# Grøstl MixBytes Python implementation

I am trying to find an efficient way to implement the Grøstl matrix multiplication on python3.

So far I have managed to get this result :

    # M2 = GF(2^8) * 2 multiplication table
# for each column i :

s0 = state[(i<<3) + 0]
s1 = state[(i<<3) + 1]
s2 = state[(i<<3) + 2]
s3 = state[(i<<3) + 3]
s4 = state[(i<<3) + 4]
s5 = state[(i<<3) + 5]
s6 = state[(i<<3) + 6]
s7 = state[(i<<3) + 7]

h = s7 ^ s6 ^ s5 ^ s4 ^ s3 ^ s2 ^ s1 ^ s0
xh = M2[h] ^ h

state[(i<<3) + 0] ^= M2[M2[s7 ^ s6 ^ s4 ^ s3] ^ s6 ^ s4 ^ s3] ^ xh ^ s1 ^ s3
state[(i<<3) + 1] ^= M2[M2[s0 ^ s7 ^ s5 ^ s4] ^ s7 ^ s5 ^ s4] ^ xh ^ s2 ^ s4
state[(i<<3) + 2] ^= M2[M2[s1 ^ s0 ^ s6 ^ s5] ^ s0 ^ s6 ^ s5] ^ xh ^ s3 ^ s5
state[(i<<3) + 3] ^= M2[M2[s2 ^ s1 ^ s7 ^ s6] ^ s1 ^ s7 ^ s6] ^ xh ^ s4 ^ s6
state[(i<<3) + 4] ^= M2[M2[s3 ^ s2 ^ s0 ^ s7] ^ s2 ^ s0 ^ s7] ^ xh ^ s5 ^ s7
state[(i<<3) + 5] ^= M2[M2[s4 ^ s3 ^ s1 ^ s0] ^ s3 ^ s1 ^ s0] ^ xh ^ s6 ^ s0
state[(i<<3) + 6] ^= M2[M2[s5 ^ s4 ^ s2 ^ s1] ^ s4 ^ s2 ^ s1] ^ xh ^ s7 ^ s1
state[(i<<3) + 7] ^= M2[M2[s6 ^ s5 ^ s3 ^ s2] ^ s5 ^ s3 ^ s2] ^ xh ^ s0 ^ s2


It works perfectly fine, however I was wondering if there would be a better way to do it, like by doing more intermediate precomputation, and without using more than one lookup table.

• How much does "python3" really factor into the equation? In other words, are you really looking for some programming language specific thing (which may be considered off-topic on this site) or are you looking for something more general purpose? – mikeazo Jan 16 '18 at 19:20
• I'm really looking to do it in python3, but I guess it is more about shortcuts that would be given by maths in GF(2^8) and could be applied elsewhere. – Pro7ech Jan 16 '18 at 19:22