# On the Construction of20

Authors: Muharrem Tolga Sakallı; Sedat Akleylek; Bora Aslan; Ercan Buluş; Fatma Büyüksaraçoğlu Sakallı
Journal: Mathematical Problems in Engineering
 (2014)

---

## Abstract

We present an algebraic construction based on state transform matrix (companion matrix) forn
×
n (where n
≠
2
k, k being a positive integer) binary matrices with high branch number and low number of fixed points. We also provide examples for 20
×
20 and 24
×
24 binary matrices having advantages on implementation issues in lightweight block ciphers and hash functions. The powers of the companion matrix for an irreducible polynomial over GF
(
2
) with degree 5 and 4 are used in finite field Hadamard or circulant manner to construct 20
×
20 and 24
×
24 binary matrices, respectively. Moreover, the binary matrices are constructed to have good software and hardware implementation properties. To the best of our knowledge, this is the first study for n
×
n (where n
≠
2
k, k being a positive integer) binary matrices with high branch number and low number of fixed points.


---

## Body

## 1. Introduction

Modern block ciphers are made of several rounds. Each of these consists of confusion and diffusion layers. Confusion and diffusion are two principles of the operation of a secure cipher as identified by Shannon [1]. Many block ciphers use linear transformations together with nonlinear substitution boxes (S-boxes) to implement Shannon’s principles. In addition, many block ciphers use S-boxes based on the inversion mapping in a finite field [2, 3]. In a block cipher, a linear transformation is employed to provide the required diffusion. The linear transformation guarantees all the output bits to depend on all the input bits after few rounds. The substitution layer or nonlinear layer provides the necessary confusion making this dependency complex and nonlinear [4]. A linear transformation provides diffusion by mixing bits of the fixed size input block to produce the corresponding output block of the same size [5]. The two existing techniques of measuring diffusion for linear transformations are the branch number [6] and the number of fixed points [5]. The branch number denotes the minimum number of active S-boxes for any two consecutive rounds and represents diffusion rate and measures security against linear and differential cryptanalysis. To achieve better diffusion property, many modern ciphers use linear transformations with high branch number. On the other hand, the number of fixed points provides an indication of how well the linear transformation effectively changes the value of the input block when producing the output block. The basis of the idea is that there is no diffusion at fixed points since the input blocks at these points are left intact by the linear transformation. Note that the expected number of fixed points in a random linear transformation is one [5].Many block ciphers use maximum distance separable (MDS) and maximum distance binary linear (MDBL) codes as diffusion layers in their round function. The AES [7] and Khazad [8] use MDS codes; the Camellia [9] and ARIA [10] use MDBL codes. It is known that MDS matrices do not give a compact implementation in hardware, for example, AES. Most diffusion layers are linear transformations having matrix representations over GF
(
2
m
) or GF
(
2
). The binary matrices, having matrix representation over GF
(
2
), are employed as diffusion layers in block ciphers like Camellia and ARIA. An advantage of using such binary matrices in the design of block ciphers compared with MDS codes is the implementation phase where only XOR operations are needed while MDS matrices may need XOR operations, table look-ups, and xtime calls [11]. Furthermore, the 8
×
8 and 16
×
16 binary matrices used in Camellia and ARIA have the maximum branch numbers 5 and 8, respectively, and are therefore called MDBL codes [4]. In [12, 13], an algebraic construction method to generate 8
×
8, 16
×
16, and 32
×
32 binary matrices of maximum branch number was given. There is no general method for n
×
n binary matrices where n
≠
2
k, k being a positive integer. Constructing diffusion layers with high branch numbers, low number of fixed points, and low-cost hardware/software implementations is an open problem for lightweight block ciphers and hash functions.In recent years, lightweight cryptography has attracted a lot of attention from the crypto community since the use of resource constraint devices has been increasing. There are several lightweight block cipher constructions with 80-bit and 96-bit block sizes in the literature [14–17]. However, these proposals neglect important real-world constraints except a small chip area and they have different deficiencies as listed below:(i)
the lack of efficiency on low-cost processors,
(ii)
a vast amount of program memory storage,
(iii)
high execution times due to the high number of rounds,
(iv)
the lack of security assessment in detail.The wide-trail strategy is one of the important approaches to design round transformations of block ciphers that combine efficiency and resistance against linear and differential cryptanalysis. It results in simple and strong security arguments. However, this approach does not help in designing efficient diffusion layers (with a suitable number of active S-boxes). In this respect, the diffusion layers constructed and the method given in this study aim to provide an alternative structure for the block ciphers with input size different than 2
k.In this study, an algebraic method based on state transform matrix (companion matrix) to construct binary matrices with good implementation properties for lightweight block ciphers and hash functions is given. The emphasis is given ton
×
n binary matrices where n
≠
2
k and k is a positive integer. The proposed method can also be considered as a generalization and different interpretation of the methods given in [12, 13] since it works for any n. This method uses 4
×
4 finite field Hadamard (FFHadamard) matrices with the powers of the companion matrix for an irreducible polynomial over GF
(
2
) of degree 5 and 6
×
6 circulant matrices with the powers of the companion matrix for an irreducible polynomial over GF
(
2
) of degree 4 to generate 20
×
20 (involutory and noninvolutory) and 24
×
24 binary matrices (noninvolutory) of branch numbers 8 and 10 with low number of fixed points, respectively. Also, the binary matrices are constructed to have suitable software and hardware implementation properties for lightweight block ciphers. Note that the binary matrices with these sizes have not been studied in the literature well enough, which may allow us to design a lightweight block cipher with 80-bit and 96-bit block sizes if these matrices are used with 4-bit S-boxes.This paper is organized as follows: Section2 describes the required mathematical background and an introduction to the proposed method. In Section 3, the proposed method is given and examples are provided with good cryptographic properties. Security assessment of lightweight block cipher using the proposed diffusion layer is analyzed in Section 4. Conclusion is given in Section 5. In Appendices A, B, and C implementation details of given examples are discussed.


