Construction of Recursive MDS Diffusion Layers from Gabidulin Codes
Résumé
Many recent block ciphers use Maximum Distance Separable (MDS) matrices in their diffusion layers. The main objective of this operation is to spread as much as possible the differences between the outputs of nonlinear Sboxes. So they generally act as nibble or bytes level. The MDS matrices are associated to MDS codes of ratio 1/2. The most famous example is those of the MixColumns operation in the AES block cipher. In this example, the MDS matrix was chosen carefully in order to obtain compact and efficient implementations in software and hardware. However, this MDS matrix is dedicated to word of 8 bits, and are not always adapted to lightweight applications. Recently, several studies have been devoted to the construction of recursive diffusion layers. Such a method allows to apply a MDS matrix by the main of an iterative process which looks like to a Feistel network with linear functions instead of nonlinear. In this paper, we present a generic construction of MDS recursive diffusion layers. This construction uses Gabidulin codes which have the property to be not only MDS but also MRD (Maximum Rank Distance). This fact gives an additional property to diffusions layers which seems interesting for cryptographic applications.