#
# first round 
#

# The first column is different in both messages....

X'_1[0,0] + 02*S(P'[0,0]) + 03*S(P[1,1]) + S(P[2,2]) + S(P[3,3])
X'_1[1,0] + S(P'[0,0]) + 02*S(P[1,1]) + 03*S(P[2,2]) + S(P[3,3])
X'_1[2,0] + S(P'[0,0]) + S(P[1,1]) + 02*S(P[2,2]) + 03*S(P[3,3])
X'_1[3,0] + 03*S(P'[0,0]) + S(P[1,1]) + S(P[2,2]) + 02*S(P[3,3])

X_1[0,0] + 02*S(P[0,0]) + 03*S(P[1,1]) + S(P[2,2]) + S(P[3,3])
X_1[1,0] + S(P[0,0]) + 02*S(P[1,1]) + 03*S(P[2,2]) + S(P[3,3])
X_1[2,0] + S(P[0,0]) + S(P[1,1]) + 02*S(P[2,2]) + 03*S(P[3,3])
X_1[3,0] + 03*S(P[0,0]) + S(P[1,1]) + S(P[2,2]) + 02*S(P[3,3])

# while the 3 remaining columns are the same...  (so X'_1[.,j] = X_1[.,j], j=1,2,3)

X_1[0,1] + 02*S(P[0,1]) + 03*S(P[1,2]) + S(P[2,3]) + S(P[3,0])
X_1[1,1] + S(P[0,1]) + 02*S(P[1,2]) + 03*S(P[2,3]) + S(P[3,0])
X_1[2,1] + S(P[0,1]) + S(P[1,2]) + 02*S(P[2,3]) + 03*S(P[3,0])
X_1[3,1] + 03*S(P[0,1]) + S(P[1,2]) + S(P[2,3]) + 02*S(P[3,0])

X_1[0,2] + 02*S(P[0,2]) + 03*S(P[1,3]) + S(P[2,0]) + S(P[3,1])
X_1[1,2] + S(P[0,2]) + 02*S(P[1,3]) + 03*S(P[2,0]) + S(P[3,1])
X_1[2,2] + S(P[0,2]) + S(P[1,3]) + 02*S(P[2,0]) + 03*S(P[3,1])
X_1[3,2] + 03*S(P[0,2]) + S(P[1,3]) + S(P[2,0]) + 02*S(P[3,1])

X_1[0,3] + 02*S(P[0,3]) + 03*S(P[1,0]) + S(P[2,1]) + S(P[3,2])
X_1[1,3] + S(P[0,3]) + 02*S(P[1,0]) + 03*S(P[2,1]) + S(P[3,2])
X_1[2,3] + S(P[0,3]) + S(P[1,0]) + 02*S(P[2,1]) + 03*S(P[3,2])
X_1[3,3] + 03*S(P[0,3]) + S(P[1,0]) + S(P[2,1]) + 02*S(P[3,2])



#
# first message, round 2
#

X_2[0,0] + 02*S(X_1[0,0]) + 03*S(X_1[1,1]) + S(X_1[2,2]) + S(X_1[3,3])
X_2[0,1] + 02*S(X_1[0,1]) + 03*S(X_1[1,2]) + S(X_1[2,3]) + S(X_1[3,0])
X_2[0,2] + 02*S(X_1[0,2]) + 03*S(X_1[1,3]) + S(X_1[2,0]) + S(X_1[3,1])
X_2[0,3] + 02*S(X_1[0,3]) + 03*S(X_1[1,0]) + S(X_1[2,1]) + S(X_1[3,2])
X_2[1,0] + S(X_1[0,0]) + 02*S(X_1[1,1]) + 03*S(X_1[2,2]) + S(X_1[3,3])
X_2[1,1] + S(X_1[0,1]) + 02*S(X_1[1,2]) + 03*S(X_1[2,3]) + S(X_1[3,0])
X_2[1,2] + S(X_1[0,2]) + 02*S(X_1[1,3]) + 03*S(X_1[2,0]) + S(X_1[3,1])
X_2[1,3] + S(X_1[0,3]) + 02*S(X_1[1,0]) + 03*S(X_1[2,1]) + S(X_1[3,2])
X_2[2,0] + S(X_1[0,0]) + S(X_1[1,1]) + 02*S(X_1[2,2]) + 03*S(X_1[3,3])
X_2[2,1] + S(X_1[0,1]) + S(X_1[1,2]) + 02*S(X_1[2,3]) + 03*S(X_1[3,0])
X_2[2,2] + S(X_1[0,2]) + S(X_1[1,3]) + 02*S(X_1[2,0]) + 03*S(X_1[3,1])
X_2[2,3] + S(X_1[0,3]) + S(X_1[1,0]) + 02*S(X_1[2,1]) + 03*S(X_1[3,2])
X_2[3,0] + 03*S(X_1[0,0]) + S(X_1[1,1]) + S(X_1[2,2]) + 02*S(X_1[3,3])
X_2[3,1] + 03*S(X_1[0,1]) + S(X_1[1,2]) + S(X_1[2,3]) + 02*S(X_1[3,0])
X_2[3,2] + 03*S(X_1[0,2]) + S(X_1[1,3]) + S(X_1[2,0]) + 02*S(X_1[3,1])
X_2[3,3] + 03*S(X_1[0,3]) + S(X_1[1,0]) + S(X_1[2,1]) + 02*S(X_1[3,2])


