Questions tagged [mds]
An MDS matrix (Maximum Distance Separable) is a matrix representing a function with certain diffusion properties that have useful applications in cryptography.
39
questions
1
vote
1
answer
50
views
Near Maximum Distance Separable Code
I want to find the minimum distance of an $[8,4]$ Near MDS code over a finite field F_4 (NMDS Code is a type of linear code). I want to know which programming language has a built-in function that ...
2
votes
1
answer
93
views
How to check whether function provides full diffusion or not?
In "The Skein Hash Function Family" paper authors wrote:
The MIX/permute structure has been designed to provide full diffusion in 9 rounds for Threefish-256, 10 rounds for Threefish-512, ...
- 1,211
2
votes
1
answer
125
views
regarding MDS matrix and security
I found a construction for MDS matrix (algorithm 4 of https://eprint.iacr.org/2020/1143) for a hash function that compresses elements in a prime field $F_p$
If the hash has a rate and capacity $(r,c)$ ...
- 43
2
votes
1
answer
377
views
Sage code for finding generator matrix of MDS code
Let $L$ be an $[n,k]$ code. A $k\times n$ matrix $G$ whose rows form a basis for $L$ is called a generator matrix for $L$.
A linear $[n,k,d]$ code with largest possible minimum distance is called ...
- 23
0
votes
0
answers
101
views
AES MDS D-XOR and S-XOR count
I am trying to implement the D-XOR and S-XOR count in python but despite reading multiple articles on how to perform the calculation I have failed to understand the process used. I would appreciate it ...
- 23
2
votes
2
answers
318
views
MDS Matrix Elements
Can zero be one of the elements used in an MDS matrix (in the context of AES)?
Based on what I have read all entries of an MDS Matrix need to be non-zero. Also, I would appreciate any help in ...
- 23
2
votes
1
answer
229
views
How to check that an $km \times km$ block-binary matrix is an MDS matrix in $k$-bit words over $\operatorname{GF}(2)$
I have been reading about MDS matrices. It is defined as (paraphrased from Section 2.1)
An $n \times n$ matrix $M$ is MDS if and only if $bn(M) = n + 1$
where $bn$ (branch number) is defined as:
$bn(...
- 603
4
votes
2
answers
608
views
How to find the inverse of a 3x3 MDS matrix
I implemented a block cipher similar to AES.
But the reason I can't decrypt is that I can't get the inverse MDS matrix.
The MDS matrix I used is a 3x3 MDS matrix on $GF(2^8) \implies GF(2^8)$ like AES
...
- 41
3
votes
0
answers
102
views
How to decide which diffusion scheme is better for a block cipher design
There are several schemes that can be used to achieve the diffusion property in a block cipher. Schemes include MDS code, Bit permutation, Byte/ Nibble permutation, Diffusion Matrix, Diffusion ...
- 157
1
vote
1
answer
139
views
The security effect caused by an MDS matrix in word-oriented designs
Considering a design where the MixColumns operation of AES is replaced by a lighter MDS matrix where by the term lighter we mean the number of required XOR to implement an MDS matrix.
As you know ...
- 253
1
vote
1
answer
175
views
Application of MDS matrices in serial and round-based implementations
We know that MDS matrices are used in the diffusion layers of block ciphers.
My question: what types of MDS matrices can be applied to serial or
round-based implementations or both of them?
I ...
- 253
0
votes
0
answers
240
views
Cryptographic Strength of MDS Matrix
Maximum Distance Separable (MDS) Matrices are used for providing diffusion in a cipher. How to test the strength (with respect to cryptographic properties) of an MDS matrix used in a cipher?
- 389
1
vote
1
answer
137
views
Can you point me to an MDS table reference for the Kalyna cipher?
I'm working with cipher Kalyna.
Kalyna — like AES — has MDS tables in its MixColumns step. But Kalyna's documentation doesn't list these MDS tables.
