SM4 (cipher)

<h2 id="cipher-detail">Cipher detail</h2>
<p>The SM4 cipher has a key size and a block size of 128 bits each.<a class="footnote-ref" id="fnref:5" href="#fn:5"><sup>5</sup></a><a class="footnote-ref" id="fnref:6" href="#fn:6"><sup>6</sup></a> Encryption or decryption of one block of data is composed of 32 rounds. A non-linear <a href="/facts/Key_schedule/H2klHRyU">key schedule</a> is used to produce the round keys and the decryption uses the same round keys as for encryption, except that they are in reversed order.
</p>
<h3>Keys and key parameters</h3>
<p>The length of encryption keys is 128 bits, represented as 
  
    
      
        M
        K
        =
        (
        M
        
          K
          
            0
          
        
        ,
         
        M
        
          K
          
            1
          
        
        ,
         
        M
        
          K
          
            2
          
        
        ,
         
        M
        
          K
          
            3
          
        
        )
      
    
    {\displaystyle MK=(MK_{0},\ MK_{1},\ MK_{2},\ MK_{3})}
  
, in which 
  
    
      
        M
        
          K
          
            i
          
        
         
        (
        i
        =
        0
        ,
         
        1
        ,
         
        2
        ,
         
        3
        )
      
    
    {\displaystyle MK_{i}\ (i=0,\ 1,\ 2,\ 3)}
  
 is a 32-bit word. The round keys are represented by 
  
    
      
        (
        r
        
          k
          
            0
          
        
        ,
         
        r
        
          k
          
            1
          
        
        ,
         
        …
        ,
         
        r
        
          k
          
            31
          
        
        )
      
    
    {\displaystyle (rk_{0},\ rk_{1},\ \ldots ,\ rk_{31})}
  
, where each 
  
    
      
        r
        
          k
          
            i
          
        
        (
        i
        =
        0
        ,
         
        …
        ,
         
        31
        )
      
    
    {\displaystyle rk_{i}(i=0,\ \ldots ,\ 31)}
  
 is a word. It is generated by the encryption key and the following parameters:
</p>
<ul><li>
  
    
      
        F
        K
        =
        (
        F
        
          K
          
            0
          
        
        ,
         
        F
        
          K
          
            1
          
        
        ,
         
        F
        
          K
          
            2
          
        
        ,
         
        F
        
          K
          
            3
          
        
        )
      
    
    {\displaystyle FK=(FK_{0},\ FK_{1},\ FK_{2},\ FK_{3})}
  
</li>
<li>
  
    
      
        C
        K
        =
        (
        C
        
          K
          
            0
          
        
        ,
         
        C
        
          K
          
            1
          
        
        ,
         
        …
        ,
         
        C
        
          K
          
            31
          
        
        )
      
    
    {\displaystyle CK=(CK_{0},\ CK_{1},\ \ldots ,\ CK_{31})}
  
</li></ul>
<p>
  
    
      
        F
        
          K
          
            i
          
        
      
    
    {\displaystyle FK_{i}}
  
 and 
  
    
      
        C
        
          K
          
            i
          
        
      
    
    {\displaystyle CK_{i}}
  
 are words, used to generate the round keys.
</p>
<h3>Round</h3>
<p>Each round are computed from the four previous round outputs 
  
    
      
        
          X
          
            i
          
        
        ,
        
          X
          
            i
            +
            1
          
        
        ,
        
          X
          
            i
            +
            2
          
        
        ,
        
          X
          
            i
            +
            3
          
        
      
    
    {\displaystyle X_{i},X_{i+1},X_{i+2},X_{i+3}}
  
 such that:

X
          
            i
            +
            4
          
        
        =
        
          X
          
            i
          
        
        ⊕
        F
        (
        
          X
          
            i
            +
            1
          
        
        ⊕
        
          X
          
            i
            +
            2
          
        
        ⊕
        
          X
          
            i
            +
            3
          
        
        ⊕
        r
        
          k
          
            i
          
        
        )
      
    
    {\displaystyle X_{i+4}=X_{i}\oplus F(X_{i+1}\oplus X_{i+2}\oplus X_{i+3}\oplus rk_{i})}

</p><p>Where 
  
    
      
        F
      
    
    {\displaystyle F}
  
 is a substitution function composed of  a non-linear transform, the S-box and linear transform 
  
    
      
