Hardware Countermeasures Benchmarking against Fault Attacks

Fault injection attacks are powerful cryptanalysis techniques against the Advanced Encryption Standard (AES) algorithm. These attacks are based on injecting faults into the structure of the AES to obtain confidential information. To protect the AES implementation against these attacks, a number of countermeasures have been proposed. In this paper, we proposed a fault detection scheme, based on the information redundancy, for the AES. We discuss the strengths and the weaknesses of this scheme against the fault attacks. Moreover, we conduct a comparative study between fault detection schemes from the literature in terms of fault detection capabilities and implementation cost. The simulation results show that the fault coverage achieves 99.998% for the proposed scheme. Moreover, the proposed detection scheme has been implemented on Xilinx Virtex-5 FPGA. Its fault coverage, area overhead, throughput and frequency degradation have been compared and it is shown that the proposed scheme allows a trade-off between the hardware overhead and the security of the AES.

An active attacker can induce errors during the computation of the cryptographic algorithm and exploit the faulty results to extract information about the secret key in embedded systems. We call this kind of attack a fault attack. Fault attacks can break an unprotected system more quickly than any other kind of side-channel attack such as simple power analysis (SPA), differential power analysis (DPA), or electromagnetic analysis (EMA). For example, the attacker can break RSA-CRT (RSA with Chinese Remainder Theorem) with one faulty result, and Data Encryption Standard (DES) and Advanced Encryption Standard (AES) with two. Furthermore, the protection of fault attacks is more costly in terms of chip area. Here, we survey fault injection methods, types of faults, and fault attack models.

Differential fault analysis (DFA) finds the key of a block cipher using differential information between correct and faulty ciphertexts obtained by inducing faults during the computation of ciphertexts. Among many ciphers, advanced encryption standard (AES) has been the main target of DFA due to its popularity. The naive implementation of AES is known to be vulnerable to DFA, which can be split into two categories depending on the fault location: the DFA on the State and the DFA on the Key Schedule. For the first category, much research has been done and very efficient methods were devised. However, there is still a lack of research in the second category. The advantage of DFA on the Key Schedule is that it can even defeat some fault-protected AES implementations. Research on DFA has been diversified into several directions: reducing the number of required faults, changing fault models (from one-byte fault to multibyte fault and vise versa), extending to AES-192 and AES-256, and exploiting faults induced at an earlier round. This paper deals with all these directions together in DFA on AES Key Schedule. We introduce new attacks that find the AES-128 key with two faults in a one-byte fault model without exhaustive search and the AES-192 and the AES-256 keys with six and four faults, respectively.

Side channel analysis(SCA) focuses on attacking cryptographic algorithm implementations by collecting leaked information and analyzing the correlation between the leaked and key information in the cryptographic system. Currently, SCA is the main threat to cryptographic implementations, with DPA (differential power analysis) and DFA (differential fault analysis) being two of the most threatening types of SCA. However, the existing countermeasures against DPA and DFA have shortcomings and can hardly protect cipher designs perfectly. Based on a comprehensive analysis of DPA and DFA, this paper proposes a new idea of using an evolutionary cipher (EVOC) against DPAs based on the model proposed by Kocher, and several different new types of DFAs. In fact, an EVOC is a kind of dynamic cipher designing method. Moreover, combined with intelligent searching algorithms and cryptography design policies, EVOCs utilize the dynamic and unpredictable properties of TRNG (a truly random number generator) to ensure cipher design at a high level of security. Therefore, with an EVOC we could design cryptography algorithms with high security to resist mathematical analysis as well as DPAs and DFAs. This paper analyzes and proves the security, efficiency, cost, and original features of EVOCs against DPA and DFA both theoretically and experimentally. Compared with existing countermeasures against SCAs, EVOCs use dynamic non-linear operations to destroy the bases of DPA and DFA. At the algorithm level, EVOCs are more efficient than other resistance methods. Based on the theory and experiments, this paper proposes certain modifications to the EVOC in the AES (advanced encryption standard) algorithm, which can be referenced by other dynamic designs of cryptographic algorithms.

