Attacking Reduced-Round Versions of the SMS4 Block Cipher in the Chinese WAPI Standard

Abstract

DOI to the publisher's website. • The final author version and the galley proof are versions of the publication after peer review. • The final published version features the final layout of the paper including the volume, issue and page numbers. Link to publication General rights Copyright and moral rights for the publications made accessible in the public portal are retained by the authors and/or other copyright owners and it is a condition of accessing publications that users recognise and abide by the legal requirements associated with these rights. • Users may download and print one copy of any publication from the public portal for the purpose of private study or research. • You may not further distribute the material or use it for any profit-making activity or commercial gain • You may freely distribute the URL identifying the publication in the public portal. If the publication is distributed under the terms of Article 25fa of the Dutch Copyright Act, indicated by the "Taverne" license above, please follow below link for the End User Agreement:

Advanced Differential-Style Cryptanalysis of the NSA's Skipjack Block Cipher

“…2.2 we unify all previous works on boomerang-style distinguishers [63,32,6,57,7,8,48,37] and their related-key counterparts [36,25,38,9,10,22,53,29,35,64,46,47,49,50,23]. We highlight their similarities and differences for a better view of which attack variant is more suitable for a particular situation.…”

Improved Linear Attacks on the Chinese Block Cipher Standard

“…As a result, only the first column of M would be stored. Round 4 5 8 9 12 13 16 17 input b800e200 b800e200 b8e20000 b8e20000 00e2e200 00e2e200 b800e200 b800e200 output d3d33189 16009f6b 6bd3d389 aee29f6b d331d389 ae007d6b d3d33189 16009f6b input 00e200b8 00e200b8 e2e20000 e2e20000 e20000b8 e20000b8 00e200b8 00e200b8 output 009f6b16 d33189d3 007d6bae 31d389d3 e29f6bae d3d3896b 009f6b16 d33189d3 input b800e200 b800e200 00e2e200 00e2e200 b8e20000 b8e20000 b800e200 b800e200 output 16009f6b d3d33189 ae007d6b d331d389 aee29f6b 6bd3d389 16009f6b d3d33189 input 00b800e2 00b800e2 00b8e200 00b8e200 0000e2e2 0000e2e2 00b800e2 00b800e2 output 89d3d331 6b16009f 896bd3d3 6baee29f 89d331d3 6bae007d 89d3d331 6b16009f input e200b800 e200b800 e20000e2 e20000e2 0000b8e2 0000b8e2 e200b800 e200b800 output 9f6b1600 3189d3d3 7d6bae00 d389d331 9f6baee2 d3896bd3 9f6b1600 3189d3d3 input 00e200b8 00e200b8 e20000b8 e20000b8 e2e20000 e2e20000 00e200b8 00e200b8 output d33189d3 009f6b16 d3d3896b e29f6bae 31d389d3 007d6bae d33189d3 009f6b16 input e200b800 e200b800 0000b8e2 0000b8e2 e20000e2 e20000e2 e200b800 e200b800 output 3189d3d3 9f6b1600 d3896bd3 9f6baee2 d389d331 7d6bae00 3189d3d3 9f6b1600 input 00b800e2 00b800e2 0000e2e2 0000e2e2 00b8e200 00b8e200 00b800e2 00b800e2 output 6b16009f 89d3d331 6bae007d 89d331d3 6baee29f 896bd3d3 6b16009f 89d3d331 20 ) and insert (−1) g to the corresponding row of the first column of M . 6.…”

Impossible Boomerang Attack for Block Cipher Structures

“…For example, for SMS4, a 12-round impossible differential characteristic was published in [6], formed by combining two 6-round differentials. Our results, however, give a definite lower bound for the number of rounds that can be attacked with an impossible differential or impossible boomerang distinguisher.…”