Expand description

The column layout will be as follow, supposing a state size of 3 elements:

| C1 | C2 | C3 | C4  | C5  | C6  | ... | C_(k) | C_(k + 1) | C_(k + 2) |
|--- |----|----|-----|-----|-----|-----|-------|-----------|-----------|
|  x |  y | z  | x'  |  y' |  z' | ... |  x''  |     y''   |    z''    |
               | MDS \circ SBOX  |     |        MDS \circ SBOX         |
               |-----------------|     |-------------------------------|

where (x’, y’, z’) = MDS(x^7, y^7, z^7), i.e. the result of the linear layer

We will have, for N full rounds:

  • 3 input columns
  • N * 3 round columns, indexed by the round number and the index in the state, the number of rounds.

The round constants are added as fixed selectors.

Enums