ShāngMì 4 (SM4, 商密4) (formerlySMS4)^[2] is ablock cipher, standardised for commercial cryptography in China.^[3] It is used in theChinese National Standard for Wireless LANWAPI (WLAN Authentication and Privacy Infrastructure), and withTransport Layer Security.^[4]

SM4

General
Designers	Data Assurance & Communication Security Center,Chinese Academy of Sciences
First published	2006 (declassified; standardized March 21, 2012)[1]
Cipher detail
Key sizes	128 bits
Block sizes	128 bits
Structure	unbalanced Feistel network
Rounds	32
Best publiccryptanalysis
Linear anddifferential attacks against 22 rounds

SM4 was a cipher proposed for theIEEE 802.11i standard, but it has so far been rejected. One of the reasons for the rejection has been opposition to the WAPI fast-track proposal by theIEEE.^{[citation needed]}

SM4 was published asISO/IEC 18033-3/Amd 1 in 2021.

The SM4 algorithm was drafted by Data Assurance & Communication Security Center,Chinese Academy of Sciences (CAS), and Commercial Cryptography Testing Center, National Cryptography Administration. It is mainly developed by Lü Shuwang (Chinese:吕述望). The algorithm was declassified in January, 2006, and it became a national standard (GB/T 32907-2016) in August 2016.^[5]

The SM4 cipher has a key size and a block size of 128 bits each.^[6][7] Encryption or decryption of one block of data is composed of 32 rounds. A non-linearkey schedule is used to produce the round keys and the decryption uses the same round keys as for encryption, except that they are in reversed order.

The length of encryption keys is 128 bits, represented as${\displaystyle MK=(M{K}_0,M{K}_1,M{K}_2,M{K}_3)}$ , in which${\displaystyle M{K}_i(i=0,1,2,3)}$  is a 32-bit word. The round keys are represented by${\displaystyle (r{k}_0,r{k}_1,\dots ,r{k}_{31})}$ , where each${\displaystyle r{k}_i(i=0,\dots ,31)}$  is a word. It is generated by the encryption key and the following parameters:

• ${\displaystyle FK=(F{K}_0,F{K}_1,F{K}_2,F{K}_3)}$ 
• ${\displaystyle CK=(C{K}_0,C{K}_1,\dots ,C{K}_{31})}$ 

${\displaystyle F{K}_i}$  and${\displaystyle C{K}_i}$  are words, used to generate the round keys.

Each round are computed from the four previous round outputs${\displaystyle X_i,X_{i+1},X_{i+2},X_{i+3}}$  such that:${\displaystyle X_{i+4}=X_i\oplus F(X_{i+1}\oplus X_{i+2}\oplus X_{i+3}\oplus r{k}_i)}$ 

Where${\displaystyle F}$  is a substitution function composed of a non-linear transform, the S-box and linear transform${\displaystyle L}$ 

SM4's S-box is fixed for 8-bit input and 8-bit output, noted as Sbox(). As withAdvanced Encryption Standard (AES), the S-box is based on themultiplicative inverse overGF(2⁸). The affine transforms and polynomial bases are different from that of AES, but due toaffine isomorphism it can be calculated efficiently given anAES S-Box.^[8]

On March 21, 2012, the Chinese government published the industrial standard "GM/T 0002-2012 SM4 Block Cipher Algorithm", officially renaming SMS4 to SM4.^[2]

A description of SM4 in English is available as anInternet Draft. It contains areference implementation inANSI C.^[9]

SM4 is part of theARMv8.4-A expansion to the ARM architecture.^[10] SM4 support for theRISC-V architecture was ratified in 2021 as the Zksed extension.^[11]

SM4 is supported by Intel processors, starting fromArrow Lake S,Lunar Lake, Diamond Rapids and Clearwater Forest.^[12]

• Linear and Differential Cryptanalysis of Reduced SMS4 Block Cipher
• Example of SMS4 implemented as a Spreadsheet
• Page of Lu Shu-wang (吕述望) (in Chinese)
• The GmSSL ProjectArchived 2020-10-21 at theWayback Machine (OpenSSL fork with GuoMi algorithms)
• [1] (ISO/IEC 18033-3:2010/Amd 1:2021 Information technology — Security techniques — Encryption algorithms — Part 3: Block ciphers — Amendment 1: SM4 )