Searching for Subspace Trails and Truncated Differentials

Grassi et al. [GRR16] introduced subspace trail cryptanalysis as a generalization of invariant subspaces and used it to give the first five round distinguisher for AEs. While it is a generic method, up to now it was only applied to the AEs and PRINCE. One problem for a broad adoption of the attack is a missing generic analysis algorithm.