Information-Theoretic Approach to Optimal Differential Fault Analysis

Sakiyama, Kazuo; Li, Y.; Ohta, Kazuo; Iwamoto, Mitsugu

doi:10.1109/tifs.2011.2174984

Cited by 50 publications

(37 citation statements)

References 8 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Small differences in the fault models might crucially affect the capabilities and the complexity of the attacks [27]. Today, there is a wide range of literature on DFAs, e.g., [16,107,145].…”

Section: Symmetric Cryptographymentioning

confidence: 99%

Why Cryptography Should Not Rely on Physical Attack Complexity

Krämer

2015

T-Labs Series in Telecommunication Services

View full text Add to dashboard Cite

Ich versichere an Eides statt, dass ich diese Dissertation selbständig verfasst und nur die angegebenen Quellen und Hilfsmittel verwendet habe. Datum Für meine Eltern AbstractEver since the first side channel attacks and fault attacks on cryptographic devices were introduced in the mid-nineties, new possibilities of physical attacks have been consistently explored. The risk that these attacks pose is reduced by reacting to known attacks and by developing and implementing countermeasures against them. For physical attacks whose theory is known but which have not been conducted yet, however, the situation is different. Attacks whose physical realization is assumed to be very complex are taken less seriously. The trust that these attacks will not be realized due to their physical complexity means that no countermeasures are developed at all. This leads to unprotected devices once the assessment of the complexity turns out to be wrong.This thesis presents two practical physical attacks whose theory is known for several years. Since neither attack has previously been successfully implemented in practice, however, they were not considered a serious threat. Their physical attack complexity has been overestimated and the implied security threat has been underestimated. First, we introduce the photonic side channel, which offers not only temporal resolution, but also the highest possible spatial resolution. Due to the high cost of its first realization, it has not been taken seriously. We show both simple and differential photonic side channel analyses. Then, we present a fault attack against pairing-based cryptography. Due to the need for at least two independent precise faults in a single pairing computation, it has also not been taken seriously. We show how attackers can reveal the secret key of symmetric as well as asymmetric cryptographic algorithms based on these physical attacks. We present countermeasures on the software and the hardware level, which help to prevent these attacks in the future.Based on these two presented attacks, this thesis shows that the assessment of physical attack complexity is error-prone. Hence, cryptography should not rely on it. Cryptographic technologies have to be protected against all physical attacks, have they already been realized or not. The development of countermeasures does not require the successful execution of an attack but can already be carried out as soon as the principle of a side channel or a fault attack is understood.

show abstract

Section: Symmetric Cryptographymentioning

confidence: 99%

Why Cryptography Should Not Rely on Physical Attack Complexity

Krämer

2015

T-Labs Series in Telecommunication Services

View full text Add to dashboard Cite

show abstract

“…For everyk, an fault value e [m],(i, j),k is obtained from every injection m. Because of the SubBytes operation, the e [m],(i, j),k is quasi-random for wrong key hypotheses [48]. The fault entropy gives the entropy of the faults which is a first-order effect.…”

Section: Fault Entropy (Fe)mentioning

confidence: 99%

Security analysis of concurrent error detection against differential fault analysis

et al. 2014

View full text Add to dashboard Cite

Differential fault analysis (DFA) poses a significant threat to advanced encryption standard (AES). Only a single faulty ciphertext is required to extract the secret key. Concurrent error detection (CED) is widely used to protect AES against DFA. Traditionally, these CEDs are evaluated with uniformly distributed faults, the resulting fault coverage indicates the security of CEDs against DFA. However, DFA-exploitable faults, which are a small subspace of the entire fault space, are not uniformly distributed. Therefore, fault coverage does not accurately measure the security of the CEDs against DFA. We provide a systematic study of DFA of AES and show that an attacker can inject biased faults to improve the success rate of the attacks. We propose fault entropy (FE) and fault differential entropy (FDE) to evaluate CEDs. We show that most CEDs with high fault coverage are not secure when evaluated with FE and FDE. This work challenges the traditional use of fault coverage for uniformly distributed faults as a metric for evaluating the security of CEDs against DFA.

show abstract

“…H(∆) = H < b. Given the non-linear property of the S-box the corresponding set of errors δ i K =K * computed for all the pairs (C i ,C i ) with a wrong key shall be uniformly distributed [22]. The set of errors δ i K=K * computed with the correct key shall be non uniformly distributed; hence, the error entropy can be used for key selection.…”

Section: B Ciphertext-based Attacks Against Spnmentioning

confidence: 99%

“…A given number of randomly generated multiple bit-reset faults were injected into a randomly generated variable x and the number of different faulty values Y were used to determine the Hamming weight of the variable using formula (22). The total number of successfully determined Hamming weights was recorded for 10 5 trials and the success rate was computed for each number of faults as shown on Figure 4.…”

Section: B Hamming Weight Computationmentioning

confidence: 99%

Blind Fault Attack against SPN Ciphers

Korkikian

Pelissier

Naccache

2014

2014 Workshop on Fault Diagnosis and Tolerance in Cryptography

View full text Add to dashboard Cite

This paper presents a novel fault attack against Substitution Permutation Networks. The main advantage of the method is an absence of necessity to know the exact cipher's input and output values. The attack relies only on the number of faulty ciphertexts originated from the same unknown plaintext. The underlying model is a multiple bitset or bit-reset faults injected several times at the same intermediate round state. This method can be applied against any round thus any round key can be extracted. The attack was shown to be efficient by simulation against several SPN block ciphers.

show abstract

Information-Theoretic Approach to Optimal Differential Fault Analysis

Cited by 50 publications

References 8 publications

Why Cryptography Should Not Rely on Physical Attack Complexity

Why Cryptography Should Not Rely on Physical Attack Complexity

Security analysis of concurrent error detection against differential fault analysis

Blind Fault Attack against SPN Ciphers

Contact Info

Product

Resources

About