A Compact S-Box Design for SMS4 Block Cipher

Abstract

This paper proposes a compact design of SMS4 S-box using combinational logic which is suitable for the implementation in area constraint environments like smart cards. The inversion algorithm of the proposed S-box is based on composite field GF(((2²)²)²) using normal basis at all levels. In our approach, we examined all possible normal basis combinations having trace equal to one at each subfield level. There are 16 such possible combinations with normal basis and we have compared the S-box designs based on each case in terms of logic gates it uses for implementation. The isomorphism mapping and inverse mapping bit matrices are fully optimized using greedy algorithm. We prove that our best case reduces the complexity upon the SMS4 S-box design with existing inversion algorithm based on polynomial basis by 15% XOR and 42% AND gates.

Appendices

Appendix A: GF(2⁸) Representation for Sms4 S-Box

The Table A.1 gives the decimal, hexadecimal and binary values of the GF(2⁸) generated modulo irreducible primitive polynomial f(x) = x⁸ + x⁷ + x⁶ + x⁵ + x⁴ + x² + 1. Let A be the root of f(x) then the field generated with respective names of elements is as below.

Dec	Hex	Binary	θi	Name	Dec	Hex	Binary	θi	Name
0	00	00000000	–	0	39	27	00100111	θ187	β4
1	01	00000001	θ0	1	40	28	00101000	θ16	A16
2	02	00000010	θ1	A	41	29	00101001	θ104	G8
3	03	00000011	θ134	G128	42	2A	00101010	θ153	γ8
4	04	00000100	θ2	A2	43	2B	00101011	θ119	β8
5	05	00000101	θ13	G	44	2C	00101100	θ176	F16
6	06	00000110	θ135	H128	45	2D	00101101	θ223	q32
7	07	00000111	θ76	J4	46	2E	00101110	θ169	b2
8	08	00001000	θ3	B	47	2F	00101111	θ114	d128
9	09	00001001	θ210	a16	48	30	00110000	θ138	K128
10	0A	00001010	θ14	D2	49	31	00110001	θ250	n
11	0B	00001011	θ174	g16	50	32	00110010	θ241	m2
12	0C	00001100	θ 136	α 8	51	33	00110011	θ160	C32
13	0D	00001101	θ 34	α 2	52	34	00110100	θ36	E4
14	0E	00001110	θ77	b16	53	35	00110101	θ82	P16
15	0F	00001111	θ147	d4	54	36	00110110	θ90	a2
16	10	00010000	θ4	A4	55	37	00110111	θ96	B32
17	11	00010001	θ26	G2	56	38	00111000	θ79	k16
18	12	00010010	θ211	k4	57	39	00111001	θ47	j16
19	13	00010011	θ203	j4	58	3A	00111010	θ54	N2
20	14	00010100	θ15	H	59	3B	00111011	θ220	e32
21	15	00010101	θ152	J8	60	3C	00111100	θ149	Q128
22	16	00010110	θ175	n16	61	3D	00111101	θ50	M2
23	17	00010111	θ168	K8	62	3E	00111110	θ10	C2
24	18	00011000	θ137	J128	63	3F	00111111	θ31	m32
25	19	00011001	θ240	H16	64	40	01000000	θ6	B2
