DOCSLIB.ORG

Appendix N Whirlpool

Total Page：16

File Type：pdf, Size：1020Kb

Download full-text PDF Read full-text

Load more

A PPENDIX N W HIRLPOOL William Stallings Copyright 2010 N.1 WHIRLPOOL HASH STRUCTURE................................................................................3 Background....................................................................................................................3 Whirlpool Logic.............................................................................................................4 N.2 BLOCK CIPHER W ..........................................................................................................5 Overall Structure............................................................................................................7 The Nonlinear Layer SB ..............................................................................................10 The Permutation Layer SC...........................................................................................10 The Diffusion Layer MR .............................................................................................11 The Add Key Layer AK...............................................................................................12 Key Expansion for the Block Cipher W ......................................................................13 REFERENCES ........................................................................................................................13 Supplement to Cryptography and Network Security, Fifth Edition William Stallings Prentice Hall 2010 ISBN-10: 0136097049 http://williamstallings.com/Crypto/Crypto5e.html In this appendix, we examine the hash function Whirlpool [BARR03], one of whose designers is also co-inventor of Rijndael, adopted as the Advanced Encryption Standard (AES). Whirlpool is one of only two hash functions endorsed by NESSIE (New European Schemes for Signatures, Integrity, and Encryption).1 The NESSIE project is a European Union-sponsored effort to put forward a portfolio of strong cryptographic primitives of various types. Whirlpool is based on the use of a block cipher for the compression function. There has traditionally been little interest in the use of block-cipher-based hash functions because of the demonstrated security vulnerabilities of the structure. The following are potential drawbacks: 1. Block ciphers do not possess the properties of randomizing functions. For example, they are invertible. This lack of randomness may lead to weaknesses that can be exploited. 2. Block ciphers typically exhibit other regularities or weaknesses. For example, [MIYA90] demonstrates how to compromise many hash schemes based on properties of the underlying block cipher. 3. Typically, block-cipher-based hash functions are significantly slower than hash functions based on a compression function specifically designed for the hash function. 4. A principal measure of the strength of a hash function is the length of the hash code in bits. For block-cipher-based hash codes, proposed designs have a hash code length equal to either the cipher block length or twice the cipher block length. Traditionally, cipher block length has been limited to 64 bits (e.g., DES, triple DES), resulting in a hash code of questionable strength. However, since the adoption of AES, there has been renewed interested in developing a secure hash function based on a strong block cipher and exhibiting good performance. Whirlpool is a block-cipher-based hash function intended to provide security and performance that is comparable, if not better, than that found in non-block-cipher based hash functions, such as SHA. Whirlpool has the following features: 1 The other endorsed scheme consists of three variants of SHA: SHA-256, SHA-384, and SHA-512. N -2 1. The hash code length is 512 bits, equaling the longest hash code available with SHA. 2. The overall structure of the hash function is one that has been shown to be resistant to the usual attacks on block-cipher-based hash codes. 3. The underlying block cipher is based on AES and is designed to provide for implementation in both software and hardware that is both compact and exhibits good performance. The design of Whirlpool sets the following security goals: Assume we take as hash result the value of any n-bit substring of the full Whirlpool output. • The expected workload of generating a collision is of the order of 2n/2 executions of Whirlpool. • Given an n-bit value, the expected workload of finding a message that hashes to that value is of the order of 2n executions of Whirlpool. • Given a message and its n-bit hash result, the expected workload of finding a second message that hashes to the same value is of the order of 2n executions of Whirlpool. • It is infeasible to detect systematic correlations between any linear combination