## 2. Preliminaries

In this section, we give the mathematical background and a view of the proposed method.LetGF
(
2
m
)
≅
GF
(
2
)
/
p
(
x
), where p
(
x
)
=
a
m
x
m
+
⋯
+
a
1
x
+
a
0 is an irreducible polynomial over GF
(
2
) with degree m. Let C
m be the companion matrix for the irreducible polynomial over GF
(
2
) with degree m. The powers of C
m can be considered as the nonzero elements of GF
(
2
m
) [18, 19]. Then, the matrix C
m can be viewed as a polynomial, that is, M
:
x
,
M
2
:
x
2
,
…. This is the core part of the proposed method. Note that this multiplication is modulo p
(
x
) and rank of these matrices is the extension degree m. The identity matrix can be obtained by C
m
2
m
-
1
(1)
C
m
=
0
0
⋯
0
a
0
1
0
⋯
0
a
1
0
1
⋯
0
a
2
⋮
⋮
⋱
⋮
⋮
0
0
⋯
1
a
m
-
1
.
In this study we focus on the finite fields GF
(
2
4
) and GF
(
2
5
), where the irreducible polynomials over GF
(
2
) are, respectively, x
4
+
x
+
1 and x
5
+
x
2
+
1. Now we give an example on how to obtain the elements of GF
(
2
4
).Example 1.
LetGF
(
2
4
)
≅
GF
(
2
)
/
p
(
x
), where p
(
x
)
=
x
4
+
x
+
1 is the irreducible polynomial over GF
(
2
). Then,(2)
C
4
=
0
0
0
1
1
0
0
1
0
1
0
0
0
0
1
0
,
C
4
2
=
0
0
1
0
0
0
1
1
1
0
0
1
0
1
0
0
,
…
,
C
4
15
=
1
0
0
0
0
1
0
0
0
0
1
0
0
0
0
1
.6
×
6 matrices with the elements of C
4
i, where 1
≤
i
≤
2
4
-
1, can be transformed to 24
×
24 binary matrices by substituting the powers of C
4 with their corresponding 4
×
4 binary matrices. Similarly, 4
×
4 matrices with the elements of C
5
i, where 1
≤
i
≤
2
5
-
1, can be transformed to 20
×
20 binary matrices by substituting the powers of C
5 with their corresponding 5
×
5 binary matrices.Now we recall some facts on the linear transformations. The linear transformations of diffusion layers used in most block ciphers are represented as matrices. Hence, a linear transformationA
:
(
{
0,1
}
m
)
n
↦
(
{
0,1
}
m
)
n can be defined as follows:
(3)
A
x
=
A
·
x
T
=
a
11
a
12
⋯
a
1
n
a
21
a
22
⋯
a
2
n
⋮
⋮
⋱
⋮
a
n
1
a
n
2
⋯
a
n
n
·
x
1
x
2
⋮
x
n
,
where x
=
(
x
1
,
x
2
,
…
,
x
n
)
T and x
i
∈
{
0,1
}
m, i
=
1
,
…
,
n. Also n represents the number of S-boxes in a diffusion layer A, where the size of each input and output is m-bit [4].Definition 2 (see [6]).
The differential and linear branch numbers of ann
×
n matrix A
:
(
{
0,1
}
m
)
n
↦
(
{
0,1
}
m
)
n are defined by
(4)
B
d
A
=
min
⁡
⁡
w
t
x
+
w
t
A
·
x
T
∣
x
∈
0,1
m
n
-
0
,
B
l
A
=
min
⁡
⁡
w
t
x
+
w
t
A
T
·
x
T
∣
x
∈
0,1
m
n
-
0
,
where w
t
(
x
) is the number of nonzero components in x, respectively.Definition 3.
Letn be a power of 2. An n
×
n finite field Hadamard (FFHadamard) matrix with the elements of GF
(
2
m
) can be given as follows:
(5)
had
a
1
,
a
2
,
…
,
a
n
=
a
1
a
2
⋯
a
n
-
1
a
n
a
2
a
1
⋯
a
n
a
n
-
1
⋮
⋮
⋱
⋮
⋮
a
n
a
n
-
1
⋯
a
2
a
1
.Remark 4.
Note that one can also divide the FFHadamard matrix into the submatrices. For example, for4
×
4 FFHadamard matrix, we have had
(
a
1
,
a
2
,
a
3
,
a
4
)
=
A
B
B
A, where A
=
a
1
a
2
a
2
a
1 and B
=
a
3
a
4
a
4
a
3. The matrices A and B have Toeplitz matrix properties. We use this observation while constructing a diffusion layer.Definition 5.
Ann
×
n circulant matrix with the elements of GF
(
2
m
) can be given as follows:
(6)
circ
a
1
,
a
2
,
…
,
a
n
=
a
1
a
2
⋯
a
n
-
1
a
n
a
n
a
1
⋯
a
n
-
2
a
n
-
1
a
n
-
1
a
n
⋯
a
n
-
3
a
n
-
2
⋮
⋮
⋱
⋮
⋮
a
2
a
3
⋯
a
n
a
1
.
Note that Remark4 is also applicable in this case. In Lemma 6, the construction of involutory 4
×
4 FFHadamard matrix is given.Lemma 6.
LetA be a 4
×
4 FFHadamard matrix with distinct elements of GF
(
2
m
)
-
{
0
}. Then A is involutory if and only if ∑
i
=
1
4
‍
a
i
=
1.Proof.
The identity matrix satisfies∑
i
=
1
4
‍
a
i
2
=
1 and ∑
i
=
1
4
‍
a
i
=
1. Since A is unitary (
A
-
1
=
A
) and symmetric (
A
=
A
T
), the matrix A is involutory:
(7)
A
2
=
a
1
a
2
a
3
a
4
a
2
a
1
a
4
a
3
a
3
a
4
a
1
a
2
a
4
a
3
a
2
a
1
·
a
1
a
2
a
3
a
4
a
2
a
1
a
4
a
3
a
3
a
4
a
1
a
2
a
4
a
3
a
2
a
1
=
∑
i
=
1
4
‍
a
i
2
0
0
0
0
∑
i
=
1
4
‍
a
i
2
0
0
0
0
∑
i
=
1
4
‍
a
i
2
0
0
0
0
∑
i
=
1
4
‍
a
i
2
.In this study,20
×
20 binary matrices are constructed by using 4
×
4 FFHadamard matrices with the elements of GF
(
2
5
) and also 24
×
24 noninvolutory binary matrices are constructed by using 6
×
6 matrices with the elements of GF
(
2
4
). The 20
×
20 binary matrices constructed are both involutory and noninvolutory with minimum number of fixed points. Involutory transformations can make the decryption process the same as the encryption process. Thus the encryption and decryption can be implemented by the same module and with equal speeds. However, noninvolutory transformations constructed in this study are aimed at having close encryption and decryption speeds. An input block is a fixed point of a transformation if the input block equals its output block. Clearly, in this context, there is no diffusion at the fixed points since the input blocks at these points are left intact by the linear transformation. Therefore, if the number of fixed points in a linear transformation greatly exceeds the expected number for a random linear transformation, then this is an indication of poor diffusion of the linear transformation. Note that the expected number of fixed points in a random linear transformation is one [5]. Consider an input block to a linear transformation formed by m-bit values in the field GF
(
2
m
) and let the linear transformation matrix be an n
×
n matrix A
=
(
a
i
j
)
n
×
n, where a
i
j
∈
GF
(
2
) or a
i
j
∈
GF
(
2
m
) and I is an n
×
n identity matrix. Then, the set of all fixed points for that linear transformation, which can be represented by a nonsingular matrix A, can be obtained by solving the following equation: (
A
+
I
)
·
x
T
=
0, where 0 is the all zero vector of length n. Hence, the number of fixed points can be given as
(8)
F
A
=
2
m
(
n
-
rank
⁡
(
A
+
I
)
)
.
It is obvious that if the matrix (
A
+
I
) has bigger rank, the matrix A has lower number of fixed points.Remark 7.
The existence of fixed points in the round function of block ciphers is used as the basis for some cryptographic attacks and these attacks use fixed points that exist across one or more rounds [5]. The block ciphers DES, SAFER K, Blowfish, GOST, DEAL, and KeeLog were previously found vulnerable to attacks based on the existence of fixed points [20–23]. For SPN ciphers, the existence of fixed points in a linear transformation hints at the presence of 1-round self-iterating differential characteristic. It should be also noted that not all fixed points are useful in constructing a self-iterating characteristic. The usefulness of a fixed point, in this case, depends on its interaction with the subsequent nonlinear transformation. If the input difference is a fixed point, then the linear transformation will replicate this difference into the same S-boxes in the next round. In this context, when designing a block cipher, the linear transformation should be considered with the S-boxes and self-iterating characteristics should be searched. The designer should decide on the number of rounds of the block cipher according to some further investigations (e.g., the resistance of the linear transformation against other attacks like impossible differential cryptanalysis and truncated differential cryptanalysis). To ensure that the large number of fixed points does not trigger an attack to the cipher where the construction is used as a building block depends on the cipher. What we expect is that the cipher itself should behave like a random permutation. Therefore, if the cipher itself does not have many fixed points then it would be almost impossible to exploit the large number of fixed points of the matrix used in the cipher. Therefore, the other building blocks of the cipher should not leverage and extend the fixed points of the matrix to the high level structure of the cipher. Otherwise the cipher may be vulnerable to some self-similarity attack such as reflection attacks.


