Fault attacks on authenticated encryption modes for GIFT

IET Information SecurityEarly View ORIGINAL RESEARCH PAPEROpen Access Fault attacks on authenticated encryption modes for GIFT Shuai Liu, Corresponding Author 379185570@qq.com orcid.org/0000-0002-1402-827X Department of Applied Mathematics, Strategic Support Force Information Engineering University, Zhengzhou, Henan, China Correspondence Shuai Liu, Department of Applied Mathematics, Strategic Support Force Information Engineering University, Zhengzhou, Henan, China. Email: 379185570@qq.comSearch for more papers by this authorJie Guan, Department of Applied Mathematics, Strategic Support Force Information Engineering University, Zhengzhou, Henan, ChinaSearch for more papers by this authorBin Hu, Department of Applied Mathematics, Strategic Support Force Information Engineering University, Zhengzhou, Henan, ChinaSearch for more papers by this author Shuai Liu, Corresponding Author 379185570@qq.com orcid.org/0000-0002-1402-827X Department of Applied Mathematics, Strategic Support Force Information Engineering University, Zhengzhou, Henan, China Correspondence Shuai Liu, Department of Applied Mathematics, Strategic Support Force Information Engineering University, Zhengzhou, Henan, China. Email: 379185570@qq.comSearch for more papers by this authorJie Guan, Department of Applied Mathematics, Strategic Support Force Information Engineering University, Zhengzhou, Henan, ChinaSearch for more papers by this authorBin Hu, Department of Applied Mathematics, Strategic Support Force Information Engineering University, Zhengzhou, Henan, ChinaSearch for more papers by this author First published: 04 August 2021 https://doi.org/10.1049/ise2.12041AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onEmailFacebookTwitterLinked InRedditWechat Abstract There are several authenticated encryption modes for block cipher GIFT in the NIST lightweight cryptography standardisation process. In this study, the authors research on the fault attacks on this kind of authenticated encryption modes and mainly complete two tasks. First, the fault attack on the nonce-based authenticated encryption mode LOTUS/LOCUS is presented. At Asiacrypt2016, Dobraunig et al. showed the first fault attacks on several nonce-based authenticated encryption modes. Because LOTUS/LOCUS adopts the structure similar to XEX with secret nonce-dependent masks, their work is not applicable to LOTUS/LOCUS. A new fault attack is launched on LOTUS/LOCUS assuming that two bits can be made to reset in the fixed location during the encryption process. In this attack, neither plaintext nor ciphertext of the underlying block cipher is necessary to be known. To recover the correct key, a few hundred faulty ciphertexts are needed when transient faults are injected, while just one faulty ciphertext is sufficient for a permanent fault. Second, the Collision Fault Attack on GIFT is shown, in which 64 faulty ciphertexts are needed to recover the correct key. Based on this attack, authenticated encryption modes ESTATE_TweGIFT-128, GIFT-COFB and SUNDAE-GIFT are analysed and their keys are efficiently obtained with chosen nonce. 