of input bits and any linear combination of bits of the hash result, or to predict what bits of the hash result will change value when certain input bits are flipped (this means resistance against linear and differential attacks). The designers assert their confidence that these goals have been met with a considerable safety margin. However, the goals are not susceptible to a formal proof. We begin with a discussion of the structure of the overall hash function, and then examine the block cipher used as the basic building block. N.1 WHIRLPOOL HASH STRUCTURE Background The general iterated hash structure proposed by Merkle (Figure 11.7) is used in virtually all secure hash functions. However, as was pointed out, there are difficulties in designing a truly N -3 secure iterated hash function when the compression function is a block cipher. Preneel [PREN93a, PREN93b] performed a systematic analysis of block-cipher-based hash functions, using the model depicted in Figure N.1. In this model, the hash code length equals the cipher block length. Additional security problems are introduced and the analysis is more difficult if the hash code length exceeds the cipher block length. Preneel devised 64 possible permutations of the basic model, based on which input served as the encryption key and which served as plaintext and on what input, if any, was combined with the ciphertext to produce the intermediate hash code. Based on his analysis, he concluded that only schemes in which the plaintext was fed forward and combined with the ciphertext were secure. Such an arrangement makes the compression function difficult to invert. [BLAC02] confirmed these results, but pointed out the security problem of using an established block cipher such as AES: The 128-bit hash code value resulting from the use of AES or another scheme with the same block size may be inadequate for security. Whirlpool Logic Given a message consisting of a sequence of blocks m1, m2, …, mt, the Whirlpool hash function is expressed as follows: H0 = initial value Hi = E(Hi–1, mi) ! Hi–1 ! mi = intermediate value Ht = hash code value In terms of the model of Figure N.1, the encryption key input for each iteration is the intermediate hash value from the previous iteration; the plaintext is the current message block; and the feedforward value is the bitwise XOR of the current message block and the intermediate hash value from the previous iteration. The algorithm takes as input a message with a maximum length of less than 2256 bits and produces as output a 512-bit message digest. The input is processed in 512-bit blocks. Figure N.2 depicts the overall processing of a message to produce a digest. This follows the general structure depicted in Figure 11.7. The processing consists of the following steps: N -4 • Step 1: Append padding bits. The message is padded so that its length in bits is an odd multiple of 256. Padding is always added, even if the message is already of the desired length. For example, if the message is 256 " 3 = 768 bits long, it is padded by 512 bits to a length of 256 " 5 = 1280 bits. Thus, the number of padding bits is in the range of 1 to 512. The padding consists of a single 1-bit followed by the necessary number of 0-bits. • Step 2: Append length. A block of 256 bits is appended to the message. This block is treated as an unsigned 256-bit integer (most significant byte first) and contains the length in bits of the original message (before the padding). The outcome of the first two steps yields a message that is an integer multiple of 512 bits in length. In Figure N.2, the expanded message is represented as the sequence of 512-bit blocks m1, m2, …, mt, so that the total length of the expanded message is t " 512 bits. These blocks are viewed externally as arrays of bytes by sequentially grouping the bits in 8-bit chunks. However, internally, the hash state Hi is viewed as an 8 " 8 matrix of bytes. The transformation between the two is explained subsequently. • Step 3: Initialize hash matrix. An 8 " 8 matrix of bytes is used to hold intermediate and final results of the hash function. The matrix is initialized as consisting of all 0-bits. • Step 4: Process message in 512-bit (64-byte) blocks. The heart of the algorithm is the block cipher W. N.2 BLOCK CIPHER W Unlike virtually all other proposals for a block-cipher-based hash function, Whirlpool uses a block cipher that is specifically designed for use in the hash function and that is unlikely ever to be used as a standalone encryption function. The reason for this is that the designers wanted to make use of a block cipher with the security and efficiency of AES but with a hash length that provided a potential security equal to SHA-512. The result is the block cipher W, which has a similar structure and uses the same elementary
Recommended publications
  • GCM) for Confidentiality And

