Fault attacks pose a potent threat to modern cryptographic implementations, particularly those used in physically approachable embedded devices in IoT environments. Information security in such resource-constrained devices is ensured using lightweight ciphers, where combinational circuit implementations of SBox are preferable over look-up tables as they are more efficient regarding area, power, and memory requirements. Most existing fault analysis techniques focus on fault injection in memory cells and registers. Recently, a novel fault model and analysis technique, namelySemi-Permanent Stuck-At(SPSA) fault analysis, has been proposed to evaluate the security of ciphers with combinational circuit implementation ofSubstitution layerelements, SBox. In this work, we propose optimized techniques to recover the key in a minimum number of ciphertexts in such implementations of lightweight ciphers. Based on the proposed techniques, a key recovery attack on the NIST lightweight cryptography (NIST-LWC) standardization process finalist,ElephantAEAD, has been proposed. The proposed key recovery attack is validated on two versions ofElephantcipher. The proposed fault analysis approach recovered the secret key within 85–240 ciphertexts, calculated over 1,000 attack instances. To the best of our knowledge, this is the first work on fault analysis attacks on theElephantscheme. Furthermore, an optimized combinational circuit implementation ofSpongentSBox (SBox used inElephantcipher) is proposed, having a smaller gate count than the optimized implementation reported in the literature. The proposed fault analysis techniques are validated on primary and optimized versions ofSpongentSBox through Verilog simulations. Further, we pinpoint SPSA hotspots in the lightweightGIFTcipher SBox architecture. We observe thatGIFTSBox exhibits resilience toward the proposed SPSA fault analysis technique under the single fault adversarial model. However,eightSPSA fault patterns reduce the nonlinearity of the SBox to zero, rendering it vulnerable to linear cryptanalysis. Conclusively, SPSA faults may adversely affect the cryptographic properties of an SBox, thereby leading to trivial key recovery. TheGIFTcipher is used as an example to focus on two aspects: (i) its SBox construction is resilient to the proposed SPSA analysis and therefore characterizing such constructions for SPSA resilience and (ii) an SBox even though resilient to the proposed SPSA analysis, may exhibit vulnerabilities toward other classical analysis techniques when subjected to SPSA faults. Our work reports new vulnerabilities in fault analysis in the combinational circuit implementations of cryptographic protocols.
Read full abstract