Design of a Linear Layer Optimised for Bitsliced 32-bit Implementation
The linear layer of block ciphers plays an important role in their security In particular, ciphers designed following the wide-trail strategy use the branch number of the linear layer to derive bounds on the probability of linear and differential trails. At FSE 2014, the LS-design construction was...
| Main Authors: | , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Ruhr-Universität Bochum
2024-03-01
|
| Series: | IACR Transactions on Symmetric Cryptology |
| Subjects: | |
| Online Access: | https://tosc.iacr.org/index.php/ToSC/article/view/11412 |
| _version_ | 1827333863012040704 |
|---|---|
| author | Gaëtan Leurent Clara Pernot |
| author_facet | Gaëtan Leurent Clara Pernot |
| author_sort | Gaëtan Leurent |
| collection | DOAJ |
| description |
The linear layer of block ciphers plays an important role in their security In particular, ciphers designed following the wide-trail strategy use the branch number of the linear layer to derive bounds on the probability of linear and differential trails. At FSE 2014, the LS-design construction was introduced as a simple and regular structure to design bitsliced block ciphers. It considers the internal state as a bit matrix, and applies alternatively an identical S-Box on all the columns, and an identical L-Box on all the lines. Security bounds are derived from the branch number of the L-Box.
In this paper, we focus on bitsliced linear layers inspired by the LS-design construction and the Spook AEAD algorithm. We study the construction of bitsliced linear transformations with efficient implementations using XORs and rotations (optimized for bitsliced ciphers implemented on 32-bit processors), and a high branch number. In order to increase the density of the activity patterns, the linear layer is designed on the whole state, rather than using multiple parallel copies of an L-Box. Our main result is a linear layer for 128-bit ciphers with branch number 21, improving upon the best 32-bit transformation with branch number 12, and the one of Spook with branch number 16.
|
| first_indexed | 2024-03-07T17:37:43Z |
| format | Article |
| id | doaj.art-1e0b96ff36d14cc2816ab324964ce76c |
| institution | Directory Open Access Journal |
| issn | 2519-173X |
| language | English |
| last_indexed | 2024-03-07T17:37:43Z |
| publishDate | 2024-03-01 |
| publisher | Ruhr-Universität Bochum |
| record_format | Article |
| series | IACR Transactions on Symmetric Cryptology |
| spelling | doaj.art-1e0b96ff36d14cc2816ab324964ce76c2024-03-02T16:23:05ZengRuhr-Universität BochumIACR Transactions on Symmetric Cryptology2519-173X2024-03-012024110.46586/tosc.v2024.i1.441-458Design of a Linear Layer Optimised for Bitsliced 32-bit ImplementationGaëtan Leurent0Clara Pernot1Inria, Paris, FranceInria, Paris, France The linear layer of block ciphers plays an important role in their security In particular, ciphers designed following the wide-trail strategy use the branch number of the linear layer to derive bounds on the probability of linear and differential trails. At FSE 2014, the LS-design construction was introduced as a simple and regular structure to design bitsliced block ciphers. It considers the internal state as a bit matrix, and applies alternatively an identical S-Box on all the columns, and an identical L-Box on all the lines. Security bounds are derived from the branch number of the L-Box. In this paper, we focus on bitsliced linear layers inspired by the LS-design construction and the Spook AEAD algorithm. We study the construction of bitsliced linear transformations with efficient implementations using XORs and rotations (optimized for bitsliced ciphers implemented on 32-bit processors), and a high branch number. In order to increase the density of the activity patterns, the linear layer is designed on the whole state, rather than using multiple parallel copies of an L-Box. Our main result is a linear layer for 128-bit ciphers with branch number 21, improving upon the best 32-bit transformation with branch number 12, and the one of Spook with branch number 16. https://tosc.iacr.org/index.php/ToSC/article/view/11412Bitsliced cipherLinear layerBranch number |
| spellingShingle | Gaëtan Leurent Clara Pernot Design of a Linear Layer Optimised for Bitsliced 32-bit Implementation IACR Transactions on Symmetric Cryptology Bitsliced cipher Linear layer Branch number |
| title | Design of a Linear Layer Optimised for Bitsliced 32-bit Implementation |
| title_full | Design of a Linear Layer Optimised for Bitsliced 32-bit Implementation |
| title_fullStr | Design of a Linear Layer Optimised for Bitsliced 32-bit Implementation |
| title_full_unstemmed | Design of a Linear Layer Optimised for Bitsliced 32-bit Implementation |
| title_short | Design of a Linear Layer Optimised for Bitsliced 32-bit Implementation |
| title_sort | design of a linear layer optimised for bitsliced 32 bit implementation |
| topic | Bitsliced cipher Linear layer Branch number |
| url | https://tosc.iacr.org/index.php/ToSC/article/view/11412 |
| work_keys_str_mv | AT gaetanleurent designofalinearlayeroptimisedforbitsliced32bitimplementation AT clarapernot designofalinearlayeroptimisedforbitsliced32bitimplementation |