Searching for Subspace Trails and Truncated Differentials


Grassi et al. introduced subspace trail cryptanalysis as a generalization of invariant subspaces and used it to give the first five round distinguisher for AES. While it is a generic method, up to now it was only applied to the AES and Prince. One problem for a broad adoption of the attack is a missing generic analysis algorithm. In this work we provide efficient and generic algorithms that allow to compute the provably best subspace trails for any substitution permutation cipher.

In Transactions on Symmetric Cryptology Volume 2018 Issue 1