0

In AES Proposal: Rijndael, page 34, there is the following figure with MixColumn transformation pattern for two columns:

enter image description here

I'm trying to reproduce these paterns.

The pattern in the column marked in green works as expected: if one applies MixColumn to a column of the form [x,0,x,x] the result is of the form [a,b,0,0], where x, a and b are non zero bytes.

But I struggle to understand how MixColumn works for the column marked in red. As per my understanding, MixColumn transforms a vector of 4 equal bytes to itself, e.g. [0xc6, 0xc6, 0xc6, 0xc6] into [0xc6, 0xc6, 0xc6, 0xc6].

How does on the Figure 9 MixColumn collapse 4 active S-boxes into 1?

Alexey Kalmykov
  • 103
  • 2

2 Answers2

2

How does on the Figure 9 MixColumn collapse 4 active S-boxes into 1?

What a shaded box means is that byte is 'active' in the differential; that is, the two halves of the differential have different values in that byte.

That does mean that the xor of the two halves results in a nonzero value for that byte; however it states nothing of the value of that xor (other than that it is not 00). In addition, two different active bytes may have different xor's; they both are nonzero, but they may have different nonzero values.

MixColumn is linear, and so the differential output of a MixColumn can be represented by the MixColumn of the differential (xor) if the inputs. And so, when they do a MixCollumn of four active bytes (that is, where the xor consists of four nonzero bytes), they are merely indicating that there is some value of those nonzero bytes which results in only one byte of the result being nonzero. Now, as you observed, the initial bytes cannot be the same if that were to happen; however we can consider other differentials where the xor bytes differ.

poncho
  • 154,064
  • 12
  • 239
  • 382
2

This question can also be answered in principle, since the minimum weight of the derived MDS code resulting from the MixColumns matrix is $5,$ this means that sometimes, given an input column weight of $4$ nonzero bytes, the output weight of the corresponding column can be as low as $5-4=1.$ Thus there can be exactly one nonzero byte. This minimum weight is also called the branch number.

For more details see this question

kodlu
  • 25,146
  • 2
  • 30
  • 63