Questions tagged [mds]
An MDS matrix (Maximum Distance Separable) is a matrix representing a function with certain diffusion properties that have useful applications in cryptography.
39
questions
1
vote
1
answer
64
views
Near Maximum Distance Separable Code
I want to find the minimum distance of an $[8,4]$ Near MDS code over a finite field F_4 (NMDS Code is a type of linear code). I want to know which programming language has a built-in function that ...
4
votes
2
answers
623
views
How to find the inverse of a 3x3 MDS matrix
I implemented a block cipher similar to AES.
But the reason I can't decrypt is that I can't get the inverse MDS matrix.
The MDS matrix I used is a 3x3 MDS matrix on $GF(2^8) \implies GF(2^8)$ like AES
...
2
votes
1
answer
103
views
How to check whether function provides full diffusion or not?
In "The Skein Hash Function Family" paper authors wrote:
The MIX/permute structure has been designed to provide full diffusion in 9 rounds for Threefish-256, 10 rounds for Threefish-512, ...
2
votes
1
answer
135
views
regarding MDS matrix and security
I found a construction for MDS matrix (algorithm 4 of https://eprint.iacr.org/2020/1143) for a hash function that compresses elements in a prime field $F_p$
If the hash has a rate and capacity $(r,c)$ ...
2
votes
1
answer
448
views
Sage code for finding generator matrix of MDS code
Let $L$ be an $[n,k]$ code. A $k\times n$ matrix $G$ whose rows form a basis for $L$ is called a generator matrix for $L$.
A linear $[n,k,d]$ code with largest possible minimum distance is called ...
0
votes
0
answers
107
views
AES MDS D-XOR and S-XOR count
I am trying to implement the D-XOR and S-XOR count in python but despite reading multiple articles on how to perform the calculation I have failed to understand the process used. I would appreciate it ...
2
votes
2
answers
343
views
MDS Matrix Elements
Can zero be one of the elements used in an MDS matrix (in the context of AES)?
Based on what I have read all entries of an MDS Matrix need to be non-zero. Also, I would appreciate any help in ...
6
votes
1
answer
443
views
Rijndael S-boxes: Where do the $\mu$ and $\nu$ polynomial ring elements come from?
I've asked some other questions before about Rijndael's S-boxes, and step by step I'm coming to an understanding; but those steps often guide me to new questions.
I did some lines of code to ...
1
vote
1
answer
217
views
Using Hadamard Form of a Matrix in the Block Cipher
Definition: A matrix A of size $2^n$ is a Hadamard matrix, if has the following form
$$
A=
\left(
\begin{array}{cc}
U & V \\
V & U
\end{array}
\right)_{2^n\times 2^n}\, ,
$$
where $U$ and $V$...
6
votes
1
answer
3k
views
How to find the AES branch number?
By definition, branch number
Definition: The branch number of a linear transformation $F$ is
$$min_{a\neq0}(W(a) + W(F(a)))$$
Source here (7.3.1)
For AES MixColumns $a \in GF(2^8)^4$ since ...
5
votes
1
answer
479
views
A Lightweight Matrix Suggestion for MixColumns State of AES
We know that the matrix in the MixColumns state of AES is the circulant MDS matrix $C=circ(2,3,1,1)$ which is defined over $GF(2^8)$ with the irreducible polynomial $f=x^{8}+x^{4}+x^{3}+x+1$. Let we ...
3
votes
0
answers
110
views
How to decide which diffusion scheme is better for a block cipher design
There are several schemes that can be used to achieve the diffusion property in a block cipher. Schemes include MDS code, Bit permutation, Byte/ Nibble permutation, Diffusion Matrix, Diffusion ...
6
votes
2
answers
600
views
Choice of reduction polynomial in Whirlpool's internal cipher
Whirlpool is an interesting little hash function in the Miyaguchi-Preneel family.
In my mind, it's most interesting feature is the design of internal cipher W, where the distinction between key and ...
12
votes
2
answers
546
views
Is standardizing a modified AES a good idea?
"Recently" the Ukraine standardized a new block cipher Kalyna, which according to the abstract of"A New Encryption Standard of Ukraine:
The Kalyna Block Cipher" by Oliynykov et al. (warning: the paper ...
8
votes
1
answer
1k
views
How 2 rounds in AES achieve full diffusion?
I have read somewhere that 2 rounds is AES provide full diffusion. So I looked it up to find out what it exactly meant. In The Design of Rijndael page 41, section 3.5 and it states that:
Two ...
5
votes
1
answer
2k
views
What is the branch number of this matrix?
We have the following matrix:
$$\begin{pmatrix}0&1&1&1\\
1&0&1&1\\
1&1&0&1\\
1&1&1&0\end{pmatrix}$$
What is the branch number?
Is this a MDS marix?
3
votes
1
answer
456
views
Variants of AES? [closed]
Would variants of AES provide the same level of security as AES, say by just replacing the S-box with another one, MDS matrix of Mixcolumn, etc.?
1
vote
0
answers
473
views
Expressing a given linear transformation in Galois Field GF(256) in terms of another linear transformation with a different reduction polynomial
Before giving a better and detailed description of what I ask, let me first tell why I need what I am looking for: Intel processors already provide instructions (AES-NI) for very efficient AES ...
2
votes
1
answer
408
views
Design of MixColumn Transformation in AES
Why is the multiplication in MixColumn Transformation particularly by 2,3,1,1 cyclically? Why not some other numbers?
3
votes
1
answer
217
views
Why are $\{0,1\}$-matrices almost-MDS only when n is 2, 3, or 4?
