Modeling for Three-Subset Division Property without Unknown Subset

A division property is a generic tool to search for integral distinguishers, and automatic tools such as MILP or SAT/SMT allow us evaluate the propagation efficiently. In application stream ciphers, it enables estimate security of cube attacks theoretically, leads best key-recovery against well-known ciphers. However, was reported that some based on degenerate distinguishing due inaccuracy property. Three-subset (without unknown subset) promising method solve this problem, new algorithm using three-subset recently proposed at Asiacrypt2019. paper, we first show state-of-the-art not always efficient cannot improve existing attacks. Then, focus without subset propose another tools. Our more than algorithms, can Trivium, 842-round attack. We also 855-round attack, which CRYPTO2018, has critical flaw does work. As result, our attack becomes Grain-128AEAD, known 184-round degenerates are improved up 189 rounds, 190 rounds. ACORN, prove 772-round ISC2019 in fact constant-sum distinguisher. then give mounting 773-, 774- 775-round ACORN. verify current 892-round Kreyvium recover exact superpoly. further 893