Design of Lightweight Linear Diffusion Layers from Near-MDS Matrices

  • Chaoyun Li imec-COSIC, Dept. Electrical Engineering (ESAT), KU Leuven, Leuven
  • Qingju Wang imec-COSIC, Dept. Electrical Engineering (ESAT), KU Leuven, Leuven, Belgium; DTU Compute, Technical University of Denmark, Lyngby, Denmark; Department of Computer Science and Engineering, Shanghai Jiao Tong University, Shanghai, China
Keywords: lightweight cryptography, diffusion layer, near-MDS matrix, branch number


Near-MDS matrices provide better trade-offs between security and efficiency compared to constructions based on MDS matrices, which are favored for hardwareoriented designs. We present new designs of lightweight linear diffusion layers by constructing lightweight near-MDS matrices. Firstly generic n×n near-MDS circulant matrices are found for 5 ≤ n ≤9. Secondly, the implementation cost of instantiations of the generic near-MDS matrices is examined. Surprisingly, for n = 7, 8, it turns out that some proposed near-MDS circulant matrices of order n have the lowest XOR count among all near-MDS matrices of the same order. Further, for n = 5, 6, we present near-MDS matrices of order n having the lowest XOR count as well. The proposed matrices, together with previous construction of order less than five, lead to solutions of n×n near-MDS matrices with the lowest XOR count over finite fields F2m for 2 ≤ n ≤ 8 and 4 ≤ m ≤ 2048. Moreover, we present some involutory near-MDS matrices of order 8 constructed from Hadamard matrices. Lastly, the security of the proposed linear layers is studied by calculating lower bounds on the number of active S-boxes. It is shown that our linear layers with a well-chosen nonlinear layer can provide sufficient security against differential and linear cryptanalysis.
How to Cite
Li, C., & Wang, Q. (2017). Design of Lightweight Linear Diffusion Layers from Near-MDS Matrices. IACR Transactions on Symmetric Cryptology, 2017(1), 129-155.