Known-Key Attack on SM4 Block Cipher

HyungChul KANG; Deukjo HONG; Jaechul SUNG; Seokhie HONG

doi:10.1587/transfun.E100.A.2985

Known-Key Attack on SM4 Block Cipher

HyungChul KANG, Deukjo HONG, Jaechul SUNG, Seokhie HONG

Full Text Views

0

Cite this

Summary :

We present the first known-key attack on SM4, which is the Chinese standard block cipher made for the wireless LAN WAPI. We make a known-key distinguisher using rebound techniques with the time complexity of 2^12.75. Then, with the distinguisher, we provide near-collision attacks on MMO and MP hash modes of SM4. Precisely, we find a 104-bit near-collision for 13 rounds of SM4 with the time complexity of 2^13.30 and a 32-bit near-collision for 17 rounds of SM4 with the time complexity of 2^12.91. They are much more efficient than generic attacks for the case of random permutation.

Publication: IEICE TRANSACTIONS on Fundamentals Vol.E100-A No.12 pp.2985-2990

Publication Date: 2017/12/01

Publicized

Online ISSN: 1745-1337

DOI: 10.1587/transfun.E100.A.2985

Type of Manuscript: PAPER

Category: Cryptography and Information Security

Authors

HyungChul KANG
  Korea University
Deukjo HONG
  Chonbuk National University
Jaechul SUNG
  University of Seoul
Seokhie HONG
  Korea University

Keyword

SM4 block cipher, known-key distinguisher, collision attack

Cite this

Copy

HyungChul KANG, Deukjo HONG, Jaechul SUNG, Seokhie HONG, "Known-Key Attack on SM4 Block Cipher" in IEICE TRANSACTIONS on Fundamentals, vol. E100-A, no. 12, pp. 2985-2990, December 2017, doi: 10.1587/transfun.E100.A.2985.
Abstract: We present the first known-key attack on SM4, which is the Chinese standard block cipher made for the wireless LAN WAPI. We make a known-key distinguisher using rebound techniques with the time complexity of 2^12.75. Then, with the distinguisher, we provide near-collision attacks on MMO and MP hash modes of SM4. Precisely, we find a 104-bit near-collision for 13 rounds of SM4 with the time complexity of 2^13.30 and a 32-bit near-collision for 17 rounds of SM4 with the time complexity of 2^12.91. They are much more efficient than generic attacks for the case of random permutation.
URL: https://global.ieice.org/en_transactions/fundamentals/10.1587/transfun.E100.A.2985/_p

Copy

@ARTICLE{e100-a_12_2985,
author={HyungChul KANG, Deukjo HONG, Jaechul SUNG, Seokhie HONG, },
journal={IEICE TRANSACTIONS on Fundamentals},
title={Known-Key Attack on SM4 Block Cipher},
year={2017},
volume={E100-A},
number={12},
pages={2985-2990},
abstract={We present the first known-key attack on SM4, which is the Chinese standard block cipher made for the wireless LAN WAPI. We make a known-key distinguisher using rebound techniques with the time complexity of 2^12.75. Then, with the distinguisher, we provide near-collision attacks on MMO and MP hash modes of SM4. Precisely, we find a 104-bit near-collision for 13 rounds of SM4 with the time complexity of 2^13.30 and a 32-bit near-collision for 17 rounds of SM4 with the time complexity of 2^12.91. They are much more efficient than generic attacks for the case of random permutation.},
keywords={},
doi={10.1587/transfun.E100.A.2985},
ISSN={1745-1337},
month={December},}

Copy

TY - JOUR
TI - Known-Key Attack on SM4 Block Cipher
T2 - IEICE TRANSACTIONS on Fundamentals
SP - 2985
EP - 2990
AU - HyungChul KANG
AU - Deukjo HONG
AU - Jaechul SUNG
AU - Seokhie HONG
PY - 2017
DO - 10.1587/transfun.E100.A.2985
JO - IEICE TRANSACTIONS on Fundamentals
SN - 1745-1337
VL - E100-A
IS - 12
JA - IEICE TRANSACTIONS on Fundamentals
Y1 - December 2017
AB - We present the first known-key attack on SM4, which is the Chinese standard block cipher made for the wireless LAN WAPI. We make a known-key distinguisher using rebound techniques with the time complexity of 2^12.75. Then, with the distinguisher, we provide near-collision attacks on MMO and MP hash modes of SM4. Precisely, we find a 104-bit near-collision for 13 rounds of SM4 with the time complexity of 2^13.30 and a 32-bit near-collision for 17 rounds of SM4 with the time complexity of 2^12.91. They are much more efficient than generic attacks for the case of random permutation.
ER -