Shorter Linear Straight-Line Programs for MDS Matrices Yet another - - PowerPoint PPT Presentation

▶
shorter linear straight line programs for mds matrices
SMART_READER_LITE
LIVE PREVIEW

Shorter Linear Straight-Line Programs for MDS Matrices Yet another - - PowerPoint PPT Presentation

Mar 01, 2024 255 likes •954 views

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion Shorter Linear Straight-Line Programs for MDS Matrices Yet another XOR Count Paper Thorsten Kranz 1 , Gregor Leander 1 , Ko Stoffelen 2 , Friedrich Wiemer 1 1

slide-1
SLIDE 1

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Shorter Linear Straight-Line Programs for MDS Matrices

Yet another XOR Count Paper Thorsten Kranz1, Gregor Leander1, Ko Stoffelen2, Friedrich Wiemer1

1Horst Görtz Institute for IT Security, Ruhr-Universität Bochum, Germany 2Digital Security Group, Radboud University, Nijmegen, The Netherlands

slide-2
SLIDE 2

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Lightweight Cryptography

Cryptographic systems might have to fulfill special constraints.

slide-3
SLIDE 3

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Lightweight Cryptography

Cryptographic systems might have to fulfill special constraints. Typical Goal Minimize the chip-area.

slide-4
SLIDE 4

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Linear Layers

Matrix multiplication(s). Often MDS matrices.     02 03 01 01 01 02 03 01 01 01 02 03 03 01 01 02         x0 x1 x2 x3     =     y0 y1 y2 y3     , xi, yi ∈ F28

slide-5
SLIDE 5

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Goal: Small round-based implementation

    02 03 01 01 01 02 03 01 01 01 02 03 03 01 01 02         x0 x1 x2 x3     =     y0 y1 y2 y3     , xi, yi ∈ F28

slide-6
SLIDE 6

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Goal: Small round-based implementation

    02 03 01 01 01 02 03 01 01 01 02 03 03 01 01 02         x0 x1 x2 x3     =     y0 y1 y2 y3     , xi, yi ∈ F28 Combinational Logic . . . . . .

slide-7
SLIDE 7

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Metric: XOR count

Implement matrix multiplication only with XOR operations. Use as few XORs as possible. Idea: Low XOR count = Low chip-area Note: No intermediate result needs to be recomputed.

slide-8
SLIDE 8

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Outline

1

Previous Work

2

Shorter Linear Straight-Line Programs

3

Results

slide-9
SLIDE 9

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Outline

1

Previous Work

2

Shorter Linear Straight-Line Programs

3

Results

slide-10
SLIDE 10

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Previous Work

FSE 2018: Jean, Peyrin, Sim, Tourteaux Optimizing Implementations of Lightweight Building Blocks FSE 2017: C. Li and Q. Wang Design of Lightweight Linear Diffusion Layers from Near-MDS Matrices FSE 2017: Sarkar and Syed Lightweight Diffusion Layer: Importance of Toeplitz Matrices CRYPTO 2016: Beierle, Kranz, Leander Lightweight Multiplication in GF(2n) with Applications to MDS Matrices FSE 2016: Liu and Sim Lightweight MDS Generalized Circulant Matrices FSE 2016: Y. Li and M. Wang On the Construction of Lightweight Circulant Involutory MDS Matrices FSE 2015: Sim, Khoo, Oggier, Peyrin Lightweight MDS Involution Matrices

slide-11
SLIDE 11

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Previous Work

Searching many matrices.

