1

Considering a design where the MixColumns operation of AES is replaced by a lighter MDS matrix where by the term lighter we mean the number of required XOR to implement an MDS matrix.

As you know the most relevant property of an MDS matrix in an AES-like design beyond its branch number is the so-called related differential.

My question: Is there any security escalation or degeneration due to the differences of the bit-level representations of the MDS matrices? (For more details please see Remark section of [1]).

kelalaka
  • 48,443
  • 11
  • 116
  • 196
user0410
  • 253
  • 3
  • 13

1 Answers1

1

The current research aims to lighter MDS for implementation in constrained resource environment. The lighter MDS require less number of xors in the binary form (AES MDS). In term of security effect, this paper took the advantage of zero XOR-sum of more than two coefficients of each row of the MixColumns matrix to mound an (theoritical) attack on AES up to 4.5-5 rounds.

to conclude this , zero XOR-sum of more than two coefficients of each row of the MDS matrix could be degradation to the security of the cipher , it is good to find MDS with no zero XOR-sum but this could a tradeoff for finding lighter MDS.

hardyrama
  • 2,126
  • 1
  • 16
  • 40
  • What do you mean by the term "zero XOR-sum of more than two coefficients"? Is it possible to make an example for this subject? Thanks. – user0410 Feb 01 '20 at 09:56
  • AES MDS matrix is cyclic which starts of (2, 3, 1,1) the xor-sum of 2, 3 , 1 =0. it is mentioned in page 14 of the paper (link above) – hardyrama Feb 01 '20 at 10:13
  • Do you have any reason about your claim that there is a relation between the implementation of lightweight MDS matrices and zero XOR-sum subject. I think you misunderstood about the structure of binary MDS matrices over $\mathbb{F}_2$. For example the binary matrix in this post that you mentioned in your answer, is not a $32\times 32$ binary matrix. – user0410 Feb 01 '20 at 10:40
  • In fact, that binary matrix is a $4\times 4$ MDS block-matrix over 8-bit words that each coefficients of this matrix is a $8 \times 8$ binary matrix. In other words, the coefficients of binary MDS matrices over $\mathbb{F}_2$ for $m$-bit words are $m \times m$ binary matrices and not a zero or one value. – user0410 Feb 01 '20 at 10:40
  • Your answer is an un-useful answer, since your claim in the last two rows of the second paragraph is incorrect. – user0410 Feb 01 '20 at 12:36