Loading [MathJax]/jax/element/mml/optable/Latin1Supplement.js
\`x^2+y_1+z_12^34\`
Advanced Search
Article Contents
Article Contents

On construction of lightweight MDS matrices

  • *Corresponding author: Yuan Chen

    *Corresponding author: Yuan Chen 

The fourth author is supported by [Application Foundation Frontier Project of Wuhan Science and Technology Bureau under Grant 2020010601012189 and the National Natural Science Foundation of China under Grant 62072161]

Abstract / Introduction Full Text(HTML) Figure(2) / Table(8) Related Papers Cited by
  • MDS matrices are widely used in block ciphers. Constructing lightweight MDS matrices is one of the research focuses of lightweight cryptography. In this paper, we define a new operation called the Copy operation by using registers. It is a generalization of Type 3 elementary operations (add a row to another one multiplied by a nonzero number). It is shown that any nonsingular matrix can be obtained by Copy operations and Multiplication operations from the identity matrix I (a Copy Block Implementation of the matrix). Thus we introduce a new metric called gw-xor using Copy Block Implementations to construct lightweight MDS matrices with respect to low xor gates. Compared with sw-xor, the gw-xor count is a better approximation of the optimal implementation cost, and in particular it may be a better approximation of the optimal implementation cost than s-xor. By searching the potential paths of Copy operations that can obtain formal MDS matrices (i.e., matrices with indeterminate elements and each determinant of square submatrix of any order is a nonzero polynomial in these indeterminates), we find 52 classes 16×16 and 32×32 binary MDS matrices with 35 and 67 xor gates respectively, which are the best known results. Furthermore, by considering the depth of MDS matrices, we find more 4×4 MDS matrices over F2n with the lowest xor gates at depths 3, 4, 5.

    Mathematics Subject Classification: Primary: 11T71, 68P25, 94B60.

    Citation:

    \begin{equation} \\ \end{equation}
  • 加载中
  • Figure 1.  The implementation of the path P1 in Example 3

    Figure 2.  The circuit implementation in Example 4

    Table 1.  An implementation of the matrix M in Example 2

    1 x5x9x17 2 x6x10x18(y7) 3 x7x11x19(y8)
    4 x8x12x20(y5) 5 x13x16x21 6 x16x9x22(y9)
    7 x21x10x23(y10) 8 x11x14x24(y11) 9 x12x15x25(y12)
    10 x17x20x26(y6) 11 x9x12x27 12 x13x12x28(y13)
    13 x14x27x29(y14) 14 x15x10x30(y15) 15 x11x16x31(y16)
     | Show Table
    DownLoad: CSV

    Table 2.  Comparison of metrics, where α is a root of the polynomial x4+x+1

    Matrix over F2[x]/x4+x+1 sw-xor s-xor gw-xor g-xor Reference
    (10000αα0001α00α1) 16 16 15 15 Example 2
    (111α3+1αa+11α3+α+1α3+αa+1α3+α2+1α3+α2α+1αα3+1α3+α2+α+1) 36 [24] 35 [26] 36 35 [26]
     | Show Table
    DownLoad: CSV

