Questions tagged [mds]

An MDS matrix (Maximum Distance Separable) is a matrix representing a function with certain diffusion properties that have useful applications in cryptography.

Filter by
Sorted by
Tagged with
2 votes
1 answer
102 views

Sage code for finding generator matrix of MDS code

Let $L$ be an $[n,k]$ code. A $k\times n$ matrix $G$ whose rows form a basis for $L$ is called a generator matrix for $L$. A linear $[n,k,d]$ code with largest possible minimum distance is called ...
user avatar
  • 23
0 votes
0 answers
23 views

Changing Field of MDS Matrix Multiplication

Assume we have an $n \times n$ MDS matrix, whose entries are among $m \times m$ binary matrices. Can we see this matrix as a $n \times n$ matrix with entries from $GF(2^m)$? How can we replace this ...
user avatar
  • 13
0 votes
0 answers
62 views

AES MDS D-XOR and S-XOR count

I am trying to implement the D-XOR and S-XOR count in python but despite reading multiple articles on how to perform the calculation I have failed to understand the process used. I would appreciate it ...
user avatar
2 votes
2 answers
169 views

MDS Matrix Elements

Can zero be one of the elements used in an MDS matrix (in the context of AES)? Based on what I have read all entries of an MDS Matrix need to be non-zero. Also, I would appreciate any help in ...
user avatar
2 votes
1 answer
161 views

How to check that an $km \times km$ block-binary matrix is an MDS matrix in $k$-bit words over $\operatorname{GF}(2)$

I have been reading about MDS matrices. It is defined as (paraphrased from Section 2.1) An $n \times n$ matrix $M$ is MDS if and only if $bn(M) = n + 1$ where $bn$ (branch number) is defined as: $bn(...
user avatar
  • 593
3 votes
1 answer
373 views

How to find the inverse of a 3x3 MDS matrix

I implemented a block cipher similar to AES. But the reason I can't decrypt is that I can't get the inverse MDS matrix. The MDS matrix I used is a 3x3 MDS matrix on $GF(2^8) \implies GF(2^8)$ like AES ...
user avatar
3 votes
0 answers
87 views

How to decide which diffusion scheme is better for a block cipher design

There are several schemes that can be used to achieve the diffusion property in a block cipher. Schemes include MDS code, Bit permutation, Byte/ Nibble permutation, Diffusion Matrix, Diffusion ...
user avatar
  • 157
1 vote
1 answer
120 views

The security effect caused by an MDS matrix in word-oriented designs

Considering a design where the MixColumns operation of AES is replaced by a lighter MDS matrix where by the term lighter we mean the number of required XOR to implement an MDS matrix. As you know ...
user avatar
  • 233
1 vote
1 answer
140 views

Application of MDS matrices in serial and round-based implementations

We know that MDS matrices are used in the diffusion layers of block ciphers. My question: what types of MDS matrices can be applied to serial or round-based implementations or both of them? I ...
user avatar
  • 233
0 votes
0 answers
197 views

Cryptographic Strength of MDS Matrix

Maximum Distance Separable (MDS) Matrices are used for providing diffusion in a cipher. How to test the strength (with respect to cryptographic properties) of an MDS matrix used in a cipher?
user avatar
  • 389
1 vote
1 answer
113 views

Can you point me to an MDS table reference for the Kalyna cipher?

I'm working with cipher Kalyna. Kalyna — like AES — has MDS tables in its MixColumns step. But Kalyna's documentation doesn't list these MDS tables. Could you give me a hint where to find proper ...
user avatar
1 vote
0 answers
360 views

Expressing a given linear transformation in Galois Field GF(256) in terms of another linear transformation with a different reduction polynomial

Before giving a better and detailed description of what I ask, let me first tell why I need what I am looking for: Intel processors already provide instructions (AES-NI) for very efficient AES ...
user avatar
  • 11
5 votes
1 answer
435 views

A Lightweight Matrix Suggestion for MixColumns State of AES

We know that the matrix in the MixColumns state of AES is the circulant MDS matrix $C=circ(2,3,1,1)$ which is defined over $GF(2^8)$ with the irreducible polynomial $f=x^{8}+x^{4}+x^{3}+x+1$. Let we ...
user avatar
  • 304
1 vote
1 answer
178 views

Security of AES under modification of Sboxes and/or MDS mixing layer

Is the security of AES algorithm increased by using many s boxes at the same time instead of using only one s box , and the same question for using many MDS instead of only one.
user avatar
1 vote
1 answer
165 views

Using Hadamard Form of a Matrix in the Block Cipher

Definition: A matrix A of size $2^n$ is a Hadamard matrix, if has the following form $$ A= \left( \begin{array}{cc} U & V \\ V & U \end{array} \right)_{2^n\times 2^n}\, , $$ where $U$ and $V$...
user avatar
  • 304
3 votes
1 answer
136 views

What Is The Number of Active S-boxes over 5 Rounds of Fides AE cipher?

It is mention in the paper " Fides: Lightweight Authenticated Cipher with Side-Channel Resistance for Constrained Hardware" , the number of active S-boxes of Fides cipher is 22 over 5 rounds but my ...
user avatar
  • 1,980
2 votes
3 answers
682 views

How can I get the binary form of AES's MDS matrix in MixColumns tranformation?

I need to write a procedure for calculating the MixColumns's operation result in the following form: $M*X^T,$ where $M$ is a 128x128 binary matrix, $X$ is a 128-bit vector (the state). My question ...
user avatar
4 votes
1 answer
153 views

Is it possible to construct a $3*3$ MDS matrix in $GF(2^4)$?

