Physical attacks on block ciphers

Physical attacks on cryptographic circuits were first identified in the late 1990s. These types of attacks, which are still considered very powerful, are generally classified into two main categories: “fault attacks” and “side-channel attacks.” To secure circuits against such attacks, it is crucial to develop appropriate methods and tools that enable accurate estimates of the protection mechanism’s effectiveness. Numerous studies have described such methods and tools but, to the best of our knowledge, these previous investigations have considered side-channel attacks or fault attacks but not the combination of the two types. The present article proposes a combined investigation of both main types of attack by describing them with the same terminology and the same algorithm. This approach is made possible by introducing the concept of “physical functions” as an extension of the concept of “leakage functions,” which are widely used in the side-channel community. The paper represents a first step toward applying the strong theoretical background developed for side-channel attacks to the investigation of fault attacks. Besides, the proposed approach could potentially make it easier to combine side-channel attacks with fault attacks, which could certainly facilitate the discovery of new attack paths.

The RSA cryptographic algorithm is a security tool that has achieved long cryptographic and market maturity. However, after the discovery and wide spread of Side Channel Attacks (SCA), RSA implementations are susceptible to a variety of different attacks that target the hardware structure rather than the algorithm itself. While there are a wide range of countermeasures that can be applied on the RSA structure in order to protect the algorithm from specific SCA categories, combining several such measures to produce an "all in one" SCA resistant RSA structure is not an easy endeavor. Several incompatibility issues between combined SCA protection methods lead to new SCA vulnerabilities. In this paper, we evaluate some very popular and potent SCAs against RSA, like Fault attacks (FA), Simple Power attacks (SPA), Doubling attacks (DA) and Differential Power attacks (DPA), and propose an SCA protection scheme for RSA based on Chinese Remainder Theorem (CRT) that can thwart them. The proposed scheme uses a square and always multiply approach in combination with the message blinding technique in such a way that possible vulnerabilities that may rise from this combination can no longer apply. The proposed scheme is evaluated against specific SCAs and is found to be very secure. From performance point of view, the proposed scheme favors parallelism and can calculate an RSA result with small time delay.

In the preceding chapters, we have examined fault attacks as a form of active side-channel analysis, wherein the adversary injects a fault, and traces its propagation characteristics to recover the key. Certain classes of fault attacks such as FSA and DFIA have attack principles which are similar to that of side-channel attacks. In this chapter, we introduce to the reader a novel form of fault attack referred to as side-channel assisted fault attack. Such attacks demonstrate the combined power of side-channel and fault attacks working in tandem to recover the secret key from a given block cipher implementation. The attack is demonstrated on the current worldwide standard for lightweight block ciphers—PRESENT, which uses a substitution-permutation network (SPN) spread across 31 rounds, and affords 80/128 bit-security for a plaintext block of size 64.

The multivariate public key cryptosystem (MPKC), which is based on the problem of solving a set of multivariate systems of quadratic equations over a finite field, is expected to be secure against quantum attacks. Although there are several existing schemes in MPKC that survived known attacks and are much faster than RSA and ECC, there have been few discussions on security against physical attacks, aside from the work of Okeya et al. (2005) on side-channel attacks against Sflash. In this study, we describe general fault attacks on MPKCs including Big Field type (e.g. Matsumoto-Imai, HFE and Sflash) and Stepwise Triangular System (STS) type (e.g. UOV, Rainbow and TTM/TTS). For both types, recovering (parts of) the secret keys S,T with our fault attacks becomes more efficient than doing without them. Especially, on the Big Field type, only single fault is sufficient to recover the secret keys.

Differential fault analysis (DFA) has already been applied to attack many block ciphers with the help of inducing some faults at the last few rounds of block ciphers. Currently, a general countermeasure against DFA is to protect the last few rounds of block ciphers by means of redundancy. In this paper, we present a new fault attack on block ciphers called linear fault analysis (LFA), in which linear characteristics for some consecutive rounds of a block cipher will be utilized instead of exploiting differential distributions of S-Boxes within the block cipher in DFA. Basically, the new approach can handle the case that faults are induced several rounds earlier compared to DFA, thus leading to a threat to the protected implementations (against DFA) of block ciphers. For the purpose of illustration, we mount an effective attack on SERPENT by adopting LFA and achieve a good cryptanalytic result on SERPENT. We hope that our work enriches the picture on the applicability of fault attacks to block ciphers and could be beneficial to the security evaluation of block ciphers.

