Skip to main content
SpringerLink
Log in

Cryptographically significant MDS matrices based on circulant and circulant-like matrices for lightweight applications

  • Published:
Cryptography and Communications Aims and scope Submit manuscript

Abstract

MDS matrices incorporate diffusion layers in block ciphers and hash functions. MDS matrices are in general not sparse and have a large description and thus induce costly implementations both in hardware and software. It is also nontrivial to find MDS matrices which could be used in lightweight cryptography. In the AES MixColumn operation, a circulant MDS matrix is used which is efficient as its elements are of low hamming weights, but no general constructions and study of MDS matrices from d×d circulant matrices for arbitrary d is available in the literature. In a SAC 2004 paper, Junod et al. constructed a new class of efficient matrices whose submatrices were circulant matrices and they coined the term circulating-like matrices for these new class of matrices. We call these matrices as Type-I circulant-like matrices. In this paper we introduce a new type of circulant-like matrices which are involutory by construction and we call them Type-II circulant-like matrices.

We study the MDS properties of d×d circulant, Type-I and Type-II circulant-like matrices and construct new and efficient MDS matrices which are suitable for lightweight cryptography for d up to 8. We also consider orthogonal and involutory properties of such matrices and study the construction of efficient MDS matrices whose inverses are also efficient. We explore some interesting and useful properties of circulant, Type-I and Type-II circulant-like matrices which are prevalent in many parts of mathematics and computer science.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Log in via an institution

Price excludes VAT (USA)
Tax calculation will be finalised during checkout.

Instant access to the full article PDF.

Institutional subscriptions

Fig. 1

Similar content being viewed by others

References

  1. Augot, D., Finiasz, M.: Direct construction of recursive MDS diffusion layers using shortened BCH codes. In: FSE (2014)

  2. Barreto, P., Rijmen, V.: The Khazad legacy-level block cipher. Submission to the NESSIE Project. Available at http://cryptonessie.org (2000)

  3. Barreto, P.S., Rijmen, V.: The Anubis block cipher. NESSIE Algorithm Submission. Available at http://cryptonessie.org (2000)

  4. Barreto, P.S.L.M., Rijmen, V.: Whirlpool In: Encyclopedia of Cryptography and Security. 2nd edn, pp. 1384–1385 (2011)

  5. Bosma, W., Cannon, J., Playoust, C.: The magma algebra system I: The User Language. J. Symbolic Comput. 24 (3–4), 235–265 (1997). Computational algebra and number theory (London, 1993)

    Article  MATH  MathSciNet  Google Scholar 

  6. Choy, J., Yap, H., Khoo, K., Guo, J., Peyrin, T., Poschmann, A., Tan, C.H.: SPN-Hash: Improving the provable resistance against differential collision attacks. In: AFRICACRYPT 2012 (2012)

  7. Daemen, J., Knudsen, L.R., Rijmen, V.: The block cipher SQUARE. In: 4th Fast Software Encryption Workshop. LNCS 1267, pp. 149–165. Springer (1997)

  8. Daemen, J., Rijmen, V.: The Design of Rijndael:AES - The Advanced Encryption Standard. Springer (2002)

  9. Filho, G.D., Barreto, P., Rijmen, V.: The maelstrom-0 hash function. In: Proceedings of the 6th Brazilian Symposium on Information and Computer Systems Security (2006)

  10. Gauravaram, P., Knudsen, L.R., Matusiewicz, K., Mendel, F., Rechberger, C., Schlaffer, M., Thomsen, S.: Gr ϕstl a SHA-3 Candidate. Submission to NIST (2008). Available at http://www.groestl.info

  11. Hirschfeld, J.W.P.: The main conjecture for MDS codes, cryptography and coding. In:Proceeding of the 5th IMA Conference, pp. 44–52. Cirencester (1995)

  12. Guo, J., Peyrin, T., Poschmann, A.: The PHOTON family of lightweight hash functions. In: CRYPTO 2011, pp. 222–239. Springer (2011)

  13. Gupta, K.C., Ray, I.G.: On constructions of involutory MDS matrices. In: AFRICACRYPT 2013, pp. 43–60. Springer (2013)

