Cryptanalysis Of A Type Of White-Box Implementations Of The SM4 Block Cipher.

This article focuses on the security analysis of a class of white-box implementations of the SM4 block cipher, a Chinese national and ISO international standard. These implementations employ linear or affine diagonal block encodings to protect the three 32-bit branches entering each round function and use the inverse encoding at the S-box layer. Through small-scale experiments, the authors find that these white-box SM4 constructions generally resist Lepoint et al.'s collision-based attack method, as the rank of the associated linear systems is significantly less than the number of unknowns. However, it remains an open problem whether certain encodings exist that yield a rank just below the number of unknowns, which would enable practical collision-based attacks to recover round keys or simplify the implementation to mainly Boolean masks. The analysis suggests that affine encodings offer better security against such attacks than linear encodings and that white-box tables with one or two S-boxes are acceptable, contrasting with findings in white-box AES implementations.