    Table 3.  The potential paths for 4×4 MDS matrices

    No Representative path No Representative path
    1 (R3,¯r4,R2,¯r1,R1,¯r5,R3,¯r6,R4,¯r7,R4,¯r8,R2,¯r9,R1,¯r11) 2 (R3,¯r4,R1,¯r2,R1,¯r5,R4,¯r6,R2,¯r8,R2,¯r7,R3,¯r9,R4,¯r11)
    3 (R3,¯r4,R2,¯r1,R1,¯r5,R4,¯r6,R2,¯r7,R3,¯r8,R4,¯r9,R1,¯r10) 4 (R3,¯r4,R1,¯r2,R2,¯r5,R3,¯r6,R4,¯r7,R4,¯r8,R1,¯r9,R2,¯r11)
    5 (R3,¯r4,R3,¯r1,R3,¯r2,R4,¯r6,R2,¯r8,R2,¯r5,R1,¯r9,R4,10) 6 (R3,¯r4,R1,¯r2,R4,¯r6,R2,¯r5,R3,¯r7,R1,¯r8,R2,¯r9,R4,10)
    7 (R3,¯r4,R3,¯r1,R3,¯r2,R2,5,R4,¯r8,R4,¯r6,R1,¯r9,R2,¯r10) 8 (R3,¯r4,R3,¯r2,R1,¯r5,R3,¯r1,R4,¯r7,R4,¯r6,R2,¯r9,R1,¯r10)
    9 (R3,¯r4,R1,¯r5,R2,¯r6,R2,¯r1,R4,¯r7,R4,¯r2,R3,¯r9,R1,¯r11) 10 (R3,¯r4,R3,¯r2,R1,¯r5,R4,¯r6,R4,¯r1,R2,¯r7,R1,¯r8,R3,¯r11)
    11 (R3,¯r4,R1,¯r5,R2,¯r6,R3,¯r7,R4,¯r8,R4,¯r1,R1,¯r9,R3,¯r11) 12 (R3,¯r4,R3,¯r2,R4,¯r6,R3,¯r1,R1,¯r7,R1,¯r5,R2,¯r9,R4,10)
    13 (R3,¯r4,R1,¯r5,R4,¯r6,R2,¯r7,R3,¯r8,R3,¯r1,R4,¯r9,R1,¯r11) 14 (R3,¯r4,R2,¯r1,R2,¯r5,R4,¯r6,R1,¯r8,R1,¯r7,R3,¯r9,R4,¯r11)
    15 (R3,¯r4,R3,¯r1,R2,¯r5,R4,¯r6,R4,¯r2,R1,¯r7,R2,¯r8,R3,¯r11) 16 (R3,¯r4,R2,¯r5,R1,¯r6,R1,¯r2,R4,¯r7,R4,¯r1,R3,¯r9,R2,¯r11)
    17 (R3,¯r4,R2,¯r5,R1,¯r6,R3,¯r7,R4,¯r8,R4,¯r2,R2,¯r9,R3,¯r11) 18 (R3,¯r4,R2,¯r5,R4,¯r6,R1,¯r7,R3,¯r8,R3,¯r2,R4,¯r9,R2,¯r11)
     | Show Table
    DownLoad: CSV

