Security of the SMS4 Block Cipher Against Differential Cryptanalysis

SMS4 is a 128-bit block cipher used in the WAPI standard for wireless networks in China. In this paper, we analyze the security of the SMS4 block cipher against differential cryptanalysis. Firstly, we prove three theorems and one corollary that reflect relationships of 5- and 6-round SMS4. Next, by these relationships, we clarify the minimum number of active S-boxes in 6-, 7- and 12-round SMS4 respectively. Finally, based on the above results, we present a family of about 2¹⁴ differential characteristics for 19-round SMS4, which leads to an attack on 23-round SMS4 with 2¹¹⁸ chosen plaintexts and 2^126.7 encryptions.