## 3. The Proposed Method

In this section, we explain our strategy by using the definitions given in Section2. Then, we give algebraic construction of 20
×
20 and 24
×
24 binary matrices. The construction procedure has four main steps.Step
1. Construct companion (state transform) matrix C
m for a given irreducible polynomial p
(
x
) of degree m. Note that C
m is an m
×
m matrix.Step
2. Choose some integers s
i’s with 1
≤
s
i
≤
2
m
-
1 and compute the corresponding C
m
s
i’s. Note that the selection of s
i’s depends on the Hamming weight of each row of the big matrix D.Step
3. Construct D by using had
(
C
m
s
1
,
C
m
s
2
,
…
,
C
m
s
l
) or circ
(
C
m
s
1
,
C
m
s
2
,
…
,
C
m
s
l
), where l is a positive integer. Choose matrix D whose Hamming weight of the each row is as small as possible. This condition helps us to have low-cost (XOR friendly) hardware implementations.Step
4. Check whether the branch and the number of fixed points are satisfactory.This algorithm can be easily implemented on a computer. The results given in this study are obtained by using Magma Computational Algebra System [24]. With the help of Magma Computational Algebra System, one can evaluate hundreds of 20
×
20 or 24
×
24 binary matrices in a second.Remark 8.
Note that the diffusion layers proposed in this study can be implemented by only XOR operations whereas other diffusion layers like MDS (maximum distance separable) matrices may use table look-ups, xtime calls, and so forth [11]. Thus, performing the proposed diffusion layers gives us better implementation properties.