    Table 4.  The 52 classes of MDS matrices with 8n+3 xor gates

    No. Path T U
    1 [24] (R3,¯r4,R2,¯r1,R1,¯r5,R3,¯r6,R4,¯r7,R4,¯r8,R2,¯r9,R1,¯r11) α23=A,α32=A,β5=A1 {0,0,0,0,0,0,0,0}
    2 [24] (R3,¯r4,R2,¯r1,R1,¯r5,R3,¯r6,R4,¯r7,R4,¯r8,R2,¯r9,R1,¯r11) α23=A1,α32=A1,β5=A {0,0,0,0,0,0,0,0}
    3 [24] (R3,¯r4,R2,¯r1,R1,¯r5,R3,¯r6,R4,¯r7,R4,¯r8,R2,¯r9,R1,¯r11) α23=A1,α41=A,β7=A {0,0,0,0,1,0,0,0}
    4 [24] (R3,¯r4,R2,¯r1,R1,¯r5,R3,¯r6,R4,¯r7,R4,¯r8,R2,¯r9,R1,¯r11) α23=A,α41=A1,β7=A1 {0,0,0,0,1,0,0,0}
    5 (R3,¯r4,R2,¯r1,R1,¯r5,R3,¯r6,R4,¯r7,R4,¯r8,R2,¯r9,R1,¯r11) α32=A1,β3=A,α64=A {0,0,0,0,0,0,1,0}
    6 (R3,¯r4,R2,¯r1,R1,¯r5,R3,¯r6,R4,¯r7,R4,¯r8,R2,¯r9,R1,¯r11) α32=A,β3=A1,α64=A1 {0,0,0,0,0,0,1,0}
    7 [24] (R3,¯r4,R2,¯r1,R1,¯r5,R3,¯r6,R4,¯r7,R4,¯r8,R2,¯r9,R1,¯r11) α41=A,β4=A,α64=A {0,0,0,0,1,0,1,0}
    8 [24] (R3,¯r4,R2,¯r1,R1,¯r5,R3,¯r6,R4,¯r7,R4,¯r8,R2,¯r9,R1,¯r11) α41=A1,β4=A1,α64=A1 {0,0,0,0,0,0,1,0}
    9 [10,24] (R3,¯r4,R2,¯r1,R1,¯r5,R4,¯r6,R2,¯r7,R3,¯r8,R4,¯r9,R1,¯r10) α23=A1,β4=A,β5=A {0,0,0,0,0,0,0,0}
    10 [24] (R3,¯r4,R2,¯r1,R1,¯r5,R4,¯r6,R2,¯r7,R3,¯r8,R4,¯r9,R1,¯r10) α23=A,β4=A1,β5=A1 {0,0,0,0,0,0,0,0}
    11 [10,24] (R3,¯r4,R2,¯r1,R1,¯r5,R4,¯r6,R2,¯r7,R3,¯r8,R4,¯r9,R1,¯r10) β3=A,α54=A,β5=A {0,0,0,0,0,1,0,0}
    12 [24] (R3,¯r4,R2,¯r1,R1,¯r5,R4,¯r6,R2,¯r7,R3,¯r8,R4,¯r9,R1,¯r10) β3=A1,α54=A1,β5=A1 {0,0,0,0,0,1,0,0}
    13 (R3,¯r4,R3,¯r1,R3,¯r2,R2,¯r5,R4,¯r8,R4,¯r6,R1,¯r9,R2,¯r10) α23=A1,α52=A,α64=A {0,0,0,0,1,0,0,0}
    14 (R3,¯r4,R3,¯r1,R3,¯r2,R2,¯r5,R4,¯r8,R4,¯r6,R1,¯r9,R2,¯r10) α23=A,α52=A1,α64=A1 {0,0,0,0,1,0,0,0}
    15 (R3,¯r4,R3,¯r1,R3,¯r2,R2,¯r5,R4,¯r8,R4,¯r6,R1,¯r9,R2,¯r10) α23=A,β5=A1,β6=A {0,0,0,0,0,0,0,0}
    16 (R3,¯r4,R3,¯r1,R3,¯r2,R2,¯r5,R4,¯r8,R4,¯r6,R1,¯r9,R2,¯r10) α23=A1,β5=A,β6=A1 {0,0,0,0,0,0,0,0}
    17 (R3,¯r4,R3,¯r1,R3,¯r2,R2,¯r5,R4,¯r8,R4,¯r6,R1,¯r9,R2,¯r10) α33=A1,α52=A,α64=A {0,0,0,0,1,1,1,0}
