24, which requires only 41 XOR gates and depth 3 after applying SBP heuristic, whereas the previously best-known cost is 45 XOR gates with the same depth. In the second part of the article, for further optimization of the circuit area of linear layers with multiple-input XOR gates, we enhance the recently proposed BDKCI heuristic algorithm by incorporating circuit depth awareness, which limits the depth of the circuits created. By using the proposed circuit depth-bounded version of BDKCI, we present better circuit implementations of linear layers of block ciphers than those given in the literature. For instance, the given circuit for the AES MixColumn matrix only requires 44 XOR gates/depth 3/240.95 GE in the STM 130 nm (simply called ASIC4) library, while the previous best-known result is 55 XOR gates/depth 5/243.00 GE. Much better, our new 4 × 4 involutory MDS matrix requires only 19 XOR gates/depth3/79.75 GE in the STM 90 nm (simply called ASIC1) library, which is the lightest and superior to the state-of-the-art results.

WAS: improved white-box cryptographic algorithm over AS iteration

The attacker in white-box model has full access to software implementation of a cryptographic algorithm and full control over its execution environment. In order to solve the issues of high storage cost and inadequate security about most current white-box cryptographic schemes, WAS, an improved white-box cryptographic algorithm over AS iteration is proposed. This scheme utilizes the AS iterative structure to construct a lookup table with a five-layer ASASA structure, and the maximum distance separable matrix is used as a linear layer to achieve complete diffusion in a small number of rounds. Attackers can be prevented from recovering the key under black-box model. The length of nonlinear layer S and affine layer A in lookup table is 16 bits, which effectively avoids decomposition attack against the ASASA structure and makes the algorithm possess anti-key extraction security under the white-box model, while WAS possesses weak white-box (32 KB, 112)-space hardness to satisfy anti-code lifting security. WAS has provable security and better storage cost than existing schemes, with the same anti-key extraction security and anti-code lifting security, only 128 KB of memory space is required in WAS, which is only 14% of SPACE-16 algorithm and 33% of Yoroi-16 algorithm.

A note on semi-orthogonal (G-matrix) and semi-involutory MDS matrices

Maximum Distance Separable (MDS) matrices are widely used in various cryptographic constructions since they provide perfect diffusion. Further, MDS matrices with easy-to-implement inverses are useful in designing diffusion layers in block ciphers. It is known that the inverse of an MDS matrix is computationally inexpensive if the matrix is either orthogonal or involutory. Generalizing the notion of orthogonal matrices, Fiedler et al. introduced semi-orthogonal property in 2012. Following this, Cheon et al. introduced semi-involutory property to generalize the involutory property in 2021. In both these cases, the aim of the authors was to construct matrices having computationally simple inverses.In this work, we show that some existing Cauchy and Vandermonde based constructions of MDS matrices satisfy semi-orthogonal properties. We give some characterization of 3×3 and 4×4 semi-involutory and semi-orthogonal matrices in light of the MDS property. We also provide some results on circulant matrices with semi-involutory and semi-orthogonal properties. Finally we give a characterization of 4×4 semi-involutory matrices which is a generalization of the 3×3 case of Cheon et al.

FAST COMPUTATION OF DIRECT EXPONENTIATION TO SPEED UP IMPLEMENTATION OF DYNAMIC BLOCK CIPHERS

MDS (maximum distance separable) matrices are ones that come from MDS codes that have been studied for a long time in error correcting code theory and have many applications in block ciphers. To improve the security of block ciphers, dynamic block ciphers can be created. Using MDS matrix transformations is a method used to make block ciphers dynamic. Direct exponentiation is a transformation that can be used to generate dynamic MDS matrices to create a dynamic diffusion layer of the block ciphers. However, for cryptographic algorithms that use an MDS matrix as a component of them, the implementation of matrix multiplication is quite expensive, especially when the matrix has a large size. In this paper, the mathematical basis for quick calculation of direct exponentiation of an MDS matrix will be presented. On that basis, it is to suggest how to apply that fast calculation to dynamic algorithms using the direct exponentiation. This result is very meaningful in software implementation for MDS matrices, especially when implementing dynamic block ciphers to increase execution speed.

