Multiple Linear Cryptanalysis of Reduced-Round SMS4 Block Cipher  

作　　者：LIU Zhiqiang GU Dawu ZHANG Jing 

机构地区：[1]Department of Computer Science and Engineering, Shanghai Jiaotong University, Shanghai 200240, China

出　　处：《Chinese Journal of Electronics》2010年第3期389-393,共5页电子学报（英文版）

基　　金：This work is supported by the National Natural Science Foundation of China （No.60573031）.

摘　　要：SMS4 is a 32-round block cipher with 128- bit block size and key size. It has been widely implemented in Chinese WLAN industry. In this papery we present a modified branch-and-bound algorithm which can be used for searching multiple linear characteristics for SMS4-1ike block ciphers. Furthermore, we find a series of 5-round iterative linear characteristics of SMS4. Then based on these 5-round iterative linear characteristics, a list of 18- round linear characteristics of SMS4 can be constructed. According to the framework of Biryukov et al from Crypto 2004, a key recovery attack can be mounted on 22-round SMS4 by utilizing the above 18-round linear characteristics. The data complexity of our attack is 2112 known plaintexts. Compared with the previously best cryptanalytic results on 22-round SMS4 （that is, the previously best cryptanalytic results on SMS4）, our result has much lower data complexity as well as comparable time complexity and memory complexity.

关 键 词：SMS4 Block cipher Linear characteristic Multiple linear cryptanalysis Branch-and-bound. 

分 类 号：TN918.1[电子电信—通信与信息系统] O221.1[电子电信—信息与通信工程]