SM4 (cipher)

The length of encryption keys is 128 bits, represented as ${\displaystyle MK=(MK_{0},\ MK_{1},\ MK_{2},\ MK_{3})}$, in which ${\displaystyle MK_{i}\ (i=0,\ 1,\ 2,\ 3)}$ is a 32-bit word. The round keys are represented by ${\displaystyle (rk_{0},\ rk_{1},\ \ldots ,\ rk_{31})}$, where each ${\displaystyle rk_{i}(i=0,\ \ldots ,\ 31)}$ is a word. It is generated by the encryption key and the following parameters:

• ${\displaystyle FK=(FK_{0},\ FK_{1},\ FK_{2},\ FK_{3})}$
• ${\displaystyle CK=(CK_{0},\ CK_{1},\ \ldots ,\ CK_{31})}$

${\displaystyle FK_{i}}$ and ${\displaystyle CK_{i}}$ are words, used to generate the round keys.

Each round are computed from the four previous round outputs ${\displaystyle X_{i},X_{i+1},X_{i+2},X_{i+3}}$ such that: ${\displaystyle X_{i+4}=X_{i}\oplus F(X_{i+1}\oplus X_{i+2}\oplus X_{i+3}\oplus rk_{i})}$

Where ${\displaystyle F}$ is a substitution function composed of a non-linear transform, the S-box and linear transform ${\displaystyle L}$

S-box is fixed for 8-bit input and 8-bit output, noted as Sbox(). As with AES, the S-box is based on the multiplicative inverse over GF(2⁸). The affine transforms and polynomial bases are different from that of AES, but due to affine isomorphism it can be calculated efficiently given an AES Rijndael S-box.[7]