    18 (R3,¯r4,R3,¯r1,R3,¯r2,R2,¯r5,R4,¯r8,R4,¯r6,R1,¯r9,R2,¯r10) α33=A,α52=A1,α64=A1 {0,0,0,0,1,1,1,0}
    19 (R3,¯r4,R3,¯r1,R3,¯r2,R2,¯r5,R4,¯r8,R4,¯r6,R1,¯r9,R2,¯r10) β4=A,α64=A,β6=A1 {0,0,0,0,0,0,1,0}
    20 (R3,¯r4,R3,¯r1,R3,¯r2,R2,¯r5,R4,¯r8,R4,¯r6,R1,¯r9,R2,¯r10) β4=A1,α64=A1,β6=A {0,0,0,0,0,0,1,0}
    21 (R3,¯r4,R3,¯r1,R3,¯r2,R4,¯r6,R2,¯r8,R2,¯r5,R1,¯r9,R4,¯r10) α23=A,α54=A,α62=A {0,0,0,0,1,0,1,0}
    22 (R3,¯r4,R3,¯r1,R3,¯r2,R4,¯r6,R2,¯r8,R2,¯r5,R1,¯r9,R4,¯r10) α23=A1,α54=A1,α62=A1 {0,0,0,0,1,0,1,0}
    23 (R3,¯r4,R3,¯r1,R3,¯r2,R4,¯r6,R2,¯r8,R2,¯r5,R1,¯r9,R4,¯r10) α33=A,α54=A,α62=A {0,0,0,1,1,0,0,0}
    24 (R3,¯r4,R3,¯r1,R3,¯r2,R4,¯r6,R2,¯r8,R2,¯r5,R1,¯r9,R4,¯r10) α33=A1,α54=A1,α62=A1 {0,0,0,1,1,0,0,0}
    25 (R3,¯r4,R3,¯r1,R3,¯r2,R4,¯r6,R2,¯r8,R2,¯r5,R1,¯r9,R4,¯r10) α33=A,β5=A,β6=A1 {0,0,0,1,0,0,0,0}
    26 (R3,¯r4,R3,¯r1,R3,¯r2,R4,¯r6,R2,¯r8,R2,¯r5,R1,¯r9,R4,¯r10) α33=A1,β5=A1,β6=A {0,0,0,1,0,0,0,0}
    27 (R3,¯r4,R3,¯r1,R3,¯r2,R4,¯r6,R2,¯r8,R2,¯r5,R1,¯r9,R4,¯r10) β4=A,α62=A,β6=A1 {0,0,0,0,0,0,1,0}
    28 (R3,¯r4,R3,¯r1,R3,¯r2,R4,¯r6,R2,¯r8,R2,¯r5,R1,¯r9,R4,¯r10) β4=A1,α62=A1,β6=A {0,0,0,0,0,0,1,0}
    29 (R3,¯r4,R1,¯r5,R2,¯r6,R2,¯r1,R4,¯r7,R4,¯r2,R3,¯r9,R1,¯r11) α23=A1,β3=A,β5=A {0,0,0,0,0,0,0,0}
    30 (R3,¯r4,R1,¯r5,R2,¯r6,R2,¯r1,R4,¯r7,R4,¯r2,R3,¯r9,R1,¯r11) α23=A,β3=A1,β5=A1 {0,0,0,0,0,0,0,0}
    31 (R3,¯r4,R1,¯r5,R2,¯r6,R2,¯r1,R4,¯r7,R4,¯r2,R3,¯r9,R1,¯r11) β2=A,β3=A,α64=A {0,0,0,0,0,0,1,0}
    32 (R3,¯r4,R1,¯r5,R2,¯r6,R2,¯r1,R4,¯r7,R4,¯r2,R3,¯r9,R1,¯r11) β2=A1,β3=A1,α64=A1 {0,0,0,0,0,0,1,0}
    33 (R3,¯r4,R1,¯r5,R2,¯r6,R2,¯r1,R4,¯r7,R4,¯r2,R3,¯r9,R1,¯r11) β2=A,α42=A,β7=A {0,0,0,0,1,0,0,0}
    34 (R3,¯r4,R1,¯r5,R2,¯r6,R2,¯r1,R4,¯r7,R4,¯r2,R3,¯r9,R1,¯r11) β2=A1,α42=A1,β7=A1 {0,0,0,0,1,0,0,0}
    35 (R3,¯r4,R1,¯r5,R2,¯r6,R2,¯r1,R4,¯r7,R4,¯r2,R3,¯r9,R1,¯r11) α31=A,β5=A,β7=A {0,0,1,0,0,0,0,0}
