Questions tagged [mds]

An MDS matrix (Maximum Distance Separable) is a matrix representing a function with certain diffusion properties that have useful applications in cryptography.

Filter by
Sorted by
Tagged with
1 vote
1 answer
64 views

Near Maximum Distance Separable Code

I want to find the minimum distance of an $[8,4]$ Near MDS code over a finite field F_4 (NMDS Code is a type of linear code). I want to know which programming language has a built-in function that ...
4 votes
2 answers
623 views

How to find the inverse of a 3x3 MDS matrix

I implemented a block cipher similar to AES. But the reason I can't decrypt is that I can't get the inverse MDS matrix. The MDS matrix I used is a 3x3 MDS matrix on $GF(2^8) \implies GF(2^8)$ like AES ...
2 votes
1 answer
103 views

How to check whether function provides full diffusion or not?

In "The Skein Hash Function Family" paper authors wrote: The MIX/permute structure has been designed to provide full diffusion in 9 rounds for Threefish-256, 10 rounds for Threefish-512, ...
2 votes
1 answer
135 views

regarding MDS matrix and security

I found a construction for MDS matrix (algorithm 4 of https://eprint.iacr.org/2020/1143) for a hash function that compresses elements in a prime field $F_p$ If the hash has a rate and capacity $(r,c)$ ...
2 votes
1 answer
448 views

Sage code for finding generator matrix of MDS code

Let $L$ be an $[n,k]$ code. A $k\times n$ matrix $G$ whose rows form a basis for $L$ is called a generator matrix for $L$. A linear $[n,k,d]$ code with largest possible minimum distance is called ...
0 votes
0 answers
107 views

AES MDS D-XOR and S-XOR count

I am trying to implement the D-XOR and S-XOR count in python but despite reading multiple articles on how to perform the calculation I have failed to understand the process used. I would appreciate it ...
2 votes
2 answers
343 views

MDS Matrix Elements

Can zero be one of the elements used in an MDS matrix (in the context of AES)? Based on what I have read all entries of an MDS Matrix need to be non-zero. Also, I would appreciate any help in ...
6 votes
1 answer
443 views

Rijndael S-boxes: Where do the $\mu$ and $\nu$ polynomial ring elements come from?

I've asked some other questions before about Rijndael's S-boxes, and step by step I'm coming to an understanding; but those steps often guide me to new questions. I did some lines of code to ...
1 vote
1 answer
217 views

Using Hadamard Form of a Matrix in the Block Cipher

Definition: A matrix A of size $2^n$ is a Hadamard matrix, if has the following form $$ A= \left( \begin{array}{cc} U & V \\ V & U \end{array} \right)_{2^n\times 2^n}\, , $$ where $U$ and $V$...
6 votes
1 answer
3k views

How to find the AES branch number?

By definition, branch number Definition: The branch number of a linear transformation $F$ is $$min_{a\neq0}(W(a) + W(F(a)))$$ Source here (7.3.1) For AES MixColumns $a \in GF(2^8)^4$ since ...
5 votes
1 answer
479 views

A Lightweight Matrix Suggestion for MixColumns State of AES

We know that the matrix in the MixColumns state of AES is the circulant MDS matrix $C=circ(2,3,1,1)$ which is defined over $GF(2^8)$ with the irreducible polynomial $f=x^{8}+x^{4}+x^{3}+x+1$. Let we ...
3 votes
0 answers
110 views

How to decide which diffusion scheme is better for a block cipher design

There are several schemes that can be used to achieve the diffusion property in a block cipher. Schemes include MDS code, Bit permutation, Byte/ Nibble permutation, Diffusion Matrix, Diffusion ...
6 votes
2 answers
600 views

Choice of reduction polynomial in Whirlpool's internal cipher

Whirlpool is an interesting little hash function in the Miyaguchi-Preneel family. In my mind, it's most interesting feature is the design of internal cipher W, where the distinction between key and ...
12 votes
2 answers
546 views

Is standardizing a modified AES a good idea?

"Recently" the Ukraine standardized a new block cipher Kalyna, which according to the abstract of"A New Encryption Standard of Ukraine: The Kalyna Block Cipher" by Oliynykov et al. (warning: the paper ...
8 votes
1 answer
1k views

How 2 rounds in AES achieve full diffusion?

I have read somewhere that 2 rounds is AES provide full diffusion. So I looked it up to find out what it exactly meant. In The Design of Rijndael page 41, section 3.5 and it states that: Two ...
5 votes
1 answer
2k views

What is the branch number of this matrix?

We have the following matrix: $$\begin{pmatrix}0&1&1&1\\ 1&0&1&1\\ 1&1&0&1\\ 1&1&1&0\end{pmatrix}$$ What is the branch number? Is this a MDS marix?
3 votes
1 answer
456 views

Variants of AES? [closed]

Would variants of AES provide the same level of security as AES, say by just replacing the S-box with another one, MDS matrix of Mixcolumn, etc.?
1 vote
0 answers
473 views

Expressing a given linear transformation in Galois Field GF(256) in terms of another linear transformation with a different reduction polynomial

Before giving a better and detailed description of what I ask, let me first tell why I need what I am looking for: Intel processors already provide instructions (AES-NI) for very efficient AES ...
2 votes
1 answer
408 views

Design of MixColumn Transformation in AES

Why is the multiplication in MixColumn Transformation particularly by 2,3,1,1 cyclically? Why not some other numbers?
3 votes
1 answer
217 views

Why are $\{0,1\}$-matrices almost-MDS only when n is 2, 3, or 4?

