对18轮SMS4的改进矩形攻击

SMS4 is a 32-round block cipher with 128-bit block size and 128-bit secret key. It is used in WAPI, the Chinese WLAN national standard. This paper analyzes the security of SMS4 against the rectangle attack. First, this paper describes two properties of SMS4. Next, it proposes the 16-round rectangle distinguisher with probability 2^-250. Finally, the rectangle attack is then carried out on 18-round SMS4 with 2^127 chosen plaintexts and the time complexity is 2^103.83 18-round encryptions. In this process a hash table is used to reduce the time complexity. This attack is the best rectangle attack on SMS4 so far.