Showing papers on "MDS matrix published in 2019"

TOA-Based Localization With NLOS Mitigation via Robust Multidimensional Similarity Analysis

Abstract: This letter focuses on time-of-arrival based localization using multidimensional similarity (MDS) analysis under non-line-of-sight (NLOS) propagation. To handle row-column structured outliers in the MDS matrix introduced by NLOS errors, we present a novel robust matrix approximation scheme with the use of $\ell _{2,1}$ -norm and apply the alternating direction method of multipliers to solve the resultant nonlinear constrained optimization problem. The proposed method does not require any prior knowledge of NLOS information and can benefit from a comparatively low complexity. Simulation results show that our algorithm is superior to several existing approaches in mild and moderate NLOS environments.

More Results on Shortest Linear Programs

Abstract: At the FSE conference of ToSC 2018, Kranz et al. presented their results on shortest linear programs for the linear layers of several well known block ciphers in literature. Shortest linear programs are essentially the minimum number of 2-input xor gates required to completely describe a linear system of equations. In the above paper the authors showed that the commonly used metrics like d-xor/s-xor count that are used to judge the “lightweightedness” do not represent the minimum number of xor gates required to describe a given MDS matrix. In fact they used heuristic based algorithms of Boyar/Peralta and Paar to find implementations of MDS matrices with even fewer xor gates than was previously known. They proved that the AES mixcolumn matrix can be implemented with as little as 97 xor gates. In this paper we show that the values reported in the above paper are not optimal. By suitably including random bits in the instances of the above algorithms we can achieve implementations of almost all matrices with lesser number of gates than were reported in the above paper. As a result we report an implementation of the AES mixcolumn matrix that uses only 95 xor gates.

Cryptographically significant mds matrices over finite fields: A brief survey and some generalized results

Abstract: A matrix is MDS or super-regular if and only if every square submatrices of it are nonsingular. MDS matrices provide perfect diffusion in block ciphers and hash functions. In this paper we provide a brief survey on cryptographically significant MDS matrices - a first to the best of our knowledge. In addition to providing a summary of existing results, we make several contributions. We exhibit some deep and nontrivial interconnections between different constructions of MDS matrices. For example, we prove that all known Vandermonde constructions are basically equivalent to Cauchy constructions. We prove some folklore results which are used in MDS matrix literature. Wherever possible, we provide some simpler alternative proofs. We do not discuss efficiency issues or hardware implementations; however, the theory accumulated and discussed here should provide an easy guide towards efficient implementations.

Constructing Low-latency Involutory MDS Matrices with Lightweight Circuits

Abstract: MDS matrices are important building blocks providing diffusion functionality for the design of many symmetric-key primitives. In recent years, continuous efforts are made on the construction of MDS matrices with small area footprints in the context of lightweight cryptography. Just recently, Duval and Leurent (ToSC 2018/FSE 2019) reported some 32 × 32 binary MDS matrices with branch number 5, which can be implemented with only 67 XOR gates, whereas the previously known lightest ones of the same size cost 72 XOR gates.In this article, we focus on the construction of lightweight involutory MDS matrices, which are even more desirable than ordinary MDS matrices, since the same circuit can be reused when the inverse is required. In particular, we identify some involutory MDS matrices which can be realized with only 78 XOR gates with depth 4, whereas the previously known lightest involutory MDS matrices cost 84 XOR gates with the same depth. Notably, the involutory MDS matrix we find is much smaller than the AES MixColumns operation, which requires 97 XOR gates with depth 8 when implemented as a block of combinatorial logic that can be computed in one clock cycle. However, with respect to latency, the AES MixColumns operation is superior to our 78-XOR involutory matrices, since the AES MixColumns can be implemented with depth 3 by using more XOR gates.We prove that the depth of a 32 × 32 MDS matrix with branch number 5 (e.g., the AES MixColumns operation) is at least 3. Then, we enhance Boyar’s SLP-heuristic algorithm with circuit depth awareness, such that the depth of its output circuit is limited. Along the way, we give a formula for computing the minimum achievable depth of a circuit implementing the summation of a set of signals with given depths, which is of independent interest. We apply the new SLP heuristic to a large set of lightweight involutory MDS matrices, and we identify a depth 3 involutory MDS matrix whose implementation costs 88 XOR gates, which is superior to the AES MixColumns operation with respect to both lightweightness and latency, and enjoys the extra involution property.