### 3.1. Algebraic Construction of Cryptographically Good20
×
20 Binary Matrices

The maximum branch number ofn
×
n binary matrices is equal to the maximum distance of binary linear 2
n
,
n codes. The exact maximum distance for n
×
n (n
≤
18) binary matrices is known. For example, the maximum branch number and also the upper bound for 8
×
8 matrices are 5 [4]. 20
×
20 binary matrix with a branch number 9 is known and the upper bound is 10 in theory. Note that there is no theoretical bound for the involutory binary matrices in view of branch number. The method presented herein is successful for generating 20
×
20 involutory and noninvolutory binary matrices of branch number 8. Also, 20
×
20 involutory and noninvolutory binary matrices are constructed such that the rank of A
+
I matrix is the highest achievable rank, which is 10 for 20
×
20 involutory binary matrices and 20 for 20
×
20 noninvolutory binary matrices. In Example 11, a 20
×
20 involutory binary matrix (A
Binary
=
A
Binary
-
1) is constructed from a 4
×
4 involutory FFHadamard matrix A that satisfies four restrictions simultaneously such that(i)
the4
×
4 matrix A should be involutory as given in Lemma 6,
(ii)
the20
×
20 binary matrix A
Binary transformed from the 4
×
4 involutory matrix A should be of differential and linear branch number 8,
(iii)
the4
×
4 involutory matrix A should be chosen such that the rank of the (
A
+
I
) matrix should be 2, which is in fact the highest achievable rank (n
/
2 for an n
×
n involutory matrix). Since the elements of GF
(
2
5
) are used to construct the 20
×
20 binary matrix, the rank of the matrix (
A
Binary
+
I
) becomes 10. Thus, if it is used as 80-bit to 80-bit linear transformation, where each input element is in GF
(
2
4
), the binary linear transformation includes 2
40 fixed points,
(iv)
the elements4
×
4 matrix A in GF
(
2
5
) should be chosen such that each row and column of the transformed binary matrix should have the Hamming weight equal to 7, which provides suitable implementation properties.Remark 9.
If we want to construct a20
×
20 binary matrix of branch number 8 with minimum Hamming weight (in each row and column), then we need to focus on a binary matrix which has Hamming weight 7 in each row and column. That means in random search we should search (
C
(
20,7
)
)
20
≈
2
324 binary matrices whereas our search space in the proposed method is C
(
31,4
)
=
31465, where 2
5
-
1
=
31 represents the number of 5
×
5 binary matrices (different elements) used in the construction and obtained by using the primitive polynomial x
5
+
x
2
+
1 and 4 represents the first 4 elements in Hadamard matrix. Therefore, the main idea of the method is to reduce search space and construct binary matrices of high branch number.Remark 10.
If one wants to construct an involutory20
×
20 binary matrix and uses it with 4-bit S-boxes, then the minimum number of fixed point is 2
40 since the rank of (
D
+
I
) matrix becomes at most 10 (or at most n
/
2 for an n
×
n involutory binary matrix). In this respect, this matrix has as possible the lowest number of fixed points. For example, the AES includes 2
16 fixed points though the diffusion layer of the AES (shiftrows + mixcolumns) is not involutory [5]. Noninvolutory diffusion layers may provide less number of fixed points as shown in Example 12 (one fixed point).Example 11.
Let(9)
A
=
had
C
5
31
,
C
5
18
,
C
5
3
,
C
5
27
=
C
5
31
C
5
18
C
5
3
C
5
27
C
5
18
C
5
31
C
5
27
C
5
3
C
5
3
C
5
27
C
5
31
C
5
18
C
5
27
C
5
3
C
5
18
C
5
31
be an involutory 4
×
4 FFHadamard matrix, which is also MDS matrix over the finite field GF
(
2
5
) defined by the primitive polynomial p
(
x
)
=
x
5
+
x
2
+
1; that is, the branch number of the 4
×
4 matrix is 5. It can be transformed into the 20
×
20 binary matrix satisfying the restrictions above as follows:(10)
A
Binary
=
1
0
0
0
0
1
0
0
0
1
0
0
1
0
0
1
0
1
0
1
0
1
0
0
0
1
1
0
0
0
0
0
0
1
0
1
1
0
1
0
0
0
1
0
0
0
1
1
0
1
0
0
1
0
1
0
1
0
0
0
0
0
0
1
0
0
0
1
1
0
1
0
0
1
0
1
0
1
0
0
0
0
0
0
1
0
0
0
1
1
0
1
0
0
1
0
1
0
1
0
1
0
0
0
1
1
0
0
0
0
1
0
1
0
1
0
0
1
0
0
1
1
0
0
0
0
1
0
0
0
1
1
0
1
0
0
0
0
1
0
0
1
1
0
1
0
0
1
0
0
0
1
0
0
0
0
0
1
0
1
0
0
1
1
0
0
0
0
1
0
1
0
1
0
0
1
0
0
1
0
0
0
0
1
1
0
0
0
0
1
0
1
0
1
0
0
1
0
0
1
0
0
1
0
0
1
0
1
0
1
1
0
0
0
0
1
0
0
0
1
0
0
0
1
0
1
1
0
1
0
0
1
0
0
0
1
1
0
0
0
0
0
1
0
1
0
1
0
0
0
0
0
1
0
0
0
1
1
0
1
1
0
0
1
0
1
0
1
0
0
0
0
0
1
0
0
0
1
1
0
0
1
0
0
1
0
1
0
1
0
0
0
0
0
1
0
0
0
1
1
1
0
1
0
1
0
0
1
0
0
1
0
0
0
1
1
0
0
0
0
1
1
0
1
0
0
0
0
1
0
1
1
0
0
0
0
1
0
0
0
0
1
0
0
0
0
0
1
0
1
0
1
1
0
1
0
0
1
0
0
1
0
1
0
0
1
0
0
1
0
0
0
1
1
0
0
0
0
1
0
0
1
0
1
0
0
1
0
0
1
0
0
0
1
1
0
0
0
0
1
.Note that 20
×
20 binary matrix, A
Binary given in Example 11, requires 120 XOR operations in the implementation for both encryption and decryption. In Example 12, a 20
×
20 noninvolutory binary matrix is constructed from 4
×
4 noninvolutory matrix B that satisfies three restrictions simultaneously such that(i)
the20
×
20 binary matrix, B
Binary, transformed from the 4
×
4 noninvolutory matrix B should be of differential and linear branch number 8,
(ii)
the rank of4
×
4 noninvolutory matrix B should be 4, which is in fact the highest achievable rank (n for n
×
n matrix). Since the elements of GF
(
2
5
) are used to construct the 20
×
20 binary matrix, the rank of the matrix (
B
Binary
+
I
) becomes 20. Therefore, if it is used as 80-bit to 80-bit linear transformation, where each input element is in GF
(
2
4
), the binary linear transformation includes only one fixed point,
(iii)
the elements of4
×
4 matrix B in GF
(
2
5
) should be chosen such that the constructed binary matrix should have suitable implementation properties.Example 12.
Let(11)
B
=
had
C
5
31
,
C
5
,
C
5
27
,
C
5
9
=
C
5
31
C
5
C
5
27
C
5
9
C
5
C
5
31
C
5
9
C
5
27
C
5
27
C
5
9
C
5
31
C
5
C
5
9
C
5
27
C
5
C
5
31
.
be a noninvolutory 4
×
4 FFHadamard matrix, which is also MDS matrix over the finite field GF
(
2
5
) defined by the primitive polynomial p
(
x
)
=
x
5
+
x
2
+
1; that is, the branch number of the 4
×
4 matrix is 5. It can be transformed into the 20
×
20 binary matrix satisfying the restrictions above as follows:(12)
B
Binary
=
1
0
0
0
0
0
0
0
0
1
1
0
1
0
1
0
1
1
0
0
0
1
0
0
0
1
0
0
0
0
1
1
0
1
0
1
0
1
1
0
0
0
1
0
0
0
1
0
0
1
0
1
0
0
0
0
0
1
1
1
0
0
0
1
0
0
0
1
0
0
1
0
1
0
0
1
0
0
1
1
0
0
0
0
1
0
0
0
1
0
0
1
0
1
0
1
1
0
0
1
0
0
0
0
1
1
0
0
0
0
0
1
1
0
0
1
0
1
0
1
1
0
0
0
0
0
1
0
0
0
1
0
1
1
0
1
1
0
1
0
0
1
0
0
1
0
0
1
0
0
0
0
1
1
1
0
1
0
0
0
0
0
1
0
0
0
0
0
1
0
1
0
0
1
1
1
0
1
0
0
0
0
0
1
0
0
0
0
0
1
1
1
0
0
1
0
1
0
1
0
1
0
1
0
1
0
1
1
0
0
1
0
0
0
0
0
0
0
0
1
1
1
0
1
0
1
0
1
1
0
0
1
0
0
0
1
0
0
0
0
0
1
0
0
0
0
0
1
1
1
0
0
1
0
0
0
1
0
0
1
1
0
1
0
0
1
0
0
1
1
0
0
0
1
0
0
0
1
0
0
0
1
0
1
0
1
1
0
0
1
0
0
0
0
1
0
0
0
1
0
0
1
1
0
0
1
0
1
0
1
0
0
0
0
1
1
0
0
0
0
1
0
1
1
0
1
1
0
1
0
1
0
0
0
0
0
1
0
0
0
0
0
1
1
1
0
1
0
0
0
0
1
0
0
1
0
0
1
0
0
1
0
0
1
1
1
0
1
0
0
0
0
1
0
0
0
0
0
1
0
1
1
0
0
1
0
1
0
1
0
0
0
0
1
0
0
0
0
0
1
.Note that the 20
×
20 binary matrix B
Binary given in Example 12 and the inverse of 20
×
20 binary matrix (Appendix A) require 124 XOR operations and 140 XOR operations in the implementation for encryption and decryption, respectively.


