文章

SM4密码算法指南

发表于 更新于
作者
6 分钟阅读
SM4密码算法指南

该文介绍 SM4 密码算法及实现。

SM4

1. 简介

SM4 密码算法是一个分组算法。该算法的分组长度为 128 比特，密钥长度为 128 比特。加密算法与密钥扩展算法都采用 32 轮非线性迭代结构。数据解密和数据加密的算法结构相同，只是轮密钥的使用顺序相反，解密轮密钥是加密轮密钥的逆序。

非平衡的 Feistel 结构，分组和密钥长度均为 128bit，用于无线局域网产品。

2. 原理

参考一为算法原理和测试用例

参考二为算法实现

2.1. 密钥及密钥参量

加密密钥长度为 128bit，表示为 $MK = (MK_{0}, MK_{1}, MK_{2}, MK_{3})$ ，其中 $MK_{i}(i = 0,1,2,3)$ 为 32bit。

轮密钥表示为 $(rk_{0}, rk_{1}, \dots, rk_{31})$，其中 $rk_{i}(i = 0,1,\dots,31)$ 为 32bit。轮密钥由加密密钥生成。

$FK = (FK_{0}, FK_{1}, FK_{2}, FK_{3})$为系统参数，$CK = (CK_{0}, CK_{1}, \dots, CK_{31})$ 为固定参数，用于密钥扩展算法，其中 $FK_{i}(i = 0,1,2,3)$ 、$CK_{i}(i = 0,1,\dots,31)$ 为 32bit。

1
2
3
4
5
6
7
8
9
10
11
12
13
14

// Family key FK
static const uint32_t fk[4] =
{
    0xA3B1BAC6, 0x56AA3350, 0x677D9197, 0xB27022DC
};

// Constant key CK
static const uint32_t ck[32] =
{
    0x00070E15, 0x1C232A31, 0x383F464D, 0x545B6269, 0x70777E85, 0x8C939AA1, 0xA8AFB6BD, 0xC4CBD2D9,
    0xE0E7EEF5, 0xFC030A11, 0x181F262D, 0x343B4249, 0x50575E65, 0x6C737A81, 0x888F969D, 0xA4ABB2B9,
    0xC0C7CED5, 0xDCE3EAF1, 0xF8FF060D, 0x141B2229, 0x30373E45, 0x4C535A61, 0x686F767D, 0x848B9299,
    0xA0A7AEB5, 0xBCC3CAD1, 0xD8DFE6ED, 0xF4FB0209, 0x10171E25, 0x2C333A41, 0x484F565D, 0x646B7279,
};

2.2. 轮函数 F

2.2.1. 轮函数结构

\[\begin{array}{crl} \because &(X_{0}, X_{1}, X_{2}, X_{3}) &\in (Z^{32}_{2})^{4} \\ &rk &\in Z^{32}_{2} \\ \therefore &F(X_{0}, X_{1}, X_{2}, X_{3}, rk) &= X_{0} \oplus T(X_{1} \oplus X_{2} \oplus X_{3} \oplus rk) \end{array}\]

2.2.2. 合成置换 T

$T: Z^{32}{2} \rightarrow Z^{32}{2}$ 是一个可逆变换，由非线性变换和线性变换复合而成，即 $T(\cdot) = L(\tau(\cdot))$。

