Countermeasures to prevent integral cryptanalysis against 4-rounds AES

Question

Integral cryptanalysis against 4-rounds AES is practical (Security of the AES with a Secret S-box). I did two experiments in order to find the impact and remove the integral distinguisher of 4 rounds:

• I replaced key addition $\oplus$ with $\boxplus$ (mod 32 bit)
• I replaced the sbox with S1 Sbox in Clefia cipher (same differential and linear probability).

but the integral distinguisher is still present.

Further reading lead me to find that BelT cipher (Finding Integral Distinguishers with Ease) has no integral distinguisher after three rounds.

Questions:

• Where is the exploitable integral structure in AES-like?

• What countermeasures are taken to remove integral distinguisher?

• What is the advantage taken in BelT cipher?

Answer 1

This question may be theoretically interesting.

However, it looks to me strongly likely that the nice diffusion properties of AES using operations of order $4$ ShiftRows) and matrix ($4\times 4$) multiplication on vectors of dimension $4$ (MixColumns) are the reason for the existence of these attacks and changing these properties may well require more rounds for security.

The requirement that these operations be one-to-one, in the absence of a feistel structure, means that the SPN structure may also need to be dumped in order to avoid 4 round integral cryptanalysis.