One way to enhance the security of AES is by increasing the number of active S-boxes. Larger MDS matrices are used to increase the number of active S-boxes. Using a $4\times4$ MDS matrix results in 25 active S-boxes after 4 rounds.

How many S-boxes would be active after 4 rounds using an $8\times8$ MDS matrix?

  • $\begingroup$ without actually doing the math, I would say 49? $\endgroup$ – Richie Frame Mar 1 '16 at 10:37
  • 3
    $\begingroup$ Thank you for the answer. could you please show the math? $\endgroup$ – hardyrama Mar 2 '16 at 9:19
  • $\begingroup$ It may depend on how you arrange the two matrices, since they interact with shift rows. $\endgroup$ – Fractalic Sep 3 at 13:27

It seems that using an 8x8 MDS will have 27 Active Sboxes after 4 Rounds(There may exist a trail shorter than 27). The image below shows the counting of active Sboxes.

  1. The Active and non-Active byte is shown as 1 and 0 respectively.
  2. The 8 bytes of state which become input to the 8x8 MDS matrix are colored in similar color (pink or blue).
  3. The shift rows step shows new byte position in pink and white color.
  4. The calculation is done under the assumption that 8x8 MDS matrix has optimal branch number of 9 i.e change in one byte will change all the 8 output bytes.
  5. If 8x8 Matrix similar to Camellia is used which has branch number of 5, then count of active Sbox may be reduced.

enter image description here

| improve this answer | |
  • 1
    $\begingroup$ it seems you made a mistake in last round . The number of active S-box in round 4 is 8 not 7 , so the total number is 27. $\endgroup$ – hardyrama Sep 9 '19 at 17:10
  • $\begingroup$ @hardyrama thanks for pointing out the issue. I have updated the image now. $\endgroup$ – abraza Sep 11 '19 at 9:43
  • 2
    $\begingroup$ This explains the designer's choice - the cost of 8x8 MDS would be much higher but the gain of security against linear/differential attacks is very small! Though, different ShiftRows layer could probably help. $\endgroup$ – Fractalic Sep 3 at 13:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.