Right or wrong collision rate analysis without profiling: full-automatic collision fault attack

Abstract

In CHES 2010, Fault Sensitivity Analysis (FSA) on Advanced Encryption Standard (AES) hardware circuit based on S-box setup-time acquired by injecting clock glitches is proposed. Soon after, some improvements of FSA were presented such as colliding timing characteristics from Moradi et al. However, the acquisition of timing characteristics requires complex procedure due to the very gradual decrease of clock glitch cycle and the heavy requirements of setup-time samples. In HOST 2015, Wang et al. presented template-based right or wrong collision rate attack to improve the efficiency of FSA, but its profiling and plaintexts-choice procedures required too many encryptions. In this paper, we fix only one specific clock glitch cycle, and take the right or wrong collision rate as a collision distinguisher. So, the whole process is a non-profiling collision attack which can be executed automatically without massive pre-computations and interactions between PC and signal generator. According to the experiments, 256 encryptions are enough for exactly deciding whether two plaintext bytes can induce an S-box collision. Compared with the existing power analysis and FSA-based attacks on AES hardware, it costs negligible time (about 6.65 s) and storage space (only one byte), and no offline computations for finding the collision between two masked S-boxes. Furthermore, our study shows that the signal-to-noise ratio in FSA-based attacks is much higher than power-based attacks.

Adaptive Chosen-Plaintext Collision Attack on Masked AES in Edge Computing

“…In 2015, Wang et al [27] mounted collision attacks on masked AES implemented on a smart card. Right or wrong collision rate was used as a distinguisher to detect collision by Wang et al [28] in 2018. So far, most existing collision detection algorithms detect collisions by searching the values of candidate plaintext byte exhaustively, which have a lot improving space in our view.…”

Correlation leakage analysis based on masking schemes

“…The efficiency of the second-order DPA greatly depends on the combining function it employs and the leakage model it constructs, but the combining function is just an approximate representation of the leakage. Collision attack [5][6][7] is another extensively applied method for achieving an attack on masked implementations. Clavier et al [5] utilized the reuse of masks to show the relationship among masked data in various substitution boxes (s-boxes) to perform the collision.…”