slide-12
SLIDE 12

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Previous Work

Searching many matrices. Cauchy

slide-13
SLIDE 13

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Previous Work

Searching many matrices. Cauchy, Vandermonde

slide-14
SLIDE 14

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Previous Work

Searching many matrices. Cauchy, Vandermonde, Circulant

slide-15
SLIDE 15

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Previous Work

Searching many matrices. Cauchy, Vandermonde, Circulant, Hadamard

slide-16
SLIDE 16

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Previous Work

Searching many matrices. Cauchy, Vandermonde, Circulant, Hadamard, Hadamard-Cauchy

slide-17
SLIDE 17

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Previous Work

Searching many matrices. Cauchy, Vandermonde, Circulant, Hadamard, Hadamard-Cauchy, Toeplitz

slide-18
SLIDE 18

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Previous Work

Searching many matrices. Cauchy, Vandermonde, Circulant, Hadamard, Hadamard-Cauchy, Toeplitz, Arbitrary

slide-19
SLIDE 19

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Previous Work

Searching many matrices. Cauchy, Vandermonde, Circulant, Hadamard, Hadamard-Cauchy, Toeplitz, Arbitrary Optimizing element multiplication.

slide-20
SLIDE 20

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Counting XORs: Overhead and Fixed Cost

The XOR count is typically split into overhead and fixed cost. Matrix Multiplication      α1,1 α1,2 . . . α1,n α2,1 . . . ... αn,1 αn,n           x1 x2 . . . xn      =      y1 y2 . . . yn      , αi,j, xi, yi ∈ F2k

  • i,j

XOR(αi,j)

  • Overhead

+ n · (n − 1) · k

  • Fixed Cost
slide-21
SLIDE 21

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Counting XORs: Overhead and Fixed Cost

The XOR count is typically split into overhead and fixed cost. Matrix Multiplication      α1,1 α1,2 . . . α1,n α2,1 . . . ... αn,1 αn,n           x1 x2 . . . xn      =      y1 y2 . . . yn      , αi,j, xi, yi ∈ F2k

  • i,j

XOR(αi,j)

  • Overhead

+ n · (n − 1) · k

  • Fixed Cost
slide-22
SLIDE 22

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Counting XORs: Overhead and Fixed Cost

The XOR count is typically split into overhead and fixed cost. Matrix Multiplication      α1,1 α1,2 . . . α1,n α2,1 . . . ... αn,1 αn,n           x1 x2 . . . xn      =      y1 y2 . . . yn      , αi,j, xi, yi ∈ F2k

  • i,j

XOR(αi,j)

  • Overhead

+ n · (n − 1) · k

  • Fixed Cost
slide-23
SLIDE 23

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Counting XORs: Overhead and Fixed Cost

The XOR count is typically split into overhead and fixed cost. Matrix Multiplication      α1,1 α1,2 . . . α1,n α2,1 . . . ... αn,1 αn,n           x1 x2 . . . xn      =      y1 y2 . . . yn      , αi,j, xi, yi ∈ F2k

  • i,j

XOR(αi,j)

  • Overhead

+ n · (n − 1) · k

  • Fixed Cost
slide-24
SLIDE 24

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Counting XORs: Overhead and Fixed Cost

The XOR count is typically split into overhead and fixed cost. Matrix Multiplication      α1,1 α1,2 . . . α1,n α2,1 . . . ... αn,1 αn,n           x1 x2 . . . xn      =      y1 y2 . . . yn      , αi,j, xi, yi ∈ F2k

  • i,j

XOR(αi,j)

  • Overhead

+ n · (n − 1) · k

  • Fixed Cost
slide-25
SLIDE 25

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Counting XORs: Overhead and Fixed Cost

The XOR count is typically split into overhead and fixed cost. Matrix Multiplication      α1,1 α1,2 . . . α1,n α2,1 . . . ... αn,1 αn,n           x1 x2 . . . xn      =      y1 y2 . . . yn      , αi,j, xi, yi ∈ F2k

  • i,j

XOR(αi,j)

  • Overhead

+ n · (n − 1) · k

  • Fixed Cost
slide-26
SLIDE 26

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Counting XORs: Overhead and Fixed Cost

The XOR count is typically split into overhead and fixed cost. Matrix Multiplication      α1,1 α1,2 . . . α1,n α2,1 . . . ... αn,1 αn,n           x1 x2 . . . xn      =      y1 y2 . . . yn      , αi,j, xi, yi ∈ F2k

