# Design of MixColumn Transformation in AES

Why is the multiplication in MixColumn Transformation particularly by 2,3,1,1 cyclically? Why not some other numbers?

## 1 Answer

Because:

• These numbers in the matrix form a Maximum Distance Separable matrix; that is, one where, if you change some bytes of the input, then the total number of bytes of input changed PLUS the total number of bytes of output changed will always be at least 5 (e.g. if you change 2 bytes of input, then you'll always change at least 3 bytes of the output). This property is crucial for the security proof against differential and linear cryptanalysis.

• These numbers make the encryption direction cheap; to compute the transform of the column $(A, B, C, D)$, you compute $2 \times A, 2 \times B, 2 \times C, 2 \times D)$, and then do a bunch of byte-wise xor's.

• These numbers make the decryption direction moderately cheap, to compute the inverse transform of the column $(A, B, C, D)$, you compute $2 \times A, 4 \times A, 8 \times A, 2 \times B,$ $4 \times B, ..., 8 \times D$ (doable with 12 doublings), and then do a bunch of byte-wise xor's.

• Thank you...I have two more questions regarding the MixColumn function. 1. If try to use this concept of diffusion in encrypting an image, does the matrix have to be a square matrix necessarily? 2. If I change the numbers of the matrix to say 2, 4, 1, 1, does that mean that the total of input plus output bytes changed will be at least 6? Is that possible? – Fiona Feb 13 '17 at 16:55
• @Fiona: as for using a nonsquare matrix, well, in the context of AES, the matrix must be invertible, and so it really has to be square. As for trying to get the input plus output bytes changed to be 6, that's not possible with a 4x4 matrix; consider an input delta that changes 1 input byte; that will change at most 4 output bytes, and so we have a total of 1+4 bytes changed. – poncho Feb 13 '17 at 17:38