>Dear editor,White-box cryptography aims to give a secure software implementation of the cryptographic algorithm running in an untrusted environment which is owned and controlled by an adversary.Its major goal is to protect the confidentiality of the secret key.Given the increasing demands for softwareonly applications,white-box cryptography has received a lot of attention from industry.By now,all

Linear layer is a fundamental primitive for many aspects of information technology. For information security, the performance of a linear layer depends on two aspects: diffusion ability and implementation cost, where the latter is usually measured by the number of XORs required to implement it. For many years, linear layers have been implemented by computing co-ordinates of the output independently. With this method, costs are determined only by the matrices representing linear layers. However, we note that the implementation cost of a given linear layer depends not only on its matrix but also on its implementation methods. So, in this paper, we focus on another implementation method: modifying input vectors to output step by step. This method uses fewer XORs than previous methods do and makes the implementation cost of every linear layer same as that of its inverse. With the new implementation method, we first clarify the measurement of implementation cost and the optimal implementation procedure of invertible linear layers. Here, “optimal” means using fewest XORs. Then, to find the optimal implementation procedure of a given invertible linear layer, we construct a graph-theoretical model and transfer the problem to the shortest path problem in graph theory. Next, we construct a new “double-direction” algorithm that uses less storage and makes the search for a shortest path more efficient in a regular graph. However, this algorithm is not practical enough for heavyweight invertible linear layers because of its high space/time complexity. So, we present another algorithm for finding efficient implementations of invertible linear layers. The advantages of this algorithm are its low complexity and high practicality. By this algorithm, we design highly efficient implementations of the linear layers of AES. To handle more general linear layers, we finally construct a practical algorithm for finding efficient implementations of singular linear layers.

Many modern block ciphers use maximum distance separate (MDS) matrices as their diffusion layers. In this paper, we propose a new method to verify a sort of MDS diffusion block matrices whose blocks are all polynomials in a certain primitive block over the finite field F2. And then we discover a new kind of transformations that can retain MDS property of diffusion matrices and generate a series of new MDS matrices from a given one. Moreover, we get an equivalence relation from this kind of transformation. And MDS property is an invariant with respect to this equivalence relation which can greatly reduce the amount of computation when we search for MDS matrices. The minimal polynomials of matrices play an important role in our strategy. To avoid being too theoretical, we list a series of MDS diffusion matrices obtained from our method for some specific parameters. Furthermore, we talk about MDS recursive diffusion layers with our method and extend the corresponding work of M. Sajadieh et al. published on FSE 2012 and the work of S. Wu published on SAC 2012.