Fault Attacks Research Articles

Statistical Fault Analysis of TinyJambu

The resource-constrained IoT devices have limited resources such as processing power, memory, and battery capacity. Therefore it is challenging to adopt traditional cryptographic algorithms on them. In order to find a solution, the National Institute of Standards and Technology (NIST) initiated the Lightweight Cryptography (LWC) competition to standardize cryptographic algorithms for resource-constrained devices. The primary aim of our work is to implement and analyse selected finalist algorithms from the NIST competition using modern cryptanalysis techniques, with a focus on statistical fault attacks. Traditional analysis methods, such as linear and differential analysis, were not prioritized as most finalist algorithms have established defences against these methods. We implemented six of the selected finalist algorithms from the competition: Ascon, Elephant, GIFT-COFB, ISAP, TinyJambu, and Xoodyak. We chose TinyJumbu for statistical fault analysis because of its attractiveness, compact block size, and provision of a more lightweight keyed permutation.

Theoretical differential fault attacks on FLIP and FiLIP

Theoretical differential fault attacks on FLIP and FiLIP

Locking-Enabled Security Analysis of Cryptographic Circuits

Hardware implementations of cryptographic primitives require protection against physical attacks and supply chain threats. This raises the question of secure composability of different attack countermeasures, i.e., whether protecting a circuit against one threat can make it more vulnerable against a different threat. In this article, we study the consequences of applying logic locking, a popular design-for-trust solution against intellectual property piracy and overproduction, to cryptographic circuits. We show that the ability to unlock the circuit incorrectly gives the adversary new powerful attack options. We introduce LEDFA (locking-enabled differential fault analysis) and demonstrate for several ciphers and families of locking schemes that fault attacks become possible (or consistently easier) for incorrectly unlocked circuits. In several cases, logic locking has made circuit implementations prone to classical algebraic attacks with no fault injection needed altogether. We refer to this “zero-fault” version of LEDFA by the term LEDA, investigate its success factors in-depth and propose a countermeasure to protect the logic-locked implementations against LEDA. We also perform test vector leakage assessment (TVLA) of incorrectly unlocked AES implementations to show the effects of logic locking regarding side-channel leakage. Our results indicate that logic locking is not safe to use in cryptographic circuits, making them less rather than more secure.

A Provably Secure Scheme to Prevent Master Key Recovery by Fault Attack on AES Hardware

A Provably Secure Scheme to Prevent Master Key Recovery by Fault Attack on AES Hardware

Differential Fault Attack of Lightweight Cipher GIFT Based on Byte Model

Differential Fault Attack of Lightweight Cipher GIFT Based on Byte Model

Differential faultt attack on DEFAULT

<p style='text-indent:20px;'>Block cipher DEFAULT has been proposed as a differential fault analysis immune cipher at Asiacrypt 2021. In this paper, we consider the initial version of DEFAULT with no permutation involved in the last round and show that one can find the key in this version with complexity <inline-formula><tex-math id="M1">\begin{document}$ 2^{16} $\end{document}</tex-math></inline-formula> by injecting 112 faults. However, our idea does not work for the modified version of the cipher (where a key scheduling algorithm is involved).</p>

Detection of Voltage Droop-Induced Timing Fault Attacks Due to Hardware Trojans

Detection of Voltage Droop-Induced Timing Fault Attacks Due to Hardware Trojans

An Automated Fault Attack Framework for Block Ciphers Through Property Mining and Verification

An Automated Fault Attack Framework for Block Ciphers Through Property Mining and Verification

StaTI: Protecting against Fault Attacks Using Stable Threshold Implementations

StaTI: Protecting against Fault Attacks Using Stable Threshold Implementations

Research on a Random Mask Infection Countermeasure against Double Fault Attacks

The infection countermeasure, in which the main idea is to prevent adversaries from exploiting faulty ciphertexts to break the key by spreading the induced fault, is a very effective countermeasure against fault attacks. However, most existing infection countermeasures struggle to defend against double-fault attacks effectively due to the single-fault assumption. By analyzing the principle of infection mechanism and adding different random Boolean masks in the two encryption paths, this paper proposes a measure called a random mask infection countermeasure to defend against double-fault attacks. In addition, the multiplication mask is used to randomize the fault diffusion to further resist single-byte fault attacks. The experimental results indicate that the random mask infection countermeasure proposed can perform fault diffusion effectively when the cryptographic circuit suffers double-fault attacks, and the fault diffusion shows randomness, and can effectively defend against these fault attacks.