  14. Gupta, K.C., Ray, I.G.: On constructions of MDS matrices from companion matrices for lightweight cryptography. In: CD-ARES 2013 Workshops: MoCrySEn, pp. 29–43. Springer (2013)

  15. Gupta, K.C., Ray, I.G.: On constructions of circulant MDS matrices for lightweight cryptography. In: ISPEC 2014, pp. 564–576. Springer (2014)

  16. Nakahara J. Jr, Abrahao, E.: A new involutory mds matrix for the AES. Int. J. Netw. Secur. 9 (2), 109–116 (2009)

    Google Scholar 

  17. Junod, P., Vaudenay, S.: Perfect diffusion primitives for block ciphers building efficient MDS matrices. Selected Areas in Cryptography 2004. Lecture Notes in Computer Science. Springer, Waterloo, Canada. Revisited papers,

  18. Junod, P., Vaudenay, S.: FOX: a new family of block ciphers. Selected Areas in Cryptography, SAC. pp. 114–119. Springer, LNCS (2004)

    Book  Google Scholar 

  19. Junod, P., Macchetti, M.: Revisiting the IDEA philosophy In: 16th International Workshop (FSE), Fast Software Encryption. Lecture Notes in Computer Science, 5665, pp. 277–295. Springer (2009)

  20. Lacan, J., Fimes, J.: Systematic MDS erasure codes based on vandermonde matrices. IEEE Trans. Commun. Lett. 8 (9), 570572 (2004). CrossRef

    Google Scholar 

  21. Lo, J.W., Hwang, M.S., Liu, C.H.: An efficient key assignment scheme for access control in a large leaf class hierarchy. In: Journal of Information Sciences: An International Journal Archive, vol. 181, no. 4, pp. 917–925. Elsevier, New York (2011)

    Google Scholar 

  22. MacWilliams, F.J., Sloane, N.J.A: The Theory of Error Correcting Codes. North Holland (1986)

  23. Rao, A.R., Bhimasankaram, P.: Linear Algebra, 2nd edn. Hindustan Book Agency

  24. Rijmen, V., Daemen, J., Preneel, B., Bosselaers, A., Win, E.D.: The cipher SHARK. In: 3rd Fast Software Encryption Workshop, LNCS 1039. pp. 99–112. Springer (1996)

  25. Sajadieh, M., Dakhilalian, M., Mala, H., Omoomi, B.: On construction of involutory MDS matrices from Vandermonde matrices in G F(2q). In: Design, Codes Cryptography (2012)

  26. Sajadieh, M., Dakhilalian, M., Mala, H., Sepehrdad, P.: Recursive diffusion layers for block ciphers and hash functions. In: FSE 2012, pp. 385–401. Springer (2012)

  27. Schneier, B., Kelsey, J., Whiting, D., Wagner, D., Hall, C., Ferguson, N.: Twofish: A 128-bit block cipher. In: The First AES Candidate Conference. National Institute for Standards and Technology (1998)

  28. Schneier, B., Kelsey, J., Whiting, D., Wagner, D., Hall, C., Ferguson, N.: The Twofish Encryption Algorithm. Wiley (1999)

  29. Schnorr, C., Vaudenay, S.: Black box cryptanalysis of hash networks based on multipermutations. In: De Santis, A. (ed.) Proceedings of LNCS Advances in Cryptology - EUROCRYPT 94, vol. 950, pp. 47–57. Springer (1995)

  30. Shannon, C.E: Communication theory of secrecy systems. Bell Syst. Technical J. 28, 656–715 (1949)

    Article  MATH  MathSciNet  Google Scholar 

  31. Shiraj, T., Shibutani, K.: On the diffusion matrix employed in the Whirlpool hashing function. Available at http://www.cosic.esat.kuleuven.be/nessie/reports/.../whirlpool-20030311.pdf.

  32. Sony Corporation: The 128-bit block cipher CLEFIA algorithm specification (2007). Available at http://www.sony.co.jp/Products/cryptography/clefia/download/data/clefia-spec-1.0.pdf.

