Improved Rectangle Attack on SMS4 Reduced to 18 Rounds

SMS4 is a 32-round block cipher with 128-bit block size and 128-bit secret key. It is used in WAPI, the Chinese WLAN national standard. In this paper, we analyze the security of SMS4 against the rectangle attack. First we describe two properties of SMS4. Next, we propose the 16-round rectangle distinguisher with probability 2^-250. Finally, the rectangle attack is then carried out on 18-round SMS4 with 2¹²⁷ chosen plaintexts and the time complexity is 2^103.83 18-round encryptions. In this process we use a hash table to reduce the time complexity. Our attack is the best rectangle attack on SMS4 so far.