### 3.2. Algebraic Construction of Cryptographically Good24
×
24 Binary Matrices

The exact maximum distance (upper bound) and therefore maximum branch number for24
×
24 binary matrices are 12 [4]. The method presented herein is successful for generating 24
×
24 noninvolutory binary matrices of branch number 10. Note that there is no known 24
×
24 binary matrices of branch number 10 or more. 24
×
24 noninvolutory binary matrices are constructed such that the rank of (
D
+
I
) matrix is as possible as high rank. Also, when constructing 24
×
24 binary matrices, 6
×
6 circulant matrices with the elements of GF
(
2
4
) are used. In Example 13, a 24
×
4 noninvolutory binary matrix is constructed from a 6
×
6 circulant matrix D that satisfies three restrictions simultaneously such that(i)
the24
×
24 binary matrix, D
Binary, transformed from the 6
×
6 circulant matrix C should be of differential and linear branch number 10,
(ii)
the6
×
6 circulant matrix C should be chosen such that the rank of the (
D
+
I
) matrix should be 5, which is in fact the highest achievable rank satisfying the previous restriction. Since the elements of GF
(
2
4
) are used to construct the 24
×
24 binary matrix, the rank of the matrix (
D
Binary
+
I
) becomes 20. Thus, if it is used as 96-bit to 96-bit linear transformation, where each input element is in GF
(
2
4
), the binary linear transformation includes 2
16 fixed points.
(iii)
The elements of6
×
6 matrix D in GF
(
2
4
) should be chosen such that the constructed binary matrix should have suitable implementation properties.Example 13.
Let(13)
D
=
circ
C
4
7
,
C
4
15
,
C
4
3
,
C
4
14
,
C
4
11
,
C
4
2
=
C
4
7
C
4
15
C
4
3
C
4
14
C
4
11
C
4
2
C
4
2
C
4
7
C
4
15
C
4
3
C
4
14
C
4
11
C
4
11
C
4
2
C
4
7
C
4
15
C
4
3
C
4
14
C
4
14
C
4
11
C
4
2
C
4
7
C
4
15
C
4
3
C
4
3
C
4
14
C
4
11
C
4
2
C
4
7
C
4
15
C
4
15
C
4
3
C
4
14
C
4
11
C
4
2
C
4
7
be a 6
×
6 circulant matrix, which is of branch number 6 over finite field GF
(
2
4
) defined by the primitive polynomial p
(
x
)
=
x
4
+
x
+
1. It can be transformed into the 24
×
24 binary matrix satisfying the restrictions above as follows:(14)
D
Binary
=
1
1
0
1
1
0
0
0
0
1
0
0
1
1
0
0
0
1
1
1
0
0
1
0
1
0
1
1
0
1
0
0
0
1
1
0
0
0
1
0
1
1
0
0
0
0
1
1
0
1
0
1
0
0
1
0
0
0
1
1
0
0
0
1
1
1
1
0
1
0
0
1
1
0
1
0
0
0
0
1
1
0
0
1
1
0
0
0
1
1
1
1
0
1
0
0
0
0
1
0
1
1
0
1
1
0
0
0
0
1
0
0
1
1
0
0
0
1
1
1
0
0
1
1
1
0
1
1
0
1
0
0
0
1
1
0
0
0
1
0
1
1
0
0
1
0
0
1
0
1
0
1
0
0
1
0
0
0
1
1
0
0
0
1
1
1
1
0
0
1
0
0
1
0
1
0
0
0
0
1
1
0
0
1
1
0
0
0
1
1
1
1
0
1
1
1
0
0
1
0
1
1
0
1
1
0
0
0
0
1
0
0
1
1
0
0
1
1
0
0
0
0
1
1
1
0
1
1
0
1
0
0
0
1
1
0
0
0
1
0
1
1
1
0
1
0
0
1
0
1
0
1
0
0
1
0
0
0
1
1
0
0
0
1
1
1
1
1
0
1
0
0
1
0
1
0
0
0
0
1
1
0
0
1
1
0
0
0
1
1
0
0
0
1
1
1
0
0
1
0
1
1
0
1
1
0
0
0
0
1
0
0
0
0
1
0
1
1
0
0
0
0
1
1
1
0
1
1
0
1
0
0
0
1
1
0
0
0
0
1
1
1
1
0
1
0
0
1
0
1
0
1
0
0
1
0
0
0
1
1
1
0
0
0
1
1
1
1
0
1
0
0
1
0
1
0
0
0
0
1
1
0
0
1
0
1
0
0
1
1
0
0
0
1
1
1
0
0
1
0
1
1
0
1
1
0
0
0
0
1
1
0
0
0
1
0
1
1
0
0
0
0
1
1
1
0
1
1
0
1
0
0
0
0
1
1
0
0
0
1
1
1
1
0
1
0
0
1
0
1
0
1
0
0
1
0
1
0
0
1
1
0
0
0
1
1
1
1
0
1
0
0
1
0
1
0
0
0
0
1
1
0
0
0
0
1
0
0
1
1
0
0
0
1
1
1
0
0
1
0
1
1
0
1
0
1
0
0
0
1
1
0
0
0
1
0
1
1
0
0
0
0
1
1
1
0
1
1
0
0
1
0
0
0
1
1
0
0
0
1
1
1
1
0
1
0
0
1
0
1
0
1
0
0
0
1
1
0
0
1
1
0
0
0
1
1
1
1
0
1
0
0
1
0
1
0
.Note that in a straight coding the 24
×
24 binary matrix, D
Binary given in Example 13, requires 240 XOR operations in the implementation for both encryption and decryption. The required number of XOR operations can be reduced to 186 by adding 6 temporary variables to the implementation for both encryption and decryption (Appendices B and C).


