用不可能差分法分析17轮SMS4算法

Impossible differential attack on the 17-round block cipher SMS4

SMS4是我国在2006年公布的第一个商用分组密码算法.通过分析SMS4每一轮输入输出对的差分的变化,首次给出一个14轮SMS4的不可能差分特性:如果输入的明文对的差分为(a,a,a,0),那么14轮之后的输出差分不可能为(a,a,a,0).利用该性质,在14轮不可能差分密码分析的基础上,前面加了两轮,后面加了一轮,提出了一种不可能差分密码分析17轮SMS4的方法.该方法分析17轮SMS4需要2103的选择明文,2124的17轮SMS4加密以及289分组的记忆存储空间,猜测密钥的错误概率仅为2-88.7.

The SMS4 is the first commercial block cipher published by our government in 2006. By analyzing the changes of the difference between input and output pairs in each round, this paper first presents an impossible differential property for the 14-round SMS4 if the difference of the input plaintext pair is （a, a, a, 0）, it is impossible that the difference of 14-round output pair is （a, a, a, 0）. Based on this property, a new method is proposed for cryptanalyzing the 17-round SMS4, which is to add two rounds and one round to each end of the impossible differential cryptanalysis for the 14-round SMS4. This attack on the reduced 17-round SMS4 requires about 2^103 chosen plaintexts, performs 2^124 17-round SMS4 encryptions, and demands 2^89 words of memory. Furthermore, the probability of its failure to recover the secret key is only 2^- 88 7.