Abstract:

It is found that in the SM4 algorithm of unbalanced Feistel network, the intermediate data from previous and subsequent rounds are relevant. Therefore, the round keys of the SM4 algorithm can be restored through the internal collision principle and the template matching method. And a side channel method of power template-collision analysis based on SM4 algorithm is given. A special set of plaintext is selected to collect the power consumption traces to analyze. And during the algorithm encryption process, the intermediate data (such as the output value of the S-box) in the right half of the unbalanced Feistel network is used as the analysis target. The round keys can be restored by using each round of the S-box output values collision. Experiments prove that approximately 2,500 power consumption traces without masking (except the template traces) are used, which can effectively implement analysis. Compared with the traditional collision analysis, the analysis reduces computational complexity, and extends collision analysis to the unbalanced Feistel network, which improves and enhances the applicability and practicability of collision analysis.

Key words: collision analysis, SM4 algorithm, unbalanced Feistel network, template matching

摘要：

分析发现在非平衡Feistel结构的SM4算法中，前后轮次的中间数据具有相关性。因此，通过内部碰撞原理并结合模板匹配的方法后，可用于恢复SM4算法轮子密钥，并给出了一种针对SM4算法的功耗模板-碰撞分析的侧信道方法。分析时选择特殊的明文采集功耗曲线，将算法加密过程中非平衡Feistel结构的右半部分的中间变量值(如S盒输出值)作为分析目标，利用每一轮各中间变量值碰撞来恢复轮子密钥。实验验证证明，在未加掩码情况下，大约采用2?500条功耗曲线（模板曲线除外），可有效实施分析。相比于传统碰撞分析方法，该方法降低了计算复杂度，将碰撞分析方法扩展到非平衡Feistel算法结构，提高并增强了碰撞分析方法的适用性与实用性。

关键词: 碰撞分析, SM4算法, 非平衡Feistel结构, 模板匹配