Integral cryptanalysis against 4-rounds AES is practical (Security of the AES with a Secret S-box). I did two experiments in order to find the impact and remove the integral distinguisher of 4 rounds:
- I replaced key addition $\oplus$ with $\boxplus$ (mod 32 bit)
- I replaced the sbox with S1 Sbox in Clefia cipher (same differential and linear probability).
but the integral distinguisher is still present.
Further reading lead me to find that BelT cipher (Finding Integral Distinguishers with Ease) has no integral distinguisher after three rounds.
Questions:
Where is the exploitable integral structure in AES-like?
What countermeasures are taken to remove integral distinguisher?
What is the advantage taken in BelT cipher?