MDS matrix

An MDS matrix (maximum distance separable) is a matrix representing a function with certain diffusion properties that have useful applications in cryptography. Technically, an ${\displaystyle m\times n}$ matrix ${\displaystyle A}$ over a finite field ${\displaystyle K}$ is an MDS matrix if it is the transformation matrix of a linear transformation ${\displaystyle f(x)=Ax}$ from ${\displaystyle K^{n}}$ to ${\displaystyle K^{m}}$ such that no two different ${\displaystyle (m+n)}$-tuples of the form ${\displaystyle (x,f(x))}$ coincide in ${\displaystyle n}$ or more components. Equivalently, the set of all ${\displaystyle (m+n)}$-tuples ${\displaystyle (x,f(x))}$ is an MDS code, i.e., a linear code that reaches the Singleton bound.

Let ${\displaystyle {\tilde {A}}={\begin{pmatrix}\mathrm {I} _{n}\\\hline \mathrm {A} \end{pmatrix}}}$ be the matrix obtained by joining the identity matrix ${\displaystyle \mathrm {I} _{n}}$ to ${\displaystyle A}$. Then a necessary and sufficient condition for a matrix ${\displaystyle A}$ to be MDS is that every possible ${\displaystyle n\times n}$ submatrix obtained by removing ${\displaystyle m}$ rows from ${\displaystyle {\tilde {A}}}$ is non-singular. This is also equivalent to the following: all the sub-determinants of the matrix ${\displaystyle A}$ are non-zero. Then a binary matrix ${\displaystyle A}$ (namely over the field with two elements) is never MDS unless it has only one row or only one column with all components ${\displaystyle 1}$.

Reed–Solomon codes have the MDS property and are frequently used to obtain the MDS matrices used in cryptographic algorithms.

Serge Vaudenay suggested using MDS matrices in cryptographic primitives to produce what he called multipermutations, not-necessarily linear functions with this same property.^[1] These functions have what he called perfect diffusion: changing ${\displaystyle t}$ of the inputs changes at least ${\displaystyle m-t+1}$ of the outputs. He showed how to exploit imperfect diffusion to cryptanalyze functions that are not multipermutations.

MDS matrices are used for diffusion in such block ciphers as AES, SHARK, Square, Twofish, Anubis, KHAZAD, Manta, Hierocrypt, Kalyna, Camellia and HADESMiMC, and in the stream cipher MUGI and the cryptographic hash function Whirlpool, Poseidon.

References

1. Vaudenay, Serge (1995), Preneel, Bart (ed.), "On the need for multipermutations: Cryptanalysis of MD4 and SAFER", Fast Software Encryption, vol. 1008, Berlin, Heidelberg: Springer Berlin Heidelberg, pp. 286–297, doi:10.1007/3-540-60590-8_22, ISBN 978-3-540-60590-4, retrieved 2023-07-17

• Vincent Rijmen; Joan Daemen; Bart Preneel; Antoon Bosselaers; Erik De Win (February 1996). The Cipher SHARK (PDF/PostScript). 3rd International Workshop on Fast Software Encryption (FSE '96). Cambridge: Springer-Verlag. pp. 99–111. Retrieved 2007-03-06.
• Bruce Schneier; John Kelsey; Doug Whiting; David Wagner; Chris Hall; Niels Ferguson (June 15, 1998). "The Twofish Encryption Algorithm" (PDF/PostScript). Retrieved 2007-03-04.