# Chosen Plaintext Combined Attack against SM4 Algorithm
###### Abstract  
The SM4 algorithm is widely used to ensure the security of data transmission. The traditional chosen plaintext power attacks against SM4 usually need to analyze four rounds power traces in turn to recover the secret key. In this paper, we propose a new combined chosen plaintext power analysis, which combines the chosen plaintext power attack and the differential characteristics of the substitution box (S-box) in SM4. In our attack, only the second and fourth round S-box outputs of SM4 algorithm are used as attack points, and some sensitive fixed intermediate values are obtained by power analysis when inputting specific plaintext. Then the differential analysis of these sensitive intermediate values is carried out to calculate the difference between the input and output of the S-box, and the key can be recovered from the differential characteristics of S-box. Compared with the traditional chosen plaintext power analysis, which requires four rounds of analysis, our analysis reduces the number of attack rounds into two rounds, and adopts the nonlinear S-box with obvious leakage information as the attack intermediate value, which effectively improves the feasibility of attack. Finally, a practical attack experiment is carried out on a Field Programmable Gate Array (FPGA) based implementation of SM4 algorithm, and the results show that our method is feasible and effective for real experiments. SM4; power analysis attack; differential cryptanalysis; combined attack +
Footnote †: journal: Applied Sciences  
output. With the fault output and the differential characteristics of S-box, the attacker can recover the secret key. After that, [PERSON] et al. conducted a traditional power analysis on SM4 algorithm [12]. They used the Hamming weight model to analyze the first four rounds of S-box output of SM4 encryption to obtain the round key, and then deduced the encryption key. The above study shows that, to recover the whole initial key, the attacker must analyze the first 4 rounds of encryption or the last 4 rounds of decryption of SM4 algorithm one by one. Moreover, the output of S-box as the only nonlinear operation is commonly chosen as the sensitive intermediate value. Just as introduced in [18], the power analysis with the leaked affine transformation included in S-box (i.e., the sensitive intermediate value) is almost the most powerful under the Gaussian noise assumption. There also exist other attacks based on different known conditions, such as unknown plaintext attack and chosen plaintext attack. When the general S-box has low leakage and there is a need to find some new leaked intermediate value in an algorithm, or some intermediate value is needed to be fixed for attack, plaintext attack is often chosen as the most effective one. For example, in the literature [13; 14; 15; 16], different intermediate values are chosen as attack points, and specific plaintext is input to obtain some sensitive fixed intermediate values for power attacks. First, [PERSON] [13] and [PERSON] et al. [14] proposed the chosen plaintext power attack on SM4. Then [PERSON] [15] and [PERSON] et al. [16] expanded the power attack on SM4 by selecting specific plaintext. In addition, [PERSON] et al. [17] proposed a general adaptively chosen-plaintext attack to improve the correlation in power analysis. Moreover, [PERSON] et al. [19] further improved the method to be both non-adaptive and adaptive by choosing appropriate plaintexts. Both the methods can be applied to analyze grouping algorithms, such as AES [20; 21; 22; 23; 24] and SM4. There are also many attacks on other algorithms. For example, [PERSON] [20] proposed the chosen plaintext power attack on AES; [PERSON] [21] expanded the chosen plaintext collision attack on masked AES; [PERSON] [22] improved chosen plaintext collision attack for masked AES. [PERSON] [25] proposed the chosen plaintext power attack on HMAC-SM3, and [PERSON] [26] proposed the chosen plaintext power attack on PRINCE. Further, chosen plaintext attacks also can be applied to public key cryptology.