1 INTRODUCTION Generally speaking, hardware devices can perform cryptographic operations correctly. However, in the case of external interference, hardware failures or operational errors may occur in the operation process of cryptographic modules. Fault attack uses these faulty behaviours or faulty messages to recover keys. Fault attacks mainly apply to the hardware implementation of cryptographic algorithms such as smartcards, iot devices, etc. Due to its simplicity and effectivity, fault attack has become the one of the most popular side channel attack methods. The most common techniques to inject faults include variations in supply voltage [1], variations in the external clock [2], and laser fault injection [3]. Fault attack was first proposed by Boneh et al. [4] in 1996. They attacked the public key algorithm RSA using a computation error in the encryption process. Subsequently, researchers proposed different fault attack techniques according to the characteristics of various cryptosystems. In 1997, Biham and Shamir [5] proposed the Differential Fault Attack (DFA) and attacked DES. DFA works by collecting correct and faulty ciphertexts corresponding to the same plaintext. The difference induced by the fault and the knowledge of ciphertexts can help to recover secret information. In 2000, Yen and Joye [6] showed the Safe Error Attack (SEA) on RSA. In 2006, Blömer and Krummel [7] proposed the Collision Fault Attack (CFA) against AES. Here, the attacker encrypts related plaintexts and injects a fault into the encryption process of one plaintext to get a collision. In 2013, Fuhr et al. [8] proposed the Statistical Fault Attack (SFA) for AES. One of the necessary conditions of SFA is that the output of cipher algorithm needs to be known. In recent years, various practical means of fault attacks have been proposed [9, 10], which also promote the emergence of methods and cryptosystems to resist fault attacks [11, 12]. While fault attacks on block cipher and stream cipher are widely concerned, there are few research studies on the fault attacks of authentication encryption schemes. An authentication encryption scheme, which guarantees both confidentiality and integrity, usually includes an encryption algorithm and a decryption algorithm. The encryption algorithm E takes as input key K, nonce N, associated data A, and plaintext M, and outputs ciphertext C, and authentication tag T: ( C , T ) = E ( K , N , A , M ) The decryption algorithm takes as input key K, nonce N, associated data A, ciphertext C, authentication tag T, and outputs plaintext M if the verification is successful or ⊥ if not: D ( K , N , A , C , T ) ∈ { M , ⊥ } It is usually required that nonce is never repeated under the same key for encryption algorithm. We refer to such schemes as nonce-based authenticated encryption schemes. Even though some schemes claim security in nonce-misuse settings (such as repeated nonces, or release of unverified plaintext), this often leads to security degradation. The unique nonce brings the unexpected result, which makes nonce-based authentication encryption schemes resist some fault attacks. In particular, DFA is rendered almost impossible, because DFA requires that the attacker gets both the correct and the faulty output corresponding to the same input, which is avoided in the nonce-based setting. Early fault attacks on authenticated encryption schemes were proposed in nonce-misuse settings [13, 14]. In 2016, Dobraunig et al. [15] showed the first practical fault attack on several nonce-based authenticated encryption modes for AES, including the ISO/IEC standards GCM, CCM, EAX and OCB, as well as several second-round candidates of CAESAR competition. At CHES 2016, Saha et al. [16] proposed a crafted fault attack technique, called internal differential fault analysis, to overcome the nonce barrier of DFA. Based on this, they attacked full-round PAEQ successfully. Their works [15, 16] are significant and inspire our work. In 2018, NIST initiated a process to solicit and standardise lightweight cryptographic algorithms (hereafter, referred to as NIST-LWC) suitable for constrained