I'm trying to construct a minimal MDS matrix for a toy cipher. I'm not entirely sure, how the various code parameters are tied to my block size, and how exactly is the binary matrix formed, when you ...
user avatar
2 votes
1 answer
147 views

How is Twofish flattening the result of Reed-Solomon MDS matrix multiplication into a 32-bit result?

I have trouble understanding how Reed-Solomon coding can produce same number of output bits than the input was. Twofish uses this technique. I've read the paper, but still can't quite understand how ...
user avatar
  • 23
0 votes
3 answers
446 views

Optimal MDS matrix - circulant or recursive?

One of the special matrix in $GF(2^q)$ is MDS matrix which can be used in the cryptography like mix column of AES. Two forms of MDS matrices are circulant and recursive. Which form of MDS matrix (...
user avatar
  • 304
3 votes
1 answer
600 views

What is an advantage of MDS matrices in block ciphers?

I saw the several articles about MDS matrices. They said that, one goal of MDS matrices is to protect the block ciphers against linear and differential attacks. My question is: For example in the ...
user avatar
8 votes
1 answer
852 views

How 2 rounds in AES achieve full diffusion?

I have read somewhere that 2 rounds is AES provide full diffusion. So I looked it up to find out what it exactly meant. In The Design of Rijndael page 41, section 3.5 and it states that: Two ...
user avatar
8 votes
2 answers
1k views

How to check that AES Matrix is MDS?

I want to understand how can I prove that M matrix in AES is MDS. I know that a matrix is MDS if every determinant of every square submatrix is different from 0. I don't get this. How much submatrix ...
user avatar
  • 115
2 votes
1 answer
371 views

Design of MixColumn Transformation in AES

Why is the multiplication in MixColumn Transformation particularly by 2,3,1,1 cyclically? Why not some other numbers?
user avatar
  • 67
3 votes
1 answer
325 views

Twofish MDS multiplication

I wasted the last 2 days finding literature and/or some illustrative explanations on how to perform correct multiplications against the MDS-Matrix in Twofish over $\operatorname{GF}(256)$ with $x^8 + ...
user avatar
6 votes
1 answer
2k views

How to find the AES branch number?

By definition, branch number Definition: The branch number of a linear transformation $F$ is $$min_{a\neq0}(W(a) + W(F(a)))$$ Source here (7.3.1) For AES MixColumns $a \in GF(2^8)^4$ since ...
user avatar
  • 63
10 votes
1 answer
1k views

How to calculate active s-boxes from branch number?

If MDS in AES has branch number 5 (so 5 active s-boxes in 2 rounds), wouldn't that mean 4 rounds of AES has $5*2=10$ active s-boxes? AES paper says it has 25 ($5^2$?) active s-boxes in 4 rounds. How ...
user avatar
  • 1,322
3 votes
1 answer
169 views

Why are $\{0,1\}$-matrices almost-MDS only when n is 2, 3, or 4?

In this paper authors claim that $\{0,1\}$-matrices are almost-MDS (have branch number $n - 1$) on when $n$ is $2, 3,$ or $4$. For example, how can this two matrices have the same branch number? $$\...
user avatar
  • 1,322
4 votes
1 answer
403 views

Twofish MDS and PHT

Twofish was an AES candidate and it uses $4 \times 4$ Matrix as MDS followed by a PHT. The Branch Number of MDS and PHT is 5 and 2 Respectively. from formula $Branch~Number = Minimum~of~[...
user avatar
  • 1,998
5 votes
1 answer
1k views

What is the branch number of this matrix?

We have the following matrix: $$\begin{pmatrix}0&1&1&1\\ 1&0&1&1\\ 1&1&0&1\\ 1&1&1&0\end{pmatrix}$$ What is the branch number? Is this a MDS marix?
user avatar
  • 1,322
6 votes
1 answer
666 views

Active S-boxes for AES with 8x8 MDS matrix

One way to enhance the security of AES is by increasing the number of active S-boxes. Larger MDS matrices are used to increase the number of active S-boxes. Using a $4\times4$ MDS matrix results in 25 ...
user avatar
  • 1,980
12 votes
2 answers
510 views

Is standardizing a modified AES a good idea?

"Recently" the Ukraine standardized a new block cipher Kalyna, which according to the abstract of"A New Encryption Standard of Ukraine: The Kalyna Block Cipher" by Oliynykov et al. (warning: the paper ...
user avatar
  • 44.6k
6 votes
1 answer
2k views

How was the MDS matrix used in AES chosen?

$$\begin{pmatrix}2&3&1&1\\ 1&2&3&1\\ 1&1&2&3\\ 3&1&1&2\end{pmatrix}$$ In the above MDS matrix used in AES encryption, why are the numbers $2$,$3$ and $1$...
user avatar
6 votes
1 answer
405 views

Rijndael S-boxes: Where do the $\mu$ and $\nu$ polynomial ring elements come from?

I've asked some other questions before about Rijndael's S-boxes, and step by step I'm coming to an understanding; but those steps often guide me to new questions. I did some lines of code to ...
user avatar
  • 717
3 votes
1 answer
447 views

Variants of AES? [closed]

Would variants of AES provide the same level of security as AES, say by just replacing the S-box with another one, MDS matrix of Mixcolumn, etc.?
user avatar
6 votes
1 answer
4k views

How can I calculate the Rijndael SBox?

I would like to implement the Rijndael subBytes() operation using calculation instead of tables, because I like to play with this on different wordsizes, as an ...
user avatar
  • 717
6 votes
2 answers
552 views

Choice of reduction polynomial in Whirlpool's internal cipher

Whirlpool is an interesting little hash function in the Miyaguchi-Preneel family. In my mind, it's most interesting feature is the design of internal cipher W, where the distinction between key and ...
user avatar