Searching for Subspace Trails and Truncated Differentials

Abstract

Grassi et al. introduced subspace trail cryptanalysis as a generalization of invariant subspaces and used it to give the first five round distinguisher for AES. While it is a generic method, up to now it was only applied to the AES and Prince. One problem for a broad adoption of the attack is a missing generic analysis algorithm. In this work we provide efficient and generic algorithms that allow to compute the provably best subspace trails for any substitution permutation cipher.