environments. It is required that the submitted cryptographic algorithms are equipped with both authentication and encryption functions. In the second round of NIST-LWC, there are several authenticated encryption modes for block cipher GIFT or its tweakable variants, including LOTUS/LOCUS [17], ESTATE [18], GIFT-COFB [19], and SUNDAE-GIFT [20]. Especially, GIFT-COFB has been announced as one of the finalists. There are still no relevant results about fault attacks on these modes and in this study, we make an effort forward in this work. 1.1 Our contribution First, we propose the fault attack on the nonce-based authenticated encryption mode LOTUS/LOCUS. Because LOTUS/LOCUS adopts the structure similar to XEX with secret nonce-dependent masks, previous fault attack techniques are not applicable to LOTUS/LOCUS. We give a new fault attack on LOTUS/LOCUS. In this attack, we assume that we can reset two bits in the fixed location during the encryption process. Then, we get a sample sequence of a discrete random variable whose distribution is determined by single-bit secret key information. By distinguishing two discrete random variables, we can recover this single-bit key information. In the whole attack process, neither plaintext nor ciphertext of underlying block cipher is necessary to be known. To recover the complete key, a few of faulty ciphertexts are needed when transient faults are injected, while just one faulty ciphertext is sufficient when a permanent fault is injected. Second, we show the Collision Fault Attack on GIFT, where 64 faulty ciphertexts are needed to recover the correct key. Based on this attack, we analyse three authenticated encryption modes ESTATE_TweGIFT-128, GIFT-COFB and SUNDAE-GIFT, and efficiently recover their keys in the nonce-chosen setting. 1.2 Outline This study is organized as follows. In Section 2, we introduce some background on GIFT algorithm and its tweakable variants, as well as other related information. In Section 3, we propose the differential statistical fault attack on LOTUS/LOCUS. In Section 4, we launch the Collision Fault Attack on GIFT algorithm, then apply the same measure to analyse the authenticated encryption modes ESTATE_TweGIFT-128, GIFT-COFB and SUNDAE-GIFT. 2 BACKGROUND In this section, we start with a general overview of GIFT algorithms, including GIFT-64 and GIFT-128. Then, we revisit the multiplication of any field element with two in the finite field F 2 128 . Finally, we introduce the optimal distinguisher between two discrete random variables. As for the authenticated encryption modes involved in this study, we will give a brief description when necessary, and we direct the readers to refer [17-20] for more details. 2.1 GIFT algorithm At CHES2017, Banik et al. [21] proposed the GIFT algorithm, which is a lightweight block cipher algorithm with the SPN structure, including GIFT-64-128 and GIFT-128-128. GIFT-64-128 is a 28-round cipher with a block length of 64-bit and a key length of 128-bit. GIFT-128-128 is a 40-round cipher with a block length of 128-bit and a key length of 128-bit. We call them GIFT-64 and GIFT-128, respectively. Figure 1 illustrates 2 rounds of GIFT-64. FIGURE 1Open in figure viewerPowerPoint 2 rounds of GIFT-64 The state S of GIFT can be expressed as an n-bit string bn−1bn−2⋯b0, where n = 64, 128 and b0 is the least significantbit. It also can be expressed as s many 4-bit nibbles S = S[s − 1]‖S[s − 2]‖⋯‖S[0] (s = 16, 32). A 128-bit key K is expressed as K = k7‖k6‖⋯‖k0, where ki is a 16-bit word. Each round of GIFT includes 4 steps: SubCells, PermBits, AddRoundKey, and AddRoundConstant (AddRoundConstant is omitted in Figure 1). 