Fault Injection Resilience

Abstract

Abstract-Fault injections constitute a major threat to the security of embedded systems. Errors occurring in the cryptographic algorithms have been shown to be extremely dangerous, since powerful attacks can exploit few of them to recover the full secrets. Most of the resistance techniques to perturbation attacks have relied so far on the detection of faults. We present in this paper another strategy, based on the resilience against fault attacks. The core idea is to allow an erroneous result to be outputted, but with the assurance that this faulty information conveys no information about the secrets concealed in the chip. We first underline the benefits of FIR: false positive are never raised, secrets are not erased uselessly in case of uncompromising faults injections, which increases the card lifespan if the fault is natural and not malevolent, and FIR enables a high potential of resistance even in the context of multiple faults. Then we illustrate two families of fault injection resilience (FIR) schemes suitable for symmetric encryption. The first family is a protocollevel scheme that can be formally proved resilient. The second family mobilizes a special logic-level architecture of the cryptographic module. We notably detail how a countermeasure of this later family, namely dual-rail with precharge logic style, can both protect both against active and passive attacks, thereby bringing a combined global protection of the device. The cost of this logic is evaluated as lower than detection schemes. Finally, we also give some ideas about the modalities of adjunction of FIR to some certification schemes.

Improving CPA Attack Against DSA and ECDSA

“…There are also some works using evolution and genetic algorithms [11]. Very powerful attacks are also active side-channel-attacks, namely Fault Injection Attacks (FIA) [12,13], and hardware trojan horses [14].…”

Vade mecum on side-channels attacks and countermeasures for the designer and the evaluator

“…Also, hiding is a countermeasure against most fault injection attacks since the attacker erases the value stored redundantly in one pair of wires by changing only one of them. The case of symmetric faults is covered in [38] and of arbitrary faults in [39]. An interesting noting is that by associating masking and hiding, the protection extends to semi-invasive and invasive attacks.…”

System-Level Methods to Prevent Reverse-Engineering, Cloning, and Trojan Insertion

“…Typically, the bitstream decryption in Xilinx FPGAs is sent to the fabric (thus becoming non-functional), but the attacker cannot know which fault has been triggered (it remains internal to the FPGA). Also, if a mode of operation is used in way secure way (an initialization vector is refreshed each time), then it is difficult to observe both a correct and a faulty ciphertext; this is the root of the fault injection resilience countermeasure introduced in [14]. Now, secrets can be recovered from a circuit by various means:…”

“…Also, differential attacks (such as DFA [4]) require a correct and at least one [28] faulty cryptogram. This approach is similar to resilient countermeasures: the secret is made volatile [17], as well as the data [15]. We emphasize that for this class of countermeasure to be efficient, a tamper-resistant TRNG (True Random Number Generator) shall be available.…”