Citation Context

...ield inversion operations. The top linear component is defined by the matrix U, a 22 × 8 matrix (Figure 2). One can compute all 22 of the required outputs with only 23 XOR gates, and 23 are necessary =-=[1, 5, 4]-=-. But these results do not attempt to minimize depth (the depth is 7). Since there are only 8 columns in this matrix, each of the 22 outputs could clearly be calculated independently using depth at mo...

Citation Context

...licative Complexity (MC) in order to produce also gate-efficient implementations: 1. (Step 1) First compute the multiplicative complexity. 2. (Step 2) Then optimise the number of XORs separately, see =-=[20, 12]-=-. 3. Optional Step 3: At the end do additional optimizations to decrease the circuit depth, an possibly additional software optimizations, see [19, 22], This methodology was then used to produce new w...

Citation Context

...ls for cryptographic research. In particular, we plan on including normal basis arithmetic in the Galois field library, developing advanced circuit minimization techniques (e.g. SAT solver reductions =-=[34]-=-), and integrating our security analysis code into the SAGE software package [71]. The rest of this thesis is outlined as follows. In the remainder of this chapter we first discuss the mathematical fu...

Citation Context

...hern Denmark, Denmark 1 Introduction In this paper we describe the implementation of a technique for minimizing XOR circuits used in cryptographic algorithms. More precisely, we present our work from =-=[4]-=- for encoding this synthesis problem to SAT with a focus on the case study of optimizing an important component of the Advanced Encryption Standard (AES) [8]. In addition to these previously published...

Citation Context

...gic formulas. In our work, we construct distributed algorithms with the help of modern SAT solvers [4]. Recently, such tools have been used in related problems, e.g., for finding small logic circuits =-=[11,12,14]-=-. 3 Applications Counters as Frequency Dividers. We can visualise a C-counter as an electronic circuit that consists of n components (nodes); see Fig. 1. Each node i has a register xi that stores its ...

Citation Context

... statements about individuals but since they are restricted (see [13]) their number is usually limited. It is known that satisfiable probabilistic KBs are typically more difficult for PSAT algorithms =-=[6, 4]-=-. We have also observed that on average our algorithm generates less than half the columns for unsatisfiable instances as compared to satisfiable instances. This is mostly due to the early unsatisfiab...

Citation Context

... minimum number of additions of elements from S necessary to obtain f . Initially, Dist[i] is set to the value which is one less than the Hamming weight of row i. Then the following loop is performed =-=[1]-=- : 1. Pick a new base element by adding two existing base elements; • If any two bases S[i], S[j] are such that S[i] ⊕ S[j] is a row in A, then pick this sum as the new base element. 2. Update Dist[i]...

Citation Context

... as lifting the solution to larger fields or rings [1] or re-optimize for circuit depth, or many other [5], [6]. This type of methodology was recently applied with success to optimize linear circuits =-=[10]-=- and bi-linear circuits [11]. We have developed a method to do this also for non-linear circuits. We have been greatly influenced by the work of Boyar and Peralta on the AES cipher S-box and its MC, h...