Abstract:Persistent Fault Analysis (PFA) is a powerful analysis technique proposed in CHES 2018, which utilizes those faults that are injected before execution and persist throughout the encryption. However, when it is applied to the block cipher which has multiple S-boxes, the key can not be recovered in just one attack. The adversary has to conduct the fault attack several times and inject faults into all the distinct S-boxes. In this paper, we propose Key Schedule Guided Persistent Fault Attack (KGPFA), which utilizes the key schedule to guide the fault injection and fault analysis. By analyzing the key schedule, KGPFA exploits the relations between the key leakages caused by the same faulty S-box in various rounds. It can reduce the number of attacks and the number of faults required to recover the key. Our major contributions are twofold. Firstly, in the fault injection step, we provide Key Schedule Guided Persistent Fault Injection (KGPFI) strategies to reduce the number of attacks and the number of faults under the assumption of both ciphertext-only and known-plaintext attacks. Secondly, in the fault analysis step, as our target ciphers are Feistel-based, we propose the Ineffective Algebraic Persistent Fault Analysis (IAPFA) to extend the usage of Algebraic Persistent Fault Analysis (APFA) in the ineffective persistent fault setting. To demonstrate the effectiveness of our technique, we apply KGPFA to four widely used block ciphers with multiple S-boxes, DES, 3DES, LBlock, and Camellia. In our experiment, in the ciphertext-only attack, the key of DES can be recovered with 300 ineffective ciphertexts (coresponding to 827 ciphertexts) and four faulty S-boxes within 12.18min. Under the assumption of known-plaintext, the key of DES is recovered within two faulty S-boxes in 2.34h. For LBlock, the key is recovered with two faulty S-boxes and 100 ineffective ciphertexts (coresponding to 6211 ciphertexts) in 1.16min.

Novel Fault Injection Attack without Artificial Trigger

Optimized Lightweight Hardware Trojan-Based Fault Attack on DES

GhostType: the Limits of Using Contactless Electromagnetic Interference to Inject Phantom Keys into Analog Circuits of Keyboards

Fiddling the Twiddle Constants - Fault Injection Analysis of the Number Theoretic Transform.

Electromagnetic fault injection against a System-on-Chip, toward new micro-architectural fault models

Low-cost Design of Stealthy Hardware Trojan for Bit-Level Fault Attacks on Block Ciphers

Experimental evaluation of two software countermeasures against fault attacks

A Novel Approach of a Low-Cost Voltage Fault Injection Method for Resource-Constrained IoT Devices: Design and Analysis

FaultMorse: an Automated Controlled-Channel Attack Via Longest Recurring Sequence

VoltJockey: Breaking SGX by Software-Controlled Voltage-Induced Hardware Faults

Electromagnetic fault injection: towards a fault model on a 32-bit microcontroller

Fault Injection Attacks Utilizing Waveform Pattern Matching against Neural Networks Processing on Microcontroller

AFIA: ATPG-Guided Fault Injection Attack on Secure Logic Locking

Analysis of an Optimal Fault Attack on the LED-64 Lightweight Cryptosystem.

Key Schedule Guided Persistent Fault Attack

Fault Injection on Embedded Neural Networks: Impact of a Single Instruction Skip

Physical and Software Based Fault Injection Attacks Against TEEs in Mobile Devices: A Systemisation of Knowledge

A Hierarchical Fault Injection System for RISC-V Processors Targeting Single Event Upsets in Flip-Flops

Key‐leakage Hardware Trojan with Super Concealment Based on the Fault Injection for Block Cipher of SM4

Sensitivity of Standard Library Cells to Optical Fault Injection Attacks in IHP 250 nm Technology

FAULT+PROBE: A Generic Rowhammer-based Bit Recovery Attack