Abstract:For years, many cryptanalysts have been devoted to working on analyzing the security of block ciphers against differential attacks and linear attacks. Thus, there are copious methods to cryptanalyze a block cipher with differential and linear cryptanalyses. An original method proposed by Achiya Bar-On et al. enables attackers to analyze more rounds of a partial SPN network in differential and linear cryptanalyses. The method involves two auxiliary matrices, which makes it possible that more constraints on differences can be exploited to sieve the inappropriate pairs. In the paper, the method is implemented to SMS4 in the setting of a multiple differential cryptanalysis. By utilizing the 214 existing 19-round differential characteristics, the paper carries out a 23-round key-recovery attack on SMS4, which leads to a lower data and memory complexities than previous multiple differential attack results on 23-round SMS4, namely,2113.5 chosen plaintexts and 217 bytes at a success possibility of 0.9. The attack presented in the paper can recover 128-bit key within 2126.7 equivalent 23-round encryptions.