# Tag Info

Accepted

Synthetically, the advantages of the Montgomery ladder are that it is simple and fast. If you look at X25519, the Diffie-Hellman algorithm applied to Curve25519 and described in RFC 7748, you will see ...
Accepted

### Why does AES use a Binary Field?

Well, there would be two possible ways to use modular arithmetic: You could do the arithmetic modulo $2^n$. However, that has some nasty properties (not all elements have multiplicative inverses, ...
Accepted

### How do Käsper and Schwabe's Bitsliced AES Mixcolumns work?

Slide #8 in the presentation you linked to describes the way Käsper and Schwabe pack the bits of the AES data blocks into CPU registers. According to the slide, what they're doing is processing eight ...
Accepted

### What is the branch number of this matrix?

The matrix is not MDS over $GF(2)$; No binary MDS codes exist and non nonbinary (over $GF(2^n)$ MDS codes would have this generator whose scalar entries are in the field $GF(2)$). Over $GF(2^n)$ The ...
Accepted

### Prove the branch of number of Advanced Encryption Standard

The dear user @kodlu has answered to the similar question with excellent discussion but I want to answer with linear algebra argument. We have two definitions for MDS (Maximum Distance Separable) ...
Accepted

### How to calculate active s-boxes from branch number?

Khazad has an $8\times 8$ MDS matrix $A$ used as the diffusion layer. The augmented matrix $[I|A]$ generates a $[n,k,d]=[16,8,9]$ MDS code over $GF(2^8).$ The implications are: The minimum number of ...
Accepted

### How do we reduce the multiplications in the AES mix column layer using $x^4 +1$

The $x^4+1$ is implicit in the matrix. What you are doing is that you consider formal sums $z_0 + z_1 \alpha + z_2 \alpha^2 + z_3 \alpha^3$ for $z_i$ elements of the field $\mathbb{F}_{256}$, and a ...

### How can I get the binary form of AES's MDS matrix in MixColumns tranformation?

Concretely, given an element $x \in$ GF($2^8$), to multiply it by 2, we simply do a left shift and xor with 0b100011011 if the result of the shift gets above 0b11111111 (255). To multiply by 3, we ...

### What is the time complexity of the basic components of a symmetric cipher?

I cannot find anything simple on time complexity for cryptographic components (functions?) as describable above You wont really find anything because those components are generally not described that ...

### How to check that an $km \times km$ block-binary matrix is an MDS matrix in $k$-bit words over $\operatorname{GF}(2)$

Let $\bf A$ be an $n \times n$ binary matrix. Let we want to check that whether $\bf A$ is an MDS matrix over the finite field $\mathbb{F}_{2^k}$ for some $k$? The necessary condition is that $k\mid n$...

### What is the time complexity of the basic components of a symmetric cipher?

You may need to specify your model of computation to make your question answerable. In some models bitwise XOR is ${\rm O}(n)$ in the number of bits being XORed; it others it can be ${\rm O}(1)$, ...
Accepted

### How can I get the binary form of AES's MDS matrix in MixColumns tranformation?

Here is a Sage code that creates the MDS matrix over $F_2$. ...

### How can I get the binary form of AES's MDS matrix in MixColumns tranformation?

This question can be used to get what you want. There we use bytes (so expand those to bits) and you have to use extra XOR's (i.e. binary additions) to get the field multiplications.

### Why are $\{0,1\}$-matrices almost-MDS only when n is 2, 3, or 4?

From the article on page 5; Theorem 1 Let $A:{GF(2^m)}^n \to {GF(2^m)}^n$ be an $n\times n \{0,1\}$-matrix over $GF(2^m)$. Then the branch number of $A$ is at most $\frac{2n+4}{3}$. Let $A$ be the ...

### Hill Cipher question

You would need (at least) 3 pairs of vectors in order to determine the 3*3 matrix.
Accepted

### How to calculate the branch number of a linear mapping?

As explained in the answer to the question here the branch number of a linear mapping $$A:F_q^n \rightarrow F_q^n, \quad x\mapsto A\cdot x$$ is the minimum weight of the linear code generated by the ...
The distinguishing problem with a single sample $x$ is impossible. This is because for any non-zero $x$ and any $u$ there exists an $S$ such that $Sx=u$. ETA 20220405: For the broader question of ...