A New Method for Constructing Integral‐Resistance Matrix for 5‐Round AES

A powerful theory for evaluating block ciphers against integral distinguishers was introduced by Hebborn et al. at ASIACRYPT 2021. To show the integral‐resistance property for a block cipher, their core idea is to construct a full‐rank integral‐resistance matrix. However, their method does not work practically for 5‐round AES due to the large S‐box and complex linear layer. In this paper, we are concerned with the integral‐resistance property of 5‐round AES. By carefully investigating the S‐box and the linear layer of AES, some significant properties about the propagation of the division property on the round function of AES are derived. In particular, with these properties, it is easy to determine the appearance of all maximum‐degree monomials after 5‐round AES encryption on a properly chosen set of key‐patterns. Consequently, a full‐rank integral‐resistance matrix is formed to show that there is no integral distinguisher for five rounds and higher of AES under the assumption of independent round keys. Since it is well known that there is a 4‐round integral distinguisher for AES, our result is tight for AES. As far as we know, this is the first proof for the integral‐resistance property of 5‐round AES.