  • i,j

XOR(αi,j)

  • Overhead

+ n · (n − 1) · k

  • Fixed Cost
slide-27
SLIDE 27

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Counting XORs: Overhead and Fixed Cost

The XOR count is typically split into overhead and fixed cost. Matrix Multiplication      α1,1 α1,2 . . . α1,n α2,1 . . . ... αn,1 αn,n           x1 x2 . . . xn      =      y1 y2 . . . yn      , αi,j, xi, yi ∈ F2k

  • i,j

XOR(αi,j)

  • Overhead

+ n · (n − 1) · k

  • Fixed Cost
slide-28
SLIDE 28

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Previous Results

Table: Best XOR counts of previous work. Matrices in the lower half are involutory.

Dimension S-box XOR count 4 × 4 4 bit 10 + 48 4 × 4 8 bit 10 + 96 8 × 8 4 bit 160 + 224 8 × 8 8 bit 192 + 448 4 × 4 4 bit 15 + 48 4 × 4 8 bit 30 + 96 8 × 8 4 bit 200 + 224 8 × 8 8 bit 288 + 448

slide-29
SLIDE 29

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Previous Results

Table: Best XOR counts of previous work. Matrices in the lower half are involutory.

Dimension S-box XOR count 4 × 4 4 bit 58 4 × 4 8 bit 106 8 × 8 4 bit 384 8 × 8 8 bit 640 4 × 4 4 bit 63 4 × 4 8 bit 126 8 × 8 4 bit 424 8 × 8 8 bit 736

slide-30
SLIDE 30

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Outline

1

Previous Work

2

Shorter Linear Straight-Line Programs

3

Results

slide-31
SLIDE 31

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Local Optimization

Optimize k × k matrix over F2. M =      α1,1 α1,2 . . . α1,n α2,1 . . . ... αn,1 αn,n      , αi,j ∈ F2k

slide-32
SLIDE 32

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Global Optimization

Optimize nk × nk matrix over F2. M =      α1,1 α1,2 . . . α1,n α2,1 . . . ... αn,1 αn,n      , αi,j ∈ F2k

slide-33
SLIDE 33

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Global Optimization

BFA 2017: Boyar, Find, Peralta Low-Depth, Low-Size Circuits for Cryptographic Applications ePrint 2017: Visconti, Schiavo, Peralta Improved upper bounds for the expected circuit complexity of dense systems of linear equations over GF(2) JoC 2013: Boyar, Matthews, Peralta Logic Minimization Techniques with Applications to Cryptology SAT 2010: Fuhs, Schneider-Kamp Synthesizing Shortest Linear Straight-Line Programs over GF(2) Using SAT IWIL 2010: Fuhs, Schneider-Kamp Optimizing the AES S-Box using SAT MFCS 2008: Boyar, Matthews, Peralta On the Shortest Linear Straight-Line Program for Computing Linear Forms ISIT 1997: Paar Optimized Arithmetic for Reed-Solomon Encoders

slide-34
SLIDE 34

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Global Optimization

Lots of work about implementing binary matrices with few XORs. Goal: Find Shortest Linear Straight-Line Programs.

slide-35
SLIDE 35

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Global Optimization

Lots of work about implementing binary matrices with few XORs. Goal: Find Shortest Linear Straight-Line Programs. Equivalent to our goal! (Hardware implementation with lowest XOR count.)