2.2.2.1. 非线性变换 $\tau$
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

// S-box S
static const uint8_t s[256] =
{
    0xD6, 0x90, 0xE9, 0xFE, 0xCC, 0xE1, 0x3D, 0xB7, 0x16, 0xB6, 0x14, 0xC2, 0x28, 0xFB, 0x2C, 0x05,
    0x2B, 0x67, 0x9A, 0x76, 0x2A, 0xBE, 0x04, 0xC3, 0xAA, 0x44, 0x13, 0x26, 0x49, 0x86, 0x06, 0x99,
    0x9C, 0x42, 0x50, 0xF4, 0x91, 0xEF, 0x98, 0x7A, 0x33, 0x54, 0x0B, 0x43, 0xED, 0xCF, 0xAC, 0x62,
    0xE4, 0xB3, 0x1C, 0xA9, 0xC9, 0x08, 0xE8, 0x95, 0x80, 0xDF, 0x94, 0xFA, 0x75, 0x8F, 0x3F, 0xA6,
    0x47, 0x07, 0xA7, 0xFC, 0xF3, 0x73, 0x17, 0xBA, 0x83, 0x59, 0x3C, 0x19, 0xE6, 0x85, 0x4F, 0xA8,
    0x68, 0x6B, 0x81, 0xB2, 0x71, 0x64, 0xDA, 0x8B, 0xF8, 0xEB, 0x0F, 0x4B, 0x70, 0x56, 0x9D, 0x35,
    0x1E, 0x24, 0x0E, 0x5E, 0x63, 0x58, 0xD1, 0xA2, 0x25, 0x22, 0x7C, 0x3B, 0x01, 0x21, 0x78, 0x87,
    0xD4, 0x00, 0x46, 0x57, 0x9F, 0xD3, 0x27, 0x52, 0x4C, 0x36, 0x02, 0xE7, 0xA0, 0xC4, 0xC8, 0x9E,
    0xEA, 0xBF, 0x8A, 0xD2, 0x40, 0xC7, 0x38, 0xB5, 0xA3, 0xF7, 0xF2, 0xCE, 0xF9, 0x61, 0x15, 0xA1,
    0xE0, 0xAE, 0x5D, 0xA4, 0x9B, 0x34, 0x1A, 0x55, 0xAD, 0x93, 0x32, 0x30, 0xF5, 0x8C, 0xB1, 0xE3,
    0x1D, 0xF6, 0xE2, 0x2E, 0x82, 0x66, 0xCA, 0x60, 0xC0, 0x29, 0x23, 0xAB, 0x0D, 0x53, 0x4E, 0x6F,
    0xD5, 0xDB, 0x37, 0x45, 0xDE, 0xFD, 0x8E, 0x2F, 0x03, 0xFF, 0x6A, 0x72, 0x6D, 0x6C, 0x5B, 0x51,
    0x8D, 0x1B, 0xAF, 0x92, 0xBB, 0xDD, 0xBC, 0x7F, 0x11, 0xD9, 0x5C, 0x41, 0x1F, 0x10, 0x5A, 0xD8,
    0x0A, 0xC1, 0x31, 0x88, 0xA5, 0xCD, 0x7B, 0xBD, 0x2D, 0x74, 0xD0, 0x12, 0xB8, 0xE5, 0xB4, 0xB0,
    0x89, 0x69, 0x97, 0x4A, 0x0C, 0x96, 0x77, 0x7E, 0x65, 0xB9, 0xF1, 0x09, 0xC5, 0x6E, 0xC6, 0x84,
    0x18, 0xF0, 0x7D, 0xEC, 0x3A, 0xDC, 0x4D, 0x20, 0x79, 0xEE, 0x5F, 0x3E, 0xD7, 0xCB, 0x39, 0x48,
};
\[\begin{array}{crllc} \because &inputA &= (a_{0}, a_{1}, a_{2}, a_{3}) &\in (Z^{8}_{2})^{4} \\ &outputB &= (b_{0}, b_{1}, b_{2}, b_{3}) &\in (Z^{8}_{2})^{4} \\ \therefore &(b_{0}, b_{1}, b_{2}, b_{3}) &= \tau(A) &= (Sbox(a_{0}),Sbox(a_{1}),Sbox(a_{2}),Sbox(a_{3})) \end{array}\]
2.2.2.2. 线性变换 $L$
\[\begin{array}{crl} \because &inputB &\in Z^{32}_{2} \\ &outputC &\in Z^{32}_{2} \\ \therefore &C &= L(B) = B \oplus (B \lll 2) \oplus (B \lll 10) \oplus (B \lll 18) \oplus (B \lll 24) \end{array}\]

2.3. 算法描述

2.3.1. 密钥扩展算法

加密密钥 $MK = (MK_{0}, MK_{1}, MK_{2}, MK_{3})$ ，轮密钥生成方法为：

\[\begin{array}{rl} (K_{0}, K_{1}, K_{2}, K_{3}) &= (MK_{0} \oplus FK_{0}, MK_{1} \oplus FK_{1}, MK_{2} \oplus FK_{2}, MK_{3} \oplus FK_{3}) \\ rk_{i} &= K_{i+4} = K_{i} \oplus T'(K_{i+1} \oplus K_{i+2} \oplus K_{i+3} \oplus CK_{i}) \qquad (i = 0,1,\dots,31) \\ T'(\cdot) &= L'(\tau(\cdot)) \\ L'(B) &= B \oplus (B \lll 13) \oplus (B \lll 23) \end{array}\]

2.3.2. 加密算法

本加密算法由 32 次迭代运算和 1 次反序变换 R 组成。

设明文输入为 $(X_{0}, X_{1}, X_{2}, X_{3}) \in (Z^{32}{2})^{4}$，密文输出为 $(Y{0}, Y_{1}, Y_{2}, Y_{3}) \in (Z^{32}{2})^{4}$，轮密钥为 $(rk{0}, rk_{1}, \dots, rk_{31}), i = 0,1,\dots,31$

\[\begin{array}{ll} 32次迭代运算 &X_{i+4} = F(X_{i}, X_{i+1}, X_{i+2}, X_{i+3}, rk_{i}) \qquad (i = 0,1,\dots,31) \\ 反序变换 &(Y_{0}, Y_{1}, Y_{2}, Y_{3}) = R(X_{32}, X_{33}, X_{34}, X_{35}) = (X_{35}, X_{34}, X_{33}, X_{32}) \end{array}\]

2.3.3. 解密算法

本算法的解密变换与加密变换结构相同，不同的仅是轮密钥的使用顺序。解密时，使用轮密钥序 $(rk_{31}, rk_{30}, \dots, rk_{0})$

3. 算法实现

常见加密解密算法：https://github.com/august295/EnDeCode

参考

密码
密码
本文由作者按照 CC BY 4.0 进行授权