Improving DFA attacks on AES with unknown and random faults

Abstract

Differential fault analysis (DFA) aiming at the advanced encryption standard (AES) hardware implementations has become a widely research topic. Unlike theoretical model, in real attack scenarios, popular and practical fault injection methods like supply voltage variation will introduce faults with random locations, unknown values and multibyte. For analyzing this kind of faults, the previous fault model needed six pairs of correct and faulty ciphertexts to recover the secret round-key. In this paper, on the premise of accuracy, a more efficient DFA attack with unknown and random faults is proposed. We introduce the concept of theoretical candidate number in the fault analysis. Based on this concept, the correct round-key can be identified in advance, so the proposed attack method can always use the least pairs of correct and faulty ciphertexts to accomplish the DFA attacks. To further support our opinion, random fault attacks based on voltage violation were taken on an FPGA board. Experiment results showed that about 97.3% of the attacks can be completed within 3 pairs of correct and faulty ciphertexts. Moreover, on average only 2.17 pairs of correct and faulty ciphertexts were needed to find out the correct round-key, showing significant advantage of efficiency compared with previous fault models. On the other hand, less amount of computation in the analyses can be realized with a high probability with our model, which also effectively improves the time efficiency in DFA attacks with unknown and random faults.

创新点

在针对AES算法的随机类型故障, 传统的多字节故障模型需要分析6个故障密文才能恢复正确的四字节密钥。为了提高分析效率, 本文提出了一种针对随机类型故障的高效率差分分析算法。在保证分析准确性的前提下, 我们利用理论密钥候选值数量的概念, 设计了一种新的故障分析算法, 该算法能够根据实际的故障注入情况, 用最少的故障密文数提前恢复密钥, 并有效减小计算复杂度。针对AES算法的实际攻击结果表明, 该算法平均只需要分析2.17个故障密文即可恢复密钥, 并且97.3%的故障攻击实例都能在3组故障密文分析内完成攻击, 有效提高了分析效率。