    GCM) for Confidentiality And

    NIST Special Publication 800-38D Recommendation for Block DRAFT (April, 2006) Cipher Modes of Operation: Galois/Counter Mode (GCM) for Confidentiality and Authentication Morris Dworkin C O M P U T E R S E C U R I T Y Abstract This Recommendation specifies the Galois/Counter Mode (GCM), an authenticated encryption mode of operation for a symmetric key block cipher. KEY WORDS: authentication; block cipher; cryptography; information security; integrity; message authentication code; mode of operation. i Table of Contents 1 PURPOSE...........................................................................................................................................................1 2 AUTHORITY.....................................................................................................................................................1 3 INTRODUCTION..............................................................................................................................................1 4 DEFINITIONS, ABBREVIATIONS, AND SYMBOLS.................................................................................2 4.1 DEFINITIONS AND ABBREVIATIONS .............................................................................................................2 4.2 SYMBOLS ....................................................................................................................................................4 4.2.1 Variables................................................................................................................................................4
  • Block Cipher Modes

    Block Cipher Modes

    Block Cipher Modes Data and Information Management: ELEN 3015 School of Electrical and Information Engineering, University of the Witwatersrand March 25, 2010 Overview Motivation for Cryptographic Modes Electronic Codebook Mode (ECB) Cipher Block Chaining (CBC) Cipher Feedback Mode (CFB) Output Feedback Mode (OFB) 1. Cryptographic Modes Problem: With block ciphers, same plaintext block always enciphers to the same ciphertext block under the same key 1. Cryptographic Modes Solution: Cryptographic mode: • block cipher • feedback • simple operations Simple operations, as the security lies in the cipher. 1. Cryptographic Modes 1.1 Considerations • The mode should not compromise security of cipher • Mode should conceal patterns in plaintext • Some random starting point is needed • Difficult to manipulate the plaintext by changing ciphertext • Requires multiple messages to be encrypted with same key • No significant impact on efficiency of cipher • Ciphertext same size as plaintext • Fault tolerance - recover from errors 2. Electronic Codebook Mode Uses the block cipher without modifications Same plaintext block encrypts to same ciphertext under same key Each plaintext block is encrypted independently of other plaintext blocks. Corrupted bits only affects one block Dropped/inserted bits cause sync errors ! all subsequent blocks decipher incorrectly 2. Electronic Codebook Mode 2.1 Advantages ECB exhibits `random access property' because plaintext blocks are encrypted independently • Encryption and decryption can be done in any order • Beneficial for databases, records can be added, deleted, modified, encrypted and deleted independently of other records Parallel implementation • Different blocks can simultaneously be decrypted on separate processors Many messages can be encrypted with the same key, since each block is independent. 2.
  • Cryptographic Sponge Functions

    Cryptographic Sponge Functions

    Cryptographic sponge functions Guido B1 Joan D1 Michaël P2 Gilles V A1 http://sponge.noekeon.org/ Version 0.1 1STMicroelectronics January 14, 2011 2NXP Semiconductors Cryptographic sponge functions 2 / 93 Contents 1 Introduction 7 1.1 Roots .......................................... 7 1.2 The sponge construction ............................... 8 1.3 Sponge as a reference of security claims ...................... 8 1.4 Sponge as a design tool ................................ 9 1.5 Sponge as a versatile cryptographic primitive ................... 9 1.6 Structure of this document .............................. 10 2 Definitions 11 2.1 Conventions and notation .............................. 11 2.1.1 Bitstrings .................................... 11 2.1.2 Padding rules ................................. 11 2.1.3 Random oracles, transformations and permutations ........... 12 2.2 The sponge construction ............................... 12 2.3 The duplex construction ............................... 13 2.4 Auxiliary functions .................................. 15 2.4.1 The absorbing function and path ...................... 15 2.4.2 The squeezing function ........................... 16 2.5 Primary aacks on a sponge function ........................ 16 3 Sponge applications 19 3.1 Basic techniques .................................... 19 3.1.1 Domain separation .............................. 19 3.1.2 Keying ..................................... 20 3.1.3 State precomputation ............................ 20 3.2 Modes of use of sponge functions .........................
  • VHDL Implementation of Twofish Algorithm