More Constructions of Light MDS Transforms Based on Known MDS Circulant Matrices

Maximum distance separable (MDS) codes have the maximum branch number in cryptography, and they are generally used in diffusion layers of symmetric ciphers. The diffusion layer of the Advanced Encryption Standard (AES) uses the circulant MDS matrix with the row element of {2;3;1;1} in F28. It is the simplest MDS matrix in F2n4, recorded as A=Circ(2;3;1;1). In this paper, we study the more extensive MDS constructions of A in F2n4. By transforming the element multiplication operation in the finite field into the bit-level operation, we propose a multivariable operation definition based on simple operations, such as cyclic shift, shift, and XOR. We apply this multivariable operation to more lightweight MDS constructions of A and discuss the classification of the MDS clusters. We also give an example of the MDS cluster of A. Without changing the structure, elements, and the implementation cost of the known MDS matrix, the number of existing MDS transformations is expanded to n2/2 times that of its original. The constructions in this paper provide rich component materials for the design of lightweight cryptographic algorithms.

Maximum Distance Separable (MDS) Matrix of size m x m over Zq

The Maximum Distance Separable (MDS) code is one of the codes that known as error-correcting code where the generator matrix [I|A] is arranged by the identity matrix and the MDS matrix. In coding, MDS matrix can detect and correct errors optimally. A matrix over the Zq is called an MDS matrix if and only if all the determinants of its square submatrix are non-zero. A matrix over the Zq is called an MDS matrix if and only if all the determinants of its square submatrix are non-zero. In m x m matrix over Zq, the analyzed of possible entries and determinants of submatrix can be declare the existence of an MDS matrix of size m x m over Zq. The result is there will be no MDS matrix of size m x m where m greater than or equal to [(q-1)^2 + 1] - [q-2] for Zq with any of q. For Zq with q prime, there will be no MDS matrix of size m x m where m greater than or equal to [(q-1)^2 + 1] - [q-2] - [1/2 x (q-1)].

Towards Low-Latency Implementation of Linear Layers

Lightweight cryptography features a small footprint and/or low computational complexity. Low-cost implementations of linear layers usually play an important role in lightweight cryptography. Although it has been shown by Boyar et al. that finding the optimal implementation of a linear layer is a Shortest Linear Program (SLP) problem and NP-hard, there exist a variety of heuristic methods to search for near-optimal solutions. This paper considers the low-latency criteria and focuses on the heuristic search of lightweight implementation for linear layers. Most of the prior approach iteratively combines the inputs (of linear layers) to reach the output, which can be regarded as the forward search. To better adapt the low-latency criteria, we propose a new framework of backward search that attempts to iteratively split every output (into an XORing of two bits) until all inputs appear. By bounding the time of splitting, the new framework can find a sub-optimal solution with a minimized depth of circuits.We apply our new search algorithm to linear layers of block ciphers and find many low-latency candidates for implementations. Notably, for AES Mixcolumns, we provide an implementation with 103 XOR gates with a depth of 3, which is among the best hardware implementations of the AES linear layer. Besides, we obtain better implementations in XOR gates for 54.3% of 4256 Maximum Distance Separable (MDS) matrices proposed by Li et al. at FSE 2019. We also achieve an involutory MDS matrix (in M4(GL(8, F2))) whose implementation uses the lowest number (i.e., 86, saving 2 from the state-of-the-art result) of XORs with the minimum depth.

О построении циркулянтных матриц, связанных с MDS-матрицами

The objective of this paper is to suggest a method of the construction of circulant matrices, which are appropriate for being MDS (Maximum Distance Separable) matrices utilising in cryptography. Thus, we focus on designing so-called bi-regular circulant matrices, and furthermore, impose additional restraints on matrices in order that they have the maximal number of some element occurrences and the minimal number of distinct elements. The reason to construct bi-regular matrices is that any MDS matrix is necessarily the bi-regular one, and two additional restraints on matrix elements grant that matrix-vector multiplication for the samples constructed may be performed efficiently. The results obtained include an upper bound on the number of some element occurrences for which the circulant matrix is bi-regular. Furthermore, necessary and sufficient conditions for the circulant matrix bi-regularity are derived. On the basis of these conditions, we developed an efficient bi-regularity verification procedure. Additionally, several bi-regular circulant matrix layouts of order up to 31 with the maximal number of some element occurrences are listed. In particular, it appeared that there are no layouts of order 32 with more than 5 occurrences of any element which yield a bi-regular matrix (and hence an MDS matrix).