    36 (R3,¯r4,R1,¯r5,R2,¯r6,R2,¯r1,R4,¯r7,R4,¯r2,R3,¯r9,R1,¯r11) α31=A1,β5=A1,β7=A1 {0,0,1,0,0,0,0,0}
    37 (R3,¯r4,R1,¯r5,R2,¯r6,R3,¯r7,R4,¯r8,R4,¯r1,R1,¯r9,R3,¯r11) α23=A,α31=A1,α64=A {0,0,0,0,0,0,1,0}
    38 (R3,¯r4,R1,¯r5,R2,¯r6,R3,¯r7,R4,¯r8,R4,¯r1,R1,¯r9,R3,¯r11) α23=A1,α31=A,α64=A1 {0,0,0,0,0,0,1,0}
    39 (R3,¯r4,R1,¯r5,R2,¯r6,R3,¯r7,R4,¯r8,R4,¯r1,R1,¯r9,R3,¯r11) β2=A,α31=A,β5=A1 {0,0,0,0,0,0,0,0}
    40 (R3,¯r4,R1,¯r5,R2,¯r6,R3,¯r7,R4,¯r8,R4,¯r1,R1,¯r9,R3,¯r11) β2=A1,α31=A1,β5=A {0,0,0,0,0,0,0,0}
    41 (R3,¯r4,R1,¯r5,R2,¯r6,R3,¯r7,R4,¯r8,R4,¯r1,R1,¯r9,R3,¯r11) β2=A1,α53=A,β7=A {0,0,0,0,1,0,0,0}
    42 (R3,¯r4,R1,¯r5,R2,¯r6,R3,¯r7,R4,¯r8,R4,¯r1,R1,¯r9,R3,¯r11) β2=A,α53=A1,β7=A1 {0,0,0,0,1,0,0,0}
    43 (R3,¯r4,R1,¯r5,R2,¯r6,R3,¯r7,R4,¯r8,R4,¯r1,R1,¯r9,R3,¯r11) α31=A1,α53=A,α64=A {0,0,1,0,1,0,1,0}
    44 (R3,¯r4,R1,¯r5,R2,¯r6,R3,¯r7,R4,¯r8,R4,¯r1,R1,¯r9,R3,¯r11) α31=A,α53=A1,α64=A1 {0,0,1,0,1,0,1,0}
    45 (R3,¯r4,R1,¯r5,R4,¯r6,R2,¯r7,R3,¯r8,R3,¯r1,R4,¯r9,R1,¯r11) α23=A1,α31=A,α44=A {0,0,1,0,0,0,0,0}
    46 (R3,¯r4,R1,¯r5,R4,¯r6,R2,¯r7,R3,¯r8,R3,¯r1,R4,¯r9,R1,¯r11) α23=A,α31=A1,α44=A1 {0,0,1,0,0,0,0,0}
    47 (R3,¯r4,R1,¯r5,R4,¯r6,R2,¯r7,R3,¯r8,R3,¯r1,R4,¯r9,R1,¯r11) α23=A,β3=A1,β7=A {0,0,0,0,0,0,0,0}
    48 (R3,¯r4,R1,¯r5,R4,¯r6,R2,¯r7,R3,¯r8,R3,¯r1,R4,¯r9,R1,¯r11) α23=A1,β3=A,β7=A1 {0,0,0,0,0,0,0,0}
    49 (R3,¯r4,R1,¯r5,R4,¯r6,R2,¯r7,R3,¯r8,R3,¯r1,R4,¯r9,R1,¯r11) β2=A,α44=A,β7=A1 {0,0,0,1,0,0,0,0}
    50 (R3,¯r4,R1,¯r5,R4,¯r6,R2,¯r7,R3,¯r8,R3,¯r1,R4,¯r9,R1,¯r11) β2=A1,α44=A1,β7=A {0,0,0,1,0,0,0,0}
    51 (R3,¯r4,R1,¯r5,R4,¯r6,R2,¯r7,R3,¯r8,R3,¯r1,R4,¯r9,R1,¯r11) α31=A,α44=A,α63=A1 {0,0,1,1,0,0,1,0}
    52 (R3,¯r4,R1,¯r5,R4,¯r6,R2,¯r7,R3,¯r8,R3,¯r1,R4,¯r9,R1,¯r11) α31=A1,α44=A1,α63=A {0,0,1,1,0,0,1,0}
    Here A is the companion matrix of the minimal polynomial x4+x+1 or x8+x2+1.
     | Show Table
    DownLoad: CSV