2.1.1 Sub cells Both versions of GIFT use the same 4-bit Sbox GS, which is applied to every nibble of the cipher state S [ i ] ← G S ( S [ i ] ) i ∈ { 0 , … , s − 1 } The Sbox is given in Table 1. TABLE 1. Sbox of GIFT x 0 1 2 3 4 5 6 7 8 9 a b c d e f GS(x) 1 a 4 c 6 f 3 9 2 d b 7 5 0 8 e 2.1.2 Perm bits It maps bits from bit position i of the cipher state to bit position P(i) b P ( i ) ← b i , i ∈ { 0 , … , n − 1 } The permutations of GIFT-64 and GIFT-128 can be, respectively, expressed as follows: P 64 ( i ) = 4 i 16 + 16 3 i mod 16 4 + ( i mod 4 ) mod 4 ) + ( i mod 4 ) P 128 ( i ) = 4 i 16 + 32 3 i mod 16 4 + ( i mod 4 ) mod 4 ) + ( i mod 4 ) 2.1.3 Key schedule Both versions of GIFT use the same key schedule. A round key RK = U‖V is extracted from the key state before the key state is updated. For GIFT-64, U ← k1, V ← k0. For GIFT-128, U ← k5‖k4, V ← k1‖k0. The key state is updated as follows: k 7 ‖ k 6 ‖ ⋯ ‖ k 1 ‖ k 0 ← k 1 > > > 2 ‖ k 0 > > > 12 ‖ ⋯ ‖ k 3 ‖ k 2 2.1.4 Add round key The n/2-bit round key is expressed as RK = U‖V = us−1⋯u0‖vs−1⋯v0, where s = 16, 32 for GIFT-64 and GIFT-128, respectively. For GIFT-64, U and V are XORed to {b4i+1} and {b4i} of the cipher state, respectively. b 4 i + 1 ← b 4 i + 1 ⊕ u i , b 4 i ← b 4 i ⊕ v i , i ∈ { 0 , … , 15 } For GIFT-128, U and V are XORed to {b4i+2} and {b4i+1} of the cipher state, respectively. b 4 i + 2 ← b 4 i + 2 ⊕ u i , b 4 i + 1 ← b 4 i + 1 ⊕ v i , i ∈ { 0 , … , 31 } 2.1.5 Add round constant For both versions of GIFT, a single bit '1' and a 6-bit round constant C = c5c4c3c2c1c0 are XORed to the cipher state at the bit position n − 1, 23, 19, 15, 11, 7 and 3, respectively. b n − 1 ← b n − 1 ⊕ 1 b 15 ← b 15 ⊕ c 3 b 3 ← b 3 ⊕ c 0 b 23 ← b 23 ⊕ c 5 b 11 ← b 11 ⊕ c 2 b 19 ← b 19 ⊕ c 4 b 7 ← b 7 ⊕ c 1 The detail about round constant generation can be found in [21]. Table 2 gives the values of the constants for each round. TABLE 2. Round constant of GIFT Rounds Constants 1-16 01,03,07,0F,1 F,3E,3D,3B,37,2F,1 E,3C,39,33,27,0E 17-32 1D,3 A,35,2B,16,2C,18,30,21,02,05,0B,17,2E,1 C,38 33-48 31,23,06,0D,1 B,36,2D,1 A,34,29,12,24,08,11,22,04 2.2 Finite field arithmetic Finite field F 2 128 can be represented by the primitive polynomial P ( x ) = x 128 + x 7 + x 2 + x + 1 The primitive element of F 2 128 is 2. The multiplication of any field element with 2 can be computed efficiently as follows: β ⊙ 2 = β ≪ 1 if β 127 = 0 ( β ≪ 1 ) ⊕ 0 120 10000111 if β 127 = 1 (1) 2.3 Optimal distinguisher between two discrete random variables In the fault attack on LOTUS/LOCUS, the problem on how to distinguish two discrete random variables will be involved. Here, we revisit the result about the optimal distinguisher [22], as well as the success probability in Theorem 1. Theorem 1. 22 Assume that ξ0 and ξ1 are two discrete random variables. Table 3 gives their distributions, where 1 2 < p ¯ ≤ 1. Let λ ∈ {ξ0, ξ1} with P ( λ = ξ 0 ) = P ( λ = ξ 1 ) = 1 2 . Given the sample sequence a = (a1, a2, …, an) of λ with length n, the optimal distinguisher to determine whether λ = ξ0 or λ = ξ1 is λ = ξ 0 n 0 ≥ n 1 ξ 1 n 0 < n 1 where n0 and n1 represent the number of 0 and one in sequence a, respectively. The success probability of the decision is p decision _ success = 1 2 ( ∑ n 0 = ⌈ n 2 ⌉ n C n n 0 p ¯ n 0 ( 1 − p ¯ ) n − n 0 + ∑ n 0 = 0 ⌈ n 2 ⌉ − 1 C n n 0 ( 1 − p ¯ ) n 0 p ¯ n − n 0 ) TABLE 3. Probability distribution table of discrete random variables ξ0 and ξ1 x 0 1 x 0 1 P(ξ0 = x) p ¯ 1 − p ¯ P(ξ1 = x) 1 − p ¯ p ¯ 3 DIFFERENCE-STATISTICAL FAULT ATTACK ON LOTUS/LOCUS Because LOTUS/LOCUS adopts the structure similar to XEX with secret nonce-dependent masks, it