Fault Based Cryptanalysis of the Advanced Encryption Standard (AES)

Differential fault analysis (DFA) finds the key of a block cipher using differential information between correct and faulty ciphertexts obtained by inducing faults during the computation of ciphertexts. Among many ciphers, advanced encryption standard (AES) has been the main target of DFA due to its popularity. The naive implementation of AES is known to be vulnerable to DFA, which can be split into two categories depending on the fault location: the DFA on the State and the DFA on the Key Schedule. For the first category, much research has been done and very efficient methods were devised. However, there is still a lack of research in the second category. The advantage of DFA on the Key Schedule is that it can even defeat some fault-protected AES implementations. Research on DFA has been diversified into several directions: reducing the number of required faults, changing fault models (from one-byte fault to multibyte fault and vise versa), extending to AES-192 and AES-256, and exploiting faults induced at an earlier round. This paper deals with all these directions together in DFA on AES Key Schedule. We introduce new attacks that find the AES-128 key with two faults in a one-byte fault model without exhaustive search and the AES-192 and the AES-256 keys with six and four faults, respectively.

Fault injection attacks are powerful cryptanalysis techniques against the Advanced Encryption Standard (AES) algorithm. These attacks are based on injecting faults into the structure of the AES to obtain confidential information. To protect the AES implementation against these attacks, a number of countermeasures have been proposed. In this paper, we proposed a fault detection scheme, based on the information redundancy, for the AES. We discuss the strengths and the weaknesses of this scheme against the fault attacks. Moreover, we conduct a comparative study between fault detection schemes from the literature in terms of fault detection capabilities and implementation cost. The simulation results show that the fault coverage achieves 99.998% for the proposed scheme. Moreover, the proposed detection scheme has been implemented on Xilinx Virtex-5 FPGA. Its fault coverage, area overhead, throughput and frequency degradation have been compared and it is shown that the proposed scheme allows a trade-off between the hardware overhead and the security of the AES.

Encryption and decryption are the two most important complex methods for achieving security in any type of smart devices and systems/machines through transport layer security protocol (TLS). The symmetric key algorithms are the significant method for encrypting and decrypting the data/information using block cipher or stream cipher which is used for TLS protocol. The primary symmetric key block cipher algorithm used in TLS is Advanced Encryption standard (AES) and it provides security based on the key bits used in AES operation. The TLS protocol provides confidentiality(C), integrity (I) and Authenticity (A) in a single pass communication that is Authentication Encryption and Authentication Data (AEAD) between web browser and web server. It uses well known TLS cipher suite AES-GCM (Galois Counter mode) which is commonly used in TLS1.2. Suppose AES-NI hardware acceleration is not available in smart devices like tablets it causes performance issues in smart devices using TLS 1.2 protocol. If the smart device does not possess AES-NI, it can use software for running AES-GCM but it takes a lot of time for encryption/decryption of information, ergo causing the battery performance in smart devices. The newer symmetric Stream cipher CHACHA20-POLY1305 provides AEAD for securing the communication in smart devices thus reducing the battery cycles which is used for TLS 1.3. The paper discusses the pros and cons of AES-GCM authentication encryption used in TLS 1.2.

Aiming to protect cryptographic circuits against physical attacks, researchers have proposed a variety of mature and effective countermeasures. However, most of these defensive technologies are used for specific and single attack, thus it is hard to thwart combined attack, such as combined power and fault attacks. In this paper, we propose a dual complementary infection countermeasure for Advanced Encryption Standard (AES) cryptographic circuit to defend against both power and fault attacks. According to the target AES circuit, we first design and construct a dual complementary AES circuit to defend against power attacks, which can balance the power consumption when processing different data. Besides, to defend against fault attacks, in the dual complementary AES circuit, we design an improved random infection mechanism to diffuse the effect of injected faults. Experiment results show that the proposed countermeasure can thwart both power and fault attacks effectively. Compared with those AES circuits which can only defend against single attack, our designed circuit increases greatly the security under extra 83.1% area overhead and 2.1% impacts on the maximum working frequency.