    Table 5.  The depth calculation of M=(P1,S,U) in Example 4

    Copy operation Transformation Depth Copy operation Transformation Depth
    D1=[1,1,1,1] - [0, 0, 0, 0] D5=[1,1,1,1] - [3, 1, 2, 0]
    R3,¯r4(1) x3(¯r5)x3+¯r4 [0, 0, 1, 0] R4,¯r7(1) x4(¯r9)x4+¯r7 [3, 1, 2, 4]
    D2=[1,1,1,1] - [0, 0, 1, 0] [3, 1, 2, 5]
    [0, 1, 1, 0] [3, 1, 2, 6]
    [0, 2, 1, 0] - [3, 1, 2, 6]
    [3, 1, 1, 0] [3, 6, 2, 6]
    - [3, 1, 1, 0] - [3, 6, 2, 6]
    [3, 1, 2, 0] [7, 6, 2, 6]
     | Show Table
    DownLoad: CSV

    Table 6.  The depth calculation of the path

    Copy operation Transformation Depth Copy operation Transformation Depth
    [0, 0, 1, 0] [2, 1, 2, 3]
    [0, 1, 1, 0] [2, 1, 2, 4]
    [2, 1, 1, 0] [2, 4, 2, 4]
    [2, 1, 2, 0] [5, 4, 2, 4]
     | Show Table
    DownLoad: CSV

    Table 7.  MDS matrices with low depth and cost

    Depth Cost 1st row 2nd row 3rd row 4th row
    5 [10,24]
    5
    4 [10]
    4
    4
    4
    3 [10]
    3
    5 [10,24]
    5
    4 [10]
    4
    4
    4
    3 [10]
    3
    Where and are the companion matrices of the minimal polynomials and , respectively.
     | Show Table
    DownLoad: CSV