A Differential Fault Attack on Security Vehicle System Applied SIMON Block Cipher

With the application of new technologies in vehicles such as wireless communications, microelectronics, Artificial Intelligence (AI) and Autonomous Vehicles (AV), there are lots of embedded hardware and software in vehicles, and so cryptographic technologies such as block ciphers are also applied to the vehicle system to protect its security and privacy. In order to better find potential security vulnerabilities and improve security of the vehicle system which applied SIMON block cipher, in this paper, a novel Differential fault attack (DFA) method is presented. By inducing a random bit fault in <formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex>$L^{T-4}$</tex> </formula> (the fourth round from the last), we first demonstrate the process of identifying the fault-induced position. Then, on the basis of the determined position, we describe how to retrieve three rounds of keys by inducing only one round of faults. For retrieving the SIMON family, compared with previous DFAs under the random bit fault model, the lowest numbers of fault-induced and fault locations (or rounds) are required by our attack. In particular, when the key words m is 2 or 3, the proposed attack only needs to induce one round of faults. Finally, we carry out simulation verification and a comparison to illustrate the correctness and effectiveness of the proposed attack.

Improved differential fault attack against SIMECK based on two-bit fault model

Low-end embedded systems gain specific advantages from using lightweight block ciphers, such as the SIMECK cipher, first introduced in 2015. However, the public nature of SIMECK has led to risks of potential fault attacks. Our study scrutinizes the differential fault attack (DFA) on SIMECK. It considers the different models of byte fault, in which the ability to obtain the fault location and the cracking efficiency of the round key are studied. Both theoretical and experimental testing demonstrate the ability to discover SIMECK's master key by inducing byte faults at LT−5, with a hamming weight of two and a bit distance of five, denoted as a two-bit fault. In the cases of SIMECK 48/96 and 64/128, an attacker can pinpoint the master key with 35.15 and 33.18 faults, respectively. Our method diverges from previous methodologies by introducing the fault in an earlier round and only one round, decreasing the number of faulty ciphertexts needed. Thus, this model is more practice.

Differential fault analysis attack-tolerant hardware implementation of AES

Differential fault analysis attack-tolerant hardware implementation of AES

Efficient identity-based traceable cloud data broadcasting with outsider anonymity and simultaneous individual transmission

In recent years, cloud data broadcasting system has attracted intensive attention due to its universal applicability in various Internet-of-Things enabled real-life scenarios. Cloud data broadcasting with simultaneous individual transmission is an exciting data broadcasting variant that empowers any data broadcaster to distribute encrypted broadcast data to a subscribed consumer group and the personalized transmission to each group member simultaneously. Recently [IEEE Transactions on Broadcasting (2020)], a certificate-based data broadcasting with simultaneous individual transmission scheme (Chen et al., 2020) is proposed with the aim to solve both key-escrow problem and certificate management problem, and it is claimed to provide subscriber’s outsider anonymity under the nonstandard q-type security assumption with the existence of random oracles. Unfortunately, we can show that this most recent work of Chen et al. (2020) is not secure against insider attacks, meaning that their protocol cannot trace the system’s traitor consumers who can resell the sensitive information for their own profit without valid authorization. Besides, the design of Chen et al. (2020) has significantly high communication bandwidth that is approvingly inconvenient for the Internet-of-Things facilitated low-powerful multimedia devices to reduce unnecessary burden on the encryption costs. We design a provably secure adaptive identity-based data broadcasting technique having simultaneous individual transmission with unbounded number of consumers that can concatenate two mutually orthogonal functionalities, namely consumer’s outsider anonymity and traitor consumer traceability, in a cost-efficient way. Our framework exploits the most secure and advanced asymmetric Type-3 bilinear maps to defend against fault attacks and realizes security in the standard provable security model without the existence of any random oracle. On a positive note, our construction eliminates the q-type security assumption that is so far a plausible achievement compared to all the existing schemes in this area.

Automatic Search of Meet-in-the-Middle Differential Fault Analysis on AES-like Ciphers

Fault analysis is a powerful technique to retrieve secret keys by exploiting side-channel information. Differential fault analysis (DFA) is one of the most powerful threats utilizing differential information between correct and faulty ciphertexts and can recover keys for symmetric-key cryptosystems efficiently. Since DFA usually targets the first or last few rounds of the block ciphers, some countermeasures against DFA only protect the first and last few rounds for efficiency. Therefore, to explore how many rounds DFA can affect is very important to make sure how many rounds to protect in practice. At CHES 2011, Derbez et al. proposed an improved DFA on AES based on MitM approach, which covers one more round than previous DFAs. To perform good (or optimal) MitM DFA on block ciphers, the good (or optimal) attack configurations should be identified, such as the location where the faults inject, the matching point with differential relationship, and the two independent computation paths where two independent subsets of the key are involved. In this paper, we formulate the essential ideas of the construction of the attack, and translate the problem of searching for the best MitM DFA into optimization problems under constraints in Mixed-Integer-Linear-Programming (MILP) models. With the models, we achieve more powerful and practical DFA attacks on SKINNY, CRAFT, QARMA, PRINCE, PRINCEv2, and MIDORI with faults injected in 1 to 9 earlier rounds than the best previous DFAs.

