# Countermeasures to prevent integral cryptanalysis against 4-rounds AES

Integral cryptanalysis against 4-rounds AES is practical (Security of the AES with a Secret S-box). I did two experiments in order to find the impact and remove the integral distinguisher of 4 rounds:

• I replaced key addition $$\oplus$$ with $$\boxplus$$ (mod 32 bit)
• I replaced the sbox with S1 Sbox in Clefia cipher (same differential and linear probability).

but the integral distinguisher is still present.

Further reading lead me to find that BelT cipher (Finding Integral Distinguishers with Ease) has no integral distinguisher after three rounds.

Questions:

• Where is the exploitable integral structure in AES-like?

• What countermeasures are taken to remove integral distinguisher?

• What is the advantage taken in BelT cipher?

• What's wrong with more than 4 rounds, per common wisdom? – fgrieu Nov 20 '18 at 14:36
• Nothing wrong but can we do better with less rounds – hardyrama Nov 20 '18 at 14:39

However, it looks to me strongly likely that the nice diffusion properties of AES using operations of order $$4$$ ShiftRows) and matrix ($$4\times 4$$) multiplication on vectors of dimension $$4$$ (MixColumns) are the reason for the existence of these attacks and changing these properties may well require more rounds for security.