Shorter Linear Straight-Line Programs for MDS Matrices

Kranz, Thorsten; Leander, Gregor; Stoffelen, Ko; Wiemer, Friedrich

doi:10.46586/tosc.v2017.i4.188-211

Cited by 40 publications

(31 citation statements)

References 27 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…. Then the sw-xor of matrix M is 36, while the best previous result is 42 xor gates [14]. Then, we have the following conclusion.…”

Section: Mds Matrices With the Fewest Sequential Xor Count Based On Wordsmentioning

confidence: 71%

“…Finally, we find 10 classes of involutory MDS matrices with 36 sw-xor and present them in Table 8. Now, we take an example to compare our constructions with previous ones in [14,16].…”

Section: Mds Matrices With the Fewest Sequential Xor Count Based On Wordsmentioning

confidence: 99%

“…Those tools were first used in the implementation of cryptographic functions in [8] and led to a more accurate estimation of the hardware costs. In 2017 [14], Kranz et al showed that the AES MixColumns matrix is implemented with only 97 xor gates by using BP algorithm [8]. Furthermore, many other variants of the BP algorithm are proposed in [3,23,24].…”

Section: Introductionmentioning

confidence: 99%

“…That is to say, each element of T M is a permutation matrix. By a given path, a 4 × 4 matrix M over GL(n, F 2 ) can be obtained by Eq (14),. where each entry can be written as a polynomial over T M .…”

mentioning

confidence: 99%

See 3 more Smart Citations

Four by four MDS matrices with the fewest XOR gates based on words

Shi¹,

Li²,

Tian³

et al. 2023

AMC

View full text Add to dashboard Cite

<p style='text-indent:20px;'>MDS matrices play an important role in the design of block ciphers, and constructing MDS matrices with fewer xor gates is of significant interest for lightweight ciphers. For this topic, Duval and Leurent proposed an approach to construct MDS matrices by using three linear operations in ToSC 2018. Taking words as elements, they found <inline-formula><tex-math id="M1">\begin{document}$ 16\times16 $\end{document}</tex-math></inline-formula> and <inline-formula><tex-math id="M2">\begin{document}$ 32\times 32 $\end{document}</tex-math></inline-formula> MDS matrices over <inline-formula><tex-math id="M3">\begin{document}$ \mathbb{F}_2 $\end{document}</tex-math></inline-formula> with only <inline-formula><tex-math id="M4">\begin{document}$ 35 $\end{document}</tex-math></inline-formula> xor gates and <inline-formula><tex-math id="M5">\begin{document}$ 67 $\end{document}</tex-math></inline-formula> xor gates respectively, which are also the best known implementations up to now. Based on the same observation as their work, we consider three linear operations as three kinds of elementary linear operations of matrices, and obtain more MDS matrices with <inline-formula><tex-math id="M6">\begin{document}$ 35 $\end{document}</tex-math></inline-formula> and <inline-formula><tex-math id="M7">\begin{document}$ 67 $\end{document}</tex-math></inline-formula> xor gates. In addition, some <inline-formula><tex-math id="M8">\begin{document}$ 16\times16 $\end{document}</tex-math></inline-formula> or <inline-formula><tex-math id="M9">\begin{document}$ 32\times32 $\end{document}</tex-math></inline-formula> involutory MDS matrices with only <inline-formula><tex-math id="M10">\begin{document}$ 36 $\end{document}</tex-math></inline-formula> or <inline-formula><tex-math id="M11">\begin{document}$ 72 $\end{document}</tex-math></inline-formula> xor gates over <inline-formula><tex-math id="M12">\begin{document}$ \mathbb{F}_2 $\end{document}</tex-math></inline-formula> are also proposed, which are better than previous results. Moreover, our method can be extended to general linear groups, and we prove that the lower bound of the sequential xor count based on words for <inline-formula><tex-math id="M13">\begin{document}$ 4 \times 4 $\end{document}</tex-math></inline-formula> MDS matrix over general linear groups is <inline-formula><tex-math id="M14">\begin{document}$ 8n+2 $\end{document}</tex-math></inline-formula>.</p>

show abstract

“…. Then the sw-xor of matrix M is 36, while the best previous result is 42 xor gates [14]. Then, we have the following conclusion.…”

Section: Mds Matrices With the Fewest Sequential Xor Count Based On Wordsmentioning

confidence: 71%

“…Finally, we find 10 classes of involutory MDS matrices with 36 sw-xor and present them in Table 8. Now, we take an example to compare our constructions with previous ones in [14,16].…”

Section: Mds Matrices With the Fewest Sequential Xor Count Based On Wordsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

mentioning

confidence: 99%

See 2 more Smart Citations

Four by four MDS matrices with the fewest XOR gates based on words

Shi¹,

Li²,

Tian³

et al. 2023

AMC

View full text Add to dashboard Cite

show abstract

“…Table 2 ), but we were not able to reproduce these results. However, highly optimized, shallower circuits have been proposed in the hardware design literature such as [ 7 , 18 , 26 , 30 , 50 ]. Hence, we chose to use one of those and experiment with a recent design by Maximov [ 34 ].…”

Section: A Quantum Circuit For Aesmentioning

confidence: 99%

Implementing Grover Oracles for Quantum Key Search on AES and LowMC

Jaques

Naehrig

Roetteler

et al. 2020

Lecture Notes in Computer Science

139

124

View full text Add to dashboard Cite

Grover’s search algorithm gives a quantum attack against block ciphers by searching for a key that matches a small number of plaintext-ciphertext pairs. This attack uses calls to the cipher to search a key space of size N . Previous work in the specific case of AES derived the full gate cost by analyzing quantum circuits for the cipher, but focused on minimizing the number of qubits. In contrast, we study the cost of quantum key search attacks under a depth restriction and introduce techniques that reduce the oracle depth, even if it requires more qubits. As cases in point, we design quantum circuits for the block ciphers AES and LowMC. Our circuits give a lower overall attack cost in both the gate count and depth-times-width cost models. In NIST’s post-quantum cryptography standardization process, security categories are defined based on the concrete cost of quantum key search against AES. We present new, lower cost estimates for each category, so our work has immediate implications for the security assessment of post-quantum cryptography. As part of this work, we release Q# implementations of the full Grover oracle for AES-128, -192, -256 and for the three LowMC instantiations used in Picnic, including unit tests and code to reproduce our quantum resource estimates. To the best of our knowledge, these are the first two such full implementations and automatic resource estimations.

show abstract

MDS Matrices

LEURENT

2023

Symmetric Cryptography 1

View full text Add to dashboard Cite

Shorter Linear Straight-Line Programs for MDS Matrices

Cited by 40 publications

References 27 publications

Four by four MDS matrices with the fewest XOR gates based on words

Four by four MDS matrices with the fewest XOR gates based on words

Implementing Grover Oracles for Quantum Key Search on AES and LowMC

MDS Matrices

Contact Info

Product

Resources

About