    VHDL Implementation of Twofish Algorithm

    VHDL Implementation of Twofish Algorithm Purnima Gehlot Richa Sharma S. R. Biradar Mody Institute of Mody Institute of Mody Institute of Technology Technology Technology and Science and Science and Science Laxmangarh, Sikar Laxmangarh, Sikar Laxmangarh, Sikar Rajasthan,India Rajasthan,India Rajasthan,India [email protected] [email protected] [email protected] which consists of two modules of function g, one MDS i.e. maximum ABSTRACT distance separable matrix,a PHT i.e. pseudo hadamard transform and Every day hundreds and thousands of people interact electronically, two adders of 32-bit for one round. To increase the complexity of the whether it is through emails, e-commerce, etc. through internet. For algorithm we can perform Endian function over the input bit stream. sending sensitive messages over the internet, we need security. In this Different modules of twofish algorithms are: paper a security algorithms, Twofish (Symmetric key cryptographic algorithm) [1] has been explained. All the important modules of 2.1 ENDIAN FUNCTION Twofish algorithm, which are Function F and g, MDS, PHT, are implemented on Xilinx – 6.1 xst software and there delay calculations Endian Function is a transformation of the input data. It is used as an interface between the input data provided to the circuit and the rest has been done on FPGA families which are Spartan2, Spartan2E and of the cipher. It can be used with all the key-sizes [5]. Here 128-bit VirtexE. input is divided into 16 bytes from byte0 to byte15 and are rearranged to get the output of 128-bit. Keywords Twofish, MDS, PHT, symmetric key, Function F and g.
  • Recommendation for Block Cipher Modes of Operation Methods

    Recommendation for Block Cipher Modes of Operation Methods

    NIST Special Publication 800-38A Recommendation for Block 2001 Edition Cipher Modes of Operation Methods and Techniques Morris Dworkin C O M P U T E R S E C U R I T Y ii C O M P U T E R S E C U R I T Y Computer Security Division Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD 20899-8930 December 2001 U.S. Department of Commerce Donald L. Evans, Secretary Technology Administration Phillip J. Bond, Under Secretary of Commerce for Technology National Institute of Standards and Technology Arden L. Bement, Jr., Director iii Reports on Information Security Technology The Information Technology Laboratory (ITL) at the National Institute of Standards and Technology (NIST) promotes the U.S. economy and public welfare by providing technical leadership for the Nation’s measurement and standards infrastructure. ITL develops tests, test methods, reference data, proof of concept implementations, and technical analyses to advance the development and productive use of information technology. ITL’s responsibilities include the development of technical, physical, administrative, and management standards and guidelines for the cost-effective security and privacy of sensitive unclassified information in Federal computer systems. This Special Publication 800-series reports on ITL’s research, guidance, and outreach efforts in computer security, and its collaborative activities with industry, government, and academic organizations. Certain commercial entities, equipment, or materials may be identified in this document in order to describe an experimental procedure or concept adequately. Such identification is not intended to imply recommendation or endorsement by the National Institute of Standards and Technology, nor is it intended to imply that the entities, materials, or equipment are necessarily the best available for the purpose.
  • The Whirlpool Secure Hash Function