is impossible for attackers to know or control the input and output of the underlying block cipher. As a result, previous fault attack techniques are not applicable to LOTUS/LOCUS in the nonce-based setting. In 2017, Mahri et al. [23] researched on the fault attack on the similar structure, but with a strong assumption of the fault model. In this section, we launch a new fault attack to recover the correct key of LOTUS/LOCUS, which is called the difference-statistical fault attack. For simplicity, we have only provided the attack process on LOTUS, all work in this section is completely applicable to LOCUS. 3.1 Structure analysis of LOTUS and TweGIFT-64 Tweakable block cipher TweGIFT-64 is the underlying cryptographic module of LOTUS [17], denoted by E ¯ x , y , where x and y represent key and tweak, respectively. TweGIFT-64 is a tweakable variant of GIFT-64 with a 4-bit tweak, which is expanded and then XORed to cipher state of round 3, 7, 11, 15, 19 and 23. Except for that, TweGIFT-64 is completely same with GIFT-64. The encryption algorithm of LOTUS takes as input the 128-bit secret key K = (K127, K126, …, K0), 128-bit public nonce N = (N127, N126, …, N0), associated data A and plaintext M of arbitrary length. The entire encryption process consists of three phases: initialisation phase, associated date processing phase, and plaintext processing phase. Hereinafter, we refer to the bit with subscript i when we say ith bit of a state vector. 3.1.1 Initialisation Generate secret parameters K N = K ⊕ N Δ N = E ¯ K N , 1 ( E ¯ K , 0 ( 0 n ) ) 3.1.2 Associated date processing Parse the date into 64-bit blocks A → A 0 A 1 ⋯ A l A − 1 and process them in a similar manner as the hash layer of PMAC [24], where lA denotes the number of associated date blocks. 3.1.3 Plaintext processing Parse the plaintext into 64-bit blocks M → M 0 M 1 ⋯ M l M − 1 and process them in a similar way as OTR [25]. Regard (M2i, M2i+1) as a plaintext di-block. For each plaintext di-block, a simple variant of two-round Feistel is applied and it outputs a ciphertext di-block (C2i, C2i+1) (the detail is showed in the left half of Figure 2, where L i = 2 i + 1 + l A K N ). The output of the entire plaintext processing phase is the ciphertext C = ( C 0 | | C 1 | | ⋯ | | C l M − 1 ) . FIGURE 2Open in figure viewerPowerPoint Processing of two consecutive plaintext di-blocks in LOTUS From the above description, ΔN is unknown and changes in every encryption along with nonce. All previous fault attack techniques require the control on the input or output of the underlying cipher. However, in the whole encryption process of LOTUS, the input and output of TweGIFT-64 is either the intermediate value, which is not outputted or XORed with ΔN. That is, the input and output of TweGIFT-64 are unknown and random. Even though [15] has given the SFA on XEX-like constructions, it requires that X is fixed and related only to the key, which is obviously not satisfied by the nonce-dependent ΔN. Then, we will show how to overcome the influence of ΔN. Figure 2 gives the processing of two consecutive plaintext di-blocks (M2i, M2i+1) and (M2i+2, M2i+3), which is called a targetted structure with serial number i. Let BCi and BCi+1 represent the output of E ¯ L i , 5 ( W 2 i + 1 ) and E ¯ L i + 1 , 5 ( W 2 i + 3 ) (marked with dotted box in Figure 2), respectively. zi and zi+1 represent the 53-rd bit in the cipher state after the last-round SubCells of E ¯ L i , 5 ( W 2 i + 1 ) and E ¯ L i + 1 , 5 ( W 2 i + 3 ) , respectively. In a targetted structure, we can easily get ( M 2 i ⊕ C 2 i + 1 ) ⊕ ( M 2 i + 2 ⊕ C 2 i + 3 ) = ( Δ N ⊕ B C i ) ⊕ ( Δ N ⊕ B C i + 