This paper proposes a fault analysis technique on LED by combining algebraic cryptanalysis and differential fault analysis (DFA). The technique is called algebraic differential fault analysis (ADFA). In ADFA on LED, we use DFA to deduce the possible fault differences of the correct and faulty S-Box input in the last round, and convert them into algebraic equations. We then combine the equation set of LED with the injected fault and use the CryptoMiniSat solver to recover the secret key. Our experiments show that, on a common PC, ADFA can succeed on LED under the nibble-based fault model within three minutes and with only one fault injection, which is more efficient than previous DFA work. To evaluate DFA on LED, we first propose an improved evaluation algorithm of DFA, then provide a modified ADFA approach to compute the solutions for the secret key. The results are more accurate than previous work. We also successfully extend ADFA on LED to other fault models using a single fault injection, where traditional DFAs are difficult to launch.

Current signature analysis of induction motor becomes very much popular for its Condition monitoring purpose. Most of these studies in recent years are focused on hardware. Though, to build an experimental set-up for fault emulating machines is not an easy task. It involves too much cost and risk of damage. Moreover, it is not possible to create different types of faults in the same machine. In this paper an accurate but simple model of 3-phase Induction motor is being proposed which describes the machine at low frequency as well as at high frequency for different types of fault situations. The model, based on DM, CM characteristics of the machine, is well suited for power frequency (50 Hz) and high frequency applications like adjustable speed drives (ASDs). A mechanical model of a three-phase induction machine is incorporated to this electrical model to make a universal model of dynamic squirrel cage induction motor for overall simulation. The proposed model has the feature to incorporate different types of electrical fault like, stator inter-turn fault, phase-to-phase and phase-to ground insulation fault etc. The premature conditions of the above faults can also be emulated.

Logic locking has been presented in the past as a solution to avoid overproduction or product piracy. All solutions so far assume or rely on the protection of the correct locking key. This paper does not target the break of locking schemes but looks at another highly critical security risk which comes with modified locking keys: The enabling of fault attacks. We will analyze the applicability of the risk based on different logic locking methods, key management techniques, and fault analysis techniques. Additionally, we will demonstrate its threat by a modified template based persistent fault analysis on an AES implementation. There, the fault injection is realized by randomly inserted locking gates and a permanently modified locking key.

In this paper we describe several fault attacks on the Ad- vanced Encryption Standard (AES). First, using optical/eddy current fault induction attacks as recently publicly presented by Skorobogatov, Anderson and Quisquater, Samyde (SA,QS), we present an implemen- tation independent fault attack on AES. This attack is able to deter- mine the complete 128-bit secret key of a sealed tamper-proof smart- card by generating 128 faulty cipher texts. Second, we present several implementation-dependent fault attacks on AES. These attacks rely on the observation that due to the AES's known timing analysis vulnera- bility (as pointed out by Koeune and Quisquater (KQ)), any implemen- tation of the AES must ensure a data independent timing behavior for the so called AES's xtime operation. We present fault attacks on AES based on various timing analysis resistant implementations of the xtime- operation. Our strongest attack in this direction uses a very liberal fault model and requires only 256 faulty encryptions to determine a 128-bit key.

Aiming to protect cryptographic circuits against physical attacks, researchers have proposed a variety of mature and effective countermeasures. However, most of these defensive technologies are used for specific and single attack, thus it is hard to thwart combined attack, such as combined power and fault attacks. In this paper, we propose a dual complementary infection countermeasure for Advanced Encryption Standard (AES) cryptographic circuit to defend against both power and fault attacks. According to the target AES circuit, we first design and construct a dual complementary AES circuit to defend against power attacks, which can balance the power consumption when processing different data. Besides, to defend against fault attacks, in the dual complementary AES circuit, we design an improved random infection mechanism to diffuse the effect of injected faults. Experiment results show that the proposed countermeasure can thwart both power and fault attacks effectively. Compared with those AES circuits which can only defend against single attack, our designed circuit increases greatly the security under extra 83.1% area overhead and 2.1% impacts on the maximum working frequency.

