More Results on Shortest Linear Programs

Banik, Subhadeep; Funabiki, Yuki; Isobe, Takanori

doi:10.1007/978-3-030-26834-3_7

Cited by 20 publications

(18 citation statements)

References 29 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Recent Works Two independent results [BFI19,Max19] have been published in IWSEC 2019 and ePrint after our submission to TCHES, in which the authors managed to achieve similar results for AES MixColumn matrix. More precisely, [BFI19] uses a method to…”

Section: The Aes Diffusion Matrixmentioning

confidence: 96%

Improved Heuristics for Short Linear Programs

Tan¹,

Peyrin²

2019

TCHES

View full text Add to dashboard Cite

In this article, we propose new heuristics for minimising the amount of XOR gates required to compute a system of linear equations in GF(2). We first revisit the well known Boyar-Peralta strategy and argue that a proper randomisation process during the selection phases can lead to great improvements. We then propose new selection criteria and explain their rationale. Our new methods outperform state-of-the-art algorithms such as Paar or Boyar-Peralta (or open synthesis tools such as Yosys) when tested on random matrices with various densities. They can be applied to matrices of reasonable sizes (up to about 32 × 32). Notably, we provide a new implementation record for the matrix underlying the MixColumns function of the AES block cipher, requiring only 94 XORs.

show abstract

Section: The Aes Diffusion Matrixmentioning

confidence: 96%

Improved Heuristics for Short Linear Programs

Tan¹,

Peyrin²

2019

TCHES

View full text Add to dashboard Cite

show abstract

“…In the design document, the authors say that they use Paar's algorithm to deduce that they can be constructed using 347 XOR gates each. However for an energy efficient solution, implementing these using the randomized version of the above algorithm [BFI19] yields solutions of 168, 144, 192, 144 and 189 XOR gates respectively.…”

Section: Pyjamaskmentioning

confidence: 99%

Energy Analysis of Lightweight AEAD Circuits

Caforio

Balli

Banik

2020

Cryptology and Network Security

Self Cite

View full text Add to dashboard Cite

“…The first work [KLSW17] in this line exhibits an implementation of AES MixColumn matrix with 97 XOR gates. In [BFI19,TP19] some improved heuristics are proposed to get better implementations of binary matrices in the sense of the number of XOR gates required. As pointed by the anonymous reviewers, it is possible to have implementations with less number of XOR gates when considered the cost of full matrix implementation for the matrices presented in the appendix.…”

Section: Our Contributionmentioning

confidence: 99%

Exhaustive Search for Various Types of MDS Matrices

Kesarwani

Sarkar

Venkateswarlu

2019

ToSC

View full text Add to dashboard Cite

MDS matrices are used in the design of diffusion layers in many block ciphers and hash functions due to their optimal branch number. But MDS matrices, in general, have costly implementations. So in search for efficiently implementable MDS matrices, there have been many proposals. In particular, circulant, Hadamard, and recursive MDS matrices from companion matrices have been widely studied. In a recent work, recursive MDS matrices from sparse DSI matrices are studied, which are of interest due to their low fixed cost in hardware implementation. In this paper, we present results on the exhaustive search for (recursive) MDS matrices over GL(4, F2). Specifically, circulant MDS matrices of order 4, 5, 6, 7, 8; Hadamard MDS matrices of order 4, 8; recursive MDS matrices from companion matrices of order 4; recursive MDS matrices from sparse DSI matrices of order 4, 5, 6, 7, 8 are considered. It is to be noted that the exhaustive search is impractical with a naive approach. We first use some linear algebra tools to restrict the search to a smaller domain and then apply some space-time trade-off techniques to get the solutions. From the set of solutions in the restricted domain, one can easily generate all the solutions in the full domain. From the experimental results, we can see the (non) existence of (involutory) MDS matrices for the choices mentioned above. In particular, over GL(4, F2), we provide companion matrices of order 4 that yield involutory MDS matrices, circulant MDS matrices of order 8, and establish the nonexistence of involutory circulant MDS matrices of order 6, 8, circulant MDS matrices of order 7, sparse DSI matrices of order 4 that yield involutory MDS matrices, and sparse DSI matrices of order 5, 6, 7, 8 that yield MDS matrices. To the best of our knowledge, these results were not known before. For the choices mentioned above, if such MDS matrices exist, we provide base sets of MDS matrices, from which all the MDS matrices with the least cost (with respect to d-XOR and s-XOR counts) can be obtained. We also take this opportunity to present some results on the search for sparse DSI matrices over finite fields that yield MDS matrices. We establish that there is no sparse DSI matrix S of order 8 over F28 such that S8 is MDS.

show abstract

More Results on Shortest Linear Programs

Cited by 20 publications

References 29 publications

Improved Heuristics for Short Linear Programs

Improved Heuristics for Short Linear Programs

Energy Analysis of Lightweight AEAD Circuits

Exhaustive Search for Various Types of MDS Matrices

Contact Info

Product

Resources

About