  33. S. Vaudenay: On the need for multipermutations: Cryptanalysis of MD4 and SAFER. In: Preneel, B. (ed.) Proceedings of LNCS Fast Software Encryption, vol. 1008, pp. 286–297. Springer (1995)

  34. Watanabe, D., Furuya, S., Yoshida, H., Takaragi, K., Preneel, B.: A new keystream generator MUGI. In: FSE 2002. pp. 179–194. Springer, Berlin/Heidelberg (2002)

    Google Scholar 

  35. Wu, S., Wang, M., Wu, W.: Recursive diffusion layers for (Lightweight) block ciphers and hash functions. In: SAC 2012, LNCS 7707, pp. 355–371. Springer, Berlin Heidelberg (2013)

    Google Scholar 

  36. Youssef, A.M., Tavares, S.E., Heys, H.M.: A new class of substitution permutation networks. In: Workshop on Selected Areas in Cryptography, SAC ’96. Workshop Record (1996)

  37. Youssef, A.M., Mister, S., Tavares, S.E.: On the design of linear transformations for substitution permutation encryption networks. In: Workshop On Selected Areas in Cryptography, SAC 97. pp. 40–48 (1997)

Download references

Acknowledgments

We are thankful to the anonymous reviewers, whose comments greatly improved the quality of the manuscript. We also wish to thank Sumit Kumar Pandey, Subhabrata Samajder and Sanjay Bhattacherjee for providing several useful and valuable suggestions.

Author information

Authors and Affiliations

  1. Applied Statistics Unit, Indian Statistical Institute, 203, B. T. Road, Kolkata, 700108, India

    Kishan Chand Gupta & Indranil Ghosh Ray

Authors
  1. Kishan Chand Gupta
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Indranil Ghosh Ray
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Kishan Chand Gupta.

Additional information

This is a substantially revised and extended version of the paper [15] of ISPEC 2014. In [15], the authors considered circulant MDS matrices. We revisited [15] and revised several results and tables. All discussions about circulant-like matrices are completely new technical contributions of this paper.

Appendices

Appendix A

The matrix A=C i r c(1,1,α −1,1,α −2,α −1+α −2,1+α −1,1+α −1) of Proposition 4over \(\mathbb {F}_{2^{8}}\) with generating polynomial x 8+x 4+x 3+x 2+1 can be implemented in the following way. The idea of the implementation is taken from [8, page 54]. This implementation requires 71 XORs, 10 temporary variables and 24 x t i m e_i n v operations (or 24 table lookup), which is the multiplication by α −1.

$$\begin{array}{@{}rcl@{}} t &=& a[0] \oplus a[1] \oplus a[2] \oplus a[3] \oplus a[4] \oplus a[5] \oplus a[6] \oplus a[7];\text{/* a is the input vector */}\\ u0&=&a[0];u1=a[1];u2=a[2];u3=a[3];u4=a[4];u5=a[5]; \\ z&=& a[4] \oplus a[5]; v = a[2] \oplus z; w= a[2] \oplus a[5] \oplus a[6] \oplus a[7]; w=xtime\_inv[w]; \\ z&=&xtime\_inv[xtime\_inv[[z]]; a[0] = v \oplus w \oplus z \oplus t;\\ z&=& a[5] \oplus a[6]; v = a[3] \oplus z; w= a[3] \oplus a[6] \oplus a[7] \oplus u0; w=xtime\_inv[w]; \\ z&=&xtime\_inv[xtime\_inv[[z]]; a[1] = v \oplus w \oplus z \oplus t;\\ z&=& a[6] \oplus a[7]; v = a[4] \oplus z; w= a[4] \oplus a[7] \oplus u0 \oplus u1; w=xtime\_inv[w]; \\ z&=&xtime\_inv[xtime\_inv[[z]]; a[2] = v \oplus w \oplus z \oplus t;\\ z&= &a[7] \oplus u0; v = a[5] \oplus z; w= a[5] \oplus u0 \oplus u1 \oplus u2; w=xtime\_inv[w];\\ z&=&xtime\_inv[xtime\_inv[[z]]; a[3] = v \oplus w \oplus z \oplus t;\\ z&=& u0 \oplus u1; v = a[6] \oplus z; w= a[6] \oplus u1 \oplus u2 \oplus u3; w=xtime\_inv[w]; \\ \end{array} $$
$$\begin{array}{@{}rcl@{}} z&=&xtime\_inv[xtime\_inv[[z]]; a[4] = v \oplus w \oplus z \oplus t;\\ z&= &u1 \oplus u2; v = a[7] \oplus z; w= a[7] \oplus u2 \oplus u3 \oplus u4; w=xtime\_inv[w];\\ z&=&xtime\_inv[xtime\_inv[[z]]; a[5] = v \oplus w \oplus z \oplus t;\\ z&= &u2 \oplus u3; v = u0 \oplus z; w= u0 \oplus u3 \oplus u4 \oplus u5; w=xtime\_inv[w];\\ z&=&xtime\_inv[xtime\_inv[[z]]; a[6] = v \oplus w \oplus z \oplus t;\\ z&=& u3 \oplus u4; v = u1 \oplus z; w= u1 \oplus u4 \oplus u5 \oplus u6; w=xtime\_inv[w];\\ z&=&xtime\_inv[xtime\_inv[[z]]; a[7] = v \oplus w \oplus z \oplus t; \end{array} $$

