Construction of lightweight involutory MDS matrices

Abstract

In this paper, we propose an efficient method to find lightweight involutory MDS matrices. To obtain involutory matrices, we give a necessary and sufficient condition for judging the involutory MDS property and propose a search method. For the $n\times n$ involutory MDS matrices over ${\mathbb {F}}_{2^m}$, the amount of computation is reduced from $2^{mn^2}$ to $2^{(mn^2)/2}$. Especially, we can exhaustively search for involutory MDS matrices when $n=4$, and for larger n, we add additional restrictions to reduce the search range. As for finding lightweight ones, we use the permutation-equivalent class to extend the input such that the efficiency of the heuristic designed by Xiang et al. can be improved. Applying our method, we obtain a class of $16\times 16$ binary MDS matrices with branch number 5, which can be implemented with only 35 XOR gates. The results even reach the same implementation cost as the lightest non-involutory MDS matrix up to now. Concerning lightweight binary matrices with order 32, it is hard to obtain optimal results through search. Hence, we construct $32\times 32$ matrices with the lightweight $16 \times 16$ matrices that we found. In this way, we obtain two classes of $4 \times 4$ involutory MDS matrices whose entries are $8 \times 8$ binary matrices with 70 XOR gates while the previous lightest matrices with the same size cost 78 XOR gates. Moreover, we also generalize our search method to general cases and it is provable that the approach is feasible for MDS matrices of order 6 and 8 to achieve efficient search.

Appendices

The costs of different permutation-equivalent matrices

We optimize the $4\times 4$ MDS matrices over ${\mathbb {F}}_{2^4}$ from [4]. For each permutation-equivalent matrix, we run Xiang et al.’s algorithm 100 times and return the lowest cost. Let P and Q be row and column permutation respectively. The arrays [a,b,c,d] are employed to represent $4 \times 4$ permutation matrices, where a, b, c, d are the position of the non-zero element in each row. The costs of a part of permutation-equivalent matrices are listed as follows.

• 1. P = [1,2,3,4], Q = [1,2,3,4], Cost = 42;

• 2. P = [1,2,3,4], Q = [1,2,4,3], Cost = 42;

• 3. P = [1,2,3,4], Q = [1,3,2,4], Cost = 42;

• 4. P = [1,2,3,4], Q = [1,3,4,2], Cost = 41;

• 5. P = [1,2,3,4], Q = [1,4,2,3], Cost = 43;

• 6. P = [1,2,3,4], Q = [1,4,3,2], Cost = 42;

• 7. P = [1,2,3,4], Q = [2,1,3,4], Cost = 42;

• 8. P = [1,2,3,4], Q = [2,1,4,3], Cost = 42;

• 9. P = [1,2,3,4], Q = [2,3,1,4], Cost = 41;

• 10. P = [1,2,3,4], Q = [2,3,4,1], Cost = 42;

• 11. P = [1,2,3,4], Q = [2,4,1,3], Cost = 42;

• 12. P = [1,2,3,4], Q = [2,4,3,1], Cost = 42;

• 13. P = [1,2,3,4], Q = [3,1,2,4], Cost = 43;

• 14. P = [1,2,3,4], Q = [3,1,4,2], Cost = 42;

• 15. P = [1,2,3,4], Q = [3,2,1,4], Cost = 42;

• 16. P = [1,2,3,4], Q = [3,2,4,1], Cost = 41;

• 17. P = [1,2,3,4], Q = [3,4,1,2], Cost = 43;

• 18. P = [1,2,3,4], Q = [3,4,2,1], Cost = 42;

• 19. P = [1,2,3,4], Q = [4,1,2,3], Cost = 42;

• 20. P = [1,2,3,4], Q = [4,1,3,2], Cost = 41;

Optimal implementations

Table 6 The optimal implementation of the lightest $16 \times 16$ matrix with 35 XOR gates, where $(x_{0},x_{1},\ldots ,x_{15})$ denotes the input vector and $(y_{0},y_{1},\ldots ,y_{15})$ denotes the output vector

Table 7 The optimal implementation of the lightest $32 \times 32$ matrix from Construction 1

Table 8 The optimal implementation of the lightest $32 \times 32$ matrix from Construction 2

Other lightweight $4 \times 4$ involutory MDS matrices

Table 9 $4 \times 4$ involutory MDS matrices with 36 XOR gates

Optimization of the best matrices in this paper with different algorithms

Table 10 Implementation costs of involutory MDS matrices in $\mathrm {M}_{4}(\mathrm {GL(4,{\mathbb {F}}_{2})})$ under different optimization tools

Table 11 Implementation costs of involutory MDS matrices in $\mathrm {M}_{4}(\mathrm {GL(8,{\mathbb {F}}_{2})})$ under different optimization tools

The implementation of lightweight $8 \times 8$ involutory MDS matrices

Table 12 The optimal implementation of $8\times 8$ matrix in Example 1

Lightweight involutory MDS matrices

Table 13 $6 \times 6$ involutory MDS matrices over ${\mathbb {F}}_{2^{8}}$