Side channel analysis(SCA) focuses on attacking cryptographic algorithm implementations by collecting leaked information and analyzing the correlation between the leaked and key information in the cryptographic system. Currently, SCA is the main threat to cryptographic implementations, with DPA (differential power analysis) and DFA (differential fault analysis) being two of the most threatening types of SCA. However, the existing countermeasures against DPA and DFA have shortcomings and can hardly protect cipher designs perfectly. Based on a comprehensive analysis of DPA and DFA, this paper proposes a new idea of using an evolutionary cipher (EVOC) against DPAs based on the model proposed by Kocher, and several different new types of DFAs. In fact, an EVOC is a kind of dynamic cipher designing method. Moreover, combined with intelligent searching algorithms and cryptography design policies, EVOCs utilize the dynamic and unpredictable properties of TRNG (a truly random number generator) to ensure cipher design at a high level of security. Therefore, with an EVOC we could design cryptography algorithms with high security to resist mathematical analysis as well as DPAs and DFAs. This paper analyzes and proves the security, efficiency, cost, and original features of EVOCs against DPA and DFA both theoretically and experimentally. Compared with existing countermeasures against SCAs, EVOCs use dynamic non-linear operations to destroy the bases of DPA and DFA. At the algorithm level, EVOCs are more efficient than other resistance methods. Based on the theory and experiments, this paper proposes certain modifications to the EVOC in the AES (advanced encryption standard) algorithm, which can be referenced by other dynamic designs of cryptographic algorithms.

The development of differential fault analysis (DFA) techniques and mechanisms to inject faults into cryptographic circuits brings with it the need to use protection mechanisms that guarantee the expected level of security. The AES cipher, as a standard, has been the target of numerous DFA techniques, where its security has been compromised through different formulations and types of fault injections. These attacks have shown vulnerabilities of different AES implementations and building blocks. Consequently, several solutions have been proposed that provide additional protection to cover the identified vulnerabilities. In this paper, an extensive analysis has been carried out covering the existing fault injection techniques, the types of faults, and the requirements needed to apply DFA. Additionally, an analysis of the countermeasures reported in the literature is also presented, considering the protection provided, the type of faults considered, and the coverage against fault attacks. The eight different types of fault that allow us to perform DFAs on the AES cipher have been differentiated, as well as the vulnerabilities of the cipher. On the other hand, two comparisons have been made considering frequency penalty vs. area and fault coverage vs. area and frequency overhead. A metric has been proposed to compare the fault coverage of all the proposed solutions. To conclude, a final analysis is presented discussing the key aspects when choosing a particular solution and the possible development of new countermeasures to provide further protection against DFA.

An active attacker can induce errors during the computation of the cryptographic algorithm and exploit the faulty results to extract information about the secret key in embedded systems. We call this kind of attack a fault attack. Fault attacks can break an unprotected system more quickly than any other kind of side-channel attack such as simple power analysis (SPA), differential power analysis (DPA), or electromagnetic analysis (EMA). For example, the attacker can break RSA-CRT (RSA with Chinese Remainder Theorem) with one faulty result, and Data Encryption Standard (DES) and Advanced Encryption Standard (AES) with two. Furthermore, the protection of fault attacks is more costly in terms of chip area. Here, we survey fault injection methods, types of faults, and fault attack models.

Fault attacks are powerful and efficient cryptanalysis techniques to find the secret key of the Advanced Encryption Standard (AES) algorithm. These attacks are based on injecting faults into the structure of the AES to obtain the confidential information. To protect the AES implementation against these attacks, a number of countermeasures have been proposed. In this paper, we propose a fault detection scheme for the Advanced Encryption Standard. We present its details implementation in each transformation of the AES. The simulation results show that the fault coverage achieves 99.999% for the proposed scheme. Moreover, the proposed fault detection scheme has been implemented on Xilinx Virtex-5 FPGA. Its area overhead and frequency degradation have been compared and it is shown that the proposed scheme achieves a good performance in terms of area and frequency.

Cryptographic hardware design is facing many challenges because of conflicting requirements such as fault attack tolerance and low power consumption. Therefore, it is important to explore different architectures that meet the above challenges. Towards this, in this paper we present different advanced encryption standard (AES) implementation with varying complexity. Specifically, we analyzed the architectural complexity with different data paths. Moreover, we incorporated error correction in sequential elements to mitigate the fault attacks and analyzed the area complexity.

Flexibility, acceptance of hire of Cloud Computing, control facilities originates a number of challenges. In precise, safety has been widely conveyed to create the key issues which stop movement to the cloud. Shamir’s Secret Sharing Scheme splits the secret message into n shares with threshold k and distribution of shares to n participants and each participant has unique share of secret message. For reconstructing the secret message, minimum k fragments are required. Threshold scheme which requires only k shares to re-construct the secret message is implemented, as collection of shares from all the n participants to reconstruct the secret message may be unfeasible. AES encryption turns out to be totally inappropriate if a password is used as an alternative of providing the key. The attacker finds file, downloads Ax crypt, and brute force/dictionary attacks it until it’s cracked. An additional security can provided to user password which of varying length by splitting the password into n shares. Advance Encryption Standard (AES) procedure is implemented to encipher the produced shares. AES with 256-bit key is applied to encode the share for every member. Covering arrangement alternative to Boolean masking established on Shamir’s Secret Sharing arrangement is suggested.