1 ) = B C i ⊕ B C i + 1 (2) It is easy to see that we can get the output difference of E ¯ L i , 5 ( W 2 i + 1 ) and E ¯ L i + 1 , 5 ( W 2 i + 3 ) with the knowledge of the plaintext M and ciphertext C. In the associated date processing and plaintext processing phase, the key of TweGIFT-64 L = KN is updated by 2-multiplication before the process of a block or a di-block. From section 2.2, it is easy to see that the most left bits will be removed after 2-mutiplication, which makes that bit cannot be recovered by our way. Therefore, we make the associated date empty to reduce the time of 2-multiplication and guarantee that we can recover as many key bits as possible. At least 2-multiplication occurs before L is used as the key of TweGIFT-64. Because the most right seven bits K6 ⊕ N6, …, K0 ⊕ N0 may be changed after 2-multiplication, those bits make the situation more complicated and thus we will ignore them. Property 1 gives a detailed analysis on how key bits participate in the encryption process. Property 1.For LOTUS, suppose the secret key K is fixed, nonce N is uniformly random, associated date A is empty, and plaintext M is long enough, we have the following: for 0 ≤ i ≤ 119, the bit zi in the last round of E ¯ L i , 5 is XORed to K126−i ⊕ N126−i to get the 13-th bit of BCi. Proof. The initialisation phase outputs KN = K ⊕ N. Since the associated date is empty, we have lA = 0. In the processing of ith(i ≥ 0) plaintext di-block, the secret key of E ¯ L i , 5 is Li = 2i+1(K ⊕ N). According to the expression (1), the left 120 − i bits of Li(0 ≤ i ≤ 119) are as follows: K 126 − i ⊕ N 126 − i , K 125 − i ⊕ N 125 − i , … , K 7 ⊕ N 7 . Observing the key schedule of TweGIFT-64 (same with GIFT-64 showed in Section 2), we can find that the above property is obvious. Since a secret nonce-dependent mask ΔN is used in the processing of each plaintext di-block, the input and output of the underlying block cipher are unknown and uncontrolled. In the nonce-based setting, previous fault attack techniques, such as DFA, CFA and SFA, are not applicable to LOTUS. We launch a new fault attack on LOTUS in the remainder of this section, which can recover the correct key of LOTUS efficiently. 3.2 Single-bit key information recovery We can recover single-bit key information, the difference of two key bits, by executing the attack once as shown in the following. Assume that the secret key K is fixed, nonce N is chosen uniformly at random, associated date A is empty, and the plaintext M is long enough. 3.2.1 Fault model In an encryption process of LOTUS, inject faults into the bits zi and zi+1in ith targetted structure to make the two bits to be reset (reset means that the value of the bit becomes 0). Then, get the faulty ciphertext C ∼ after every encryption process. The two faulty bits are denoted by z ∼ i and z ∼ i + 1 . We will show how to recover single-bit key information. Let sum represent the difference of the two faulty bits, that is s u m = z ∼ i ⊕ z ∼ i + 1 Here, it is not required that fault injection always succeeds in every encryption process. It is sufficient to make the values of sum tend to 0 in repeated trials. Assume that the success probability of fault injection is p(0 < p ≤ 1) in every encryption process. If fault injection succeeds, we have sum = 0. If not, sum is uniformly distributed in {0, 1}. We can get the distribution of discrete random variable sum: P ( s u m = 0 ) = p + 1 2 ( 1 − p ) = 1 2 + 1 2 p P ( s u m = 1 ) = 1 2 ( 1 − p ) = 1 2 − 1 2 p Property 1 shows the fact that the two faulty bits are XORed to K126−i ⊕ N126−i and K125−i ⊕ N125−i, respectively, to get the 13-th bit of BCi and