Differential fault analysis on the lightweight block cipher plug‐in plug‐out

Algebraic fault analysis (AFA), which combines algebraic cryptanalysis with fault attacks, has represented serious threats to the security of lightweight block ciphers. Inspired by an earlier framework for the analysis of side-channel attacks presented at EUROCRYPT 2009, a new generic framework is proposed to analyze and evaluate algebraic fault attacks on lightweight block ciphers. We interpret AFA at three levels: the target, the adversary, and the evaluator. We describe the capability of an adversary in four parts: the fault injector, the fault model describer, the cipher describer, and the machine solver. A formal fault model is provided to cover most of the current fault attacks. Different strategies of building optimal equation set are also provided to accelerate the solving process. At the evaluator level, we consider the approximate information metric and the actual security metric. These metrics can be used to guide adversaries, cipher designers, and industrial engineers. To verify the feasibility of the proposed framework, we make a comprehensive study of AFA on an ultra-lightweight block cipher called LBlock. Three scenarios are exploited which include injecting a fault to encryption, to key scheduling, or modifying the round number or counter. Our best results show that a single fault injection is enough to recover the master key of LBlock within the affordable complexity in each scenario.

Differential fault analysis (DFA) has already been applied to attack many block ciphers with the help of inducing some faults at the last few rounds of block ciphers. Currently, a general countermeasure against DFA is to protect the last few rounds of block ciphers by means of redundancy. In this paper, we present a new fault attack on block ciphers called linear fault analysis (LFA), in which linear characteristics for some consecutive rounds of a block cipher will be utilized instead of exploiting differential distributions of S-Boxes within the block cipher in DFA. Basically, the new approach can handle the case that faults are induced several rounds earlier compared to DFA, thus leading to a threat to the protected implementations (against DFA) of block ciphers. For the purpose of illustration, we mount an effective attack on SERPENT by adopting LFA and achieve a good cryptanalytic result on SERPENT. We hope that our work enriches the picture on the applicability of fault attacks to block ciphers and could be beneficial to the security evaluation of block ciphers.

Literature on Differential Fault Analysis (DFA) on AES-128 shows that it is more difficult to attack AES when the fault is induced in the key schedule, than when it is injected in the intermediate states. Recent research shows that DFA on AES key schedule still requires two faulty cipher texts, while it requires only one faulty cipher text and a brute-force search of $2^8$ AES-128 keys when the fault is injected inside the round of AES. The present paper proposes a DFA on AES-128 key schedule which requires only one single byte fault and a brute-force search of $2^8$ keys, showing that a DFA on AES key schedule is equally dangerous as a fault analysis when the fault is injected in the intermediate state of AES. Further, the fault model of the present attack is a single byte fault. This is more realistic than the existing fault model of injecting three byte faults in a column of the AES key which has a less chance of success. To the best of our knowledge the proposed attack is the best known DFA on AES key schedule and requires minimum number of faulty cipher text. The simulated attack, running on 3GHz Intel Core 2 Duo desktop machine with 2GB RAM, takes around 35 minutes to reveal the secret key.

Differential fault analysis on the contracting UFN structure, with application to SMS4 and MacGuffin

This paper proposes a fault analysis technique on LED by combining algebraic cryptanalysis and differential fault analysis (DFA). The technique is called algebraic differential fault analysis (ADFA). In ADFA on LED, we use DFA to deduce the possible fault differences of the correct and faulty S-Box input in the last round, and convert them into algebraic equations. We then combine the equation set of LED with the injected fault and use the CryptoMiniSat solver to recover the secret key. Our experiments show that, on a common PC, ADFA can succeed on LED under the nibble-based fault model within three minutes and with only one fault injection, which is more efficient than previous DFA work. To evaluate DFA on LED, we first propose an improved evaluation algorithm of DFA, then provide a modified ADFA approach to compute the solutions for the secret key. The results are more accurate than previous work. We also successfully extend ADFA on LED to other fault models using a single fault injection, where traditional DFAs are difficult to launch.

The integration of wireless sensor nodes (WSNs) in the Internet of things (IoT) may generate new security challenges for establishing secure channels between low-power sensor nodes and Internet hosts. It includes a bunch of challenges right from redefining the existing ones from scratch of legacy codes to the current trend of proposing and designing new key establishment and authentication protocols. This paper is the successful attempt in resource constraint environment like wireless sensor network (WSN) to integrate cipher authentication and lightweight key management solutions in one bundle so that it can be deployed in IoT domains WSN is also a part of IoT. The cipher should be authenticated, lightweight, and should be flexible to use in the cryptanalysis. The cipher gives the better authentication techniques and performance but limited to the flexibility. Lightweight block cipher (LBC) uses less computation and secures the data with low computational cost and it is used for many purposes like radio-frequency identification (RFID) tags and sensor network nodes. Advanced Encryption Standard is applied in many devices for the encryption, but it cannot be applied to the smaller embedded devices like wearable devices, etc. LBC works for the many devices with low resources, and research on the LBC has been increased. In this research, Data Encryption Standard (DES) and analyzed algorithm are used to increase the efficiency in terms of solving time and Improved Fault Analysis (IAFA) is used to increases the security of the LBC in wireless sensor node for IoT.