slide-36
SLIDE 36

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Global Optimization

BFA 2017: Boyar, Find, Peralta Low-Depth, Low-Size Circuits for Cryptographic Applications ePrint 2017: Visconti, Schiavo, Peralta Improved upper bounds for the expected circuit complexity of dense systems of linear equations over GF(2) JoC 2013: Boyar, Matthews, Peralta Logic Minimization Techniques with Applications to Cryptology SAT 2010: Fuhs, Schneider-Kamp Synthesizing Shortest Linear Straight-Line Programs over GF(2) Using SAT IWIL 2010: Fuhs, Schneider-Kamp Optimizing the AES S-Box using SAT MFCS 2008: Boyar, Matthews, Peralta On the Shortest Linear Straight-Line Program for Computing Linear Forms ISIT 1997: Paar Optimized Arithmetic for Reed-Solomon Encoders

slide-37
SLIDE 37

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Algorithm 1 (Paar 1997)

Find most common subexpression. Add according computation to the program. Example     1 1 1 1 1 1 1 1 1 1 1 1 1         a0 a1 a2 a3     =     a0 + a2 + a3 a0 + a1 + a2 a0 + a1 + a2 + a3 a1 + a2 + a3    

slide-38
SLIDE 38

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Algorithm 1 (Paar 1997)

Example     1 1 1 1 1 1 1 1 1 1 1 1 1         a0 a1 a2 a3     =     a0 + a2 + a3 a0 + a1 + a2 a0 + a1 + a2 + a3 a1 + a2 + a3    

slide-39
SLIDE 39

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Algorithm 1 (Paar 1997)

Example     1 1 1 1 1 1 1 1 1 1 1 1 1         a0 a1 a2 a3     =     (a0 + a2) + a3 (a0 + a2) + a1 (a0 + a2) + a1 + a3 a1 + a2 + a3     x0 = a0 + a2

slide-40
SLIDE 40

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Algorithm 1 (Paar 1997)

Example     1 1 1 1 1 1 1 1 1 1 1 1 1         a0 a1 a2 a3     =     x0 + a3 x0 + a1 x0 + a1 + a3 a1 + a2 + a3     x0 = a0 + a2

slide-41
SLIDE 41

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Algorithm 1 (Paar 1997)

Example     1 1 1 1 1 1 1 1 1 1 1 1 1         a0 a1 a2 a3     =     x0 + a3 x0 + a1 x0 + a1 + a3 a1 + a2 + a3     x0 = a0 + a2

slide-42
SLIDE 42

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Algorithm 1 (Paar 1997)

Example     1 1 1 1 1 1 1 1 1 1 1 1 1         a0 a1 a2 a3     =     x0 + a3 x0 + a1 x0 + a1 + a3 a1 + a2 + a3     x0 = a0 + a2

slide-43
SLIDE 43

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Algorithm 1 (Paar 1997)

Example     1 1 1 1 1 1 1 1 1 1 1 1 1         a0 a1 a2 a3     =     x0 + a3 (x0 + a1) (x0 + a1) + a3 a1 + a2 + a3     x0 = a0 + a2 x1 = x0 + a1

slide-44
SLIDE 44

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Algorithm 1 (Paar 1997)

Example     1 1 1 1 1 1 1 1 1 1 1 1 1         a0 a1 a2 a3     =     x0 + a3 x1 x1 + a3 a1 + a2 + a3     x0 = a0 + a2 x1 = x0 + a1

slide-45
SLIDE 45

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Algorithm 1 (Paar 1997)

Example     1 1 1 1 1 1 1 1 1 1 1 1 1         a0 a1 a2 a3     =     x0 + a3 x1 x1 + a3 a1 + a2 + a3     x0 = a0 + a2 x1 = x0 + a1

slide-46
SLIDE 46

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Algorithm 1 (Paar 1997)

Example     1 1 1 1 1 1 1 1 1 1 1 1 1         a0 a1 a2 a3     =     x3 x1 x4 x6     x0 = a0 + a2 x1 = x0 + a1 x2 = a1 + a2 x3 = x0 + a3 x4 = x1 + a3 x5 = x2 + a3

slide-47
SLIDE 47

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Algorithm 1 (Paar 1997)

Example     1 1 1 1 1 1 1 1 1 1 1 1 1         a0 a1 a2 a3     =     x3 = a0 + a2 + a3 x1 = a0 + a1 + a2 x4 = a0 + a1 + a2 + a3 x5 = a1 + a2 + a3     x0 = a0 + a2 x1 = x0 + a1 = a0 + a1 + a2 x2 = a1 + a2 x3 = x0 + a3 = a0 + a2 + a3 x4 = x1 + a3 = a0 + a1 + a2 + a3 x5 = x2 + a3 = a1 + a2 + a3

slide-48
SLIDE 48

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Algorithm 1 (Paar 1997)

Table: New XOR counts for matrices from previous work. Matrices in the lower half are involutory.

