I read a paper about nonlinear invariant attack that is Y.Todo et al's "Nonlinear Invariant Attack: Practical Attack on Full SCREAM, iSCREAM, and Midori64"

In this paper's Appendix A., they said that

"Then, by Gaussian elimination like computation, we compute matrix $M'=[M_1'||M_2']. $ If rows of $M_2'$ are $[0,0,...,0]$ or $[1,0,0,...,0]$, the corresponding row of $M_1'$is the basis of $U(S)$ "

I wonder why that is the basis of $U(S)$.

In my thinking corresponding row of $M_1'$ such that the row of $M_2'$are $[1,0,0,...,0]$ or $[0,1,0,0,...,0]$ or $...$ or $[0,0,0,...,0,1]$ is the basis of $U(S)$.

Can you show me why "If rows of $M_2'$ are $[0,0,...,0]$ or $[1,0,0,...,0]$, the corresponding row of $M_1'$is the basis of $U(S)$" is right.

I read a paper about a nonlinear invariant attack that is Y.Todo et. al's "Nonlinear Invariant Attack: Practical Attack on Full SCREAM, iSCREAM, and Midori64"

In this paper's Appendix A., they said that

Then, by Gaussian elimination like computation, we compute matrix $M'=[M_1'\|M_2']. $ If rows of $M_2'$ are $[0,0,...,0]$ or $[1,0,0,...,0]$, the corresponding row of $M_1'$is the basis of $U(S)$

I wonder why that is the basis of $U(S)$.

In my thinking corresponding row of $M_1'$ such that the row of $M_2'$ are $[1,0,0,...,0]$ or $[0,1,0,0,...,0]$ or $...$ or $[0,0,0,...,0,1]$ is the basis of $U(S)$.

Can you show me why "If rows of $M_2'$ are $[0,0,...,0]$ or $[1,0,0,...,0]$, the corresponding row of $M_1'$ is the basis of $U(S)$" is right.

I read a paper about nonlinear invariant attack that is Y.Todo et al's "Nonlinear Invariant Attack: Practical Attack on Full SCREAM, iSCREAM, and Midori64"

In this paper's Appendix A., they said that

"Then, by Gaussian elimination like computation, we compute matrix $M'=[M_1'||M_2']. $ If rows of $M_2'$ are $[0,0,...,0]$ or $[1,0,0,...,0]$, the corresponding row of $M_1'$is the basis of $U(S)$ "

I wonder why that is the basis of $U(S)$.

In my thinking corresponding row of $M_1'$ such that the row of $M_2'$are $[1,0,0,...,0]$ or $[0,1,0,0,...,0]$ or $...$ or $[0,0,0,...,0,1]$ is the basis of $U(S)$.

Can you show me why "If rows of $M_2'$ are $[0,0,...,0]$ or $[1,0,0,...,0]$, the corresponding row of $M_1'$is the basis of $U(S)" is right.

Thank you very much.

I read a paper about nonlinear invariant attack that is Y.Todo et al's "Nonlinear Invariant Attack: Practical Attack on Full SCREAM, iSCREAM, and Midori64"

In this paper's Appendix A., they said that

"Then, by Gaussian elimination like computation, we compute matrix $M'=[M_1'||M_2']. $ If rows of $M_2'$ are $[0,0,...,0]$ or $[1,0,0,...,0]$, the corresponding row of $M_1'$is the basis of $U(S)$ "

I wonder why that is the basis of $U(S)$.

In my thinking corresponding row of $M_1'$ such that the row of $M_2'$are $[1,0,0,...,0]$ or $[0,1,0,0,...,0]$ or $...$ or $[0,0,0,...,0,1]$ is the basis of $U(S)$.

Can you show me why "If rows of $M_2'$ are $[0,0,...,0]$ or $[1,0,0,...,0]$, the corresponding row of $M_1'$is the basis of $U(S)$" is right.