Security Evaluation and Improvement of a White-Box SMS4 Implementation Based on Affine Equivalence Algorithm.

Tingting Lin,Hailun Yan,Xuejia Lai,Yixin Zhong,Yin Jia

DOI: https://doi.org/10.1093/comjnl/bxy068

2018-01-01

Abstract:The purpose of white-box implementation of a cipher is to protect the secret key of the cipher against a white-box attack, where the white-box adversary has full control over the execution environment and total visibility of internal details of the implementation. In 2015, Shi et al. proposed a lightweight white-box SMS4 implementation and claimed that the implementation is secure against known white-box attacks and known side-channel attacks. Based on the affine equivalence algorithm proposed by Biryukov et al., this paper presents an adjusted version of the affine equivalence algorithm and uses it as an attack against the white-box symmetric encryption algorithm proposed by Shi et al. With our attack, one byte of a round key of SMS4 can be recovered with worst time complexity of O(2(49)) and the full cipher key of SMS4 can be recovered with time complexity of O(2(53)). Moreover, we present a simple way to improve the white-box SMS4 implementation, which will make the time complexity of recovering one byte key increase to O(2(92)).