        L
      
    
    {\displaystyle L}

</p>
<h3>S-box</h3>
<p class="note">Further information: <a href="/facts/AES_instruction_set/NomFEB4w">AES instruction set § Application beyond AES</a></p>
<p>SM4's S-box is fixed for 8-bit input and 8-bit output, noted as Sbox(). As with <a href="/facts/Advanced_Encryption_Standard/HdXGBY2Q">Advanced Encryption Standard</a> (AES), the S-box is based on the <a href="/facts/Multiplicative_inverse/yczdYyCw">multiplicative inverse</a> over <a href="/facts/Finite_field/UkMGJo3m">GF</a>(28). The affine transforms and polynomial bases are different from that of AES, but due to <a href="/facts/Affine_space/tlvI3oX1">affine isomorphism</a> it can be calculated efficiently given an <a href="/facts/Rijndael_S-box/Jf0Sahjy">AES S-Box</a>.<a class="footnote-ref" id="fnref:7" href="#fn:7"><sup>7</sup></a>
</p>
<h2 id="history">History</h2>
<p>On March 21, 2012, the Chinese government published the industrial standard "GM/T 0002-2012 SM4 Block Cipher Algorithm", officially renaming SMS4 to SM4.<a class="footnote-ref" id="fnref:8" href="#fn:8"><sup>8</sup></a>
</p><p>A description of SM4 in English is available as an <a href="/facts/Internet_Draft/h13QYxXa">Internet Draft</a>. It contains a <a href="/facts/Reference_implementation/k9B97xel">reference implementation</a> in <a href="/facts/ANSI_C/rPKeEuPm">ANSI C</a>.<a class="footnote-ref" id="fnref:9" href="#fn:9"><sup>9</sup></a>
</p><p>SM4 is part of the <a href="/facts/ARMv8.4-A/bauXRos7">ARMv8.4-A</a> expansion to the ARM architecture.<a class="footnote-ref" id="fnref:10" href="#fn:10"><sup>10</sup></a> SM4 support for the <a href="/facts/RISC-V_architecture/pUSKDat1">RISC-V</a> architecture was ratified in 2021 as the Zksed extension.<a class="footnote-ref" id="fnref:11" href="#fn:11"><sup>11</sup></a>
</p><p>SM4 is supported by Intel processors, starting from <a href="/facts/Arrow_Lake_(microprocessor)/AFTvbCBU">Arrow Lake S</a>, <a href="/facts/Lunar_Lake/LAyQmrEB">Lunar Lake</a>,  Diamond Rapids and Clearwater Forest.<a class="footnote-ref" id="fnref:12" href="#fn:12"><sup>12</sup></a>
</p>

<h2 id="external-links">External links</h2>
<ul><li><a href="http://eprint.iacr.org/2008/281">Linear and Differential Cryptanalysis of Reduced SMS4 Block Cipher</a></li>
<li><a href="https://web.archive.org/web/20110708205942/http://www.cryptoclarity.com/CryptoClarityLLC/Welcome/Entries/2009/2/24_SMS4_Cipher_as_a_Spreadsheet.html">Example of SMS4 implemented as a Spreadsheet</a></li>
<li><a href="https://web.archive.org/web/20041103211024/http://www.lois.labs.gov.cn/personnel/lvshuwang.htm">Page of Lu Shu-wang (吕述望) (in Chinese)</a></li>
<li><a href="http://gmssl.org">The GmSSL Project</a> <a href="https://web.archive.org/web/20201021125413/http://gmssl.org/">Archived</a> 2020-10-21 at the <a href="/facts/Wayback_Machine/nmQ3a6JC">Wayback Machine</a> (OpenSSL fork with GuoMi algorithms)</li>
<li><a href="https://www.iso.org/standard/81564.html">[1]</a> (ISO/IEC 18033-3:2010/Amd 1:2021 Information technology — Security techniques — Encryption algorithms — Part 3: Block ciphers — Amendment 1: SM4 )</li></ul>

