Infective Computation and Dummy Rounds: Fault Protection for Block Ciphers without Check-before-Output

Abstract

Abstract. Implementation attacks pose a serious threat for the security of cryptographic devices and there are a multitude of countermeasures that are used to prevent them. Two countermeasures used in implementations of block ciphers to increase the complexity of such attacks are the use of dummy rounds and redundant computation with consistency checks to prevent fault attacks. In this paper we present several countermeasures based on the idea of infective computation. Our countermeasures ensure that a fault injected into a cipher, dummy, or redundant round will infect the ciphertext such that an attacker cannot derive any information on the secret key being used. This has one clear advantage: the propagation of faults prevents an attacker from being able to conduct any fault analysis on any corrupted ciphertexts. As a consequence, there is no need for any test at the end of an implementation to determine if a fault has been injected and a ciphertext can always be returned.

Fault analysis in cryptography

“…This attack can said to be successful when the attacker will be able to know the plaintext from the cipher text he knows. Mainly encryption key can be known with the help of this attack Morden cryptosystem are guarded against COA [15].…”

Using linear codes as a fault countermeasure for nonlinear operations: application to AES and formal verification

“…Recently Gierlichs et al [18] and then Tupsamudre et al [39] published an AES countermeasure that consists in infecting the result in the presence of fault in order to make it nonexploitable by an attacker.…”

Fault Tolerant Infective Countermeasure for AES

“…However, deterministic diffusion-based infective countermeasures are vulnerable to attack as demonstrated by Lomné et al [8]. A random variation of the infective countermeasure was proposed by Gierlichs et al [9]. However, the infection method employed by this countermeasure has a number of shortcomings, as demonstrated by Battistello and Giraud [10], and in greater detail by Tupsamudre et al [11].…”

“…However, the infection method employed by this countermeasure has a number of shortcomings, as demonstrated by Battistello and Giraud [10], and in greater detail by Tupsamudre et al [11]. Tupsamudre et al have also proposed an improved infective countermeasure that avoids all the pitfalls of [9] and is claimed to thwart DFA.…”