Appendix B

The matrix M=C i r c(1 x ,1 x ,2 x ,1 x ,5 x ,8 x ,9 x ,4 x ) proposed in [31] can be implemented in the following way. This implementation requires 71 XORs, 12 temporary variables and 48 xtime (or 48 table lookup) operations.

$$\begin{array}{@{}rcl@{}} t &=& a[0] \oplus a[1] \oplus a[2] \oplus a[3] \oplus a[4] \oplus a[5] \oplus a[6] \oplus a[7];\text{/* a is the input vector */}\\ u0&=&a[0];u1=a[1];u2=a[2];u3=a[3];u4=a[4];u5=a[5]; u6=a[6];\\ v &=& a[4] \oplus a[7]; w= a[5] \oplus a[6];y = xtime[a[2]]; z= a[2] \oplus a[5] \oplus a[7]; v=xtime[xtime[v]];\\ w&=&xtime[xtime[xtime[z]]];a[0] = t \oplus v \oplus w \oplus y \oplus z;\\ v &=& a[5] \oplus u0; w= a[6] \oplus a[7];y = xtime[a[3]]; z= a[3] \oplus a[6] \oplus u0; v=xtime[xtime[v]];\\ w&=&xtime[xtime[xtime[z]]];a[1] = t \oplus v \oplus w \oplus y \oplus z;\\ v &=& a[6] \oplus u1; w= a[7] \oplus u0;y = xtime[a[4]]; z= a[4] \oplus a[7] \oplus u1; v=xtime[xtime[v]];\\ w&=&xtime[xtime[xtime[z]]];a[2] = t \oplus v \oplus w \oplus y \oplus z;\\ v &=& a[7] \oplus u2; w= u0 \oplus u1;y = xtime[a[5]]; z= a[5] \oplus u0 \oplus u2; v=xtime[xtime[v]];\\ w&=&xtime[xtime[xtime[z]]];a[3] = t \oplus v \oplus w \oplus y \oplus z;\\ v &=& u0 \oplus u3; w= u1 \oplus u2;y = xtime[a[6]]; z= a[6] \oplus u1 \oplus u3; v=xtime[xtime[v]];\\ w&=&xtime[xtime[xtime[z]]];a[4] = t \oplus v \oplus w \oplus y \oplus z;\\ v &=& u1 \oplus u4; w= u2 \oplus u3;y = xtime[a[7]]; z= a[7] \oplus u2 \oplus u4; v=xtime[xtime[v]];\\ w&=&xtime[xtime[xtime[z]]];a[5] = t \oplus v \oplus w \oplus y \oplus z;\\ v &=& u2 \oplus u5; w= u3 \oplus u4;y = xtime[u0]; z= u0 \oplus u3 \oplus u5; v=xtime[xtime[v]]; \\ w&=&xtime[xtime[xtime[z]]];a[6] = t \oplus v \oplus w \oplus y \oplus z;\\ v &=& u3 \oplus u6; w= u4 \oplus u5;y = xtime[u1]; z= u1 \oplus u4 \oplus u6; v=xtime[xtime[v]];\\ w&=&xtime[xtime[xtime[z]]];a[7]= t \oplus v \oplus w \oplus y \oplus z; \end{array} $$