## 3.1. Algebraic Construction of Cryptographically Good20
×
20 Binary Matrices

The maximum branch number ofn
×
n binary matrices is equal to the maximum distance of binary linear 2
n
,
n codes. The exact maximum distance for n
×
n (n
≤
18) binary matrices is known. For example, the maximum branch number and also the upper bound for 8
×
8 matrices are 5 [4]. 20
×
20 binary matrix with a branch number 9 is known and the upper bound is 10 in theory. Note that there is no theoretical bound for the involutory binary matrices in view of branch number. The method presented herein is successful for generating 20
×
20 involutory and noninvolutory binary matrices of branch number 8. Also, 20
×
20 involutory and noninvolutory binary matrices are constructed such that the rank of A
+
I matrix is the highest achievable rank, which is 10 for 20
×
20 involutory binary matrices and 20 for 20
×
20 noninvolutory binary matrices. In Example 11, a 20
×
20 involutory binary matrix (A
Binary
=
A
Binary
-
1) is constructed from a 4
×
4 involutory FFHadamard matrix A that satisfies four restrictions simultaneously such that(i)
the4
×
4 matrix A should be involutory as given in Lemma 6,
(ii)
the20
×
20 binary matrix A
Binary transformed from the 4
×
4 involutory matrix A should be of differential and linear branch number 8,
(iii)
the4
×
4 involutory matrix A should be chosen such that the rank of the (
A
+
I
) matrix should be 2, which is in fact the highest achievable rank (n
/
2 for an n
×
n involutory matrix). Since the elements of GF
(
2
5
) are used to construct the 20
×
20 binary matrix, the rank of the matrix (
A
Binary
+
I
) becomes 10. Thus, if it is used as 80-bit to 80-bit linear transformation, where each input element is in GF
(
2
4
), the binary linear transformation includes 2
40 fixed points,
(iv)
the elements4
×
4 matrix A in GF
(
2
5
) should be chosen such that each row and column of the transformed binary matrix should have the Hamming weight equal to 7, which provides suitable implementation properties.Remark 9.
If we want to construct a20
×
20 binary matrix of branch number 8 with minimum Hamming weight (in each row and column), then we need to focus on a binary matrix which has Hamming weight 7 in each row and column. That means in random search we should search (
C
(
20,7
)
)
20
≈
2
324 binary matrices whereas our search space in the proposed method is C
(
31,4
)
=
31465, where 2
5
-
1
=
31 represents the number of 5
×
5 binary matrices (different elements) used in the construction and obtained by using the primitive polynomial x
5
+
x
2
+
1 and 4 represents the first 4 elements in Hadamard matrix. Therefore, the main idea of the method is to reduce search space and construct binary matrices of high branch number.Remark 10.
If one wants to construct an involutory20
×
20 binary matrix and uses it with 4-bit S-boxes, then the minimum number of fixed point is 2
40 since the rank of (
D
+
I
) matrix becomes at most 10 (or at most n
/
2 for an n
×
n involutory binary matrix). In this respect, this matrix has as possible the lowest number of fixed points. For example, the AES includes 2
16 fixed points though the diffusion layer of the AES (shiftrows + mixcolumns) is not involutory [5]. Noninvolutory diffusion layers may provide less number of fixed points as shown in Example 12 (one fixed point).Example 11.
Let(9)
A
=
had
C
5
31
,
C
5
18
,
C
5
3
,
C
5
27
=
C
5
31
C
5
18
C
5
3
C
5
27
C
5
18
C
5
31
C
5
27
C
5
3
C
5
3
C
5
27
C
5
31
C
5
18
C
5
27
C
5
3
C
5
18
C
5
31
be an involutory 4
×
4 FFHadamard matrix, which is also MDS matrix over the finite field GF
(
2
5
) defined by the primitive polynomial p
(
x
)
=
x
5
+
x
2
+
1; that is, the branch number of the 4
×
4 matrix is 5. It can be transformed into the 20
×
20 binary matrix satisfying the restrictions above as follows:(10)
A
Binary
=
1
0
0
0
0
1
0
0
0
1
0
0
1
0
0
1
0
1
0
1
0
1
0
0
0
1
1
0
0
0
0
0
0
1
0
1
1
0
1
0
0
0
1
0
0
0
1
1
0
1
0
0
1
0
1
0
1
0
0
0
0
0
0
1
0
0
0
1
1
0
1
0
0
1
0
1
0
1
0
0
0
0
0
0
1
0
0
0
1
1
0
1
0
0
1
0
1
0
1
0
1
0
0
0
1
1
0
0
0
0
1
0
1
0
1
0
0
1
0
0
1
1
0
0
0
0
1
0
0
0
1
1
0
1
0
0
0
0
1
0
0
1
1
0
1
0
0
1
0
0
0
1
0
0
0
0
0
1
0
1
0
0
1
1
0
0
0
0
1
0
1
0
1
0
0
1
0
0
1
0
0
0
0
1
1
0
0
0
0
1
0
1
0
1
0
0
1
0
0
1
0
0
1
0
0
1
0
1
0
1
1
0
0
0
0
1
0
0
0
1
0
0
0
1
0
1
1
0
1
0
0
1
0
0
0
1
1
0
0
0
0
0
1
0
1
0
1
0
0
0
0
0
1
0
0
0
1
1
0
1
1
0
0
1
0
1
0
1
0
0
0
0
0
1
0
0
0
1
1
0
0
1
0
0
1
0
1
0
1
0
0
0
0
0
1
0
0
0
1
1
1
0
1
0
1
0
0
1
0
0
1
0
0
0
1
1
0
0
0
0
1
1
0
1
0
0
0
0
1
0
1
1
0
0
0
0
1
0
0
0
0
1
0
0
0
0
0
1
0
1
0
1
1
0
1
0
0
1
0
0
1
0
1
0
0
1
0
0
1
0
0
0
1
1
0
0
0
0
1
0
0
1
0
1
0
0
1
0
0
1
0
0
0
1
1
0
0
0
0
1
.Note that 20
×
20 binary matrix, A
Binary given in Example 11, requires 120 XOR operations in the implementation for both encryption and decryption. In Example 12, a 20
×
20 noninvolutory binary matrix is constructed from 4
×
4 noninvolutory matrix B that satisfies three restrictions simultaneously such that(i)
the20
×
20 binary matrix, B
Binary, transformed from the 4
×
4 noninvolutory matrix B should be of differential and linear branch number 8,
(ii)
the rank of4
×
4 noninvolutory matrix B should be 4, which is in fact the highest achievable rank (n for n
×
n matrix). Since the elements of GF
(
2
5
) are used to construct the 20
×
20 binary matrix, the rank of the matrix (
B
Binary
+
I
) becomes 20. Therefore, if it is used as 80-bit to 80-bit linear transformation, where each input element is in GF
(
2
4
), the binary linear transformation includes only one fixed point,
(iii)
the elements of4
×
4 matrix B in GF
(
2
5
) should be chosen such that the constructed binary matrix should have suitable implementation properties.Example 12.
Let(11)
B
=
had
C
5
31
,
C
5
,
C
5
27
,
C
5
9
=
C
5
31
C
5
C
5
27
C
5
9
C
5
C
5
31
C
5
9
C
5
27
C
5
27
C
5
9
C
5
31
C
5
C
5
9
C
5
27
C
5
C
5
31
.
be a noninvolutory 4
×
4 FFHadamard matrix, which is also MDS matrix over the finite field GF
(
2
5
) defined by the primitive polynomial p
(
x
)
=
x
5
+
x
2
+
1; that is, the branch number of the 4
×
4 matrix is 5. It can be transformed into the 20
×
20 binary matrix satisfying the restrictions above as follows:(12)
B
Binary
=
1
0
0
0
0
0
0
0
0
1
1
0
1
0
1
0
1
1
0
0
0
1
0
0
0
1
0
0
0
0
1
1
0
1
0
1
0
1
1
0
0
0
1
0
0
0
1
0
0
1
0
1
0
0
0
0
0
1
1
1
0
0
0
1
0
0
0
1
0
0
1
0
1
0
0
1
0
0
1
1
0
0
0
0
1
0
0
0
1
0
0
1
0
1
0
1
1
0
0
1
0
0
0
0
1
1
0
0
0
0
0
1
1
0
0
1
0
1
0
1
1
0
0
0
0
0
1
0
0
0
1
0
1
1
0
1
1
0
1
0
0
1
0
0
1
0
0
1
0
0
0
0
1
1
1
0
1
0
0
0
0
0
1
0
0
0
0
0
1
0
1
0
0
1
1
1
0
1
0
0
0
0
0
1
0
0
0
0
0
1
1
1
0
0
1
0
1
0
1
0
1
0
1
0
1
0
1
1
0
0
1
0
0
0
0
0
0
0
0
1
1
1
0
1
0
1
0
1
1
0
0
1
0
0
0
1
0
0
0
0
0
1
0
0
0
0
0
1
1
1
0
0
1
0
0
0
1
0
0
1
1
0
1
0
0
1
0
0
1
1
0
0
0
1
0
0
0
1
0
0
0
1
0
1
0
1
1
0
0
1
0
0
0
0
1
0
0
0
1
0
0
1
1
0
0
1
0
1
0
1
0
0
0
0
1
1
0
0
0
0
1
0
1
1
0
1
1
0
1
0
1
0
0
0
0
0
1
0
0
0
0
0
1
1
1
0
1
0
0
0
0
1
0
0
1
0
0
1
0
0
1
0
0
1
1
1
0
1
0
0
0
0
1
0
0
0
0
0
1
0
1
1
0
0
1
0
1
0
1
0
0
0
0
1
0
0
0
0
0
1
.Note that the 20
×
20 binary matrix B
Binary given in Example 12 and the inverse of 20
×
20 binary matrix (Appendix A) require 124 XOR operations and 140 XOR operations in the implementation for encryption and decryption, respectively.


