Active S-boxes for AES with 8x8 MDS matrix

One way to enhance the security of AES is by increasing the number of active S-boxes. Larger MDS matrices are used to increase the number of active S-boxes. Using a $$4\times4$$ MDS matrix results in 25 active S-boxes after 4 rounds.

How many S-boxes would be active after 4 rounds using an $$8\times8$$ MDS matrix?

• without actually doing the math, I would say 49? Mar 1 '16 at 10:37
• Thank you for the answer. could you please show the math? Mar 2 '16 at 9:19
• It may depend on how you arrange the two matrices, since they interact with shift rows. Sep 3 '20 at 13:27

1 Answer

It seems that using an 8x8 MDS will have 27 Active Sboxes after 4 Rounds(There may exist a trail shorter than 27). The image below shows the counting of active Sboxes.

1. The Active and non-Active byte is shown as 1 and 0 respectively.
2. The 8 bytes of state which become input to the 8x8 MDS matrix are colored in similar color (pink or blue).
3. The shift rows step shows new byte position in pink and white color.
4. The calculation is done under the assumption that 8x8 MDS matrix has optimal branch number of 9 i.e change in one byte will change all the 8 output bytes.
5. If 8x8 Matrix similar to Camellia is used which has branch number of 5, then count of active Sbox may be reduced.

• it seems you made a mistake in last round . The number of active S-box in round 4 is 8 not 7 , so the total number is 27. Sep 9 '19 at 17:10
• @hardyrama thanks for pointing out the issue. I have updated the image now. Sep 11 '19 at 9:43
• This explains the designer's choice - the cost of 8x8 MDS would be much higher but the gain of security against linear/differential attacks is very small! Though, different ShiftRows layer could probably help. Sep 3 '20 at 13:43