Novel Fault Injection Attack without Artificial Trigger
Source abstract
Abstract
Theoretical process of fault injection attacks is defined as a process of recovering a secret key assuming that an attacker can inject faults into a specific targeted operation. Therefore, an artificial triggering is required to execute such an attack. However, when conducting analysis on real devices, artificial triggering needs to rely on a powerful assumption, such as manipulation of internal codes. In this paper, we propose a novel fault injection system using Input/Output (I/O) signals of target devices as a trigger for relaxing an attacker assumption. This system does not require an implementation of artificial triggering as input signals are used as a trigger in transmission of plaintexts for fault injection attacks. As a result, the attacker can perform fault injection attacks concerning the entire encryption process. To decide the fault injection time based on the trigger, the proposed system applies simple power analysis (SPA), employing electromagnetic emission of target devices. Considering that the fault injection time identified by SPA can be relatively vague compared with that obtained using a system based on an artificial triggering, we address this problem by proposing a process to recover the secret key without knowing the byte index of an injected fault.
Source: crossref · Quality: baseline
Research context
OpenAlex topics: Cryptographic Implementations and Security · Physical Unclonable Functions (PUFs) and Hardware Security · Advanced Malware Detection Techniques
SciVX discovery tags are terminology-based. OpenAlex topics are source-provided classifications.
Affiliations
Department of Financial Information Security, Kookmin University, 77 Jeongneung-ro, Seongbuk-gu, Seoul 02707, Korea
Funding
Agency for Defense Development
References (22)
Show source-provided references
1. Kocher, P.C. (1996). Timing attacks on implementations of Diffie-Hellman, RSA, DSS, and other systems. Annual International Cryptology Conference, Springer.10.1007/3-540-68697-5_9 ↗
2. Boneh, D., DeMillo, R.A., and Lipton, R.J. (1997). On the importance of checking cryptographic protocols for faults. International Conference on the Theory and Applications Of Cryptographic Techniques, Springer.10.1007/3-540-69053-0_4 ↗
3. Dusart, P., Letourneux, G., and Vivolo, O. (2003). Differential fault analysis on AES. International Conference on Applied Cryptography and Network Security, Springer.10.1007/978-3-540-45203-4_23 ↗
4. Chen, C.N., and Yen, S.M. (2003). Differential fault analysis on AES key schedule and some countermeasures. Australasian Conference on Information Security and Privacy, Springer.10.1007/3-540-45067-X_11 ↗
5. Blömer, J., and Seifert, J.P. (2003). Fault based cryptanalysis of the advanced encryption standard (AES). International Conference on Financial Cryptography, Springer.10.1007/978-3-540-45126-6_12 ↗
6. Giraud, C. (2004). Dfa on aes. International Conference on Advanced Encryption Standard, Springer.10.1007/11506447_4 ↗
7. (2020, May 30). Arduino Uno Rev3. Available online: https://store.arduino.cc/usa/arduino-uno-rev3.
8. Hong, D., Sung, J., Hong, S., Lim, J., Lee, S., Koo, B.S., Lee, C., Chang, D., Lee, J., and Jeong, K. (2006). HIGHT: A new block cipher suitable for low-resource device. International Workshop on Cryptographic Hardware and Embedded Systems, Springer.10.1007/11894063_4 ↗
9. A Differential Fault Attack against Block Cipher HIGHT
10. Kwon, D., Kim, J., Park, S., Sung, S.H., Sohn, Y., Song, J.H., Yeom, Y., Yoon, E.J., Lee, S., and Lee, J. (2003). New block cipher: ARIA. International Conference on Information Security and Cryptology, Springer.
11. Improved Differential Fault Analysis on ARIA using Small Number of Faults
12. Hong, D., Lee, J.K., Kim, D.C., Kwon, D., Ryu, K.H., and Lee, D.G. (2013). LEA: A 128-bit block cipher for fast encryption on common processors. International Workshop on Information Security Applications, Springer.10.1007/978-3-319-05149-9_1 ↗
13. Jap, D., and Breier, J. (2015). Differential fault attack on LEA. Information and Communication Technology-EurAsia Conference, Springer.10.1007/978-3-319-24315-3_27 ↗
14. The SIMON and SPECK Families of Lightweight Block Ciphers
15. Tupsamudre, H., Bisht, S., and Mukhopadhyay, D. (2014, January 23). Differential fault analysis on the families of SIMON and SPECK ciphers. Proceedings of the 2014 Workshop on Fault Diagnosis and Tolerance in Cryptography, Busan, Korea.10.1109/FDTC.2014.14 ↗
16. Koo, B., Roh, D., Kim, H., Jung, Y., Lee, D.G., and Kwon, D. (2017). CHAM: A family of lightweight block ciphers for resource-constrained devices. International Conference on Information Security and Cryptology, Springer.
17. Fault Injection Attack on Lightweight Block Cipher CHAM
18. Derouet, O. (2007, January 10). Secure smartcard design against laser fault injection. Proceedings of the 4th Workshop on Fault Diagnostic and Tolerance in Cryptography, Vienne, Autriche.
19. (2020, May 30). Spider. Available online: https://getquote.riscure.com/en/quote/2101116/spider.htm.
20. (2020, May 30). EM-FI Transient Probe. Available online: https://getquote.riscure.com/en/quote/2101068/em-fi-transient-probe.htm.
21. (2020, May 30). Inspector Subscription FI Professional. Available online: https://getquote.riscure.com/en/quote/2101094/inspector-subscription-fi-professional.htm.
22. (2020, May 30). XYZ Stage. Available online: https://getquote.riscure.com/en/quote/2101124/xyz-stage-emps-em-fi-and-compact-laser.htm.