26	1A	00011010	θ35	M32	65	41	01000001	θ165	a32
27	1B	00011011	θ89	Q8	66	42	01000010	θ144	E16
28	1C	00011100	θ78	d16	67	43	01000011	θ73	P64
29	1D	00011101	θ53	b64	68	44	01000100	θ28	D4
30	1E	00011110	θ148	P4	69	45	01000101	θ93	g32
31	1F	00011111	θ9	E	70	46	01000110	θ111	l16
32	20	00100000	θ5	C	71	47	01000111	θ184	L8
33	21	00100001	θ143	m16	72	48	01001000	θ213	g2
34	22	00100010	θ27	N	73	49	01001001	θ193	D64
35	23	00100011	θ110	e16	74	4A	01001010	θ58	f64
36	24	00100100	θ212	b	75	4B	01001011	θ181	c2
37	25	00100101	θ57	d64	76	4C	01001100	θ205	e2
38	26	00100110	θ204	γ4	77	4D	01001101	θ99	N32
78	4E	01001110	θ188	j64	123	7B	01111011	θ238	β
79	4F	01001111	θ61	k64	124	7C	01111100	θ11	F
80	50	01010000	θ 17	α	125	7D	01111101	θ253	q2
81	51	01010001	θ 68	α 4	126	7E	01111110	θ32	A32
82	52	01010010	θ105	a8	127	7F	01111111	θ208	G16
83	53	01010011	θ129	B128	128	80	10000000	θ7	D
84	54	01010100	θ154	b32	129	81	10000001	θ87	g8
85	55	01010101	θ39	d8	130	82	10000010	θ166	b8
86	56	01010110	θ120	H8	131	83	10000011	θ201	d2
87	57	01010111	θ196	J64	132	84	10000100	θ145	M16
88	58	01011000	θ177	N16	133	85	10000101	θ172	Q4
89	59	01011001	θ230	e	134	86	10000110	θ74	P2
90	5A	01011010	θ224	D32	135	87	10000111	θ132	E128
91	5B	01011011	θ234	g	136	88	10001000	θ29	f32
92	5C	01011100	θ 170	λ 2	137	89	10001001	θ218	c
93	5D	01011101	θ 85	λ	138	8A	10001010	θ94	j32
94	5E	01011110	θ115	e128	139	8B	10001011	θ158	k32
95	5F	01011111	θ216	N8	140	8C	10001100	θ112	D16
96	60	01100000	θ139	L128	141	8D	10001101	θ117	g128
97	61	01100001	θ246	l	142	8E	10001110	θ185	e64
98	62	01100010	θ251	q4	143	8F	10001111	θ108	N4
99	63	01100011	θ22	F2	144	90	10010000	θ214	c8
100	64	01100100	θ242	j	145	91	10010001	θ232	f
101	65	01100101	θ244	k	146	92	10010010	θ194	F64
102	66	01100110	θ161	G32	147	93	10010011	θ127	q128
103	67	01100111	θ64	A64	148	94	10010100	θ 59	h 64
104	68	01101000	θ37	P	149	95	10010101	θ 179	h 4
105	69	01101001	θ66	E64	150	96	10010110	θ182	c64
106	6A	01101010	θ83	b4	151	97	10010111	θ71	f8
107	6B	01101011	θ228	d	152	98	10011000	θ 206	h 16
108	6C	01101100	θ91	c32	153	99	10011001	θ 236	h
109	6D	01101101	θ163	f4	154	9A	10011010	θ100	M4
110	6E	01101110	θ97	F32	155	9B	10011011	θ43	Q
111	6F	01101111	θ191	q64	156	9C	10011100	θ189	l64
112	70	01110000	θ80	C16	157	9D	10011101	θ226	L32
113	71	01110001	θ248	m	158	9E	10011110	θ62	m64
114	72	01110010	θ48	B16	159	9F	10011111	θ20	C4
115	73	01110011	θ45	a	160	A0	10100000	θ18	E2
116	74	01110100	θ55	e8	161	A1	10100001	θ41	P8
