The Cryptanalysis of Reduced-Round SMS4

Abstract

In this paper we consider the cryptanalysis of the block cipher SMS4. The cipher has received much recent attention due its simplicity and prominence (it is used in wireless networks in China) and a range of differential attacks break up to 21 of the 32 rounds used in SMS4. Here we consider the application of linear cryptanalysis to the cipher and we demonstrate a simple attack on 22 rounds of SMS4. We also consider some advanced linear cryptanalytic techniques which, under the best conditions for the cryptanalyst, might (just) extend to 23 rounds.

New Linear Cryptanalysis of Chinese Commercial Block Cipher Standard SM4

“…Therefore, the key point is to search for the linear approximation of SM4. As far as we know, some methods to search for linear approximations of SM4 have been considered in [3,4,9,19]. The search method in [3] is to construct linear approximations for reduced-round SM4 by identifying a one-round linear approximation with the same input and output masks for the function.…”

“…In [3], the rectangle and boomerang attacks on 18-round SM4 and the linear and differential attacks on 22-round SM4 have been presented. Using multiple linear attack, Etrog and Robshaw gave an attack on 23-round SM4 in [4]. Besides these, the differential attack and the multiple linear attack on 22-round SM4 have been introduced in [5,6].…”

Improved Linear Attacks on the Chinese Block Cipher Standard

“…In this subsection, we propose a new method to search for the linear approximations of SMS4. The purpose of our method is to seek for the linear approximations with as few active S-boxes as possible, which results in non-iterative ones that are different from those in [5,10,17,19]. We use a two-step procedure to achieve this goal.…”

“…In Table 2, the fourth and the fifth columns stand for the output and input masks of the S-box layer, respectively; the sixth column indicates the bias of the round, the rest of the columns give the masks of the intermediate values. We learn from [10] that the piling-up lemma [21] works quite well for SMS4, so the bias of the linear approximation in Table 2 is about 2 −62.27 .…”

“…The linear attacks on SMS4 in [5,10,17,19] are all based on 18-round linear approximations whose fundamental parts are 5-round iterative linear approximations. The first contribution of this paper is proposing a new family of 19-round linear approximations with a different approach.…”