#
# second message , round 2
#

X'_2[0,0] + 02*S(X'_1[0,0]) + 03*S(X_1[1,1]) + S(X_1[2,2]) + S(X_1[3,3])
X'_2[0,1] + 02*S(X_1[0,1]) + 03*S(X_1[1,2]) + S(X_1[2,3]) + S(X'_1[3,0])
X'_2[0,2] + 02*S(X_1[0,2]) + 03*S(X_1[1,3]) + S(X'_1[2,0]) + S(X_1[3,1])
X'_2[0,3] + 02*S(X_1[0,3]) + 03*S(X'_1[1,0]) + S(X_1[2,1]) + S(X_1[3,2])
X'_2[1,0] + S(X'_1[0,0]) + 02*S(X_1[1,1]) + 03*S(X_1[2,2]) + S(X_1[3,3])
X'_2[1,1] + S(X_1[0,1]) + 02*S(X_1[1,2]) + 03*S(X_1[2,3]) + S(X'_1[3,0])
X'_2[1,2] + S(X_1[0,2]) + 02*S(X_1[1,3]) + 03*S(X'_1[2,0]) + S(X_1[3,1])
X'_2[1,3] + S(X_1[0,3]) + 02*S(X'_1[1,0]) + 03*S(X_1[2,1]) + S(X_1[3,2])
X'_2[2,0] + S(X'_1[0,0]) + S(X_1[1,1]) + 02*S(X_1[2,2]) + 03*S(X_1[3,3])
X'_2[2,1] + S(X_1[0,1]) + S(X_1[1,2]) + 02*S(X_1[2,3]) + 03*S(X'_1[3,0])
X'_2[2,2] + S(X_1[0,2]) + S(X_1[1,3]) + 02*S(X'_1[2,0]) + 03*S(X_1[3,1])
X'_2[2,3] + S(X_1[0,3]) + S(X'_1[1,0]) + 02*S(X_1[2,1]) + 03*S(X_1[3,2])
X'_2[3,0] + 03*S(X'_1[0,0]) + S(X_1[1,1]) + S(X_1[2,2]) + 02*S(X_1[3,3])
X'_2[3,1] + 03*S(X_1[0,1]) + S(X_1[1,2]) + S(X_1[2,3]) + 02*S(X'_1[3,0])
X'_2[3,2] + 03*S(X_1[0,2]) + S(X_1[1,3]) + S(X'_1[2,0]) + 02*S(X_1[3,1])
X'_2[3,3] + 03*S(X_1[0,3]) + S(X'_1[1,0]) + S(X_1[2,1]) + 02*S(X_1[3,2])