Basically, Differential Fault Analysis (DFA) against ciphers consists of two stages: fault induction and fault exploitation. Success rate of the latter strongly depends upon the availability of the required type of some faulty ciphertexts, which typically assumes that adversaries have precise control over the location, timing and/or even the type of the fault induced. In view of this, there seems to be a technical gap between these two stages. In this paper, by amplifying the fault propagation pattern inherent in block ciphers, we propose an algorithmic method to narrow this gap, or to relax the underlying assumption. Our method provides a faulty ciphertext filtering process between two basic stages in DFA. This additional process equips adversaries with the capabilities to deterministically decide whether or not one faulty ciphertext is relevant to a specific DFA, before or without performing DFA itself. We take AES as a concrete case of study and conduct theoretical analysis and simulation experiments as well, the results of which strongly demonstrate the validity and power of our proposed filtering method.

Lightweight block ciphers are proposed for Internet of Things (IoT) edge devices to ensure secure data transmission with limited resources. However, past research has been designed on ideal channel models, disregarding the possibility of ciphertext errors caused by channel interference during actual transmission. This omission poses difficulties in ensuring the reliability of the ciphertext, especially in the Internet of Medical Things (IoMT) where resources are limited and data accuracy requirements are high. Designing a highly secure and reliable lightweight block cipher for such situations is one of the most challenging tasks. Hence, we propose a lightweight block cipher ECLBC with error detection and correction mechanisms. For security, ECLBC not only achieves a certain security level in fewer rounds but also achieves a mode transition within AND-Rotation-XOR (AND-RX) lightweight block ciphers. This transition involves a shift from the Feistel to the Substitution-Permutation Network (SPN) and from half-round key XOR to full-round key XOR. For reliability, ECLBC supports detecting and correcting erroneous ciphertext due to channel interference. Given the resource-constrained nature of IoMT devices, we implement the detection and correction mechanism of ECLBC based on the linear block code. Finally, various classical cryptography methods are employed to analyze the performance and security of the ECLBC.

PRESENT is a hardware-optimized 64-bit lightweight block cipher which supports 80- and 128-bit secret keys. In this paper, we propose a differential fault analysis (DFA) on PRESENT-80/128. The proposed attack is based on a 2-byte random fault model. In detail, by inducing several 2-byte random faults in input registers after 28 rounds, our attack recovers the secret key of the target algorithm. From simulation results, our attacks on PRESENT-80/128 can recover the secret key by inducing only two and three 2-byte random faults, respectively. These are superior to known DFA results on them.

Efficiency is essential in lightweight cryptography to ensure robust protection within constrained environments. This paper introduces a lightweight block cipher built on a Non-Linear Feedback Shift Register (NFSR), referred to as the NFSR-Based Block Cipher (NFBC). The cipher is designed for constrained environments where both efficiency and strong security are critical. NFBC operates as a Nonce-based Authenticated Encryption with Associated Data (NAEAD) scheme, providing confidentiality and authenticity within a single framework. The design achieves robust protection while maintaining minimal hardware overhead. NFBC operates on 128-bit data, key, and nonce sizes, fully aligning with National Institute of Standards and Technology (NIST) lightweight cryptography requirements. The design integrates a Non-Linear Feedback Shift Register (NFSR) for generating high-entropy round subkeys, dynamic chaotic substitution box (S-boxes) for strong confusion, and a Group Permutation (GRP) mechanism that ensures rapid diffusion with hardware-friendly efficiency. Security is rigorously evaluated across multiple dimensions. NFBC passes all 15 NIST Statistical Test Suite (STS) tests, achieves near-ideal avalanche and Bit Independence Criterion (BIC), and demonstrates consistently high nonlinearity across 200 independent chaotic S-box instances. The S-box achieves a maximum differential probability of 10/256 and maximum linear probability of (72/256)^{2}, confirming strong resistance to classical attacks. To strengthen theoretical guarantees, a provable branch-number analysis is introduced, establishing conservative lower bounds on active S-boxes (ge 45 across 20 rounds), with corresponding differential and linear probabilities that are vanishingly small. Formal AEAD security is ensured through an Encrypt-then-MAC (EtM) construction. Implementation on a Xilinx Artix-7 FPGA confirms practicality: NFBC achieves superior throughput-per-area compared to several NIST Round-2 lightweight candidates (SPOC, SPOOK, GIFT-COFB, ESTATE, SAEAES, Oribatida) and CAESAR finalists (Ascon-128, Ascon-small, CLOC-AES, SILC-AES). Estimated countermeasure overheads for masking and fault detection demonstrate feasibility against side-channel and fault attacks. These results confirm NFBC as a secure, efficient, and practically deployable lightweight cryptographic solution.

