# Tag Info

There are two well-known distinguishers of reduced-rounds version of AES based on integral cryptanalysis. The first one is a 3-rounds distinguisher from Daemen and Rijmen while the other is a 4-rounds distinguisher from Gilbert and Minier. The 3-rounds distinguisher relies on the fact that one byte $y$ of the state in the third round is the xor of four ...