Constructing Binary Matrices with Good Implementation Properties for Low-Latency Block Ciphers based on Lai-Massey Structure

Diffusion layers are crucial components for lightweight cryptographic schemes. Optimal binary matrices are widely used diffusion layers that can be easier to achieve the best security/performance trade-off. However, most of the constructions of binary matrices are concentrated in smaller dimensions. Besides, to maximize the number of branches, the performance is often neglected. In this paper, we investigate the diffusion of the Lai-Massey (L-M) structures and propose a series of binary diffusion layers with the best possible branch number and efficient software/hardware implementations as well for feasible parameters (up to 64). Firstly, we prove the lower bound of the circuit depth of a binary matrix with a fixed branch number. Then, we construct binary matrices by L-M structure with cyclic shift as round functions because of taking account of the improvement of software performance and demonstrate that this construction can not get the diffusion layers with branch number >4. Then, we get some 4 x 4 and 6 x 6 optimal binary matrices with branch number 4 by one-round L-M structure. Note that the depth of these results is optimal, i. e. they achieve the lowest hardware costs without loss of software efficiency. Secondly, we construct diffusion layers by extended L-M structures to obtain binary matrices with large sizes. We give a list of software/hardware friendly optimal binary matrices with large dimensions, especially for dimensions 48 and 64. In particular, some of the solutions are Maximum Distance Binary Linear matrices. Finally, we also present diffusion layers constructed by the extended generalized L-M structure to improve their applicabilities on other platforms.