Abstract

Abstract. Although linear perfect diffusion primitives, i.e. MDS matrices, are widely used in block ciphers, e.g. AES, very little systematic work has been done on how to find "efficient " ones. In this paper we attempt to do so by considering software implementations on various platforms. These considerations lead to interesting combinatorial problems: how to maximize the number of occurrences of 1 in those matrices, and how to minimize the number of pairwise different entries. We investigate these problems and construct efficient 4*4 and 8*8 MDS matrices to be used e.g. in block ciphers. 1 Introduction Block ciphers are cascades of diffusion and confusion layers [9]. We usually for-malize confusion layers as application of substitution boxes which are defined by lookup tables. Since those tables must be as small as possible for implementationreasons, confusion layers apply substitution in parallel on pieces of informations, e.g. elements whose values lie in a set K of size 256. The goal of diffusion is tomix up those pieces. One possibility for formalizing the notion of perfect diffusion is the concept of multipermutation which was introduced in [8, 10]. Bydefinition, a diffusion function f from Kp to Kq is a multipermutation if for any x1,..., xp 2 K and any integer r such that 1 < = r < = p, the influence of modifying r input values on f (x1,..., xp) is to modify at least q- r + 1 output values.Another way to define it consists of saying that the set of all words consisting of

Citations