Almost involutory recursive MDS diffusion layers

Abstract: A recursive MDS matrix is an MDS matrix which can be expressed as a power of some companion matrix. The advantage of such a matrix is that it can be implemented by a single LFSR clocking several times. Such matrices are suitable for the design of diffusion layer in lightweight cryptographic applications. It is known that there do not exist involutory recursive MDS matrices. It means that if a recursive MDS matrix M is considered for the diffusion layer in encryption then the diffusion layer process in both encryption and decryption (if $$M^{-1}$$ needs to be computed) cannot be the same, requiring two different LFSR implementations. In this paper we look at some possibilities of making the implementation of the diffusion layer part in both encryption and decryption to use almost the same circuit (LFSR) by using some special recursive MDS matrices. The difference or the cost of the additional operations/control mechanism used is minimal. In this direction we first discuss two known structures: regular recursive MDS matrices, symmetric recursive MDS matrices. We then propose some other structures called almost involutory recursive MDS matrices which can use the same LFSR for realizing the diffusion layer part in both encryption and decryption. We then present a new method for the direct construction of recursive MDS matrices. Our method gives a new infinite class polynomials that yield recursive MDS matrices. We also present some experimental results and comparison results.

Exhaustive Search for Various Types of MDS Matrices

Abstract: MDS matrices are used in the design of diffusion layers in many block ciphers and hash functions due to their optimal branch number. But MDS matrices, in general, have costly implementations. So in search for efficiently implementable MDS matrices, there have been many proposals. In particular, circulant, Hadamard, and recursive MDS matrices from companion matrices have been widely studied. In a recent work, recursive MDS matrices from sparse DSI matrices are studied, which are of interest due to their low fixed cost in hardware implementation. In this paper, we present results on the exhaustive search for (recursive) MDS matrices over GL(4, F2). Specifically, circulant MDS matrices of order 4, 5, 6, 7, 8; Hadamard MDS matrices of order 4, 8; recursive MDS matrices from companion matrices of order 4; recursive MDS matrices from sparse DSI matrices of order 4, 5, 6, 7, 8 are considered. It is to be noted that the exhaustive search is impractical with a naive approach. We first use some linear algebra tools to restrict the search to a smaller domain and then apply some space-time trade-off techniques to get the solutions. From the set of solutions in the restricted domain, one can easily generate all the solutions in the full domain. From the experimental results, we can see the (non) existence of (involutory) MDS matrices for the choices mentioned above. In particular, over GL(4, F2), we provide companion matrices of order 4 that yield involutory MDS matrices, circulant MDS matrices of order 8, and establish the nonexistence of involutory circulant MDS matrices of order 6, 8, circulant MDS matrices of order 7, sparse DSI matrices of order 4 that yield involutory MDS matrices, and sparse DSI matrices of order 5, 6, 7, 8 that yield MDS matrices. To the best of our knowledge, these results were not known before. For the choices mentioned above, if such MDS matrices exist, we provide base sets of MDS matrices, from which all the MDS matrices with the least cost (with respect to d-XOR and s-XOR counts) can be obtained. We also take this opportunity to present some results on the search for sparse DSI matrices over finite fields that yield MDS matrices. We establish that there is no sparse DSI matrix S of order 8 over F28 such that S8 is MDS.

A Few Negative Results on Constructions of MDS Matrices Using Low XOR Matrices

Abstract: This paper studies some low XOR matrices systematically. Some known low XOR matrices are companion, DSI and sparse DSI matrices. Companion matrices have been well studied now whereas DSI and sparse DSI are newly proposed matrices. There are very few results on these matrices. This paper presents some new mathematical results and rediscovers some existing results on DSI and sparse DSI matrices. Furthermore, we start from a matrix with the minimum number of fixed XORs required, which is one, to construct any recursive MDS matrix. We call such matrices 1-XOR matrices. No family of low XOR matrices can have lesser fixed XORs than 1-XOR matrices. We then move on to 2-XOR and provide some impossibility results for matrices of order 5 and 6 to compute recursive MDS matrices. Finally, this paper shows the non-existence of 8-MDS sparse DSI matrix of order 8 over the field \(\mathbb {F}_{2^8}\).

A Generalized Format Preserving Encryption Framework Using MDS Matrices

Abstract: The construction SPF, presented in Inscrypt-2016, was the first known substitution permutation network (SPN)–based format preserving encryption (FPE) algorithm. In this work, we present a new family of SPN-based FPE algorithms “eSPF” that significantly improves the performance and flexibility of SPF. The eSPF uses a MDS matrix instead of the binary matrix used in SPF. The optimal diffusion of MDS matrix leads to an efficient and secure design. However, this change leads to violations in the message format. To mitigate this, we propose a discarding algorithm to drop the symbols that are not the elements of the format thus preserving it. In this work, we propose the general framework of eSPF and then show how our construction can be adapted under different use cases. We provide detailed analysis of eSPF for four popular concrete instantiations—digits , alphabets, case-insensitive alphanumeric, and case-sensitive alphanumeric. We provide security and performance analysis for all these use cases. We also compare our construction with existing FPE algorithms like FFX and SPF and show that the proposed design is approx ten times faster than FFX for most of the practical applications.