In this paper we present an improved differential fault attack on the Advanced Encryption Standard (AES) with 256-bit key. We show an improved attack which retrieves the AES-256 key using two pairs of fault free and faulty ciphertexts and a brute-force search of 216 with a time complexity 232. The attack retrieves the secret key within approximately 45 minutes, running on desktop Intel Core TM 2 Duo processor of 3GHz speed. To the best of the knowledge of the authors, this is the most optimized fault attack on AES-256 among reported results requiring only two faulty ciphertexts.

The wide acceptability of Advanced Encryption Standard (AES) as the most efficient of all of the symmetric cryptographic techniques has further opened it up to more attacks. Efforts that were aimed at securing information while using AES is still being undermined by the activities of attackers This has further necessitated the need for researchers to come up with ways of enhancing the strength of AES. This article presents an enhanced AES algorithm that was achieved by modifying its SubBytes and ShiftRows transformations. The SubBytes transformation is modified to be round key dependent, while the ShiftRows transformation is randomized. The rationale behind the modification is to make the two transformations round key dependent, so that a single bit change in the key will produce a significant change in the cipher text. The conventional and modified AES algorithms are both implemented and evaluated in terms avalanche effect and execution time. The modified AES algorithm achieved an avalanche effect of 57.81% as compared to 50.78 recorded with the conventional AES. However, with 16, 32, 64, and 128 plain text bytes, the modified AES recorded an execution time of 0.18, 0.31, 0.46, and 0.59 ms, respectively. This is slightly higher than the results obtained with the conventional AES. Though a slightly higher execution time in milliseconds was recorded with the modified AES, the improved encryption and decryption strength via the avalanche effects measured is a desirable feat.

The Advanced Encryption Standard (AES) defines the most popular block cipher. It is commonly used and often implemented on smart cards. In this paper, we show how a 128-bit AES key can be retrieved by microprobing. Thereby, a probe is placed onto the chip to spy on inner values. Watching one arbitrary bit of the AES State during the first two rounds of about 210 encryptions is enough to reveal the whole key. For special positions of the probe, this number can be reduced to 168. The paper demonstrates that even few information is sufficient for a successful attack on AES.

The present paper develops a new fault attack suitable against hardware designs of the Advanced Encryption Standard (AES) cryptosystem. The paper presents a two stage fault based attack of an AES implementation that assumes a random non-zero random byte fault at the input of the eighth round. The paper shows that the fault model is practical, does not assume the location of the byte fault in the state matrix and requires a brute force search of complexity 236. The paper discusses the possibility of the attack on an FPGA implementation of AES by making sudden changes in the frequency of the input clock.

Nowadays, a large number of digital data are transmitted worldwide using wireless communications. Therefore, data security is a significant task in communication to prevent cybercrimes and avoid information loss. The Advanced Encryption Standard (AES) is a highly efficient secure mechanism that outperforms other symmetric key cryptographic algorithms using message secrecy. However, AES is efficient in terms of software and hardware implementation, and numerous modifications are done in the conventional AES architecture to improve the performance. This research article proposes a significant modification to the AES architecture’s key expansion section to increase the speed of producing subkeys. The fork–join model of key expansion (FJMKE) architecture is developed to improve the speed of the subkey generation process, whereas the hardware resources of AES are minimized by avoiding the frequent computation of secret keys. The AES-FJMKE architecture generates all of the required subkeys in less than half the time required by the conventional architecture. The proposed AES-FJMKE architecture is designed and simulated using the Xilinx ISE 5.1 software. The Field Programmable Gate Arrays (FPGAs) behaviour of the AES-FJMKE architecture is analysed by means of performance count for hardware resources, delay, and operating frequency. The existing AES architectures such as typical AES, AES-PNSG, AES-AT, AES-BE, ISAES, AES-RS, and AES-MPPRM are used to evaluate the efficiency of AES-FJMKE. The AES-FJMKE implemented using Spartan 6 FPGA used fewer slices (i.e., 76) than the AES-RS.