#
# first message, round 3
#

X_3[0,0] + 02*S(X_2[0,0]) + 03*S(X_2[1,1]) + S(X_2[2,2]) + S(X_2[3,3])
X_3[0,1] + 02*S(X_2[0,1]) + 03*S(X_2[1,2]) + S(X_2[2,3]) + S(X_2[3,0])
X_3[0,2] + 02*S(X_2[0,2]) + 03*S(X_2[1,3]) + S(X_2[2,0]) + S(X_2[3,1])
X_3[0,3] + 02*S(X_2[0,3]) + 03*S(X_2[1,0]) + S(X_2[2,1]) + S(X_2[3,2])
X_3[1,0] + S(X_2[0,0]) + 02*S(X_2[1,1]) + 03*S(X_2[2,2]) + S(X_2[3,3])
X_3[1,1] + S(X_2[0,1]) + 02*S(X_2[1,2]) + 03*S(X_2[2,3]) + S(X_2[3,0])
X_3[1,2] + S(X_2[0,2]) + 02*S(X_2[1,3]) + 03*S(X_2[2,0]) + S(X_2[3,1])
X_3[1,3] + S(X_2[0,3]) + 02*S(X_2[1,0]) + 03*S(X_2[2,1]) + S(X_2[3,2])
X_3[2,0] + S(X_2[0,0]) + S(X_2[1,1]) + 02*S(X_2[2,2]) + 03*S(X_2[3,3])
X_3[2,1] + S(X_2[0,1]) + S(X_2[1,2]) + 02*S(X_2[2,3]) + 03*S(X_2[3,0])
X_3[2,2] + S(X_2[0,2]) + S(X_2[1,3]) + 02*S(X_2[2,0]) + 03*S(X_2[3,1])
X_3[2,3] + S(X_2[0,3]) + S(X_2[1,0]) + 02*S(X_2[2,1]) + 03*S(X_2[3,2])
X_3[3,0] + 03*S(X_2[0,0]) + S(X_2[1,1]) + S(X_2[2,2]) + 02*S(X_2[3,3])
X_3[3,1] + 03*S(X_2[0,1]) + S(X_2[1,2]) + S(X_2[2,3]) + 02*S(X_2[3,0])
X_3[3,2] + 03*S(X_2[0,2]) + S(X_2[1,3]) + S(X_2[2,0]) + 02*S(X_2[3,1])
X_3[3,3] + 03*S(X_2[0,3]) + S(X_2[1,0]) + S(X_2[2,1]) + 02*S(X_2[3,2])


#
# second message , round 3
#

X'_3[0,0] + 02*S(X'_2[0,0]) + 03*S(X'_2[1,1]) + S(X'_2[2,2]) + S(X'_2[3,3])
X'_3[0,1] + 02*S(X'_2[0,1]) + 03*S(X'_2[1,2]) + S(X'_2[2,3]) + S(X'_2[3,0])
X'_3[0,2] + 02*S(X'_2[0,2]) + 03*S(X'_2[1,3]) + S(X'_2[2,0]) + S(X'_2[3,1])
X'_3[0,3] + 02*S(X'_2[0,3]) + 03*S(X'_2[1,0]) + S(X'_2[2,1]) + S(X'_2[3,2])
X'_3[1,0] + S(X'_2[0,0]) + 02*S(X'_2[1,1]) + 03*S(X'_2[2,2]) + S(X'_2[3,3])
X'_3[1,1] + S(X'_2[0,1]) + 02*S(X'_2[1,2]) + 03*S(X'_2[2,3]) + S(X'_2[3,0])
X'_3[1,2] + S(X'_2[0,2]) + 02*S(X'_2[1,3]) + 03*S(X'_2[2,0]) + S(X'_2[3,1])
X'_3[1,3] + S(X'_2[0,3]) + 02*S(X'_2[1,0]) + 03*S(X'_2[2,1]) + S(X'_2[3,2])
X'_3[2,0] + S(X'_2[0,0]) + S(X'_2[1,1]) + 02*S(X'_2[2,2]) + 03*S(X'_2[3,3])
X'_3[2,1] + S(X'_2[0,1]) + S(X'_2[1,2]) + 02*S(X'_2[2,3]) + 03*S(X'_2[3,0])
X'_3[2,2] + S(X'_2[0,2]) + S(X'_2[1,3]) + 02*S(X'_2[2,0]) + 03*S(X'_2[3,1])
X'_3[2,3] + S(X'_2[0,3]) + S(X'_2[1,0]) + 02*S(X'_2[2,1]) + 03*S(X'_2[3,2])
X'_3[3,0] + 03*S(X'_2[0,0]) + S(X'_2[1,1]) + S(X'_2[2,2]) + 02*S(X'_2[3,3])
X'_3[3,1] + 03*S(X'_2[0,1]) + S(X'_2[1,2]) + S(X'_2[2,3]) + 02*S(X'_2[3,0])
X'_3[3,2] + 03*S(X'_2[0,2]) + S(X'_2[1,3]) + S(X'_2[2,0]) + 02*S(X'_2[3,1])
X'_3[3,3] + 03*S(X'_2[0,3]) + S(X'_2[1,0]) + S(X'_2[2,1]) + 02*S(X'_2[3,2])