Occurrence of unwanted resistance at terminal of IGBTs is a type of Incipient faults which occurs in 3-phase voltage source Inverter. This type of faults does not trigger the protective circuit and in due course of time leads to severe faults. The present work had made an attempt to identify this type of faults related to two IGBTs in the VSI scheme. Rigorous simulation is done with different cases of faults in a PSIM software platform. The current profiles obtained from the simulation are processed by data processing tools to obtain Mean Current vector (MCV). A two phase reference frame shows the distribution of MCV for different types of faults. The distribution is found to follow a particular pattern. This has encouraged the authors to use SVM classifier for analyzing the distributed pattern and classify different types of faults.

A combined image processing and Nearest Neighbor Algorithm tool for classification of incipient faults in induction motor drives

A general framework and a method for model based diagnosis are suggested. In the framework, faults and modeling of faults are formally described. Then the method is used to construct a diagnosis system based on a structure of hypothesis tests. Using these principles, it is possible to diagnose a large variety of different types of faults. The framework and the method are applied to the design of a diagnosis system for an automotive engine. This application clearly shows the strength of these principles because several different types of sensor faults and leakage need to be diagnosed. The resulting diagnosis system is demonstrated using experiments on a real automotive engine.

In the 1970s researchers noticed that radioactive particles produced by elements naturally present in packaging material could cause bits to flip in sensitive areas of electronic chips. Research into the effect of cosmic rays on semiconductors, an area of particular interest in the aerospace industry, led to methods of hardening electronic devices designed for harsh environments. Ultimately various mechanisms for fault creation and propagation were discovered, and in particular it was noted that many cryptographic algorithms succumb to so-called fault attacks. Preventing fault attacks without sacrificing performance is nontrivial and this is the subject of this book. Part I deals with side-channel analysis and its relevance to fault attacks. The chapters in Part II cover fault analysis in secret key cryptography, with chapters on block ciphers, fault analysis of DES and AES, countermeasures for symmetric-key ciphers, and countermeasures against attacks on AES. Part III deals with fault analysis in public key cryptography, with chapters dedicated to classical RSA and RSA-CRT implementations, elliptic curve cryptosystems and countermeasures using fault detection, devices resilient to fault injection attacks, lattice-based fault attacks on signatures, and fault attacks on pairing-based cryptography. Part IV examines fault attacks on stream ciphers and how faults interact with countermeasures used to prevent power analysis attacks. Finally, Part V contains chapters that explain how fault attacks are implemented, with chapters on fault injection technologies for microprocessors, and fault injection and key retrieval experiments on a widely used evaluation board. This is the first book on this topic and will be of interest to researchers and practitioners engaged with cryptographic engineering.

This work analyzes the strength of NIST Lightweight Cryptography (LWC) Round 1 Candidate SIV-Rijndael256 in light of Differential Fault Attacks (DFA). It is observed that SIV-Rijndael256 presents an interesting case for DFA due to its large state-size which has been capitalized in this work to contribute to the state-of-the-art in DFA on AES-like ciphers. We first study the differential properties over three rounds of the cipher and then use it to mount a DFA that uses a classical strategy in conjunction with the properties of the key-schedule. The nonce-misuse property of SIV-Rijndael256 facilitates the use of DFA and is exploited to reduce the key-space from 2 <sup xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">128</sup> to just one using only a single random byte fault in the internal state. Moreover, the support for the release of unverified plaintexts which have been shown in literature as a vulnerability to DFA, makes the decryption also vulnerable to the same attack. Finally, the ability to uniquely retrieve the key using just a single fault makes the attack, reported here, an optimal DFA. To the best of our knowledge, this is the first differential fault analysis of any candidate in the NIST LWC competition.

Fault injection attacks rely on experimental techniques to inject one or several faults into a device during operation. Among these techniques, laser fault injection is known as a powerful one, thanks to its unmatched spatial and temporal precision. So far though, the overwhelming majority of published laser fault injection attacks were performed with only one laser spot. In this article, we present a new multi-spot laser fault injection setup. After a description of the optical system, we highlight its new capabilities against the limitations of existing single-spot laser fault injection setups. We then discuss some intrinsic limitations that this setup has, making it not equivalent to running multiple single-spot setups simultaneously on the same target. We then provide experimental evidence of faults performed with two and four spots which are unfeasible with a single-spot laser fault injection setup. This paves the way for new fault attacks on security and cryptography algorithms that exploit this new type of fault.