Appendix C

The matrix A=T y p e I(α,C i r c(1, 1 +α −1,α)) proposed in [18] can be implemented in the following way. The implementation involves 14 XORs, 4 xtimes and 3 x t i m e_i n vs (or 7 table lookups) and also 5 temporary variables:

$$\begin{array}{@{}rcl@{}} t &=& a[0] \oplus a[1] \oplus a[2] \oplus a[3];u1=a[1];u2=a[2]\\ v &=& xtime[a[0]]; a[0] = a[0] \oplus v \oplus t; \\ v &=& xtime[a[3]]; w=xtime\_inv[a[2]];a[1] = a[3] \oplus v \oplus w \oplus t;\\ v &=& xtime[u1]; w=xtime\_inv[a[3]];a[2] = u1 \oplus v \oplus w \oplus t;\\ v &=& xtime[u2]; w=xtime\_inv[u1];a[3] = u2 \oplus v \oplus w \oplus t;\\ \end{array} $$

Appendix D

The matrix A=T y p e I(1+α,C i r c(1,α+α −1,1+α)) of Table 6 can be implemented in the following way. The implementation involves 16 XORs, 4 xtimes and 3 x t i m e_i n vs (or 7 table lookups) and also 6 temporary variables:

$$\begin{array}{@{}rcl@{}} t &=& a[0] \oplus a[1] \oplus a[2] \oplus a[3];u1=a[1];u2=a[2]\\ v &=& xtime[a[0]]; a[0] = v \oplus t; \\ v &=& a[2]\oplus [3]; y = xtime[v]; w = xtime\_inv[a[2]];a[1] = a[2] \oplus y \oplus w \oplus t;\\ x &=& u1 \oplus a[3]; y = xtime[x]; w = xtime\_inv[a[3]];a[2] = a[3] \oplus y \oplus w \oplus t;\\ x &=& v \oplus x; y = xtime[x]; w = xtime\_inv[u1];a[3] = u1 \oplus y \oplus w \oplus t;\\ \end{array} $$

Appendix E

Let us consider the MDS matrix M=A 4 where A=S e r i a l(1,α,1,α 2)=\( \left (\begin {array}{cccc} 0 & 1 & 0 & 0 \\ 0 & 0 & 1 & 0 \\ 0 & 0 & 0 & 1 \\ 1 & \alpha & 1 & \alpha ^{2} \end {array} \right ) \)and α is the root of the irreducible polynomial x 8+x 4+x 3+x+1. The implementation of A, as given below, requires 3 XORs, 3 xtimes and 5 temps. So implementation of M requires 12 XORs, 12 xtimes and 5 temps. The implementation of multiplication by A is as follows:

$$\begin{array}{@{}rcl@{}} u0 &=& a[0]; u1=a[1]; u2=a[2]; a[0] = a[1]; a[1] = a[2]; a[2] = a[3]; \\ u &=& xtime[u1]; v = xtime[xtime[a[3]]]; a[3]= u0 \oplus u \oplus u2 \oplus v; \end{array} $$

Rights and permissions

Reprints and permissions

About this article

Check for updates. Verify currency and authenticity via CrossMark

Cite this article

Gupta, K.C., Ray, I.G. Cryptographically significant MDS matrices based on circulant and circulant-like matrices for lightweight applications. Cryptogr. Commun. 7, 257–287 (2015). https://doi.org/10.1007/s12095-014-0116-3

Download citation

  • Received:

  • Accepted:

  • Published:

  • Issue Date:

  • DOI: https://doi.org/10.1007/s12095-014-0116-3

Keywords

Mathematics Subject Classification (2010)

Search

Navigation