#
# first message, round 4
#

X_4[0,0] + 02*S(X_3[0,0]) + 03*S(X_3[1,1]) + S(X_3[2,2]) + S(X_3[3,3])
X_4[0,1] + 02*S(X_3[0,1]) + 03*S(X_3[1,2]) + S(X_3[2,3]) + S(X_3[3,0])
X_4[0,2] + 02*S(X_3[0,2]) + 03*S(X_3[1,3]) + S(X_3[2,0]) + S(X_3[3,1])
X_4[0,3] + 02*S(X_3[0,3]) + 03*S(X_3[1,0]) + S(X_3[2,1]) + S(X_3[3,2])
X_4[1,0] + S(X_3[0,0]) + 02*S(X_3[1,1]) + 03*S(X_3[2,2]) + S(X_3[3,3])
X_4[1,1] + S(X_3[0,1]) + 02*S(X_3[1,2]) + 03*S(X_3[2,3]) + S(X_3[3,0])
X_4[1,2] + S(X_3[0,2]) + 02*S(X_3[1,3]) + 03*S(X_3[2,0]) + S(X_3[3,1])
X_4[1,3] + S(X_3[0,3]) + 02*S(X_3[1,0]) + 03*S(X_3[2,1]) + S(X_3[3,2])
X_4[2,0] + S(X_3[0,0]) + S(X_3[1,1]) + 02*S(X_3[2,2]) + 03*S(X_3[3,3])
X_4[2,1] + S(X_3[0,1]) + S(X_3[1,2]) + 02*S(X_3[2,3]) + 03*S(X_3[3,0])
X_4[2,2] + S(X_3[0,2]) + S(X_3[1,3]) + 02*S(X_3[2,0]) + 03*S(X_3[3,1])
X_4[2,3] + S(X_3[0,3]) + S(X_3[1,0]) + 02*S(X_3[2,1]) + 03*S(X_3[3,2])
X_4[3,0] + 03*S(X_3[0,0]) + S(X_3[1,1]) + S(X_3[2,2]) + 02*S(X_3[3,3])
X_4[3,1] + 03*S(X_3[0,1]) + S(X_3[1,2]) + S(X_3[2,3]) + 02*S(X_3[3,0])
X_4[3,2] + 03*S(X_3[0,2]) + S(X_3[1,3]) + S(X_3[2,0]) + 02*S(X_3[3,1])
X_4[3,3] + 03*S(X_3[0,3]) + S(X_3[1,0]) + S(X_3[2,1]) + 02*S(X_3[3,2])