## 3.2. Algebraic Construction of Cryptographically Good24
×
24 Binary Matrices

The exact maximum distance (upper bound) and therefore maximum branch number for24
×
24 binary matrices are 12 [4]. The method presented herein is successful for generating 24
×
24 noninvolutory binary matrices of branch number 10. Note that there is no known 24
×
24 binary matrices of branch number 10 or more. 24
×
24 noninvolutory binary matrices are constructed such that the rank of (
D
+
I
) matrix is as possible as high rank. Also, when constructing 24
×
24 binary matrices, 6
×
6 circulant matrices with the elements of GF
(
2
4
) are used. In Example 13, a 24
×
4 noninvolutory binary matrix is constructed from a 6
×
6 circulant matrix D that satisfies three restrictions simultaneously such that(i)
the24
×
24 binary matrix, D
Binary, transformed from the 6
×
6 circulant matrix C should be of differential and linear branch number 10,
(ii)
the6
×
6 circulant matrix C should be chosen such that the rank of the (
D
+
I
) matrix should be 5, which is in fact the highest achievable rank satisfying the previous restriction. Since the elements of GF
(
2
4
) are used to construct the 24
×
24 binary matrix, the rank of the matrix (
D
Binary
+
I
) becomes 20. Thus, if it is used as 96-bit to 96-bit linear transformation, where each input element is in GF
(
2
4
), the binary linear transformation includes 2
16 fixed points.
(iii)
The elements of6
×
6 matrix D in GF
(
2
4
) should be chosen such that the constructed binary matrix should have suitable implementation properties.Example 13.
Let(13)
D
=
circ
C
4
7
,
C
4
15
,
C
4
3
,
C
4
14
,
C
4
11
,
C
4
2
=
C
4
7
C
4
15
C
4
3
C
4
14
C
4
11
C
4
2
C
4
2
C
4
7
C
4
15
C
4
3
C
4
14
C
4
11
C
4
11
C
4
2
C
4
7
C
4
15
C
4
3
C
4
14
C
4
14
C
4
11
C
4
2
C
4
7
C
4
15
C
4
3
C
4
3
C
4
14
C
4
11
C
4
2
C
4
7
C
4
15
C
4
15
C
4
3
C
4
14
C
4
11
C
4
2
C
4
7
be a 6
×
6 circulant matrix, which is of branch number 6 over finite field GF
(
2
4
) defined by the primitive polynomial p
(
x
)
=
x
4
+
x
+
1. It can be transformed into the 24
×
24 binary matrix satisfying the restrictions above as follows:(14)
D
Binary
=
1
1
0
1
1
0
0
0
0
1
0
0
1
1
0
0
0
1
1
1
0
0
1
0
1
0
1
1
0
1
0
0
0
1
1
0
0
0
1
0
1
1
0
0
0
0
1
1
0
1
0
1
0
0
1
0
0
0
1
1
0
0
0
1
1
1
1
0
1
0
0
1
1
0
1
0
0
0
0
1
1
0
0
1
1
0
0
0
1
1
1
1
0
1
0
0
0
0
1
0
1
1
0
1
1
0
0
0
0
1
0
0
1
1
0
0
0
1
1
1
0
0
1
1
1
0
1
1
0
1
0
0
0
1
1
0
0
0
1
0
1
1
0
0
1
0
0
1
0
1
0
1
0
0
1
0
0
0
1
1
0
0
0
1
1
1
1
0
0
1
0
0
1
0
1
0
0
0
0
1
1
0
0
1
1
0
0
0
1
1
1
1
0
1
1
1
0
0
1
0
1
1
0
1
1
0
0
0
0
1
0
0
1
1
0
0
1
1
0
0
0
0
1
1
1
0
1
1
0
1
0
0
0
1
1
0
0
0
1
0
1
1
1
0
1
0
0
1
0
1
0
1
0
0
1
0
0
0
1
1
0
0
0
1
1
1
1
1
0
1
0
0
1
0
1
0
0
0
0
1
1
0
0
1
1
0
0
0
1
1
0
0
0
1
1
1
0
0
1
0
1
1
0
1
1
0
0
0
0
1
0
0
0
0
1
0
1
1
0
0
0
0
1
1
1
0
1
1
0
1
0
0
0
1
1
0
0
0
0
1
1
1
1
0
1
0
0
1
0
1
0
1
0
0
1
0
0
0
1
1
1
0
0
0
1
1
1
1
0
1
0
0
1
0
1
0
0
0
0
1
1
0
0
1
0
1
0
0
1
1
0
0
0
1
1
1
0
0
1
0
1
1
0
1
1
0
0
0
0
1
1
0
0
0
1
0
1
1
0
0
0
0
1
1
1
0
1
1
0
1
0
0
0
0
1
1
0
0
0
1
1
1
1
0
1
0
0
1
0
1
0
1
0
0
1
0
1
0
0
1
1
0
0
0
1
1
1
1
0
1
0
0
1
0
1
0
0
0
0
1
1
0
0
0
0
1
0
0
1
1
0
0
0
1
1
1
0
0
1
0
1
1
0
1
0
1
0
0
0
1
1
0
0
0
1
0
1
1
0
0
0
0
1
1
1
0
1
1
0
0
1
0
0
0
1
1
0
0
0
1
1
1
1
0
1
0
0
1
0
1
0
1
0
0
0
1
1
0
0
1
1
0
0
0
1
1
1
1
0
1
0
0
1
0
1
0
.Note that in a straight coding the 24
×
24 binary matrix, D
Binary given in Example 13, requires 240 XOR operations in the implementation for both encryption and decryption. The required number of XOR operations can be reduced to 186 by adding 6 temporary variables to the implementation for both encryption and decryption (Appendices B and C).


