6
$\begingroup$

One way to enhance the security of AES is by increasing the number of active S-boxes. Larger MDS matrices are used to increase the number of active S-boxes. Using a $4\times4$ MDS matrix results in 25 active S-boxes after 4 rounds.

How many S-boxes would be active after 4 rounds using an $8\times8$ MDS matrix?

Improve this question
$\endgroup$
3
  • $\begingroup$ without actually doing the math, I would say 49? $\endgroup$
    – Richie Frame
    Mar 1, 2016 at 10:37
  • 3
    $\begingroup$ Thank you for the answer. could you please show the math? $\endgroup$
    – hardyrama
    Mar 2, 2016 at 9:19
  • $\begingroup$ It may depend on how you arrange the two matrices, since they interact with shift rows. $\endgroup$
    – Fractalice
    Sep 3, 2020 at 13:27

1 Answer 1

Reset to default
7
$\begingroup$

It seems that using an 8x8 MDS will have 27 Active Sboxes after 4 Rounds(There may exist a trail shorter than 27). The image below shows the counting of active Sboxes.

  1. The Active and non-Active byte is shown as 1 and 0 respectively.
  2. The 8 bytes of state which become input to the 8x8 MDS matrix are colored in similar color (pink or blue).
  3. The shift rows step shows new byte position in pink and white color.
  4. The calculation is done under the assumption that 8x8 MDS matrix has optimal branch number of 9 i.e change in one byte will change all the 8 output bytes.
  5. If 8x8 Matrix similar to Camellia is used which has branch number of 5, then count of active Sbox may be reduced.

enter image description here

Improve this answer
$\endgroup$
4
  • 1
    $\begingroup$ it seems you made a mistake in last round . The number of active S-box in round 4 is 8 not 7 , so the total number is 27. $\endgroup$
    – hardyrama
    Sep 9, 2019 at 17:10
  • $\begingroup$ @hardyrama thanks for pointing out the issue. I have updated the image now. $\endgroup$
    – crypt
    Sep 11, 2019 at 9:43
  • 2
    $\begingroup$ This explains the designer's choice - the cost of 8x8 MDS would be much higher but the gain of security against linear/differential attacks is very small! Though, different ShiftRows layer could probably help. $\endgroup$
    – Fractalice
    Sep 3, 2020 at 13:43
  • $\begingroup$ @crypt How do you calculate values in Mix Column? Could I get spreadsheet with formulas? $\endgroup$
    – LightBit
    Sep 21, 2022 at 15:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.