117	75	01110101	θ141	N128	162	A2	10100010	θ69	K64
118	76	01110110	θ221	β2	163	A3	10100011	θ125	n128
119	77	01110111	θ102	γ2	164	A4	10100100	θ106	b128
120	78	01111000	θ150	a128	165	A5	10100101	θ156	d32
121	79	01111001	θ24	B8	166	A6	10100110	θ130	C128
122	7A	01111010	θ51	γ	167	A7	10100111	θ199	m8
168	A8	10101000	θ155	e4	212	D4	11010100	θ84	K4
169	A9	10101001	θ198	N64	213	D5	11010101	θ215	n8
170	AA	10101010	θ40	C8	214	D6	11010110	θ229	j2
171	AB	10101011	θ124	m128	215	D7	11010111	θ233	k2
172	AC	10101100	θ121	j128	216	D8	11011000	θ92	L4
173	AD	10101101	θ122	k128	217	D9	11011001	θ183	l8
174	AE	10101110	θ197	L64	218	DA	11011010	θ164	P32
175	AF	10101111	θ123	l128	219	DB	11011011	θ72	E8
176	B0	10110000	θ178	Q16	220	DC	11011100	θ98	J32
177	B1	10110001	θ70	M64	221	DD	11011101	θ60	H4
178	B2	10110010	θ 231	p 8	222	DE	11011110	θ192	B64
179	B3	10110011	θ 126	p 128	223	DF	11011111	θ180	a4
180	B4	10110100	θ225	H32	224	E0	11100000	θ81	K16
181	B5	10110101	θ19	J	225	E1	11100001	θ95	n32
182	B6	10110110	θ235	n4	226	E2	11100010	θ 249	p 2
183	B7	10110111	θ42	K2	227	E3	11100011	θ 159	p 32
184	B8	10111000	θ171	g4	228	E4	11100100	θ49	J16
185	B9	10111001	θ131	D128	229	E5	11100101	θ30	H2
186	BA	10111010	θ86	Q2	230	E6	11100110	θ46	L2
187	BB	10111011	θ200	M8	231	E7	11100111	θ219	l4
188	BC	10111100	θ116	f128	232	E8	11101000	θ56	D8
189	BD	10111101	θ107	c4	233	E9	11101001	θ186	g64
190	BE	10111110	θ 217	h 2	234	EA	11101010	θ142	f16
191	BF	10111111	θ 157	h 32	235	EB	11101011	θ109	c128
192	C0	11000000	θ140	M128	236	EC	11101100	θ222	l32
193	C1	11000001	θ101	Q32	237	ED	11101101	θ113	L16
194	C2	11000010	θ247	q8	238	EE	11101110	θ 103	h 8
195	C3	11000011	θ44	F4	239	EF	11101111	θ 118	h 128
196	C4	11000100	θ 252	p	240	F0	11110000	θ151	j8
197	C5	11000101	θ 207	p 16	241	F1	11110001	θ167	k8
198	C6	11000110	θ23	L	242	F2	11110010	θ25	M
199	C7	11000111	θ237	l2	243	F3	11110011	θ202	Q64
200	C8	11001000	θ 243	p 4	244	F4	11110100	θ52	G4
201	C9	11001001	θ 63	p 64	245	F5	11110101	θ8	A8
202	CA	11001010	θ245	n2	246	F6	11110110	θ239	q16
203	CB	11001011	θ21	K	247	F7	11110111	θ88	F8
204	CC	11001100	θ162	K32	248	F8	11111000	θ12	B4
205	CD	11001101	θ190	n64	249	F9	11111001	θ75	a64
206	CE	11001110	θ65	C64	250	FA	11111010	θ254	q
207	CF	11001111	θ227	m4	251	FB	11111011	θ133	F128
208	D0	11010000	θ38	J2	252	FC	11111100	θ33	E32
209	D1	11010001	θ195	H64	253	FD	11111101	θ146	P128
210	D2	11010010	θ67	G64	254	FE	11111110	θ209	f2
211	D3	11010011	θ128	A128	255	FF	11111111	θ173	c16