    The Whirlpool Secure Hash Function

    Cryptologia, 30:55–67, 2006 Copyright Taylor & Francis Group, LLC ISSN: 0161-1194 print DOI: 10.1080/01611190500380090 The Whirlpool Secure Hash Function WILLIAM STALLINGS Abstract In this paper, we describe Whirlpool, which is a block-cipher-based secure hash function. Whirlpool produces a hash code of 512 bits for an input message of maximum length less than 2256 bits. The underlying block cipher, based on the Advanced Encryption Standard (AES), takes a 512-bit key and oper- ates on 512-bit blocks of plaintext. Whirlpool has been endorsed by NESSIE (New European Schemes for Signatures, Integrity, and Encryption), which is a European Union-sponsored effort to put forward a portfolio of strong crypto- graphic primitives of various types. Keywords advanced encryption standard, block cipher, hash function, sym- metric cipher, Whirlpool Introduction In this paper, we examine the hash function Whirlpool [1]. Whirlpool was developed by Vincent Rijmen, a Belgian who is co-inventor of Rijndael, adopted as the Advanced Encryption Standard (AES); and by Paulo Barreto, a Brazilian crypto- grapher. Whirlpool is one of only two hash functions endorsed by NESSIE (New European Schemes for Signatures, Integrity, and Encryption) [13].1 The NESSIE project is a European Union-sponsored effort to put forward a portfolio of strong cryptographic primitives of various types, including block ciphers, symmetric ciphers, hash functions, and message authentication codes. Background An essential element of most digital signature and message authentication schemes is a hash function. A hash function accepts a variable-size message M as input and pro- duces a fixed-size hash code HðMÞ, sometimes called a message digest, as output.
  • Block Cipher and Data Encryption Standard (DES)

    Block Cipher and Data Encryption Standard (DES)

    Block Cipher and Data Encryption Standard (DES) 2021.03.09 Presented by: Mikail Mohammed Salim Professor 박종혁 Cryptography and Information Security 1 Block Cipher and Data Encryption Standard (DES) Contents • What is Block Cipher? • Padding in Block Cipher • Ideal Block Cipher • What is DES? • DES- Key Discarding Process • Des- 16 rounds of Encryption • How secure is DES? 2 Block Cipher and Data Encryption Standard (DES) What is Block Cipher? • An encryption technique that applies an algorithm with parameters to encrypt blocks of text. • Each plaintext block has an equal length of ciphertext block. • Each output block is the same size as the input block, the block being transformed by the key. • Block size range from 64 -128 bits and process the plaintext in blocks of 64 or 128 bits. • Several bits of information is encrypted with each block. Longer messages are encoded by invoking the cipher repeatedly. 3 Block Cipher and Data Encryption Standard (DES) What is Block Cipher? • Each message (p) grouped in blocks is encrypted (enc) using a key (k) into a Ciphertext (c). Therefore, 푐 = 푒푛푐푘(푝) • The recipient requires the same k to decrypt (dec) the p. Therefore, 푝 = 푑푒푐푘(푐) 4 Block Cipher and Data Encryption Standard (DES) Padding in Block Cipher • Block ciphers process blocks of fixed sizes, such as 64 or 128 bits. The length of plaintexts is mostly not a multiple of the block size. • A 150-bit plaintext provides two blocks of 64 bits each with third block of remaining 22 bits. • The last block of bits needs to be padded up with redundant information so that the length of the final block equal to block size of the scheme.
  • Characterization of Padding Rules and Different Variants of MD Hash Functions

    Characterization of Padding Rules and Different Variants of MD Hash Functions

    Characterization of Padding Rules and Different Variants of MD Hash Functions Mridul Nandi National Institute of Standards and Technology Outline • Introduction to hash function and known Padding Rules. • Thm1 : Suffix-free Padding rule is necessary and sufficient for MD hash functions. • Thm2 : A new suffix-free padding rule handling arbitrary message using log |M| bits and study comparison. • Thm3 : The simplest 10 k padding rule (no length overhead) is secure on a modified MD hash or mMD . • Thm4 : It also works for newly introduced design mode BCM ( Backward Chaining Mode ) and its modification mBCM . Introduction to Hash Function: Security notions, applications and MD iteration and known padding rules Hash Function Arbitrary Length Strings à fixed length strings 101010101010101010101010101010110101010101010010101010101101001001001001010101110100010101110100100001001011100010010001000101101 001010111010001010100010100010100101010101010101010101010000000000011111110110101011010101010101010010110101010101010101111110000 101010101010100101010101010011101010100110101010101010101010101010101010101010101010010111100001110101110000111010001100011110011 101010110101010101010101011001010001010101000010001010111000101110010100000101001110010101010101011101010101010101010101010101010 110101010101010010101010101101001001001001010101110100010101110100100001001011100010010001000101101001010111010001010100010100010 10010101010101010101010101000000000001111111011010101101010101010101001011010101010101010111111000010101010101010010101010101 001 1 10101010011010101010101010101010101010101010101010101001011110000111010111000011101000110001111001110101011010101010101010101
  • Lightweight Diffusion Layer from the Kth Root of the MDS Matrix