Efficient Implementation of Lightweight MDS Matrix on FPGA

Recently, studying of Maximum Distance Separable (MDS) matrix has become a topic of interest. The MDS matrix is the most important component of the diffusion layer in block ciphers. This paper introduces an optimized, low-cost hardware construction of Galois Field GF(2^8 ) 4×4 MDS matrix. The proposed design is implemented on Field programmable Gate Array (FPGA). The proposed design is synthesized targeting Virtex-7 FPGA using Xilinx ISE Design suite. Xilinx primitives LUT6 and LUT6_2 were used to control exactly the component placement in the design to maintain the minimum occupation area. The pipeline and parallel implementation techniques were used to improve the speed performance. The verification of the functionality of the proposed design has been proved using the ModelSim simulation tool. The synthesis result of the proposed design shows that, the new proposed architecture provides very competitive area and throughput trade-offs. In comparison with other related designs, the proposed design occupies the least area with the minimum time delay. The area of the developed MDS matrix design was significantly reduced, 68 LUT, with high throughput of 21.178 Gbps. The proposed design is a suitable candidate for lightweight cryptographic implementations.

Sparse MDS Matrices over Small Fields: A Proof of the GM-MDS Conjecture

A $k \times n$ matrix over a field is called an MDS (maximum distance separable) matrix if it satisfies the following property: Any $k$ columns of it are linearly independent. Equivalently, its rows span an MDS code. A question arising in coding theory is what zero patterns MDS matrices can have. There is a natural combinatorial condition, called the rectangle condition, which is necessary over any field, and sufficient over exponentially large fields, concretely of size ${n-1 \choose k-1}$. The GM-MDS conjecture of Dau, Song, and Yuen [On the existence of MDS codes over small fields with constrained generator matrices, in 2014 IEEE International Symposium on Information Theory (ISIT), pp. 1787--1791] speculated that whenever the rectangle condition holds, there exist algebraic constructions over much smaller fields of size $n+k-1$, and gave an algebraic conjecture that implies this. In this work, we prove this algebraic conjecture. In an independent and parallel work, Yildiz and Hassibi [Optimum linear codes with support constraints over small fields, in 2018 IEEE Information Theory Workshop (ITW), pp. 1--5] found an alternative proof for the algebraic conjecture.

Enhancing advance encryption standard security based on dual dynamic XOR table and MixColumns transformation

An efficient approach to secure information is critically needed at present. Cryptography remains the best approach to achieve security. On this basis, the National Institute of Standards and Technology (NIST) selected Rijndael, which is a symmetric block cipher, as the advanced encryption standard (AES). The MixColumns transformation of this cipher is the most important function within the linear unit and the major source of diffusion. Dynamic MixColumns transformation can be used to enhance the AES security. In this study, a method to enhance the AES security is developed on the basis of two methods. The first method is an extension of a previous study entitled “A novel Approach for Enhancing Security of Advance Encryption Standard using Private XOR Table and 3D chaotic regarding to Software quality Factor.” In the current study, the fixed XOR operation in AES rounds is replaced with a dual dynamic XOR table by using a 3D chaotic map. The dual dynamic XOR table is based on 4 bits; one is used for even rounds, and the other is used for odd rounds. The second method is dynamic MixColumns transformation, where the maximum distance separable (MDS) matrix of the MixColumns transformation, which is fixed and public in every round, is changed with a dynamic MDS matrix, which is private, by using a 3D chaotic map. A 3D chaotic map is used to generate secret keys. These replacements enhance the AES security, particularly the resistance against attacks. Diehard and NIST tests, entropy, correlation coefficient, and histogram are used for security analysis of the proposed method. C++ is used to implement the proposed and original algorithms. MATLAB and LINX are used for the security analysis. Results show that the proposed method is better than the original AES.

Applications of design theory for the constructions of MDS matrices for lightweight cryptography