Digital security practitioners are facing enormous challenge in face of the growing repertoire of physical attacks, e.g., Side Channel Attack (SCA) and Fault Injection Attack (FIA). Countermeasures to such threats are usually very different in nature and come with a significant performance penalty. While the FIA countermeasures rely on fault-detecting sensors or concurrent error detection schemes, SCA countermeasures are based on data masking or dual-rail logic circuits. Recently, a low-overhead FIA countermeasure has been proposed that utilises a ring oscillator circuit with Phase-Locked Loop (PLL). In this paper, we extend that countermeasure to further provide protection against SCA, thereby proposing PLL based Protection Against Physical attacks (PPAP). We demonstrate the PPAP on an FPGA prototype under rigorous SCA and FIA testing. We evaluate SCA resistance using the TVLA metric and observe a 2000x increase in SCA protection (in terms of number of traces) with PPAP. We further improve the security of PPAP using statistical analysis through an improved PPAP design (iPPAP) with an increase in SCA resistance of at least 5000x compared to the unprotected implementation with a minimal area overhead.

Integrated Circuits (ICs) are sensible to a wide range of (passive, active, invasive, non-invasive) physical attacks. In this context, Hardware Trojans (HTs), that are malicious modifications of a circuit by an untrusted manufacturer, are one of the most challenging threats to mitigate. HTs aim to alter the functionality of the infected chip in a malicious way, e.g. under specific conditions known by the adversary. Fault attacks are a typical attack vector. However, for a HT to be exploitable by an adversary, it also has to be stealthy. For example, a HT that would directly inject exploitable faults in a block cipher may be spotted by analyzing its functional behavior (i.e. the positions and the distribution of the faulty values appearing). In this paper, we propose a stealthy HT instance leading to successful and hidden Statistical Fault Attacks (SFA). More precisely, the faults are injected when the chip is running under condition for which metastabilty occurs (i.e. with a increased clock frequency), leading to the apparition faults at random positions within the target implementation. In addition, an internal bit is set to a value known only by the adversary, allowing him to perform efficient SFA. Compared to classical SFA, the HT uses its control on the target to circumvent behavioral detection tests. Indeed, it also adds computation errors in the early rounds of the target cipher which are not exploitable via SFA.

Side-channel attacks are a class of attacks where an attacker deduces the internal state of a device by observing information that leaks during the normal functioning of the device. In this chapter we describe side-channel analysis and its relevance to fault attacks. Side-channel analysis is typically used to extract information about cryptographic keys. However, we will be concentrating on how it can be used as a means to identify target operations and as a trigger mechanism for fault attacks.

Implementation attacks like side-channel and fault attacks are a threat to deployed devices especially if an attacker has physical access. As a consequence, devices like smart cards and IoT devices usually provide countermeasures against implementation attacks, such as masking against side-channel attacks and detection-based countermeasures like temporal or spacial redundancy against fault attacks. In this paper, we show how to attack implementations protected with both masking and detection-based fault countermeasures by using statistical ineffective fault attacks using a single fault induction per execution. Our attacks are largely unaffected by the deployed protection order of masking and the level of redundancy of the detection-based countermeasure. These observations show that the combination of masking plus error detection alone may not provide sufficient protection against implementation attacks.

Basically, Differential Fault Analysis (DFA) against ciphers consists of two stages: fault induction and fault exploitation. Success rate of the latter strongly depends upon the availability of the required type of some faulty ciphertexts, which typically assumes that adversaries have precise control over the location, timing and/or even the type of the fault induced. In view of this, there seems to be a technical gap between these two stages. In this paper, by amplifying the fault propagation pattern inherent in block ciphers, we propose an algorithmic method to narrow this gap, or to relax the underlying assumption. Our method provides a faulty ciphertext filtering process between two basic stages in DFA. This additional process equips adversaries with the capabilities to deterministically decide whether or not one faulty ciphertext is relevant to a specific DFA, before or without performing DFA itself. We take AES as a concrete case of study and conduct theoretical analysis and simulation experiments as well, the results of which strongly demonstrate the validity and power of our proposed filtering method.

Physical attacks, such as fault attacks, pose a decisive threat for the security of devices in the Internet of Things. An important class of countermeasures for fault attacks is fault tolerant software that is applicable for systems based on COTS hardware. In order to evaluate software countermeasures against fault attacks, fault injection is needed. However, established fault injection approaches require manufactured products or hardware details (e.g. netlists, RTL models), which are not available when using COTS hardware. In this paper, we present a QEMU-based fault injection platform that supports commercial COTS processors that are widely-used in the embedded domain. This framework allows a system-level analysis of software countermeasures by featuring the simulation of high-level hardware faults targeting, for example, memory cells, register cells, or the correct execution of instructions. The framework supports the generation of realistic fault attack scenarios. We illustrate the practicability of the approach by presenting two exemplary use cases.

Aiming to protect cryptographic circuits against physical attacks, researchers have proposed a variety of mature and effective countermeasures. However, most of these defensive technologies are used for specific and single attack, thus it is hard to thwart combined attack, such as combined power and fault attacks. In this paper, we propose a dual complementary infection countermeasure for Advanced Encryption Standard (AES) cryptographic circuit to defend against both power and fault attacks. According to the target AES circuit, we first design and construct a dual complementary AES circuit to defend against power attacks, which can balance the power consumption when processing different data. Besides, to defend against fault attacks, in the dual complementary AES circuit, we design an improved random infection mechanism to diffuse the effect of injected faults. Experiment results show that the proposed countermeasure can thwart both power and fault attacks effectively. Compared with those AES circuits which can only defend against single attack, our designed circuit increases greatly the security under extra 83.1% area overhead and 2.1% impacts on the maximum working frequency.