    Table 8.  The statistical results

    Depth Cost Number of MDS matrices Depth Cost Number of MDS matrices
    - 35 52 - 67 52
    5 35 2 5 67 2
    4 37 4 4 69 4
    3 41 2 3 77 2
     | Show Table
    DownLoad: CSV
  • [1] J. P. Aumasson, L. Henzen, W. Meier et al., QUARK: A lightweight hash, Cryptographic Hardware and Embedded Systems-CHES 2010, 6225 (2010), 1-15. doi: 10.1007/978-3-642-15031-9_1.
    [2] S. Banik, Y. Funabiki and T. Isobe, More results on shortest linear programs, Advances in Information and Computer Security-IWSEC 2019, 11689 (2019), 109-128. doi: 10.1007/978-3-030-26834-3_7.
    [3] A. Bogdanov, M. Knezevic, G. Leander et al., SPONGENT: A lightweight hash function, Cryptographic Hardware and Embedded Systems-CHES 2011, Lecture Notes in Computer Science, 6917 (2011), 312-325. doi: 10.1007/978-3-642-23951-9_21.
    [4] A. Bogdanov, L. R. Knudsen, G. Leander, C. Paar, A. Poschmann, M. J. B. Robshaw, Y. Seurin and C. Vikkelsoe, PRESENT: An ultra-lightweight block cipher, Cryptographic Hardware and Embedded Systems-CHES 2007, 4727 (2007), 450-466. doi: 10.1007/978-3-540-74735-2_31.
    [5] J. Boyar, P. Matthews and R. Peralta, On the shortest linear straight-line program for computing linear forms, Mathematical Foundations of Computer Science 2008, 33rd International Symposium, In MFCS 2008, 5162 (2008), 168-179. doi: 10.1007/978-3-540-85238-4_13.
    [6] J. BoyarP. Matthews and R. Peralta, Logic minimization techniques with applications to cryptology,, J. Cryptology, 26 (2013), 280-312.  doi: 10.1007/s00145-012-9124-7.
    [7] J. Daemen and V. Rijmen, The wide trail design strategy, Cryptography and Coding, 8th IMA International Conference, 2260 (2001), 222-238. doi: 10.1007/3-540-45325-3_20.
    [8] J. Daemen and V. Rijmen, The Design of Rijndael: AES - The Advanced Encryption Standard, Information Security and Cryptography, Springer, 2002. doi: 10.1007/978-3-662-04722-4.
    [9] C. De Cannière, O. Dunkelman and M. Knezevic, KATAN and KTANTAN - A family of small and efficient hardware-oriented block ciphers, Cryptographic Hardware and Embedded Systems-CHES 2009, 5747 (2009), 272-288. doi: 10.1007/978-3-642-04138-9_20.
    [10] S. Duval and G. Leurent, MDS matrices with lightweight circuits, IACR Trans. Symmetric Cryptol., 2018 (2018), 48-78.  doi: 10.46586/tosc.v2018.i2.48-78.
    [11] J. Guo, T. Peyrin and A. Poschmann, The PHOTON family of lightweight hash functions, Advances in Cryptology-CRYPTO 2011, 6841 (2011), 222-239. doi: 10.1007/978-3-642-22792-9_13.
    [12] K. C. Gupta and I. G. Ray, On constructions of involutory MDS matrices, Progress in Cryptology-AFRICACRYPT 2013, 7918 (2013), 43-60. doi: 10.1007/978-3-642-38553-7_3.
    [13] H. M. Heys and S. E. Tavares, The design of substitution-permutation networks resistant to differential and linear cryptanalysis, CCS'94, Proceedings of the 2nd ACM Conference on Computer and Communications Security, (1994), 148-155.
    [14] J. JeanT. PeyrinS. M. Sim and J. Tourteaux, Optimizing implementations of lightweight building blocks, IACR Trans. Symmetric Cryptol., 2017 (2017), 130-168.  doi: 10.46586/tosc.v2017.i4.130-168.
    [15] K. Khoo, T. Peyrin, A. T. Poschmann et al., FOAM: Searching for hardware-optimal SPN structures and components with a fair comparison, Cryptographic Hardware and Embedded Systems-CHES 2014, 8731 (2014), 433-450. doi: 10.1007/978-3-662-44709-3_24.
    [16] T. KranzG. LeanderK. Stoffelen and F. Wiemer, Shorter linear straight-line programs for MDS matrices, IACR Trans. Symmetric Cryptol., 2017 (2017), 188-211.  doi: 10.46586/tosc.v2017.i4.188-211.
    [17] S. LiS. SunC. LiZ. Wei and L. Hu, Constructing low-latency involutory MDS matrices with lightweight circuits, IACR Trans. Symmetric Cryptol., 2019 (2019), 84-117.  doi: 10.46586/tosc.v2019.i1.84-117.
    [18] Y. Li and M. Wang, On the construction of lightweight circulant involutory MDS matrices, Fast Software Encryption 2016, 9783 (2016), 121-139.  doi: 10.1007/978-3-662-52993-5_7.
    [19] M. Liu and S. M. Sim, Lightweight MDS generalized circulant matrices, Fast Software Encryption 2016, 9783 (2016), 101-120.  doi: 10.1007/978-3-662-52993-5_6.
    [20] F. J. MacWilliams and N. J. A. Sloane, The theory of error correcting codes, North-Holland Mathematical Library, Amsterdam-New York Oxford: North-Holland Publishing Company, 16 (1977), 317-329. 
    [21] C. Paar, Optimized arithmetic for reed-solomon encoders, In: Proceedings of IEEE International Symposium on Information Theory, (1997), 250-250. doi: 10.1109/ISIT.1997.613165.
    [22] B. Ray, S. Douglas, S. Jason et al., The SIMON and SPECK families of lightweight block ciphers, Cryptology ePrint Archive, Report (2013), 414-414. Available from: http://eprint.iacr.org/2013/404.
    [23] S. M. Sim, K. Khoo, F. Oggier and T. Peyrin, Lightweight MDS involution matrices, In: Fast Software Encryption 2015, 9054 (2015), 471-493. doi: 10.1007/978-3-662-48116-5_23.
    [24] S. Wang, Y. Li, S. Tian et al., Four by four MDS matrices with the fewest XOR gates based on words, Advances in Mathematics of Communications, 2021. doi: 10.3934/amc.2021025.
    [25] Z. XiangX. ZengD. LinZ. Bao and S. Zhang, Optimizing implementations of linear layers, IACR Trans. Symmetric Cryptol., 2020 (2020), 120-145.  doi: 10.13154/tosc.v2020.i2.120-145.
    [26] Y. YangX. Zeng and S. Wang, Construction of lightweight involutory MDS matrices, Des. Codes Cryptogr., 89 (2021), 1453-1483.  doi: 10.1007/s10623-021-00879-3.
  • 加载中

Figures(2)

Tables(8)

SHARE

Article Metrics

HTML views(1954) PDF downloads(51) Cited by(0)

Access History

Other Articles By Authors

Catalog

    /

    DownLoad:  Full-Size Img  PowerPoint
    Return
    Return