Abstract In this paper, we observe simple yet subtle interconnections among design theory, coding theory and cryptography. Maximum distance separable (MDS) matrices have applications not only in coding theory but are also of great importance in the design of block ciphers and hash functions. It is nontrivial to find MDS matrices which could be used in lightweight cryptography. In the SAC 2004 paper [12], Junod and Vaudenay considered bi-regular matrices which are useful objects to build MDS matrices. Bi-regular matrices are those matrices all of whose entries are nonzero and all of whose 2 × 2 {2\times 2} submatrices are nonsingular. Therefore MDS matrices are bi-regular matrices, but the converse is not true. They proposed the constructions of efficient MDS matrices by studying the two major aspects of a d × d {d\times d} bi-regular matrix M, namely v 1 ⁢ ( M ) {v_{1}(M)} , i.e. the number of occurrences of 1 in M, and c 1 ⁢ ( M ) {c_{1}(M)} , i.e. the number of distinct elements in M other than 1. They calculated the maximum number of ones that can occur in a d × d {d\times d} bi-regular matrices, i.e. v 1 d , d {v_{1}^{d,d}} for d up to 8, but with their approach, finding v 1 d , d {v_{1}^{d,d}} for d ≥ 9 {d\geq 9} seems difficult. In this paper, we explore the connection between the maximum number of ones in bi-regular matrices and the incidence matrices of Balanced Incomplete Block Design (BIBD). In this paper, tools are developed to compute v 1 d , d {v_{1}^{d,d}} for arbitrary d. Using these results, we construct a restrictive version of d × d {d\times d} bi-regular matrices, introducing by calling almost-bi-regular matrices, having v 1 d , d {v_{1}^{d,d}} ones for d ≤ 21 {d\leq 21} . Since, the number of ones in any d × d {d\times d} MDS matrix cannot exceed the maximum number of ones in a d × d {d\times d} bi-regular matrix, our results provide an upper bound on the number of ones in any d × d {d\times d} MDS matrix. We observe an interesting connection between Latin squares and bi-regular matrices and study the conditions under which a Latin square becomes a bi-regular matrix and finally construct MDS matrices from Latin squares. Also a lower bound of c 1 ⁢ ( M ) {c_{1}(M)} is computed for d × d {d\times d} bi-regular matrices M such that v 1 ⁢ ( M ) = v 1 d , d {v_{1}(M)=v_{1}^{d,d}} , where d = q 2 + q + 1 {d=q^{2}+q+1} and q is any prime power. Finally, d × d {d\times d} efficient MDS matrices are constructed for d up to 8 from bi-regular matrices having maximum number of ones and minimum number of other distinct elements for lightweight applications.

DIRECT EXPONENT AND SCALAR MULTIPLICATION TRANSFORMATIONS OF MDS MATRICES: SOME GOOD CRYPTOGRAPHIC RESULTS FOR DYNAMIC DIFFUSION LAYERS OF BLOCK CIPHERS

Abstract: MDS (Maximum Distance Separable) matrices have an important role in the design of block ciphers and hash functions. The methods for transforming an MDS matrix into other ones have been proposed by many authors in the literature. In this paper, some new results about direct exponent and scalar multiplication transformations are given including the preservation of good cryptographic properties (the coefficient of fixed points and involutory property) of MDS matrices and other important cryptographic properties obtained from studying equivalence relations based on these transformations. An estimation of the number of MDS matrices over is also presented. In addition, these results are shown to be an important theoretical basis for building efficient dynamic diffusion layer algorithms for block ciphers.

The preservation of good cryptographyic properties of MDS matrix under direct exponent transformation

Maximum Distance Separable (MDS) code has been studied for a long time in the coding theory and has been applied widely in cryptography. The methods for transforming an MDS into other ones have been proposed by many authors in the literature. These methods are called MDS matrix transformations in order to generate different MDS matrices (dynamic MDS matrices) from an existing one. In this paper, some new results on the preservation of many good cryptographic properties of MDS matrices under direct exponent transformation are presented. These good cryptographic properties include MDS, involutory, symmetric, recursive (exponent of a companion matrix), the number of 1's and distinct elements in a matrix, circulant and circulant-like. In addition, these results are shown to have important applications in constructing dynamic diffusion layers for block ciphers. The strength of the ciphers against developing cryptanalytic techniques can be enhanced by the dynamic MDS diffusion layers.

On construction of involutory MDS matrices from Vandermonde Matrices in GF(2 q )

Due to their remarkable application in many branches of applied mathematics such as combinatorics, coding theory, and cryptography, Vandermonde matrices have received a great amount of attention. Maximum distance separable (MDS) codes introduce MDS matrices which not only have applications in coding theory but also are of great importance in the design of block ciphers. Lacan and Fimes introduce a method for the construction of an MDS matrix from two Vandermonde matrices in the finite field. In this paper, we first suggest a method that makes an involutory MDS matrix from the Vandermonde matrices. Then we propose another method for the construction of 2 n × 2 n Hadamard MDS matrices in the finite field GF(2 q ). In addition to introducing this method, we present a direct method for the inversion of a special class of 2 n × 2 n Vandermonde matrices.