MDS Matrices
Gaëtan Leurent · 2023
Maximum distance separable (MDS) matrices are linear layers with optimal properties. They are used in many substitution–permutation network block ciphers, and in particular in the advanced encryption standard. In recent years, there has been a lot of work on the construction of MDS matrices with a low implementation cost, in the context of lightweight cryptography. The wide trail strategy links the branch number with the differential and linear properties of the cipher. In a software implementation, MDS linear layers are usually implemented with tables, and the efficiency is independent of the choice of the MDS matrix. In a hardware implementation, the MDS matrix can be a significant part of the cipher, and there are different ways to optimize its implementation. The choice of the ring plays an important role in the implementation cost of an MDS matrix.