Could you give me a hint where to find proper ...
- 23
1
vote
0
answers
446
views
Expressing a given linear transformation in Galois Field GF(256) in terms of another linear transformation with a different reduction polynomial
Before giving a better and detailed description of what I ask, let me first tell why I need what I am looking for: Intel processors already provide instructions (AES-NI) for very efficient AES ...
- 11
5
votes
1
answer
472
views
A Lightweight Matrix Suggestion for MixColumns State of AES
We know that the matrix in the MixColumns state of AES is the circulant MDS matrix $C=circ(2,3,1,1)$ which is defined over $GF(2^8)$ with the irreducible polynomial $f=x^{8}+x^{4}+x^{3}+x+1$. Let we ...
- 304
1
vote
1
answer
213
views
Security of AES under modification of Sboxes and/or MDS mixing layer
Is the security of AES algorithm increased by using many s boxes at the same time instead of using only one s box , and the same question for using many MDS instead of only one.
- 61
1
vote
1
answer
196
views
Using Hadamard Form of a Matrix in the Block Cipher
Definition: A matrix A of size $2^n$ is a Hadamard matrix, if has the following form
$$
A=
\left(
\begin{array}{cc}
U & V \\
V & U
\end{array}
\right)_{2^n\times 2^n}\, ,
$$
where $U$ and $V$...
- 304
3
votes
1
answer
166
views
What Is The Number of Active S-boxes over 5 Rounds of Fides AE cipher?
It is mention in the paper "
Fides: Lightweight Authenticated Cipher with Side-Channel Resistance for Constrained Hardware" , the number of active S-boxes of Fides cipher is 22 over 5 rounds but my ...
- 2,074
2
votes
3
answers
880
views
How can I get the binary form of AES's MDS matrix in MixColumns tranformation?
I need to write a procedure for calculating the MixColumns's operation result in the following form:
$M*X^T,$
where $M$ is a 128x128 binary matrix, $X$ is a 128-bit vector (the state).
My question ...
- 81
4
votes
1
answer
165
views
Is it possible to construct a $3*3$ MDS matrix in $GF(2^4)$?
I'm trying to construct a minimal MDS matrix for a toy cipher. I'm not entirely sure, how the various code parameters are tied to my block size, and how exactly is the binary matrix formed, when you ...
- 43
2
votes
1
answer
181
views
How is Twofish flattening the result of Reed-Solomon MDS matrix multiplication into a 32-bit result?
I have trouble understanding how Reed-Solomon coding can produce same number of output bits than the input was.
Twofish uses this technique. I've read the paper, but still can't quite understand how ...
- 23
0
votes
3
answers
510
views
Optimal MDS matrix - circulant or recursive?
One of the special matrix in $GF(2^q)$ is MDS matrix which can be used in the cryptography like mix column of AES. Two forms of MDS matrices are circulant and recursive.
Which form of MDS matrix (...
- 304
3
votes
1
answer
647
views
What is an advantage of MDS matrices in block ciphers?
I saw the several articles about MDS matrices. They said that, one goal of MDS matrices is to protect the block ciphers against linear and differential attacks. My question is:
For example in the ...
- 2,323
8
votes
1
answer
1k
views
How 2 rounds in AES achieve full diffusion?
I have read somewhere that 2 rounds is AES provide full diffusion. So I looked it up to find out what it exactly meant. In The Design of Rijndael page 41, section 3.5 and it states that:
Two ...
- 391
8
votes
2
answers
1k
views
How to check that AES Matrix is MDS?
I want to understand how can I prove that M matrix in AES is MDS. I know that a matrix is MDS if every determinant of every square submatrix is different from 0.
I don't get this. How much submatrix ...
- 115
2
votes
1
answer
406
views
Design of MixColumn Transformation in AES
Why is the multiplication in MixColumn Transformation particularly by 2,3,1,1 cyclically? Why not some other numbers?
