# Chosen Plaintext Combined Attack against SM4 Algorithm
## 3 Methodologies
### Round Reduction-Based Chosen Plaintext on SM4  
Step 1: Chosen plaintext  
For N encryption operations, the plaintext input in each encryption operation must meet the requirement that \(X_{0}\) is a random value and \(X_{1}\oplus X_{2}\oplus X_{3}=M_{0}\) (\(M_{0}\) is a fixed value). That is, the first four bytes of plaintext grouping in each encryption operation are random, and the last 12 bytes are divided into three groups, and the XOR result is fixed. According to the round operation of SM4, the round input \(A_{1}\)\(=\)\((a_{0,1},a_{1,1},a_{2,1},a_{3,1})\) and round output of the first round meet the following conditions:  
\[A_{1}=M_{0}\oplus rk_{0} \tag{4}\]  
\[X_{4}=X_{0}\oplus T(A_{1}) \tag{5}\]  
For the second round iteration, it can be obtained that the round input \(A_{2}=(a_{0,2},a_{1,2},\)\(a_{2,2},a_{3,2})\) and the S-box output \(B_{2}\) of the second round meet the following conditions:  
\[A_{2}=X_{2}\oplus X_{3}\oplus X_{0}\oplus T(A_{1})\oplus rk_{1} \tag{6}\]  
\[B_{2}=\tau(A_{2}) \tag{7}\]  
Step 2: Power analysis  
Let \(V_{1}=T(A_{1})\oplus rk_{1}\), then \(V_{1}\) is a fixed value. The output \(B_{2}\) of S-box in the second round of N group encryption operation is selected as the attack object (intermediate value) to conduct CPA (where the value of N, that is, the number of encryption operations, should make CPA analysis successful). The value of \(V_{1}\) can be obtained, and then the equation for \(rk_{0}\) and \(rk_{1}\) is expressed as follows. \[V_{1}=T(M_{0}\oplus rk_{0})\oplus rk_{1} \tag{8}\]  
Since there are two unknowns in \(V_{1}\), the key byte cannot be determined. Step 3: Repeat steps 1 and 2 twice. 1. Repeat for the first time. Reselect \(N\) groups of plaintext for encryption, input plaintext such that \(X_{0}^{\prime}\) (the first 4 bytes of plaintext) is a random value,\({M_{0}}^{\prime}({M_{0}}^{\prime}=X_{1}^{\prime}\oplus X_{2}^{\prime}\oplus X_{3}^{ \prime}\)) is still fixed and \({M_{0}}^{\prime}\
eq M_{0}\). Let the S-box input of round 1 and round 2 be \(A_{1}^{\prime}\) (\({A_{1}}^{\prime}=({a^{\prime}}_{0,1},{a^{\prime}}_{1,1},{a^{\prime}}_{2,1},{a^{ \prime}}_{3,1})\)) and \(A_{2}^{\prime}\), \(X_{4}^{\prime}\) be the round output of round 1, \(B_{2}^{\prime}\) be the round output of round 2 S-box, then  
\[A_{1}^{\prime}={M_{0}}^{\prime}\oplus rk_{0} \tag{9}\]  
\[X_{4}^{\prime}=X_{0}^{\prime}\oplus T(A_{1}^{\prime}) \tag{10}\]  
\[A_{2}^{\prime}=X_{2}^{\prime}\oplus X_{3}^{\prime}\oplus X_{0}^{\prime}\oplus T (A_{1}^{\prime})\oplus rk_{1} \tag{11}\]  
\[B_{2}^{\prime}=\tau(A_{2}^{\prime}) \tag{12}\]  
Let \(V_{2}=T(A_{1}^{\prime})\oplus rk_{1}\) (a fixed value) and \(X_{2}^{\prime}\oplus X_{3}^{\prime}\oplus X_{0}^{\prime}\) be a random known value, select the output of S-box as the attack object, and conduct CPA on the above N groups of data to recover the value of \(V_{2}\). Repeat for the second time. Similarly, the following formula can be obtained by choosing the plaintext input:  
\[A_{1}^{\prime\prime}={M_{0}}^{\prime\prime}\oplus rk_{0} \tag{13}\]  
\[X_{4}=X_{0}\oplus T(A_{1}) \tag{5}\]0  
\[X_{4}=X_{0}\oplus T(A_{1}) \tag{5}\]1  
\[X_{4}=X_{0}\oplus T(A_{1}) \tag{5}\]2  
where \({M_{0}}^{\prime\prime}({M_{0}}^{\prime\prime}=X_{1}^{\prime\prime}\oplus X_{2 }^{\prime\prime}\oplus X_{3}^{\prime\prime})\) is still fixed and \({M_{0}}^{\prime\prime}\
eq{M_{0}}^{\prime}\
eq M_{0}\). \(A_{1}^{\prime\prime}\) and \(A_{2}^{\prime\prime}\) are the input values of S-box in round 1 and round 2, and \(B_{2}^{\prime}\) is the output of S-box in round 2. Then \(V_{3}=T({M_{0}}^{\prime\prime}\oplus rk_{0})\oplus rk_{1}\) can be recovered by chosen plaintext CPA. To sum up, three equations about \(rk_{0}\) and \(rk_{1}\) can be obtained by collecting different plaintext inputs for the chosen plaintext power analysis. \[\left\{ \begin{array}{l}V_{1}=T(M_{0}\oplus rk_{0})\oplus rk_{1}\\ V_{2}=T(M_{0}^{\prime}\oplus rk_{0})\oplus rk_{1}\\ V_{3}=T(M_{0}^{\prime\prime}\oplus rk_{0})\oplus rk_{1}\end{array} \right. \tag{17}\]