Decomposing Linear Layers


  • Christof Beierle Faculty of Computer Science, Ruhr University Bochum, Bochum, Germany
  • Patrick Felke University of Applied Sciences Emden/Leer, Emden, Germany
  • Gregor Leander Faculty of Computer Science, Ruhr University Bochum, Bochum, Germany
  • Sondre Rønjom Nasjonal Sikkerhetsmyndighet (NSM), Oslo, Norway; University of Bergen, Bergen, Norway



finite field, matrix, substitution-permutation network, MDS, Cauchy


There are many recent results on reverse-engineering (potentially hidden) structure in cryptographic S-boxes. The problem of recovering structure in the other main building block of symmetric cryptographic primitives, namely, the linear layer, has not been paid that much attention so far. To fill this gap, in this work, we develop a systematic approach to decomposing structure in the linear layer of a substitutionpermutation network (SPN), covering the case in which the specification of the linear layer is obfuscated by applying secret linear transformations to the S-boxes. We first present algorithms to decide whether an ms x ms matrix with entries in a prime field Fp can be represented as an m x m matrix over the extension field Fps . We then study the case of recovering structure in MDS matrices by investigating whether a given MDS matrix follows a Cauchy construction. As an application, for the first time, we show that the 8 x 8 MDS matrix over F28 used in the hash function Streebog is a Cauchy matrix.




How to Cite

Beierle, C., Felke, P., Leander, G., & Rønjom, S. (2022). Decomposing Linear Layers. IACR Transactions on Symmetric Cryptology, 2022(4), 243–265.