 
Summary: Synthesizing Shortest Linear StraightLine
Programs over GF(2) for the AES using SAT
Carsten Fuhs
LuFG Informatik 2, RWTH Aachen University, Germany
fuhs@informatik.rwthaachen.de
Abstract. Recently, the use of SAT solving has expanded to the area of
automatically synthesizing shortest linear straightline programs from a
specification [5,4]. We provide corresponding application benchmarks for
parts of the implementation of the Sbox of the Advanced Encryption
Standard.
1 Introduction
The paper [5] describes the use for SAT solving for automated synthesis of short
est linear straightline programs over the Galois field of two elements (GF(2)).
Such a program of k lines can equivalently be expressed as a Boolean circuit of
k XOR gates. The specification for the program then consists of several multi
variate linear forms over GF(2).
For the SAT encoding, in addition to the specification one provides the max
imum number k of lines of the straightline program that is supposed to be
synthesized. The goal is to find a program with the minimal number of lines
that adheres to the specification. The resulting CNF encodes the following de