In this paper authors claim that $\{0,1\}$-matrices are almost-MDS (have branch number $n - 1$) on when $n$ is $2, 3,$ or $4$.
For example, how can this two matrices have the same branch number?
$$\...
1
vote
1
answer
224
views
Security of AES under modification of Sboxes and/or MDS mixing layer
Is the security of AES algorithm increased by using many s boxes at the same time instead of using only one s box , and the same question for using many MDS instead of only one.
4
votes
1
answer
174
views
Is it possible to construct a $3*3$ MDS matrix in $GF(2^4)$?
I'm trying to construct a minimal MDS matrix for a toy cipher. I'm not entirely sure, how the various code parameters are tied to my block size, and how exactly is the binary matrix formed, when you ...
2
votes
3
answers
927
views
How can I get the binary form of AES's MDS matrix in MixColumns tranformation?
I need to write a procedure for calculating the MixColumns's operation result in the following form:
$M*X^T,$
where $M$ is a 128x128 binary matrix, $X$ is a 128-bit vector (the state).
My question ...
1
vote
1
answer
139
views
Can you point me to an MDS table reference for the Kalyna cipher?
I'm working with cipher Kalyna.
Kalyna — like AES — has MDS tables in its MixColumns step. But Kalyna's documentation doesn't list these MDS tables.
Could you give me a hint where to find proper ...
1
vote
1
answer
182
views
Application of MDS matrices in serial and round-based implementations
We know that MDS matrices are used in the diffusion layers of block ciphers.
My question: what types of MDS matrices can be applied to serial or
round-based implementations or both of them?
I ...
10
votes
1
answer
2k
views
How to calculate active s-boxes from branch number?
If MDS in AES has branch number 5 (so 5 active s-boxes in 2 rounds), wouldn't that mean 4 rounds of AES has $5*2=10$ active s-boxes?
AES paper says it has 25 ($5^2$?) active s-boxes in 4 rounds.
How ...
2
votes
1
answer
187
views
How is Twofish flattening the result of Reed-Solomon MDS matrix multiplication into a 32-bit result?
I have trouble understanding how Reed-Solomon coding can produce same number of output bits than the input was.
Twofish uses this technique. I've read the paper, but still can't quite understand how ...
6
votes
1
answer
5k
views
How can I calculate the Rijndael SBox?
I would like to implement the Rijndael subBytes() operation using calculation instead of tables, because I like to play with this on different wordsizes, as an ...
2
votes
1
answer
242
views
How to check that an $km \times km$ block-binary matrix is an MDS matrix in $k$-bit words over $\operatorname{GF}(2)$
I have been reading about MDS matrices. It is defined as (paraphrased from Section 2.1)
An $n \times n$ matrix $M$ is MDS if and only if $bn(M) = n + 1$
where $bn$ (branch number) is defined as:
$bn(...
3
votes
1
answer
167
views
What Is The Number of Active S-boxes over 5 Rounds of Fides AE cipher?
It is mention in the paper "
Fides: Lightweight Authenticated Cipher with Side-Channel Resistance for Constrained Hardware" , the number of active S-boxes of Fides cipher is 22 over 5 rounds but my ...
1
vote
1
answer
140
views
The security effect caused by an MDS matrix in word-oriented designs
Considering a design where the MixColumns operation of AES is replaced by a lighter MDS matrix where by the term lighter we mean the number of required XOR to implement an MDS matrix.
As you know ...
8
votes
2
answers
1k
views
How to check that AES Matrix is MDS?
I want to understand how can I prove that M matrix in AES is MDS. I know that a matrix is MDS if every determinant of every square submatrix is different from 0.
I don't get this. How much submatrix ...
6
votes
1
answer
873
views
Active S-boxes for AES with 8x8 MDS matrix
One way to enhance the security of AES is by increasing the number of active S-boxes. Larger MDS matrices are used to increase the number of active S-boxes. Using a $4\times4$ MDS matrix results in 25 ...
3
votes
1
answer
652
views
What is an advantage of MDS matrices in block ciphers?
I saw the several articles about MDS matrices. They said that, one goal of MDS matrices is to protect the block ciphers against linear and differential attacks. My question is:
For example in the ...
4
votes
1
answer
470
views
Twofish MDS and PHT
Twofish was an AES candidate and it uses $4 \times 4$ Matrix as MDS followed by a PHT.
The Branch Number of MDS and PHT is 5 and 2 Respectively.
from formula
$Branch~Number = Minimum~of~[...
7
votes
1
answer
2k
views
How was the MDS matrix used in AES chosen?
$$\begin{pmatrix}2&3&1&1\\
1&2&3&1\\
1&1&2&3\\
3&1&1&2\end{pmatrix}$$
In the above MDS matrix used in AES encryption, why are the numbers $2$,$3$ and $1$...
0
votes
0
answers
247
views
Cryptographic Strength of MDS Matrix
Maximum Distance Separable (MDS) Matrices are used for providing diffusion in a cipher. How to test the strength (with respect to cryptographic properties) of an MDS matrix used in a cipher?
0
votes
3
answers
532
views
Optimal MDS matrix - circulant or recursive?
One of the special matrix in $GF(2^q)$ is MDS matrix which can be used in the cryptography like mix column of AES. Two forms of MDS matrices are circulant and recursive.
Which form of MDS matrix (...
3
votes
1
answer
387
views
Twofish MDS multiplication
I wasted the last 2 days finding literature and/or some illustrative explanations on how to perform correct multiplications against the MDS-Matrix in Twofish over $\operatorname{GF}(256)$ with $x^8 + ...