Timeline for How to find the AES branch number?
Current License: CC BY-SA 3.0
18 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jul 6, 2023 at 13:24 | comment | added | kodlu | The full weight distribution of MDS codes is known, so they are all equivalent in terms of diffusion. See this other question and answer: crypto.stackexchange.com/questions/35823/… | |
| Jun 17, 2020 at 8:17 | history | edited | CommunityBot |
Commonmark migration
|
|
| Apr 13, 2017 at 12:48 | history | edited | CommunityBot |
replaced http://crypto.stackexchange.com/ with https://crypto.stackexchange.com/
|
|
| Mar 21, 2017 at 2:37 | history | edited | kodlu | CC BY-SA 3.0 |
Spelling
|
| Jan 6, 2017 at 9:47 | vote | accept | Sasha | ||
| Jan 6, 2017 at 9:47 | vote | accept | Sasha | ||
| Jan 6, 2017 at 9:47 | |||||
| Jan 5, 2017 at 9:04 | history | edited | kodlu | CC BY-SA 3.0 |
added 560 characters in body
|
| Jan 5, 2017 at 8:39 | comment | added | Sasha | Yes, we need some MDS matrix BUT the matrix used in AES is pre-determined. And this pre-determined matrix allows to get the branch number = 5. In other words, the authors of AES chose this matrix for a reason (How did they do it? Not at random the same). This is the question, is it possible to mathematically prove that this matrix allows to obtain branch number = 5? There is a way - brute force, but I want to prove analytically | |
| Jan 4, 2017 at 22:34 | comment | added | kodlu | You need some MDS Matrix. A general MixColumns matrix may have minimum weight (equal to branch number) as low as 2. Since it needs to be invertible in an SPN structure, it can't map a nonzero vector to a zero vector, hence the two (one input and one output byte must be nonzero). The MDS matrix chosen in AES has low weight coefficients and is circulant, giving fast implementation. | |
| Jan 4, 2017 at 21:57 | comment | added | Sasha | Ok, I read about MDS codes and Reed Solomon codes, but could you explain: if we define the branch number through $$n-k+1$$ what is the need for a predetermined MDS matrix this? And what does it mean "Hence, the upper bound for the branch number is 5" from here - that is, the result may be less than 5 or what? I'm a little confused :) | |
| Jan 4, 2017 at 20:41 | history | edited | kodlu | CC BY-SA 3.0 |
added 208 characters in body
|
| Jan 4, 2017 at 20:31 | comment | added | Sasha | Yes, you can edit :) | |
| Jan 4, 2017 at 20:28 | comment | added | Sasha | Ok, I use byte weight. But I still don't understand why 5? In the documentation of AES is described as a fact. There is no mathematical explanation of why chosen this polynomial (exactly this polynomial allows to obtain a branch number = 5) | |
| Jan 4, 2017 at 20:26 | comment | added | kodlu | Do you mind me editing the question since the way the weight is used from the NIST doc is the problem. | |
| Jan 4, 2017 at 20:21 | comment | added | kodlu | The branch number is 5 not 4. Also, your definition of the weight uses the bit weight not byte weight., which is wrong. | |
| Jan 4, 2017 at 20:00 | comment | added | Sasha | in other words, how to prove "The branch number, which is the minimum weight of the corresponding linear code is 4, in $GF(2^n)$ for all $n$"? | |
| Jan 4, 2017 at 19:36 | comment | added | Sasha | in AES uses a fixed polynomial $$c(x) = 3x^3 + x^2 + x + 2$$ The coefficients have been chosen in such a way that the upper bound is reached. "Any nonzer byte contributes 1 to the minimum weight" - Thank you, well done! "ensures that the 8 bytes" and "See the answer to this question for more" - Yeah, I saw this answer, but still not very well understood, how is the calculation (from a mathematical point of view) | |
| Jan 4, 2017 at 19:14 | history | answered | kodlu | CC BY-SA 3.0 |