The minimal polynomials over GF(2) and their respective conjugate roots in terms of θⁱ are presented in the following Table A.2.

Name	Minimal polynomial	Conjugate roots (θi )
1	x + 1	θ0
λ	x2 + x + 1	θ85, θ170
α	x4 + x + 1	θ17, θ34, θ68, θ136
β	x4 + x3 + 1	θ238, θ221, θ187, θ119
γ	x4 + x3 + x2 + x + 1	θ51, θ102, θ204, θ153
A	x8 + x7 + x6 + x5 + x4 + x2 + 1	θ1, θ2, θ4, θ8, θ16, θ32, θ64, θ128
B	x8 + x7 + x5 + x4 + x3 + x2 + 1	θ3, θ6, θ12, θ24, θ48, θ96, θ192, θ129
C	x8 + x4 + x3 + x + 1	θ5, θ10, θ20, θ40, θ80, θ160, θ65, θ130
D	x8 + x6 + x5 + x4 + 1	θ7, θ14, θ28, θ56, θ112, θ224, θ193, θ131
E	x8 + x5 + x4 + x3 + x2 + x + 1	θ9, θ18, θ36, θ72, θ144, θ33, θ66, θ132
F	x8 + x6 + x3 + x2 + 1	θ11, θ22, θ44, θ88, θ176, θ97, θ194, θ133
G	x8 + x7 + x3 + x2 + 1	θ13, θ26, θ52, θ104, θ208, θ161, θ67, θ134
H	x8 + x5 + x4 + x3 + 1	θ15, θ30, θ60, θ120, θ240, θ225, θ195, θ135
J	x8 + x5 + x3 + x2 + 1	θ19, θ38, θ76, θ152, θ49, θ98, θ196, θ137
K	x8 + x7 + x6 + x4 + x3 + x2 + 1	θ21, θ42, θ84, θ168, θ81, θ162, θ69, θ138
L	x8 + x7 + x2 + x + 1	θ23, θ46, θ92, θ184, θ113, θ226, θ197, θ139
M	x8 + x7 + x4 + x3 + x2 + 1	θ25, θ50, θ100, θ200, θ145, θ35, θ70, θ140
N	x8 + x7 + x3 + x + 1	θ27, θ54, θ108, θ216, θ177, θ99, θ198, θ141
P	x8 + x5 + x3 + x + 1	θ37, θ74, θ148, θ41, θ82, θ164, θ73, θ146
Q	x8 + x7 + x6 + x5 + x2 + x + 1	θ43, θ86, θ172, θ89, θ178, θ101, θ202, θ149
a	x8 + x7 + x6 + x4 + x2 + x + 1	θ45, θ90, θ180, θ105, θ210, θ165, θ75, θ150
b	x8 + x7 + x6 + x3 + x2 + x + 1	θ212, θ169, θ83, θ166, θ77, θ154, θ53, θ106
c	x8 + x7 + x5 + x3 + 1	θ218, θ181, θ107, θ214, θ173, θ91, θ182, θ109
d	x8 + x7 + x5 + x + 1	θ228, θ201, θ147, θ39, θ78, θ156, θ57, θ114
e	x8 + x7 + x6 + x5 + x4 + x + 1	θ230, θ205, θ155, θ55, θ110, θ220, θ185, θ115
f	x8 + x7 + x6 + x + 1	θ232, θ209, θ163, θ71, θ142, θ29, θ58, θ116
g	x8 + x6 + x5 + x4 + x2 + x + 1	θ234, θ213, θ171, θ87, θ174, θ93, θ186, θ117
h	x8 + x6 + x5 + x3 + 1	θ236, θ217, θ179, θ103, θ206, θ157, θ59, θ118
j	x8 + x6 + x5 + x + 1	θ242, θ229, θ203, θ151, θ47, θ94, θ188, θ121
k	x8 + x6 + x5 + x2 + 1	θ244, θ233, θ211, θ167, θ79, θ158, θ61, θ122
l	x8 + x7 + x6 + x5 + x4 + x3 + 1	θ246, θ237, θ219, θ183, θ111, θ222, θ189, θ123
m	x8 + x4 + x3 + x2 + 1	θ248, θ241, θ227, θ199, θ143, θ31, θ62, θ124
n	x8 + x7 + x5 + x4 + 1	θ250, θ245, θ235, θ215, θ175, θ95, θ190, θ125
p	x8 + x6 + x5 + x4 + x3 + x + 1	θ252, θ249, θ243, θ231, θ207, θ159, θ63, θ126
q	x8 + x6 + x4 + x3 + x2 + x + 1	θ254, θ253, θ251, θ247, θ239, θ223, θ191, θ127

Appendix B: Tables for GF(2⁴) Computations

The Table B.1 gives the decimal, hexadecimal and binary values of the GF(2⁴) generated modulo irreducible primitive polynomial g(x) = x⁴ + x + 1. Let α be the root of g(x) then the field generated with respective names of elements is as below.

Dec	Hex	ANF Ωi	Bin Ωi	Ωi	Name
0	00	0	0000	–	0
1	01	x	0001	Ω0	1
2	02	x2	0010	Ω1	α
3	03	x + 1	0011	Ω4	α4
4	04	x2	0100	Ω2	α2
5	05	x2 + 1	0101	Ω8	α8
6	06	x2 + x	0110	Ω5	λ
7	07	x2 + x + 1	0111	Ω10	λ2
8	08	x3	1000	Ω3	γ
9	09	x3 + 1	1001	Ω14	β
10	0A	x3 + x	1010	Ω9	γ8
11	0B	x3 + x + 1	1011	Ω7	β8
12	0C	x3 + x2	1100	Ω6	γ2
13	0D	x3 + x2 + 1	1101	Ω13	β2
14	0E	x3 + x2 + x	1110	Ω11	β4
15	0F	x3 + x2 + x + 1	1111	Ω12	γ4

The Table B.2 below gives the minimal polynomials over GF(2) and their respective conjugate roots in terms of Ωⁱ are presented using irreducible primitive polynomial g(x) = x⁴ + x + 1.

Name	Minimal polynomial	Conjugate roots (θi )
1	x + 1	Ω0
λ	x2 + x + 1	Ω5, Ω10
α	x4 + x + 1	Ω, Ω2, Ω4, Ω8
β	x4 + x3 + 1	Ω14, Ω13, Ω11, Ω7
γ	x4 + x3 + x2 + x + 1	Ω3, Ω6, Ω12, Ω9

The addition Table B.3 in GF(16) using the naming convention in Table A.1 is given below.

