Modeling Modular Multiplication for Monomial Prediction and Impossible Differentials, with Application to MSX

What it is

A preprint by Emanuele Bellini, Mohamed Rachidi and Sharwan K. Tiwari (ePrint 2026/2586, approved 24 October 2026). It gives the first independent cryptanalysis of MSX, a lightweight block cipher family for microcontrollers. MSX uses modular addition and modular multiplication on 32-bit words. Its designers prove ideal strong differential and linear properties because the multiplication makes the round function a strongly universal hash. They did so with bounds and estimates, with no explicit trail.

How it works

The authors build two bit-level models of z = (x·y) mod 2^n.

• Monomial prediction under 3SDP-woU. The model assigns an exact parity to every monomial without a truth table.
• Impossible differentials. This is a deterministic truncated model for miss-in-the-middle search. The authors prove it is exact for two independent operands, so every incompatibility reported through a multiplication is genuine.

Both models are implemented in the CLAASP library and can be used on any included primitive that uses modular multiplication.

Results on MSX

• MSX-128 integral distinguisher: 7 rounds, data complexity 2^96. A 96-bit cube leaves 64 of the 128 output bits balanced.
• Key recovery: 8 and 9 of 18 rounds, recovering the 256-bit master key in about 2^228 operations. The authors say this improves on the designers' generic yoyo key recovery on seven rounds.
• Impossible differentials: a search over all 16,384 single-bit input/output pairs at each round count found 1,984 at seven rounds and none at eight.

Caveats

• Cost is about 2^228 against a 256-bit key, and the attacks reach at most 9 of 18 rounds. The abstract gives no sign that the full cipher is threatened.
• The exactness proof covers independent operands only. The abstract does not say what happens when the multiplication operands are correlated.
• The impossible-differential search covered single-bit pairs only, so the "none at eight rounds" result does not rule out other differentials.
• The page is an unrefereed preprint, and the abstract does not give the 8-round and 9-round complexities separately.