#
# second message , round 4
#

X'_4[0,0] + 02*S(X'_3[0,0]) + 03*S(X'_3[1,1]) + S(X'_3[2,2]) + S(X'_3[3,3])
X'_4[0,1] + 02*S(X'_3[0,1]) + 03*S(X'_3[1,2]) + S(X'_3[2,3]) + S(X'_3[3,0])
X'_4[0,2] + 02*S(X'_3[0,2]) + 03*S(X'_3[1,3]) + S(X'_3[2,0]) + S(X'_3[3,1])
X'_4[0,3] + 02*S(X'_3[0,3]) + 03*S(X'_3[1,0]) + S(X'_3[2,1]) + S(X'_3[3,2])
X'_4[1,0] + S(X'_3[0,0]) + 02*S(X'_3[1,1]) + 03*S(X'_3[2,2]) + S(X'_3[3,3])
X'_4[1,1] + S(X'_3[0,1]) + 02*S(X'_3[1,2]) + 03*S(X'_3[2,3]) + S(X'_3[3,0])
X'_4[1,2] + S(X'_3[0,2]) + 02*S(X'_3[1,3]) + 03*S(X'_3[2,0]) + S(X'_3[3,1])
X'_4[1,3] + S(X'_3[0,3]) + 02*S(X'_3[1,0]) + 03*S(X'_3[2,1]) + S(X'_3[3,2])
X'_4[2,0] + S(X'_3[0,0]) + S(X'_3[1,1]) + 02*S(X'_3[2,2]) + 03*S(X'_3[3,3])
X'_4[2,1] + S(X'_3[0,1]) + S(X'_3[1,2]) + 02*S(X'_3[2,3]) + 03*S(X'_3[3,0])
X'_4[2,2] + S(X'_3[0,2]) + S(X'_3[1,3]) + 02*S(X'_3[2,0]) + 03*S(X'_3[3,1])
X'_4[2,3] + S(X'_3[0,3]) + S(X'_3[1,0]) + 02*S(X'_3[2,1]) + 03*S(X'_3[3,2])
X'_4[3,0] + 03*S(X'_3[0,0]) + S(X'_3[1,1]) + S(X'_3[2,2]) + 02*S(X'_3[3,3])
X'_4[3,1] + 03*S(X'_3[0,1]) + S(X'_3[1,2]) + S(X'_3[2,3]) + 02*S(X'_3[3,0])
X'_4[3,2] + 03*S(X'_3[0,2]) + S(X'_3[1,3]) + S(X'_3[2,0]) + 02*S(X'_3[3,1])
X'_4[3,3] + 03*S(X'_3[0,3]) + S(X'_3[1,0]) + S(X'_3[2,1]) + 02*S(X'_3[3,2])


#
# Known input difference : only in one byte
#

P[0,0] +  P'[0,0] + alpha

#
# Known output difference : everywhere
#
X'_4[0,0] + X_4[0,0] + Delta_o[0,0]
X'_4[0,1] + X_4[0,1] + Delta_o[0,1]
X'_4[0,2] + X_4[0,2] + Delta_o[0,2]
X'_4[0,3] + X_4[0,3] + Delta_o[0,3]
X'_4[1,0] + X_4[1,0] + Delta_o[1,0]
X'_4[1,1] + X_4[1,1] + Delta_o[1,1]
X'_4[1,2] + X_4[1,2] + Delta_o[1,2]
X'_4[1,3] + X_4[1,3] + Delta_o[1,3]
X'_4[2,0] + X_4[2,0] + Delta_o[2,0]
X'_4[2,1] + X_4[2,1] + Delta_o[2,1]
X'_4[2,2] + X_4[2,2] + Delta_o[2,2]
X'_4[2,3] + X_4[2,3] + Delta_o[2,3]
X'_4[3,0] + X_4[3,0] + Delta_o[3,0]
X'_4[3,1] + X_4[3,1] + Delta_o[3,1]
X'_4[3,2] + X_4[3,2] + Delta_o[3,2]
X'_4[3,3] + X_4[3,3] + Delta_o[3,3]

#guess1 + X_2[1,1] + X'_2[1,1]
#guess2 + 09*X_3[2,2] + 0d*X_3[1,2]
#guess3 + 09*X'_3[2,2] + 0d*X'_3[1,2]
guess4 + X_2[0,0] + X'_2[0,0]
#guess5 + X_2[2,2] + X'_2[2,2]
#guess6 + X_2[3,3] + X'_2[3,3]
#guess7 + X_3[2,2] + X'_3[2,2]
#guess8 + X_3[1,2] + X'_3[1,2]

=======================================================
#Known variables

#guess1
#guess2
#guess3
guess4
#guess5
#guess6
#guess7
#guess8
alpha 
Delta_o[0,0]
Delta_o[0,1]
Delta_o[0,2]
Delta_o[0,3]
Delta_o[1,0]
Delta_o[1,1]
Delta_o[1,2]
Delta_o[1,3]
Delta_o[2,0]
Delta_o[2,1]
Delta_o[2,2]
Delta_o[2,3]
Delta_o[3,0]
Delta_o[3,1]
Delta_o[3,2]
Delta_o[3,3]
