Lightweight Design Choices for LED-like Block Ciphers

Sarkar, Sumanta; Syed, Habeeb; Sadhukhan, Rajat; Mukhopadhyay, Debdeep

doi:10.1007/978-3-319-71667-1_14

Cited by 6 publications

(2 citation statements)

References 19 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…One method to obtain iterative MDS matrices is to exhaust certain search space of A with a predefined form, and test whether A t is MDS [GPP11,TTKS18,GPV17,WWW12,SSSM17]. Another approach for producing iterative MDS matrices is to construct matrices with the iterative-MDS property directly based on some codes (e.g., shortened BCH codes, Gabidulin codes) [AF14,Ber13,CLM16].…”

Section: Introductionmentioning

confidence: 99%

Lightweight Iterative MDS Matrices: How Small Can We Go?

Sun

Shi

et al. 2020

ToSC

View full text Add to dashboard Cite

As perfect building blocks for the diffusion layers of many symmetric-key primitives, the construction of MDS matrices with lightweight circuits has received much attention from the symmetric-key community. One promising way of realizing low-cost MDS matrices is based on the iterative construction: a low-cost matrix becomes MDS after rising it to a certain power. To be more specific, if At is MDS, then one can implement A instead of At to achieve the MDS property at the expense of an increased latency with t clock cycles. In this work, we identify the exact lower bound of the number of nonzero blocks for a 4 × 4 block matrix to be potentially iterative-MDS. Subsequently, we show that the theoretically lightest 4 × 4 iterative MDS block matrix (whose entries or blocks are 4 × 4 binary matrices) with minimal nonzero blocks costs at least 3 XOR gates, and a concrete example achieving the 3-XOR bound is provided. Moreover, we prove that there is no hope for previous constructions (GFS, LFS, DSI, and spares DSI) to beat this bound. Since the circuit latency is another important factor, we also consider the lower bound of the number of iterations for certain iterative MDS matrices. Guided by these bounds and based on the ideas employed to identify them, we explore the design space of lightweight iterative MDS matrices with other dimensions and report on improved results. Whenever we are unable to find better results, we try to determine the bound of the optimal solution. As a result, the optimality of some previous results is proved.

show abstract

Section: Introductionmentioning

confidence: 99%

Lightweight Iterative MDS Matrices: How Small Can We Go?

Sun

Shi

et al. 2020

ToSC

View full text Add to dashboard Cite

show abstract

“…Liu et al [LS16a] observed that the implementation of circulant matrices could also be done in a serialized way. Several constructions of recursive MDS matrices have been studied in [GPP11,WWW12,AF13,KPPY14,AF14,GPV17,SSSM17,TTKS18]. In 2018, Toh et al [TTKS18] proposed a new matrix structure known as Diagonal-Serial Invertible (DSI) matrices and its variants sparse DSI matrices.…”

Section: Introductionmentioning

confidence: 99%

Exhaustive Search for Various Types of MDS Matrices

Kesarwani

Sarkar

Venkateswarlu

2019

ToSC

View full text Add to dashboard Cite

MDS matrices are used in the design of diffusion layers in many block ciphers and hash functions due to their optimal branch number. But MDS matrices, in general, have costly implementations. So in search for efficiently implementable MDS matrices, there have been many proposals. In particular, circulant, Hadamard, and recursive MDS matrices from companion matrices have been widely studied. In a recent work, recursive MDS matrices from sparse DSI matrices are studied, which are of interest due to their low fixed cost in hardware implementation. In this paper, we present results on the exhaustive search for (recursive) MDS matrices over GL(4, F2). Specifically, circulant MDS matrices of order 4, 5, 6, 7, 8; Hadamard MDS matrices of order 4, 8; recursive MDS matrices from companion matrices of order 4; recursive MDS matrices from sparse DSI matrices of order 4, 5, 6, 7, 8 are considered. It is to be noted that the exhaustive search is impractical with a naive approach. We first use some linear algebra tools to restrict the search to a smaller domain and then apply some space-time trade-off techniques to get the solutions. From the set of solutions in the restricted domain, one can easily generate all the solutions in the full domain. From the experimental results, we can see the (non) existence of (involutory) MDS matrices for the choices mentioned above. In particular, over GL(4, F2), we provide companion matrices of order 4 that yield involutory MDS matrices, circulant MDS matrices of order 8, and establish the nonexistence of involutory circulant MDS matrices of order 6, 8, circulant MDS matrices of order 7, sparse DSI matrices of order 4 that yield involutory MDS matrices, and sparse DSI matrices of order 5, 6, 7, 8 that yield MDS matrices. To the best of our knowledge, these results were not known before. For the choices mentioned above, if such MDS matrices exist, we provide base sets of MDS matrices, from which all the MDS matrices with the least cost (with respect to d-XOR and s-XOR counts) can be obtained. We also take this opportunity to present some results on the search for sparse DSI matrices over finite fields that yield MDS matrices. We establish that there is no sparse DSI matrix S of order 8 over F28 such that S8 is MDS.

show abstract