    Lightweight Diffusion Layer from the Kth Root of the MDS Matrix

    Lightweight Diffusion Layer from the kth root of the MDS Matrix Souvik Kolay1, Debdeep Mukhopadhyay1 1Dept. of Computer Science and Engineering Indian Institute of Technology Kharagpur, India fsouvik1809,[email protected] Abstract. The Maximum Distance Separable (MDS) mapping, used in cryptog- raphy deploys complex Galois field multiplications, which consume lots of area in hardware, making it a costly primitive for lightweight cryptography. Recently in lightweight hash function: PHOTON, a matrix denoted as ‘Serial’, which re- quired less area for multiplication, has been multiplied 4 times to achieve a lightweight MDS mapping. But no efficient method has been proposed so far to synthesize such a serial matrix or to find the required number of repetitive multiplications needed to be performed for a given MDS mapping. In this pa- per, first we provide an generic algorithm to find out a low-cost matrix, which can be multiplied k times to obtain a given MDS mapping. Further, we optimize the algorithm for using in cryptography and show an explicit case study on the MDS mapping of the hash function PHOTON to obtain the ‘Serial’. The work also presents quite a few results which may be interesting for lightweight imple- mentation. Keywords: MDS Matrix, kth Root of a Matrix, Lightweight Diffusion Layer 1 Introduction With several resource constrained devices requiring support for cryptographic algo- rithms, the need for lightweight cryptography is imperative. Several block ciphers, like Kasumi[19], mCrypton[24], HIGHT[20], DESL and DESXL[23], CLEFIA[34], Present[8], Puffin[11], MIBS[22], KATAN[9], Klein[14], TWINE[36], LED[16], Pic- colo [33] etc and hash functions like PHOTON[33], SPONGENT[7], Quark [3] etc.
  • Secret-Key Encryption Introduction

    Secret-Key Encryption Introduction

    Secret-Key Encryption Introduction • Encryption is the process of encoding a message in such a way that only authorized parties can read the content of the original message • History of encryption dates back to 1900 BC • Two types of encryption • secret-key encryption : same key for encryption and decryption • pubic-key encryption : different keys for encryption and decryption • We focus on secret-key encryption in this chapter Substitution Cipher • Encryption is done by replacing units of plaintext with ciphertext, according to a fixed system. • Units may be single letters, pairs of letters, triplets of letters, mixtures of the above, and so forth • Decryption simply performs the inverse substitution. • Two typical substitution ciphers: • monoalphabetic - fixed substitution over the entire message • Polyalphabetic - a number of substitutions at different positions in the message Monoalphabetic Substitution Cipher • Encryption and decryption Breaking Monoalphabetic Substitution Cipher • Frequency analysis is the study of the frequency of letters or groups of letters in a ciphertext. • Common letters : T, A, E, I, O • Common 2-letter combinations (bigrams): TH, HE, IN, ER • Common 3-letter combinations (trigrams): THE, AND, and ING Breaking Monoalphabetic Substitution Cipher • Letter Frequency Analysis results: Breaking Monoalphabetic Substitution Cipher • Bigram Frequency Analysis results: Breaking Monoalphabetic Substitution Cipher • Trigram Frequency analysis results: Breaking Monoalphabetic Substitution Cipher • Applying the partial mappings… Data Encryption Standard (DES) • DES is a block cipher - can only encrypt a block of data • Block size for DES is 64 bits • DES uses 56-bit keys although a 64-bit key is fed into the algorithm • Theoretical attacks were identified. None was practical enough to cause major concerns.
  • Variations to the Cryptographic Algorithms Aes and Twofish