In this paper authors claim that $\{0,1\}$-matrices are almost-MDS (have branch number $n - 1$) on when $n$ is $2, 3,$ or $4$. For example, how can this two matrices have the same branch number? $$\...
1 vote
1 answer
224 views

Security of AES under modification of Sboxes and/or MDS mixing layer

Is the security of AES algorithm increased by using many s boxes at the same time instead of using only one s box , and the same question for using many MDS instead of only one.
4 votes
1 answer
174 views

Is it possible to construct a $3*3$ MDS matrix in $GF(2^4)$?

I'm trying to construct a minimal MDS matrix for a toy cipher. I'm not entirely sure, how the various code parameters are tied to my block size, and how exactly is the binary matrix formed, when you ...
2 votes
3 answers
927 views

How can I get the binary form of AES's MDS matrix in MixColumns tranformation?

I need to write a procedure for calculating the MixColumns's operation result in the following form: $M*X^T,$ where $M$ is a 128x128 binary matrix, $X$ is a 128-bit vector (the state). My question ...
1 vote
1 answer
139 views

Can you point me to an MDS table reference for the Kalyna cipher?

I'm working with cipher Kalyna. Kalyna — like AES — has MDS tables in its MixColumns step. But Kalyna's documentation doesn't list these MDS tables. Could you give me a hint where to find proper ...
1 vote
1 answer
182 views

Application of MDS matrices in serial and round-based implementations

We know that MDS matrices are used in the diffusion layers of block ciphers. My question: what types of MDS matrices can be applied to serial or round-based implementations or both of them? I ...
10 votes
1 answer
2k views

How to calculate active s-boxes from branch number?

If MDS in AES has branch number 5 (so 5 active s-boxes in 2 rounds), wouldn't that mean 4 rounds of AES has $5*2=10$ active s-boxes? AES paper says it has 25 ($5^2$?) active s-boxes in 4 rounds. How ...
2 votes
1 answer
187 views

How is Twofish flattening the result of Reed-Solomon MDS matrix multiplication into a 32-bit result?

I have trouble understanding how Reed-Solomon coding can produce same number of output bits than the input was. Twofish uses this technique. I've read the paper, but still can't quite understand how ...
6 votes
1 answer
5k views

How can I calculate the Rijndael SBox?

I would like to implement the Rijndael subBytes() operation using calculation instead of tables, because I like to play with this on different wordsizes, as an ...
2 votes
1 answer
242 views

How to check that an $km \times km$ block-binary matrix is an MDS matrix in $k$-bit words over $\operatorname{GF}(2)$

I have been reading about MDS matrices. It is defined as (paraphrased from Section 2.1) An $n \times n$ matrix $M$ is MDS if and only if $bn(M) = n + 1$ where $bn$ (branch number) is defined as: $bn(...
3 votes
1 answer
167 views

What Is The Number of Active S-boxes over 5 Rounds of Fides AE cipher?

It is mention in the paper " Fides: Lightweight Authenticated Cipher with Side-Channel Resistance for Constrained Hardware" , the number of active S-boxes of Fides cipher is 22 over 5 rounds but my ...
1 vote
1 answer
140 views

The security effect caused by an MDS matrix in word-oriented designs

Considering a design where the MixColumns operation of AES is replaced by a lighter MDS matrix where by the term lighter we mean the number of required XOR to implement an MDS matrix. As you know ...
8 votes
2 answers
1k views

How to check that AES Matrix is MDS?

I want to understand how can I prove that M matrix in AES is MDS. I know that a matrix is MDS if every determinant of every square submatrix is different from 0. I don't get this. How much submatrix ...
6 votes
1 answer
873 views

Active S-boxes for AES with 8x8 MDS matrix

One way to enhance the security of AES is by increasing the number of active S-boxes. Larger MDS matrices are used to increase the number of active S-boxes. Using a $4\times4$ MDS matrix results in 25 ...
3 votes
1 answer
652 views

What is an advantage of MDS matrices in block ciphers?

I saw the several articles about MDS matrices. They said that, one goal of MDS matrices is to protect the block ciphers against linear and differential attacks. My question is: For example in the ...
4 votes
1 answer
470 views

Twofish MDS and PHT

Twofish was an AES candidate and it uses $4 \times 4$ Matrix as MDS followed by a PHT. The Branch Number of MDS and PHT is 5 and 2 Respectively. from formula $Branch~Number = Minimum~of~[...
7 votes
1 answer
2k views

How was the MDS matrix used in AES chosen?

$$\begin{pmatrix}2&3&1&1\\ 1&2&3&1\\ 1&1&2&3\\ 3&1&1&2\end{pmatrix}$$ In the above MDS matrix used in AES encryption, why are the numbers $2$,$3$ and $1$...
0 votes
0 answers
247 views

Cryptographic Strength of MDS Matrix

Maximum Distance Separable (MDS) Matrices are used for providing diffusion in a cipher. How to test the strength (with respect to cryptographic properties) of an MDS matrix used in a cipher?
0 votes
3 answers
532 views

Optimal MDS matrix - circulant or recursive?

One of the special matrix in $GF(2^q)$ is MDS matrix which can be used in the cryptography like mix column of AES. Two forms of MDS matrices are circulant and recursive. Which form of MDS matrix (...
3 votes
1 answer
387 views

Twofish MDS multiplication

I wasted the last 2 days finding literature and/or some illustrative explanations on how to perform correct multiplications against the MDS-Matrix in Twofish over $\operatorname{GF}(256)$ with $x^8 + ...