Differential Fault Analysis of SHA-3 Under Relaxed Fault Models

Abstract

Keccak-based algorithms such as Secure Hash Algorithm-3 (SHA-3) will be widely used in cryptosystems, and evaluating their security against different kinds of attacks is vitally important. This paper presents an efficient differential fault analysis (DFA) method on all four modes of SHA-3 to recover an entire internal state, which leads to message recovery in the regular hashing mode and key retrieval in the message authentication code (MAC) mode. We adopt relaxed fault models in this paper, assuming the attacker can inject random single-byte faults into the penultimate round input of SHA-3. We also propose algorithms to find the lower bound on the number of fault injections needed to recover an entire internal state for the proposed attacks. Results show that on average, the attacker needs about 120 random faults to recover an internal state, while he needs 17 faults at best if he has control of the faults injected. The proposed attack method is further extended for systems with input messages longer than the bitrate.

Genetic Algorithm-Based Electromagnetic Fault Injection

“…Attacks do exist, but only simulated ones: [23] show that differential fault analysis (DFA) can be used to recover the complete state in around 80 faults on average, if the attacker is able to inject single-bit faults in the input of the penultimate round (i.e., θ 22 i ), though they rely on brute-forcing the last few bits. According to [24] (itself an extension of [25]), this is around 500 single-bit random faults for the whole state. [24] generalize the attack to a single-byte fault model, recovering the state in around 120 random faults.…”

Lightweight Cryptographic Hash Functions: Design Trends, Comparative Study, and Future Directions

“…These types of attacks are also called side-channel attacks. One example of a side-channel attack is differential fault analysis (DFA), which is commonly used with cryptographic hash functions [128]- [131]. The principle of the attack is to push errors or faults with unforeseen environmental conditions into the cryptographic implementation to reveal its internal state.…”

Optimizing Electromagnetic Fault Injection with Genetic Algorithms

“…The authors show that differential fault analysis (DFA) can be used to recover the complete state in around 80 faults on average if the attacker is able to inject single-bit faults in the input of the penultimate round (i.e., θ 22 i ), though they rely on brute-forcing the last few bits. According to [16] (itself an extension of [15]), this is around 500 singlebit random faults for the whole state. The work in [16] generalizes the attack to a single-byte fault model, recovering the state in around 120 random faults.…”

“…According to [16] (itself an extension of [15]), this is around 500 singlebit random faults for the whole state. The work in [16] generalizes the attack to a single-byte fault model, recovering the state in around 120 random faults. Algebraic fault analysis (AFA) seems more promising.…”

“…Algebraic fault analysis (AFA) seems more promising. Luo et al manage to bring down the number of faults needed to recover the internal state with SHA3-512 down to under 10 with AFA and the 32-bit fault model in the progress described in [15][16][17].…”