Abstract
Faults have been practically exploited on several occasions to compromise the security of mathematically robust cryptosystems at the implementation level. However, not every possible fault within a cryptosystem is exploitable for fault attack. Comprehensive knowledge about the exploitable part of the fault space is thus imperative for both the algorithm designer and the implementer in order to invent precise countermeasures and robust algorithms. This paper addresses the problem of exploitable fault characterization in the context of differential fault analysis attacks on block ciphers. A generic and automated framework has been proposed, which can determine the exploitability of fault instances from any given block cipher in a fast and scalable manner. Such automation is supposed to work as the core engine for analysing the fault spaces, which are, in general, difficult to characterize with manual effort due to their formidable size and the complex structural features of the ciphers. Our framework significantly outperforms another recently proposed one as reported by Khanna et.al. (in: DAC, ACM, pp. 1–6, 2017), in terms of attack class coverage and automation effort. Evaluation of the framework on AES and PRESENT establishes the efficacy of it as a potential tool for exploitable fault analysis.
This is a preview of subscription content, log in via an institution to check access.
Similar content being viewed by others
Notes
Roughly speaking, distinguishers are certain mathematical constraints over the values assumed by an intermediate state (or more specifically, constraints over the XOR difference between the correct and faulty computation of an intermediate state) of a cipher, resulting from the injection of a fault. They typically work as filters for eliminating wrong candidates reducing the entropy of the secret key.
Without loss of generality, we assume all the states to be of fixed length.
As a concrete example, in PRESENT the S-Boxes process data as 4-bit words, whereas the bit-permutation layer processes it as bits.
From now onward, we shall use the terms wrong key distinguisher and distinguisher interchangeably.
It is worth noting that Definitions 9 and 6 are equivalent. The reduction in the entropy of a state-differential implies that its underlying distribution is biased (i.e. not uniformly random). As already pointed out in Sect. 2.2.2, the constraints over state-differential variables make the underlying state-differential distribution non-uniform. This non-uniformity can be quantified via the reduction in Shannon entropy.
Set-up for the Apriori algorithm is provided in the extended version of the paper in [7].
Our prototype implementation can output such graphs in .dot format during analysis.
As the fault injection points go deeper inside the rounds (from the ciphertext side), the number of state-differentials to analyse increases. That is why we observe this linear increase in runtime.
In principle, any nonlinear operation standing between a distinguisher and a key addition layer should lead to the construction of fault difference equations for key extraction.
References
Biham, E., Shamir, A.: Differential fault analysis of secret key cryptosystems. In: CRYPTO’97, pp. 513–525 (1997)
Derbez, P., et al.: Meet-in-the-middle and impossible differential fault analysis on AES. In: CHES’11
Dusart, P., et al.: Differential fault analysis on AES. In: ACNS’03, pp. 293–306. Springer (2003)
Hall, M., et al.: The WEKA data mining software: an update. SIGKDD Explor. 11(1), 10–18 (2009)
Jeong, K., et al.: Improved differential fault analysis on PRESENT-80/128. Int. J. Comput. Math. 90(12), 2553–2563 (2013)
Khanna, P., et al.: XFC: a framework for eXploitable fault characterization in block ciphers. In: DAC. pp. 1–6. ACM (2017)
Saha, S., et al.: Differential fault analysis automation. IACR Cryptology ePrint Archive. http://eprint.iacr.org/2017/673 (2017)
Tunstall, M., et al.: Differential fault analysis of the advanced encryption standard using a single fault. In: WISTP’11, pp. 224–233. Springer (2011)
Zhang, F., et al.: A framework for the analysis and evaluation of algebraic fault attacks on lightweight block ciphers. IEEE Trans. Inf. Forensics Secur. 11(5), 1039–1054 (2016)
Barthe, G., et al.: Synthesis of fault attacks on cryptographic implementations. In: ACMCCS 2014, pp. 1016–1027. ACM (2014)
Banik, S., et al.: GIFT: a small PRESENT. In: CHES 2017, pp. 321–345. Springer (2017)
Ghalaty, N.F., et al.: Differential fault intensity analysis. In: FDTC 2014, pp. 49–58. IEEE (2014)
Saha, S., et al.: ExpFault: an automated framework for exploitable fault characterization in block ciphers IACR Trans. Cryptogr. Hardw. Embed. Syst. 2018(2), 242–276 (2018)
Author information
Authors and Affiliations
Corresponding author
Additional information
Publisher's Note
Springer Nature remains neutral with regard to jurisdictional claims in published maps and institutional affiliations.
Rights and permissions
About this article
Cite this article
Saha, S., Kumar, U., Mukhopadhyay, D. et al. An automated framework for exploitable fault identification in block ciphers. J Cryptogr Eng 9, 203–219 (2019). https://doi.org/10.1007/s13389-019-00203-9
Received:
Accepted:
Published:
Issue Date:
DOI: https://doi.org/10.1007/s13389-019-00203-9