In recent years, many lightweight block ciphers were proposed to provide security for resource‐constrained environments such as Internet of Things (IoT). PIPO, which stands for “plug‐in plug‐out”, is just a lightweight bit‐sliced block cipher offering excellent performance in 8‐bit AVR software implementations. In fact, PIPO owns 64‐bit input and output, 128‐bit secret key. In this article, we consider the differential fault analysis (DFA), a typical side‐channel attack, on the PIPO cipher. More concretely, for the first time, we apply the mixed attack model, which considers the DFA on the encryption state and key schedule simultaneously, to recover PIPO's 128‐bit master key. The theoretical analysis shows that, in average, after injecting 4‐byte faults, the complexity of obtaining the master key reduces from 2128 reduces to 214. In fact, this attack model alleviates the assumption on attacker than the bit‐injection case. It should be noted that our analysis also holds for other bit‐sliced block ciphers. Finally, the simulations show that our proposed DFA on PIPO cipher is rather practical.

Efficiency is essential in lightweight cryptography to ensure robust protection within constrained environments. This paper introduces a lightweight block cipher built on a Non-Linear Feedback Shift Register (NFSR), referred to as the NFSR-Based Block Cipher (NFBC). The cipher is designed for constrained environments where both efficiency and strong security are critical. NFBC operates as a Nonce-based Authenticated Encryption with Associated Data (NAEAD) scheme, providing confidentiality and authenticity within a single framework. The design achieves robust protection while maintaining minimal hardware overhead. NFBC operates on 128-bit data, key, and nonce sizes, fully aligning with National Institute of Standards and Technology (NIST) lightweight cryptography requirements. The design integrates a Non-Linear Feedback Shift Register (NFSR) for generating high-entropy round subkeys, dynamic chaotic substitution box (S-boxes) for strong confusion, and a Group Permutation (GRP) mechanism that ensures rapid diffusion with hardware-friendly efficiency. Security is rigorously evaluated across multiple dimensions. NFBC passes all 15 NIST Statistical Test Suite (STS) tests, achieves near-ideal avalanche and Bit Independence Criterion (BIC), and demonstrates consistently high nonlinearity across 200 independent chaotic S-box instances. The S-box achieves a maximum differential probability of 10/256 and maximum linear probability of (72/256)^{2}, confirming strong resistance to classical attacks. To strengthen theoretical guarantees, a provable branch-number analysis is introduced, establishing conservative lower bounds on active S-boxes (ge 45 across 20 rounds), with corresponding differential and linear probabilities that are vanishingly small. Formal AEAD security is ensured through an Encrypt-then-MAC (EtM) construction. Implementation on a Xilinx Artix-7 FPGA confirms practicality: NFBC achieves superior throughput-per-area compared to several NIST Round-2 lightweight candidates (SPOC, SPOOK, GIFT-COFB, ESTATE, SAEAES, Oribatida) and CAESAR finalists (Ascon-128, Ascon-small, CLOC-AES, SILC-AES). Estimated countermeasure overheads for masking and fault detection demonstrate feasibility against side-channel and fault attacks. These results confirm NFBC as a secure, efficient, and practically deployable lightweight cryptographic solution.

In the 1970s researchers noticed that radioactive particles produced by elements naturally present in packaging material could cause bits to flip in sensitive areas of electronic chips. Research into the effect of cosmic rays on semiconductors, an area of particular interest in the aerospace industry, led to methods of hardening electronic devices designed for harsh environments. Ultimately various mechanisms for fault creation and propagation were discovered, and in particular it was noted that many cryptographic algorithms succumb to so-called fault attacks. Preventing fault attacks without sacrificing performance is nontrivial and this is the subject of this book. Part I deals with side-channel analysis and its relevance to fault attacks. The chapters in Part II cover fault analysis in secret key cryptography, with chapters on block ciphers, fault analysis of DES and AES, countermeasures for symmetric-key ciphers, and countermeasures against attacks on AES. Part III deals with fault analysis in public key cryptography, with chapters dedicated to classical RSA and RSA-CRT implementations, elliptic curve cryptosystems and countermeasures using fault detection, devices resilient to fault injection attacks, lattice-based fault attacks on signatures, and fault attacks on pairing-based cryptography. Part IV examines fault attacks on stream ciphers and how faults interact with countermeasures used to prevent power analysis attacks. Finally, Part V contains chapters that explain how fault attacks are implemented, with chapters on fault injection technologies for microprocessors, and fault injection and key retrieval experiments on a widely used evaluation board. This is the first book on this topic and will be of interest to researchers and practitioners engaged with cryptographic engineering.