From MLWE to RLWE: A Differential Fault Attack on Randomized &amp; Deterministic Dilithium

The post-quantum digital signature scheme CRYSTALS-Dilithium has been recently selected by the NIST for standardization. Implementing CRYSTALSDilithium, and other post-quantum cryptography schemes, on embedded devices raises a new set of challenges, including ones related to performance in terms of speed and memory requirements, but also related to side-channel and fault injection attacks security. In this work, we investigated the latter and describe a differential fault attack on the randomized and deterministic versions of CRYSTALS-Dilithium. Notably, the attack requires a few instructions skips and is able to reduce the MLWE problem that Dilithium is based on to a smaller RLWE problem which can be practically solved with lattice reduction techniques. Accordingly, we demonstrated key recoveries using hints extracted on the secret keys from the same faulted signatures using the LWE with side-information framework introduced by Dachman-Soled et al. at CRYPTO’20. As a final contribution, we proposed algorithmic countermeasures against this attack and in particular showed that the second one can be parameterized to only induce a negligible overhead over the signature generation.

Belief Propagation Meets Lattice Reduction: Security Estimates for Error-Tolerant Key Recovery from Decryption Errors

In LWE-based KEMs, observed decryption errors leak information about the secret key in the form of equations or inequalities. Several practical fault attacks have already exploited such leakage by either directly applying a fault or enabling a chosen-ciphertext attack using a fault. When the leaked information is in the form of inequalities, the recovery of the secret key is not trivial. Recent methods use either statistical or algebraic methods (but not both), with some being able to handle incorrect information. Having in mind that integration of the side-channel information is a crucial part of several classes of implementation attacks on LWEbased schemes, it is an important question whether statistically processed information can be successfully integrated in lattice reduction algorithms.We answer this question positively by proposing an error-tolerant combination of statistical and algebraic methods that make use of the advantages of both approaches. The combination enables us to improve upon existing methods – we use both fewer inequalities and are more resistant to errors. We further provide precise security estimates based on the number of available inequalities.Our recovery method applies to several types of implementation attacks in which decryption errors are used in a chosen-ciphertext attack. We practically demonstrate the improved performance of our approach in a key-recovery attack against Kyber with fault-induced decryption errors.

Loop Aborts Strike Back: Defeating Fault Countermeasures in Lattice Signatures with ILP

At SAC 2016, Espitau et al. presented a loop-abort fault attack against lattice-based signature schemes following the Fiat–Shamir with aborts paradigm. Their attack recovered the signing key by injecting faults in the sampling of the commitment vector (also called masking vector) y, leaving its coefficients at their initial zero value. As possible countermeasures, they proposed to carry out the sampling of the coefficients of y in shuffled order, or to ensure that the masking polynomials in y are not of low degree. In this paper, we show that both of these countermeasures are insufficient. We demonstrate a new loop-abort fault injection attack against Fiat–Shamir with aborts lattice-based signatures that can recover the secret key from faulty signatures even when the proposed countermeasures are implemented. The key idea of our attack is that faulted signatures give rise to a noisy linear system of equations, which can be solved using integer linear programming. We present an integer linear program that recovers the secret key efficiently in practice, and validate the efficacy of our attack by conducting a practical end-to-end attack against a shuffled version of the Dilithium reference implementation, mounted on an ARM Cortex M4. We achieve a full (equivalent) key recovery in under 3 minutes total execution time (including signature generation), using only 5 faulted signatures. In addition, we conduct extensive theoretical simulations of the attack against Dilithium. We find that our method can achieve key recovery in under 5 minutes given a (sufficiently large) set of signatures where just one of the coefficients of y is zeroed out (or left at its initial value of zero). Furthermore, we find that our attack works against all security levels of Dilithium. Our attack shows that protecting Fiat–Shamir with aborts lattice-based signatures against fault injection attacks cannot be achieved using the simple countermeasures proposed by Espitau et al. and likely requires significantly more expensive countermeasures.

Easily Overlooked Vulnerability in Implementation: Practical Fault Attack on ECDSA Round Counter

ECC is a widely used public key cryptosystem. Though it has good theoretical security, it is still vulnerable to some physical attacks due to the implementation weakness. To resist the attacks, a number of physical countermeasures have been proposed. However, there are still some implementation vulnerabilities that may be overlooked, leading to more practical and effective attacks. In this paper, we construct a new fault attack on round counter which is a component of scalar multiplications in ECDSA. The attack is divided into two parts. In the first part, the partial bits of nonce in each signature can be recovered by the fault injection on round counter. In the second part, an efficient lattice attack can be constructed to recover the private key by combining the recovered bits. Compared with other lattice-based fault attacks, our attack has the advantage of practicability and effectiveness. Especially it has less requirement of moment precision and wide applicability of scalar multiplications, which is the critical factors for practicability and effectiveness. To verify the strength of our attack, we carry on the laser injection experiments respectively on an AVR MCU(ATmega163L) and a Kintex-7 FPGA(XC7K325T). The experiment results verify the practicability and effectiveness of the attack in both software and hardware platform. Finally, we also propose two directions for efficient countermeasures against our attack.

Fault Attack Investigation on TaOx Resistive-RAM for Cyber Secure Application

Fault Attack Investigation on TaO_x Resistive-RAM for Cyber Secure Application