SMS4 is a 128-bit block cipher used in the WAPI standard for providing data confidentiality in wireless networks. In this
paper we investigate and explain the origin of the S-Box employed by the cipher, show that an embedded cipher similar to BES
can be obtained for SMS4 and demonstrate the fragility of the cipher design by giving variants that exhibit 2
64 weak keys.
We also show attacks on reduced round versions of the cipher. The best practical attack we found is an integral attack that
works on 10 rounds out of 32 rounds with a complexity of 218 operations; it can be extended to 13 rounds using round key guesses, resulting in a complexity of 2114 operations and a data complexity of 216 chosen pairs.
Keywords block ciphers - cryptanalysis - UFN - algebraic structure