<h2 id="references">References</h2>

<ol>
<li id="fn:1"><p>"Announcement No.23 of the State Cryptography Administration" (in Chinese (China)). The Office of the State Commercial Code Administration (OSCCA). 2012-03-21. Archived from the original on 2016-08-14. Retrieved 2016-07-24. <a href="https://web.archive.org/web/20160814151056/http://www.oscca.gov.cn/News/201204/News_1228.htm" target="_blank">https://web.archive.org/web/20160814151056/http://www.oscca.gov.cn/News/201204/News_1228.htm</a> <a href="#fnref:1" class="footnote-back-ref">↩</a></p></li>
<li id="fn:2"><p>Martinkauppi, Louise Bergman; He, Qiuping; Ilie, Dragos (June 2020). "On the Design and Performance of Chinese OSCCA-approved Cryptographic Algorithms". 2020 13th International Conference on Communications (COMM). pp. 119–124. doi:10.1109/COMM48946.2020.9142035. ISBN 978-1-7281-5611-8. S2CID 220668639. <a href="978-1-7281-5611-8" target="_blank">978-1-7281-5611-8</a> <a href="#fnref:2" class="footnote-back-ref">↩</a></p></li>
<li id="fn:3"><p>Yang, P (March 2021). RFC 8998. IETF. doi:10.17487/RFC8998. Retrieved 2022-07-30. <a href="https://datatracker.ietf.org/doc/html/rfc8998" target="_blank">https://datatracker.ietf.org/doc/html/rfc8998</a> <a href="#fnref:3" class="footnote-back-ref">↩</a></p></li>
<li id="fn:4"><p>Lu Shuwang. Overview on SM4 Algorithm[J]. Journal of Information Security Research, 2016, 2(11): 995-1007. <a href="http://ris.sic.gov.cn/CN/Y2016/V2/I11/995" target="_blank">http://ris.sic.gov.cn/CN/Y2016/V2/I11/995</a> <a href="#fnref:4" class="footnote-back-ref">↩</a></p></li>
<li id="fn:5"><p>"无线局域网产品使用的 SMS4 密码算法" (PDF) (in Simplified Chinese). State Cryptography Administration of the People's Republic of China. Archived from the original (PDF) on 2007-07-10. <a href="https://web.archive.org/web/20070710015158/http://www.oscca.gov.cn/UpFile/200621016423197990.pdf" target="_blank">https://web.archive.org/web/20070710015158/http://www.oscca.gov.cn/UpFile/200621016423197990.pdf</a> <a href="#fnref:5" class="footnote-back-ref">↩</a></p></li>
<li id="fn:6"><p>SMS4 Encryption Algorithm for Wireless Networks <a href="http://eprint.iacr.org/2008/329.pdf" target="_blank">http://eprint.iacr.org/2008/329.pdf</a> <a href="#fnref:6" class="footnote-back-ref">↩</a></p></li>
<li id="fn:7"><p>Saarinen, Markku-Juhani O. (17 April 2020). "mjosaarinen/sm4ni: Demonstration that AES-NI instructions can be used to implement the Chinese Encryption Standard SM4". GitHub. <a href="https://github.com/mjosaarinen/sm4ni" target="_blank">https://github.com/mjosaarinen/sm4ni</a> <a href="#fnref:7" class="footnote-back-ref">↩</a></p></li>
<li id="fn:8"><p>"Announcement No.23 of the State Cryptography Administration" (in Chinese (China)). The Office of the State Commercial Code Administration (OSCCA). 2012-03-21. Archived from the original on 2016-08-14. Retrieved 2016-07-24. <a href="https://web.archive.org/web/20160814151056/http://www.oscca.gov.cn/News/201204/News_1228.htm" target="_blank">https://web.archive.org/web/20160814151056/http://www.oscca.gov.cn/News/201204/News_1228.htm</a> <a href="#fnref:8" class="footnote-back-ref">↩</a></p></li>
<li id="fn:9"><p>Tse, Ronald; Kit, Wong; Saarinen, Markku-Juhani (22 April 2018). "The SM4 Blockcipher Algorithm And Its Modes Of Operations". tools.ietf.org. <a href="https://tools.ietf.org/html/draft-ribose-cfrg-sm4-10" target="_blank">https://tools.ietf.org/html/draft-ribose-cfrg-sm4-10</a> <a href="#fnref:9" class="footnote-back-ref">↩</a></p></li>
<li id="fn:10"><p>"Introducing 2017's extensions to the Arm Architecture". community.arm.com. 2 November 2017. <a href="https://community.arm.com/developer/ip-products/processors/b/processors-ip-blog/posts/introducing-2017s-extensions-to-the-arm-architecture" target="_blank">https://community.arm.com/developer/ip-products/processors/b/processors-ip-blog/posts/introducing-2017s-extensions-to-the-arm-architecture</a> <a href="#fnref:10" class="footnote-back-ref">↩</a></p></li>
<li id="fn:11"><p>"RISC-V Cryptography Extensions Task Group Announces Public Review of the Scalar Cryptography Extensions". riscv.org. <a href="https://riscv.org/blog/2021/09/risc-v-cryptography-extensions-task-group-announces-public-review-of-the-scalar-cryptography-extensions" target="_blank">https://riscv.org/blog/2021/09/risc-v-cryptography-extensions-task-group-announces-public-review-of-the-scalar-cryptography-extensions</a> <a href="#fnref:11" class="footnote-back-ref">↩</a></p></li>
<li id="fn:12"><p>"Intel® Architecture Instruction Set Extensions and Future Features" (PDF). Intel Corporation. December 2024. p. 1-3. Retrieved 2 February 2025. <a href="https://cdrdv2-public.intel.com/843860/architecture-instruction-set-extensions-programming-reference-dec-24.pdf" target="_blank">https://cdrdv2-public.intel.com/843860/architecture-instruction-set-extensions-programming-reference-dec-24.pdf</a> <a href="#fnref:12" class="footnote-back-ref">↩</a></p></li>
</ol>

SM4 (cipher) open-in-new

SM4 (cipher)