## 4. Security Assessment of an Assumed Lightweight Block Cipher with 80-Bit or 96-Bit Block Size

In this section, we focus on the security analysis of the assumed block cipher using the proposed linear transformation. A differentially active S-box is defined as an S-box given a nonzero input difference, and a linearly active S-box is defined as an S-box given a nonzero output mask. In this study, S-boxes are assumed to be bijective mappings defined onGF
(
2
m
) and round keys are assumed to be independent and random uniform. Thus the number of active S-boxes is not affected by the key addition layer. The branch number of a diffusion layer is the minimum number of active S-boxes in the 2-round SPN (substitution permutation network). We follow the method defined in [25, 26]. Let p
D and q
L be the the maximum probabilities of the differential and linear characteristic for 2
r-round SPN, respectively. Let p
D
2
r
≤
p
r
·
β and q
L
2
r
≤
q
r
·
β, where p,  q, and β denote the maximum differential probability for the S-box, the maximum linear probability for the S-box, and branch number for the diffusion layer used in a block cipher, respectively. In this study, an SPN structure consisting of a number of rounds of the same 20 4-bit S-boxes connected by a 20
×
20 binary matrix is considered for 80-bit block size. Figure 1 shows one round function of an assumed block cipher. Note that the maximum differential and linear probabilities of the S-box are assumed to be 2
-
2 which is the best value for 4
×
4 S-boxes [27]. Then, the maximum probabilities of the differential, p
D, and linear characteristic, q
L, for 2
r-round SPN are as follows:
(15)
p
D
2
r
≤
2
-
2
r
·
β
A
,
q
L
2
r
≤
2
-
2
r
·
β
A
,
where β
A denotes the branch number of 20
×
20 binary matrix assumed for the lightweight block cipher demonstrated in Figure 1. The maximum differential and linear probabilities of 2-round SPN are bounded by (
2
-
2
)
1
·
8
=
2
-
16 since the branch number of the binary matrix is assumed to be 8 and thus the number of minimum active S-box is 8 in the 2-round SPN. In Table 1, the lower bounds for the number of active S-boxes and the upper bounds for the probabilities for linear and differential probabilities in each round size are computed for the assumed block cipher of 80-bit and 96-bit block sizes.Table 1
The lower bounds for the number of active S-boxes and the upper bounds for the linear and differential probabilities for the assumed block cipher of 80-bit and 96-bit block size.
Round
The lower bounds for the number of active S-boxes
The upper bounds for the linear and differential probabilities
80-bit block cipher
96-bit block cipher
80-bit block cipher
96-bit block cipher
2
8
10
2
-
16
2
-
20
3
9
11
2
-
18
2
-
22
4
16
20
2
-
32
2
-
40
5
17
21
2
-
34
2
-
42
6
24
30
2
-
48
2
-
60
7
25
31
2
-
50
2
-
62
8
32
40
2
-
64
2
-
80
9
33
41
2
-
66
2
-
82
10
40
50
2
-
80
2
-
100
11
41
51
2
-
82
2
-
102
12
48
60
2
-
96
2
-
120Figure 1
One round function of an assumed lightweight block cipher.In this context, the minimum number of rounds needed for the lightweight block cipher with80-bit block size to be secure against differential and linear cryptanalysis is 10 because the maximum differential and linear probabilities of 10-round SPN are bounded by (
2
-
2
)
5
·
8
=
2
-
80
≤
2
-
80. Similarly, if an SPN structure consisting of a number of rounds of the same 24 4-bit S-boxes connected by a 24
×
24 binary matrix is considered for 96-bit block size, then the minimum number of rounds needed for the lightweight block cipher to be secure against differential and linear cryptanalysis is again obtained as 10 because the maximum differential and linear probabilities of 10-round SPN are bounded by (
2
-
2
)
5
·
10
=
2
-
100
≤
2
-
96.


## 5. Conclusion

In this study, an algebraic method based on state transform matrix (companion matrix) to constructn
×
n binary matrices with good implementation properties for lightweight block ciphers and hash functions is given. The proposed method can also be considered as a generalization and different interpretation of the methods given in [12, 13] since it works for any n. For 20
×
20 and 24
×
24 binary matrices, examples are provided with good implementation properties. The binary matrices are also constructed to have suitable software and hardware implementation properties for lightweight block ciphers. In other words, by using the proposed method, the matrices have smaller hardware implementations in view of the required number of XOR gates. Note that the binary matrices with these sizes have not been studied in the literature well enough, which may allow us to design a lightweight block cipher with 80-bit and 96-bit block sizes if these matrices are used with 4-bit S-boxes. 20
×
20 binary matrix given in Example 12 has only one fixed point and branch number 8.



---

*Source: 540253-2014-11-02.xml*