Dimension S-box Previously best New results 4 × 4 4 bit 58 46 4 × 4 8 bit 106 102 8 × 8 4 bit 384 210 8 × 8 8 bit 640 464 4 × 4 4 bit 63 51 4 × 4 8 bit 126 102 8 × 8 4 bit 424 222 8 × 8 8 bit 736 620

slide-49
SLIDE 49

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

More advanced heuristics

There exists many follow-up work. More sophisticated algorithms.

slide-50
SLIDE 50

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

More advanced heuristics

There exists many follow-up work. More sophisticated algorithms. Example     1 1 1 1 1 1 1 1 1 1 1 1 1         a0 a1 a2 a3     =     a0 + a2 + a3 a0 + a1 + a2 a0 + a1 + a2 + a3 a1 + a2 + a3    

slide-51
SLIDE 51

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

More advanced heuristics

There exists many follow-up work. More sophisticated algorithms. Example     1 1 1 1 1 1 1 1 1 1 1 1 1         a0 a1 a2 a3     =     a0 + a2 + a3 a0 + a1 + a2 a0 + a1 + a2 + a3 a1 + a2 + a3     x0 = a0 + a1

slide-52
SLIDE 52

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

More advanced heuristics

There exists many follow-up work. More sophisticated algorithms. Example     1 1 1 1 1 1 1 1 1 1 1 1 1         a0 a1 a2 a3     =     a0 + a2 + a3 a0 + a1 + a2 a0 + a1 + a2 + a3 a1 + a2 + a3     x0 = a0 + a1 x1 = x0 + a2 = a0 + a1 + a2

slide-53
SLIDE 53

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

More advanced heuristics

There exists many follow-up work. More sophisticated algorithms. Example     1 1 1 1 1 1 1 1 1 1 1 1 1         a0 a1 a2 a3     =     a0 + a2 + a3 a0 + a1 + a2 a0 + a1 + a2 + a3 a1 + a2 + a3     x0 = a0 + a1 x1 = x0 + a2 = a0 + a1 + a2 x2 = x1 + a3 = a0 + a1 + a2 + a3

slide-54
SLIDE 54

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

More advanced heuristics

There exists many follow-up work. More sophisticated algorithms. Example     1 1 1 1 1 1 1 1 1 1 1 1 1         a0 a1 a2 a3     =     a0 + a2 + a3 a0 + a1 + a2 a0 + a1 + a2 + a3 a1 + a2 + a3     x0 = a0 + a1 x1 = x0 + a2 = a0 + a1 + a2 x2 = x1 + a3 = a0 + a1 + a2 + a3 x3 = x2 + a1 = a0 + a2 + a3

slide-55
SLIDE 55

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

More advanced heuristics

There exists many follow-up work. More sophisticated algorithms. Example     1 1 1 1 1 1 1 1 1 1 1 1 1         a0 a1 a2 a3     =     a0 + a2 + a3 a0 + a1 + a2 a0 + a1 + a2 + a3 a1 + a2 + a3     x0 = a0 + a1 x1 = x0 + a2 = a0 + a1 + a2 x2 = x1 + a3 = a0 + a1 + a2 + a3 x3 = x2 + a1 = a0 + a2 + a3 x4 = x2 + a0 = a1 + a2 + a3

