Differential Fault Attack against Grain Family with Very Few Faults and Minimal Assumptions

Abstract

Abstract. The series of published works, related to Differential Fault Attack (DFA) against the Grain family, require (i) quite a large number (hundreds) of faults (around n ln n, where n = 80 for Grain v1 and n = 128 for Grain-128, Grain-128a) and also (ii) several assumptions on location and timing of the fault injected. In this paper we present a significantly improved scenario from the adversarial point of view for DFA against the Grain family of stream ciphers. Our model is the most realistic one so far as it considers that the cipher to be re-keyed a very few times and fault can be injected at any random location and at any random point of time, i.e., no precise control is needed over the location and timing of fault injections. We construct equations based on the algebraic description of the cipher by introducing new variables so that the degrees of the equations do not increase. In line of algebraic cryptanalysis, we accumulate such equations based on the fault-free and faulty key-stream bits and solve them using the SAT Solver Cryptominisat-2.9.5 installed with SAGE 5.7. In a few minutes we can recover the state of Grain v1, Grain-128 and Grain-128a with as little as 10, 4 and 10 faults respectively (and may be improved further with more computational efforts).

Stealthy Hardware Trojan Based Algebraic Fault Analysis of HIGHT Block Cipher

“…The basic idea of AFA is to convert both the cipher and the injected faults into algebraic equations and recover the secret key with automated solvers such as SAT instead of the manual analysis on fault propagations in DFA, hence making it easier to extend AFA to deep rounds and different ciphers and fault models. AFA has been successfully used to improve DFA on the stream ciphers such as Trivium [19] and Grain [20] and block ciphers such as AES [21], LED [22,23], KASUMI [24], and Piccolo [25].…”

“…We notice that this issue was already explored from a theoretical point of view in [41]. And a worst case lower bound on the number of queries ( , ) to solve (16) is a constant 3, and the corresponding number of queries (0, ) to solve (20) in the worst case is (8 − ), where t is the position of the least significant "1" of and 0 ≤ ≤ 7.…”

“…And there are 5 candidate locations ( , ) = {(25, 0), (25,1), (25,2), (25,3), (25,4)} and each of them is tested by AFA to get the optimal location for the HT. According to the equations for addition mod2 in Section 6.2.1, the most significant bit of and for (19) and (20) can be never recovered for no observation which can be made about the most significant bit of . Thus, there are multiple solutions for (19) and (20); that is, multiple candidates for MK will be collected by solving the merged equation system with an SAT solver.…”

“…According to the equations for addition mod2 in Section 6.2.1, the most significant bit of and for (19) and (20) can be never recovered for no observation which can be made about the most significant bit of . Thus, there are multiple solutions for (19) and (20); that is, multiple candidates for MK will be collected by solving the merged equation system with an SAT solver. To determine MK uniquely, a distinguisher is required to further filter the MK candidates.…”

Improved Greedy Nonrandomness Detectors for Stream Ciphers

“…In (Banik et al, 2013) the authors present a related-key key attack requiring > 2 32 related keys, and > 2 64 chosen IVs, while in (Sarkar et al, 2015) the authors present a differential fault attack against all the three ciphers in the Grain-family.…”