MDS Diffusion Research Articles

Nonlinear 4 × 4 MDS diffusion layers

Nonlinear diffusion layers are less studied in cryptographic literature, up to now. In 2018, Liu, Rijmen and Leander studied nonlinear non-MDS diffusion layers and mentioned some advantages of them. As they stated, nonlinear diffusion layers could make symmetric ciphers more resistant against statistical and algebraic cryptanalysis. In this paper, we examine nonlinear MDS mappings and present a family of 4 × 4 nonlinear MDS diffusion layers. Then, we discuss the optimized implementation of the proposed family in software- oriented applications.

Provable one-XOR matrices for construction of 4 × 4 hardware-oriented MDS diffusion layers

MDS diffusion layers are critical in the design of modern symmetric ciphers. Lightweight MDS matrices are studied for designing ciphers targeting hardware-oriented applications. In 2016, Beierle, Kranz, and Leander studied elements for which x → ax could be implemented with only one XOR in hardware. Then, they searched for such a’s satisfying the desired conditions for MDS-ness of some constructions. We adopt an opposite approach: we fix the conditions that A, A 3⊕ I and A 7 ⊕ I are n × n invertible binary matrices and then give provable binary n × n one-XOR matrices for which the mentioned conditions hold. Note that these conditions are sufficient ones for MDS-ness of many well-known constructions of 4 × 4 MDS matrices over n-bit words such as some recursive MDS diffusion layers as well as circulant AES-like MDS matrices.

Randomized nonlinear software-oriented MDS diffusion layers

Abstract MDS diffusion layers are critical components in the design of symmetric ciphers. In this paper, after introducing some new algebraic structures, we provide new MDS matrices over special types of R-modules. With the help of the proposed methodology, we have more flexibility in designing software-oriented diffusion layers. Most notably, we construct randomized and/or nonlinear MDS diffusion layers, based upon the presented theoretical results, and discuss the resistance of the presented diffusion layers against various kinds of cryptanalysis, compared with classical linear diffusion layers.

Optimizing Implementations of Lightweight Building Blocks

We study the synthesis of small functions used as building blocks in lightweight cryptographic designs in terms of hardware implementations. This phase most notably appears during the ASIC implementation of cryptographic primitives. The quality of this step directly affects the output circuit, and while general tools exist to carry out this task, most of them belong to proprietary software suites and apply heuristics to any size of functions. In this work, we focus on small functions (4- and 8-bit mappings) and look for their optimal implementations on a specific weighted instructions set which allows fine tuning of the technology. We propose a tool named LIGHTER, based on two related algorithms, that produces optimized implementations of small functions. To demonstrate the validity and usefulness of our tool, we applied it to two practical cases: first, linear permutations that define diffusion in most of SPN ciphers; second, non-linear 4-bit permutations that are used in many lightweight block ciphers. For linear permutations, we exhibit several new MDS diffusion matrices lighter than the state-of-the-art, and we also decrease the implementation cost of several already known MDS matrices. As for non-linear permutations, LIGHTER outperforms the area-optimized synthesis of the state-of-the-art academic tool ABC. Smaller circuits can also be reached when ABC and LIGHTER are used jointly.

Searching for perfect diffusion matrices with lightweight coefficients

Diffusion layer is one of the main components of block ciphers and hash functions. MDS matrices are widely used to implement the diffusion layer. In this article, we first study the 4 × 4 MDS diffusion matrices constructed with linear feedback shift registers (LFSRs) of Fibonacci. For better hardware implementation, we focus on the low Hamming weight coefficients which are in the set {1,α,α+1,α2,α2+1,α3} and there are not two identical elements in a row or column. In addition, we introduce a way to calculate the number of XORs. Then, we give the minimum of XORs required to implement a multiplication by a finite element x by using GF(28) defined by different irreducible polynomials and present some new lightweight coefficients that are lighter than the current known ones, such as the ones used in AES. These MDS matrices not only are lighter than AES diffusion matrix but also do not contain two identical elements in a row or column.

Generalized Feistel networks revisited

This work deals with the classification, security and efficiency of generalized Feistel networks (GFNs) with 4 lines. We propose a definition of a GFN, essentially limiting consideration to Feistel-type constructions with domain-preserving F-functions and rotation by one line between rounds. Under this definition, we demonstrate that there are only two non-contracting representatives in the class of 4-line GFNs up to equivalence, namely, the type-I and type-II GFNs that avoid obvious differential effects. We propose to instantiate the GFNs with SPS-functions (two substitution layers separated by a permutation layer) instead of single SP-functions (one substitution-permutation layer only). We prove tight lower bounds on the number of differentially and linearly active functions and S-boxes in such ciphers. We show that the instantiation with SPS-functions using MDS diffusion provides a proportion of differentially and linearly active S-boxes by up to 33 and 50 % higher than that with single SP-functions for type-I and type-II GFNs, respectively, if the same matrix is used in all rounds. Moreover, we present the upper bounds on the differential and the linear hull probability for the type-II GFNs with SPS-functions. This opens up the possibility of designing more efficient block ciphers based on GFN structure.

On unbalanced Feistel networks with contracting MDS diffusion

Though unbalanced Feistel networks (UFN) are widely considered as an alternative to balanced Feistel networks (BFN) and substitution---permutation networks (SPN) in symmetric cryptography, little has been known yet about their resistance against differential and linear cryptanalysis. In this work, we tackle the problem at the example of d-branch SP-type UFNs with contracting MDS diffusion (dCUFN-SP). Under some restrictions on the contracting MDS matrices over multiple rounds, we prove lower bounds on the number of differentially active S-boxes for dCUFN-SP with $${d\in\{3,4\}}$$ and on the number of linearly active S-boxes for dCUFN-SP with d ? 3. As opposed to SPNs and BFNs, the number of differentially active S-boxes for such constructions does not directly translate to an upper bound on the probability of differential trails. So we provide a thorough analysis of single-round differentials that yields an upper bound on the probability of a differential trail. It is also shown that the efficiency level of dCUFN-SP is comparable to that of BFNs and SPNs with respect to differential and linear cryptanalysis.