Paper 2026/2586

Modeling Modular Multiplication for Monomial Prediction and Impossible Differentials, with Application to MSX

Abstract

MSX is a recent family of lightweight block ciphers for microcontrollers, and its round function draws nonlinearity from modular addition and modular multiplication on $32$-bit words. The multiplication is the distinctive part of the design because it turns the round function into a strongly universal hash function, and from this, the designers prove ideal strong differential and linear properties. The same operation also kept MSX out of reach of automated cryptanalysis, since no exact bit-level model of a modular multiplication was available. We give two such models for $z=(x\cdot y)\bmod 2^n$. Both work at the bit level and, to the best of our knowledge, both are new. The first is for monomial prediction under the three-subset division property without an unknown subset (3SDP-woU), and it assigns an exact parity to every monomial without using a truth table. The second is a deterministic truncated model for impossible differential search, and we prove that it is not merely sound but exact for two independent operands, so every incompatibility a miss-in-the-middle search reports through a multiplication is genuine. Both properties are deterministic, so our results are exact, whereas the designers' own analysis provides bounds and estimates, with no explicit trail. Using the two models, we analyze MSX. As far as we know, this is its first independent cryptanalysis. For MSX-128 we obtain a $7$-round deterministic integral distinguisher of data complexity $2^{96}$, where a $96$-bit cube leaves $64$ of the $128$ output bits balanced, and we extend it to key recoveries on $8$ and $9$ of the $18$ rounds that recover the $256$-bit master key in about $2^{228}$ operations, improving over the MSX designers' generic yoyo key recovery attack on seven rounds. Searching all $16,384$ single-bit pairs at each round count, we also find $1,984$ impossible differentials at seven rounds and none at eight. Both models are implemented in the CLAASP library, so they can be used on any included primitive that uses modular multiplication.