Differential fault analysis (DFA) finds the key of a block cipher using differential information between correct and faulty ciphertexts obtained by inducing faults during the computation of ciphertexts. Among many ciphers, advanced encryption standard (AES) has been the main target of DFA due to its popularity. The naive implementation of AES is known to be vulnerable to DFA, which can be split into two categories depending on the fault location: the DFA on the State and the DFA on the Key Schedule. For the first category, much research has been done and very efficient methods were devised. However, there is still a lack of research in the second category. The advantage of DFA on the Key Schedule is that it can even defeat some fault-protected AES implementations. Research on DFA has been diversified into several directions: reducing the number of required faults, changing fault models (from one-byte fault to multibyte fault and vise versa), extending to AES-192 and AES-256, and exploiting faults induced at an earlier round. This paper deals with all these directions together in DFA on AES Key Schedule. We introduce new attacks that find the AES-128 key with two faults in a one-byte fault model without exhaustive search and the AES-192 and the AES-256 keys with six and four faults, respectively.

Recent lightweight block cipher competition (FELICS Triathlon) evaluates efficient implementations of block ciphers for Internet of things (IoT) environment. In the competition, the implementation of HIGHT block cipher achieved the most efficient lightweight block cipher, in terms of code size (ROM), memory (RAM), and execution time. In this paper, we further investigate lightweight features of HIGHT block cipher and present the optimized implementations of both software and hardware for low-end IoT platforms, including resource-constrained devices (8-bit AVR and 32-bit ARM Cortex-M3) and application-specific integrated circuit (ASIC). By using proposed optimization methods, the implemented HIGHT block cipher shows better performance compared to previous state-of-the-art implementations.

Block ciphers are typically resistant to direct attacks, such as an exhaustive key search or cryptanalysis, all of which require too many resources to achieve an efficient attack. Many block ciphers are examined for their resistance to less direct attacks that target a given implementation. Of these attacks, fault attacks are amongst the most effective at retrieving information on secret key, and require specific countermeasures to be included in an implementation. In this paper we describe a simple platform for the study of fault injection and analysis in the context of fault attacks block ciphers based on a Feistel structure (e.g. DES). We show that an attacker who can successfully inject faults into a block cipher can reduce the complexity of an attack to derive the secret key. We also present a novel version of the attack than can be applied to Triple-DES by independently injecting faults in the second and third instantiations of DES involved in a Triple- DES computation.

In the 1970s researchers noticed that radioactive particles produced by elements naturally present in packaging material could cause bits to flip in sensitive areas of electronic chips. Research into the effect of cosmic rays on semiconductors, an area of particular interest in the aerospace industry, led to methods of hardening electronic devices designed for harsh environments. Ultimately various mechanisms for fault creation and propagation were discovered, and in particular it was noted that many cryptographic algorithms succumb to so-called fault attacks. Preventing fault attacks without sacrificing performance is nontrivial and this is the subject of this book. Part I deals with side-channel analysis and its relevance to fault attacks. The chapters in Part II cover fault analysis in secret key cryptography, with chapters on block ciphers, fault analysis of DES and AES, countermeasures for symmetric-key ciphers, and countermeasures against attacks on AES. Part III deals with fault analysis in public key cryptography, with chapters dedicated to classical RSA and RSA-CRT implementations, elliptic curve cryptosystems and countermeasures using fault detection, devices resilient to fault injection attacks, lattice-based fault attacks on signatures, and fault attacks on pairing-based cryptography. Part IV examines fault attacks on stream ciphers and how faults interact with countermeasures used to prevent power analysis attacks. Finally, Part V contains chapters that explain how fault attacks are implemented, with chapters on fault injection technologies for microprocessors, and fault injection and key retrieval experiments on a widely used evaluation board. This is the first book on this topic and will be of interest to researchers and practitioners engaged with cryptographic engineering.

The advances of Internet of Things (IoT) have had a fundamental impact and influence on sharping our rich living experiences. However, since IoT devices are usually resource-constrained, lightweight block ciphers have played a major role in serving as a building block for secure IoT protocols. In CHES 2015, SIMECK, a family of block ciphers, was designed for resource-constrained IoT devices. Since its publication, there have been many analyses on its security. In this paper, under the one bit-flip model, we propose a new efficient fault analysis attack on SIMECK ciphers. Compared to those previously reported attacks, our attack can recover the full master key by injecting faults into only a single round of all SIMECK family members. This property is crucial, as it is infeasible for an attacker to inject faults into different rounds of a SIMECK implementation on IoT devices in the real world. Specifically, our attack is characterized by exercising a deep analysis of differential trail between the correct and faulty immediate ciphertexts. Extensive simulation evaluations are conducted, and the results demonstrate the effectiveness and correctness of our proposed attack.