⊕	0	1	α	α2	γ	α4	λ	γ2	β8	α8	γ8	λ2	β4	γ4	β2	β
0	0	1	α	α2	γ	α4	λ	γ2	β8	α 8	γ8	λ 2	β4	γ4	β2	β
1	1	0	α4	α8	β	α	λ2	β2	γ8	α2	β8	λ	γ4	β4	γ2	γ
α	α	α4	0	λ	γ8	1	α2	β4	β	λ2	γ	α8	γ2	β2	γ4	β8
α2	α2	α8	λ	0	γ2	λ2	α	γ	γ4	1	β4	α4	γ8	β8	β	β2
γ	γ	β	γ8	γ2	0	β8	β4	α2	α4	β2	α	γ4	λ	λ2	α8	1
α4	α4	α	1	λ2	β8	0	α8	γ4	γ	λ	β	α2	β2	γ2	β4	γ8
λ	λ	λ2	α2	α	β4	α8	0	γ8	β2	α4	γ2	1	γ	β	β8	γ4
γ2	γ2	β2	β4	γ	α2	γ4	γ8	0	λ2	β	λ	β8	α	α4	1	α8
β8	β8	γ8	β	γ4	α4	γ	β2	λ2	0	β4	1	γ2	α8	α2	λ	α
α8	α8	α2	λ2	1	β2	λ	α4	β	β4	0	γ4	α	β8	γ8	γ	γ2
γ8	γ8	β8	γ	β4	α	β	γ2	λ	1	γ4	0	β2	α2	α8	λ2	α4
λ2	λ2	λ	α8	α4	γ4	α2	1	β8	γ2	α	β2	0	β	γ	γ8	β4
β4	β4	γ4	γ2	γ8	λ	β2	γ	α	α8	β8	α2	β	0	1	α4	λ2
γ4	γ4	β4	β2	β8	λ2	γ2	β	α4	α2	γ8	α8	γ	1	0	α	λ
β2	β2	γ2	γ4	β	α8	β4	β8	1	λ	γ	λ2	γ8	α4	α	0	α2
β	β	γ	β8	β2	1	γ8	γ4	α8	α	γ2	α4	β4	λ2	λ	α2	0

The multiplication Table B.4 in GF(16) is given as below.

⊗	0	1	α	α2	γ	α4	λ	γ2	β8	α8	γ8	λ2	β4	γ4	β2	β
0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0	0
1	0	1	α	α2	γ	α4	λ	γ2	β8	α8	γ8	λ2	β4	γ4	β2	β
α	0	α	α2	γ	α4	λ	γ2	β8	α8	γ8	λ2	β4	γ4	β2	β	1
α2	0	α2	γ	α4	λ	γ2	β8	α8	γ8	λ2	β4	γ4	β2	β	1	α
γ	0	γ	α4	λ	γ2	β8	α8	γ8	λ2	β4	γ4	β2	β	1	α	α2
α4	0	α4	λ	γ2	β8	α8	γ8	λ2	β4	γ4	β2	β	1	α	α2	γ
λ	0	λ	γ2	β8	α8	γ8	λ2	β4	γ4	β2	β	1	α	α2	γ	α4
γ2	0	γ2	β8	α8	γ8	λ2	β4	γ4	β2	β	1	α	α2	γ	α4	λ
β8	0	β8	α8	γ8	λ2	β4	γ4	β2	β	1	α	α2	γ	α4	λ	γ2
α8	0	α8	γ8	λ2	β4	γ4	β2	β	1	α	α2	γ	α4	λ	γ2	β8
γ8	0	γ8	λ2	β4	γ4	β2	β	1	α	α2	γ	α4	λ	γ2	β8	α8
λ2	0	λ2	β4	γ4	β2	β	1	α	α2	γ	α4	λ	γ2	β8	α8	γ8
β4	0	β4	γ4	β2	β	1	α	α2	γ	α4	λ	γ2	β8	α8	γ8	λ2
γ4	0	γ4	β2	β	1	α	α2	γ	α4	λ	γ2	β8	α8	γ8	λ2	β4
β2	0	β2	β	1	α	α2	γ	α4	λ	γ2	β8	α8	γ8	λ2	β4	γ4
β	0	β	1	α	α2	γ	α4	λ	γ2	β8	α8	γ8	λ2	β4	γ4	β2