    Variations to the Cryptographic Algorithms Aes and Twofish

    VARIATIONS TO THE CRYPTOGRAPHIC ALGORITHMS AES AND TWOFISH P. Freyre∗1, N. D´ıaz ∗ and O. Cuellar y2 ∗Faculty of Mathematics and Computer Science, University of Havana, Cuba. yFaculty of Mathematics, Physical and Computer Science, Central University of Las Villas, Cuba. 1e-mail: [email protected] 2e-mail: [email protected] Abstract The cryptographic algorithms AES and Twofish guarantee a high diffusion by the use of fixed 4×4 MDS matrices. In this article variations to the algorithms AES and Twofish are made. They allow that the process of cipher - decipher come true with MDS matrices selected randomly from the set of all MDS matrices with the use of proposed algorithm. A new key schedule with a high diffusion is designed for the algorithm AES. Besides proposed algorithm generate new S - box that depends of the key. Key words: Block Cipher, AES, Twofish, S - boxes, MDS matrix. 1 1 Introduction. The cryptographic algorithms Rijndael (see [DR99] and [DR02]) and Twofish (see [SKWHF98] and [GBS13]) were finalists of the contest to select the Advanced Encryption Standard (AES) convened by the National Institute of Standards and Technology from the United States (NIST). The contest finished in October 2000 with the selection of the algorithm Rijndael as the AES, stated algorithm was proposed by Joan Daemen and Vincent Rijmen from Belgium. In order to reach a high diffusion, the algorithms AES and Twofish, use a MDS (Maximal Distance Separable) matrices, selected a priori. In this article we will explain the variations of these algorithms, where the MDS matrices are selected randomly as function of the secret key.
  • On Constructions of MDS Matrices from Circulant-Like Matrices for Lightweight Cryptography

    On Constructions of MDS Matrices from Circulant-Like Matrices for Lightweight Cryptography

    On Constructions of MDS Matrices From Circulant-Like Matrices For Lightweight Cryptography Technical Report No. ASU/2014/1 Dated : 14th February, 2014 Kishan Chand Gupta Applied Statistics Unit Indian Statistical Institute 203, B. T. Road, Kolkata 700108, INDIA. [email protected] Indranil Ghosh Ray Applied Statistics Unit Indian Statistical Institute 203, B. T. Road, Kolkata 700108, INDIA. indranil [email protected] On Constructions of MDS Matrices From Circulant-Like Matrices For Lightweight Cryptography Kishan Chand Gupta and Indranil Ghosh Ray Applied Statistics Unit, Indian Statistical Institute. 203, B. T. Road, Kolkata 700108, INDIA. [email protected], indranil [email protected] Abstract. Maximum distance separable (MDS) matrices have applications not only in coding theory but are also of great importance in the design of block ciphers and hash functions. It is highly nontrivial to find MDS matrices which could be used in lightweight cryptography. In a SAC 2004 paper, Junod et. al. constructed a new class of efficient MDS matrices whose submatrices were circulant matrices and they coined the term circulating-like matrices for these new class of matrices which we rename as circulant-like matrices. In this paper we study this construction and propose efficient 4 × 4 and 8 × 8 circulant-like MDS matrices. We prove that such d × d circulant-like MDS matrices can not be involutory or orthogonal which are good for designing SPN networks. Although these matrices are efficient, but the inverse of such matrices are not guaranteed to be efficient. Towards this we design a new type of circulant- like MDS matrices which are by construction involutory.