In this article, we provide new methods to look for lightweight MDS matrices, and in particular involutory ones. By proving many new properties and equivalence classes for various MDS matrices constructions such as circulant, Hadamard, Cauchy and Hadamard-Cauchy, we exhibit new search algorithms that greatly reduce the search space and make lightweight MDS matrices of rather high dimension possible to find. We also explain why the choice of the irreducible polynomial might have a significant impact on the lightweightness, and in contrary to the classical belief, we show that the Hamming weight has no direct impact. Even though we focused our studies on involutory MDS matrices, we also obtained results for non-involutory MDS matrices. Overall, using Hadamard or Hadamard-Cauchy constructions, we provide the (involutory or non-involutory) MDS matrices with the least possible XOR gates for the classical dimensions $4 \times 4$, $8 \times 8$, $16 \times 16$ and $32 \times 32$ in $\mathrm {GF}(2^4)$ and $\mathrm {GF}(2^8)$. Compared to the best known matrices, some of our new candidates save up to 50 % on the amount of XOR gates required for an hardware implementation. Finally, our work indicates that involutory MDS matrices are really interesting building blocks for designers as they can be implemented with almost the same number of XOR gates as non-involutory MDS matrices, the latter being usually non-lightweight when the inverse matrix is required.

Lightweight MDS Involution Matrices

In the present paper, we investigate the problem of constructing MDS matrices with as few bit XOR operations as possible. The key contribution of the present paper is constructing MDS matrices with entries in the set of $$m\times m$$ non-singular matrices over $$\mathbb {F}_2$$ directly, and the linear transformations we used to construct MDS matrices are not assumed pairwise commutative. With this method, it is shown that circulant involutory MDS matrices, which have been proved do not exist over the finite field $$\mathbb {F}_{2^m}$$, can be constructed by using non-commutative entries. Some constructions of $$4\times 4$$ and $$5\times 5$$ circulant involutory MDS matrices are given when $$m=4,8$$. To the best of our knowledge, it is the first time that circulant involutory MDS matrices have been constructed. Furthermore, some lower bounds on XORs that required to evaluate one row of circulant and Hadamard MDS matrices of order 4 are given when $$m=4,8$$. Some constructions achieving the bound are also given, which have fewer XORs than previous constructions.

/pdf/on-the-construction-of-lightweight-circulant-involutory-mds-3pnxbdtfo7.pdf

On the Construction of Lightweight Circulant Involutory MDS Matrices

A matrix is MDS or super-regular if and only if every square submatrices of it are nonsingular. MDS matrices provide perfect diffusion in block ciphers and hash functions. In this paper we provide a brief survey on cryptographically significant MDS matrices - a first to the best of our knowledge. In addition to providing a summary of existing results, we make several contributions. We exhibit some deep and nontrivial interconnections between different constructions of MDS matrices. For example, we prove that all known Vandermonde constructions are basically equivalent to Cauchy constructions. We prove some folklore results which are used in MDS matrix literature. Wherever possible, we provide some simpler alternative proofs. We do not discuss efficiency issues or hardware implementations; however, the theory accumulated and discussed here should provide an easy guide towards efficient implementations.

https://www.aimsciences.org/article/exportPdf?id=8da3c52e-04aa-435a-bcec-0ad59daf7a55

Cryptographically significant mds matrices over finite fields: A brief survey and some generalized results

TWINE is a recent lightweight block cipher based on a Feistel structure. We first present two new attacks on TWINE-128 reduced to 25 rounds that have a slightly higher overall complexity than the 25round attack presented by Wang and Wu at ACISP 2014, but a lower data complexity. Then, we introduce alternative representations of both the round function of this block cipher and of a sequence of 4 rounds. LBlock, another lightweight block cipher, turns out to exhibit the same behaviour. Then, we illustrate how this alternative representation can shed new light on the security of TWINE by deriving high probability iterated truncated differential trails covering 4 rounds with probability 2−16. The importance of these is shown by combining different truncated differential trails to attack 23-rounds TWINE-128 and by giving a tighter lower bound on the high probability of some differentials by clustering differential characteristics following one of these truncated trails. A comparison between these high probability differentials and those recently found in a variant of LBlock by Leurent highlights the importance of considering the whole distribution of the coefficients in the difference distribution table of a S-Box and not only their maximum value.

Fast Software Encryption

Lightweight MDS Involution Matrices.

Maximum distance separable (MDS) matrices are widely used in the design of block ciphers. However, it is highly nontrival to find MDS matrices which could be used in practice. This paper focuses on the design of efficient MDS matrices for substitution-permutation networks (SPNs). We provide a new method to construct and count these MDS matrices. Moreover, we identified an interesting class of Cauchy matrices (named compact Cauchy matrices) which has the fewest different entries and is thus more favorable for implementation. Finally, we prove that all compact Cauchy matrices could be modified into an involution compact Cauchy matrix, and show how to maximize the occurrences of entry “1” in a compact Cauchy matrix.

Chenhui Jin

Papers

On Compact Cauchy Matrices for Substitution-Permutation Networks