- 67
3
votes
1
answer
378
views
Twofish MDS multiplication
I wasted the last 2 days finding literature and/or some illustrative explanations on how to perform correct multiplications against the MDS-Matrix in Twofish over $\operatorname{GF}(256)$ with $x^8 + ...
- 163
6
votes
1
answer
2k
views
How to find the AES branch number?
By definition, branch number
Definition: The branch number of a linear transformation $F$ is
$$min_{a\neq0}(W(a) + W(F(a)))$$
Source here (7.3.1)
For AES MixColumns $a \in GF(2^8)^4$ since ...
- 63
10
votes
1
answer
2k
views
How to calculate active s-boxes from branch number?
If MDS in AES has branch number 5 (so 5 active s-boxes in 2 rounds), wouldn't that mean 4 rounds of AES has $5*2=10$ active s-boxes?
AES paper says it has 25 ($5^2$?) active s-boxes in 4 rounds.
How ...
- 1,649
3
votes
1
answer
209
views
Why are $\{0,1\}$-matrices almost-MDS only when n is 2, 3, or 4?
In this paper authors claim that $\{0,1\}$-matrices are almost-MDS (have branch number $n - 1$) on when $n$ is $2, 3,$ or $4$.
For example, how can this two matrices have the same branch number?
$$\...
- 1,649
4
votes
1
answer
453
views
Twofish MDS and PHT
Twofish was an AES candidate and it uses $4 \times 4$ Matrix as MDS followed by a PHT.
The Branch Number of MDS and PHT is 5 and 2 Respectively.
from formula
$Branch~Number = Minimum~of~[...
- 2,397
5
votes
1
answer
2k
views
What is the branch number of this matrix?
We have the following matrix:
$$\begin{pmatrix}0&1&1&1\\
1&0&1&1\\
1&1&0&1\\
1&1&1&0\end{pmatrix}$$
What is the branch number?
Is this a MDS marix?
- 1,649
6
votes
1
answer
854
views
Active S-boxes for AES with 8x8 MDS matrix
One way to enhance the security of AES is by increasing the number of active S-boxes. Larger MDS matrices are used to increase the number of active S-boxes. Using a $4\times4$ MDS matrix results in 25 ...
- 2,074
12
votes
2
answers
536
views
Is standardizing a modified AES a good idea?
"Recently" the Ukraine standardized a new block cipher Kalyna, which according to the abstract of"A New Encryption Standard of Ukraine:
The Kalyna Block Cipher" by Oliynykov et al. (warning: the paper ...
- 45.7k
7
votes
1
answer
2k
views
How was the MDS matrix used in AES chosen?
$$\begin{pmatrix}2&3&1&1\\
1&2&3&1\\
1&1&2&3\\
3&1&1&2\end{pmatrix}$$
In the above MDS matrix used in AES encryption, why are the numbers $2$,$3$ and $1$...
- 73
6
votes
1
answer
432
views
Rijndael S-boxes: Where do the $\mu$ and $\nu$ polynomial ring elements come from?
I've asked some other questions before about Rijndael's S-boxes, and step by step I'm coming to an understanding; but those steps often guide me to new questions.
I did some lines of code to ...
- 737
3
votes
1
answer
455
views
Variants of AES? [closed]
Would variants of AES provide the same level of security as AES, say by just replacing the S-box with another one, MDS matrix of Mixcolumn, etc.?
- 41
6
votes
1
answer
5k
views
How can I calculate the Rijndael SBox?
I would like to implement the Rijndael subBytes() operation using calculation instead of tables, because I like to play with this on different wordsizes, as an ...
- 737
6
votes
2
answers
581
views
Choice of reduction polynomial in Whirlpool's internal cipher
Whirlpool is an interesting little hash function in the Miyaguchi-Preneel family.
In my mind, it's most interesting feature is the design of internal cipher W, where the distinction between key and ...
- 4,297