Shorter Linear Straight-Line Programs for MDS Matrices. Yet another XOR Count Paper

Kranz, Thorsten; Leander, Gregor; Stoffelen, Ko; Wiemer, Friedrich

doi:10.13154/tosc.v2017.i4.188-211

Cited by 12 publications

(2 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Their combination allows to prove that the number of active S-boxes in any 4-round trail is 25, or in general, the square of the branch number [12]. In the context of lightweight cryptography, there has been ample research about constructing MDS matrices with low gate cost, see [2,17,[23][24][25]27,33,35]. While most research is about 4 × 4 matrices, the first MixColumn-like MDS matrices for use in cryptographic round functions were 8 × 8, introduced in the block cipher SHARK [32].…”

Section: Introductionmentioning

confidence: 99%

“…While most research is about 4 × 4 matrices, the first MixColumn-like MDS matrices for use in cryptographic round functions were 8 × 8, introduced in the block cipher SHARK [32]. Later 8×8 MDS matrices were used in the compression function of hash functions such as Whirlpool [1] and there has also been research on reducing the gate cost of such mappings [23]. Constructions that combine 8 × 8 MDS matrices with an appropriate ShiftRows mapping have at least 9 2 = 81 active S-boxes in any 4-round trail.…”

Section: Introductionmentioning

confidence: 99%

See 1 more Smart Citation

Twin Column Parity Mixers and Gaston

Hirch

Daemen

Rohit

et al. 2023

Lecture Notes in Computer Science

View full text Add to dashboard Cite

We introduce a new type of mixing layer for the round function of cryptographic permutations, called circulant twin column parity mixer (CPM), that is a generalization of the mixing layers in Keccak-f and Xoodoo. While these mixing layers have a bitwise differential branch number of 4 and a computational cost of 2 (bitwise) additions per bit, the circulant twin CPMs we build have a bitwise differential branch number of 12 at the expense of an increase in computational cost: depending on the dimension this ranges between 3 and 3.34 XORs per bit. Our circulant twin CPMs operate on a state in the form of a rectangular array and can serve as mixing layer in a round function that has as non-linear step a layer of S-boxes operating in parallel on the columns. When sandwiched between two ShiftRow-like mappings, we can obtain a columnwise branch number of 12 and hence it guarantees 12 active S-boxes per two rounds in differential trails. Remarkably, the linear branch numbers (bitwise and columnwise alike) of these mappings is only 4. However, we define the transpose of a circulant twin CPM that has linear branch number of 12 and a differential branch number of 4. We give a concrete instantiation of a permutation using such a mixing layer, named Gaston. It operates on a state of 5 × 64 bits and uses χ operating on columns for its nonlinear layer. Most notably, the Gaston round function is lightweight in that it takes as few bitwise operations as the one of NIST lightweight standard Ascon. We show that the best 3-round differential and linear trails of Gaston have much higher weights than those of Ascon. Permutations like Gaston can be very competitive in applications that rely for their security exclusively on good differential properties, such as keyed hashing as in the compression phase of Farfalle.

show abstract