slide-56
SLIDE 56

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

More advanced heuristics

There exists many follow-up work. More sophisticated algorithms. Example     1 1 1 1 1 1 1 1 1 1 1 1 1         a0 a1 a2 a3     =     x3 = a0 + a2 + a3 x1 = a0 + a1 + a2 x2 = a0 + a1 + a2 + a3 x4 = a1 + a2 + a3     x0 = a0 + a1 x1 = x0 + a2 = a0 + a1 + a2 x2 = x1 + a3 = a0 + a1 + a2 + a3 x3 = x2 + a1 = a0 + a2 + a3 x4 = x2 + a0 = a1 + a2 + a3

slide-57
SLIDE 57

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Outline

1

Previous Work

2

Shorter Linear Straight-Line Programs

3

Results

slide-58
SLIDE 58

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Improved Implementations

We applied the heuristics to

slide-59
SLIDE 59

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Improved Implementations

We applied the heuristics to

matrices from previous work

slide-60
SLIDE 60

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Improved Implementations

We applied the heuristics to

matrices from previous work matrices known from block ciphers and hash functions

slide-61
SLIDE 61

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Improved Implementations

We applied the heuristics to

matrices from previous work matrices known from block ciphers and hash functions

Could always find improved implementations (lower XOR count).

slide-62
SLIDE 62

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Improved Implementations

We applied the heuristics to

matrices from previous work matrices known from block ciphers and hash functions

Could always find improved implementations (lower XOR count). Including AES MixColumns implementation with 97 XORs. (So far 103 was best.)

slide-63
SLIDE 63

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Statistical Analysis

Analyzed different constructions Cauchy, Circulant, Hadamard, Toeplitz, Vandermonde, Arbitrary

slide-64
SLIDE 64

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Statistical Analysis

Analyzed different constructions Cauchy, Circulant, Hadamard, Toeplitz, Vandermonde, Arbitrary No construction was superior. Exception: Subfield Construction

slide-65
SLIDE 65

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Statistical Analysis

Analyzed different constructions Cauchy, Circulant, Hadamard, Toeplitz, Vandermonde, Arbitrary No construction was superior. Exception: Subfield Construction Good strategy Using subfield construction with best results from smaller S-box size.

slide-66
SLIDE 66

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

New Results

Table: New best XOR counts compared to previous work. Matrices in the lower half are involutory.

Dimension S-box Previously best New best 4 × 4 4 bit 58 36 4 × 4 8 bit 106 72 8 × 8 4 bit 384 196 8 × 8 8 bit 640 392 4 × 4 4 bit 63 42 4 × 4 8 bit 126 84 8 × 8 4 bit 424 212 8 × 8 8 bit 736 424

slide-67
SLIDE 67

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

New Results

Table: New best XOR counts compared to previous work. Matrices in the lower half are involutory.

Dimension S-box Previously best New best 4 × 4 4 bit 10 + 48 −12 + 48 4 × 4 8 bit 10 + 96 −24 + 96 8 × 8 4 bit 160 + 224 −28 + 224 8 × 8 8 bit 192 + 448 −56 + 448 4 × 4 4 bit 15 + 48 −6 + 48 4 × 4 8 bit 30 + 96 −12 + 96 8 × 8 4 bit 200 + 224 −12 + 224 8 × 8 8 bit 288 + 448 −24 + 448

slide-68
SLIDE 68

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Conclusion

Take Home Messages Optimize globally rather than locally. Stop thinking in overhead and fixed cost. Use the existing heuristics. Not necessary to restrict to matrices over finite fields.

https://github.com/pfasante/shorter_linear_slps_for_mds_matrices

slide-69
SLIDE 69

Motivation Previous Work Shorter Linear Straight-Line Programs Results Conclusion

Conclusion

Take Home Messages Optimize globally rather than locally. Stop thinking in overhead and fixed cost. Use the existing heuristics. Not necessary to restrict to matrices over finite fields.

https://github.com/pfasante/shorter_linear_slps_for_mds_matrices

Any Questions?