BCi+1. From Equation (2), we have the following: s u m ⊕ ( K 126 − i ⊕ N 126 − i ) ⊕ ( K 125 − i ⊕ N 125 − i ) = B C i ⊕ B C i + 1 [ 13 ] = ( ( M 2 i ⊕ C ∼ 2 i + 1 ) ⊕ ( M 2 i + 2 ⊕ C ∼ 2 i + 3 ) ) [ 13 ] where the subscript [13] represents the 13-th bit of a state vector. Simplify the above equation: s u m ⊕ K 126 − i ⊕ K 125 − i = ( M 2 i ⊕ C ∼ 2 i + 1 ) ⊕ ( M 2 i + 2 ⊕ C ∼ 2 i + 3 ) [ 13 ] ⊕ N 126 − i ⊕ N 125 − i (3) Define three discrete random variables λ = sum ⊕ K126−i ⊕ K125−i, ξ0 = sum, and ξ1 = sum ⊕ 1. If K126−i ⊕ K125−i = 0, we have λ = ξ0. If K126−i ⊕ K125−i = 1, λ = ξ1. So, P ( λ = ξ 0 ) = P ( K 126 − i ⊕ K 125 − i = 0 ) = 1 2 P ( λ = ξ 1 ) = P ( K 126 − i ⊕ K 125 − i = 1 ) = 1 2 According to Equation (3), we can get an n-length sample sequence a = (a1, a2, …, an) of λ by injecting the above faults in n encryption processes and getting n faulty ciphertexts. Then, we decide whether λ = ξ0 or λ = ξ1 according to Theorem 1 (n0 and n1 represent the number of 0 and the number of 1 in the sequence a, respectively): λ = ξ 0 n 0 ≥ n 1 ξ 1 n 0 < n 1 We will get K126−i ⊕ K125−i = 0 if λ = ξ0, and K126−i ⊕ K125−i = 1 if λ = ξ1. According to Theorem 1, the success probability of recovering single-bit key information is p single _ bit = 1 2 n + 1 ( ∑ n 0 = ⌈ n 2 ⌉ n C n n 0 ( 1 + p ) n 0 ( 1 − p ) n − n 0 + ∑ n 0 = 0 ⌈ n 2 ⌉ − 1 C n n 0 ( 1 − p ) n 0 ( 1 + p ) n − n 0 ) For simplicity, we denote this expression by psingle _ bit = f(p, n). The factors affecting the success probability psingle _ bit include the success probability of fault injection p and the number of faulty ciphertexts n. Table 4 shows the theoretical value of psingle _ bit corresponding to different p and n. TABLE 4. The success probability of recovering single-bit key information Success pr. of fault injection (p) Nb. of faulty ciphertexts (n) Success pr. (psingle _ bit) 0.8 1 0.90 3 0.97 5 0.99 0.7 3 0.94 5 0.97 9 0.99 0.6 5 0.94 7 0.97 13 0.99 0.5 7 0.93 9 0.95 19 0.99 0.4 9 0.90 17 0.96 31 0.99 3.3 Complete key recovery The complete key K of LOTUS can be recovered by using the approach in Section 3.2. The Algorithm 1 shows the entire attack process. L O T U S _ E ∼ ( K , i ) denotes the encryption algorithm of LOTUS with faults injected into the bits zi and zi+1 of ith targetted structure, in which the nonce and plaintexts are choosen randomly. #denotes the number of elements in a set. Algorithm 1. The key recovery attack on LOTUS Input: The number of bits recovered by fault attack: m(1 ≤ m ≤ 119), the number of faulty ciphertexts used to recover single-bit key information: n. Output: The correct key K. Step1: for i = 0 to m − 1 do for j = 0 to n − 1 do C∼=LOTUS_E∼(K,i) aj=((M2i⊕C∼2i+1)⊕(M2i+2⊕C∼2i+3))[13]⊕ N126−i ⊕ N125−i end for a = (a0, a1, …, an−1) n0 = #{aj = 0|j ∈{0, 1, …, n − 1}} n1 = #{aj = 1|j ∈{0, 1, …, n − 1}} If n0 ≥ n1 do K126−i ⊕ K125−i = 0 else do K126−i ⊕ K125−i = 1 end if end for Step2: Guess remainder key bits K127 and {K126−m, …, K0}. If the correct key is not recovered, jump to Step1. In Algorithm 1, after Step 1, we get the equation set K 126 ⊕ K 125 = c 0 K 125 ⊕ K 124 = c 1 ⋮ K 128 − m ⊕ K 127 − m = c m − 2 K 127 − m ⊕ K 126 − m = c m − 1 The probability of recovering the correct key by executing Step 1-Step 2 once is ps = f(p,n)m, that is the probability of the above equation set being correct. 3.3.1 Complexity analysis To recover the correct key K, the average times of executing Step 1-Step 2 is ∑ i = 1 ∞ i ⋅ p s ⋅ ( 1 − p s ) i − 1 = p s ∑ i = 1 ∞ i ⋅ ( 1 − p s ) i − 1 = 1 p s As a result, the total number of faulty ciphertexts needed is m ⋅ n p s and the computation complexity is 2 128 - m p s on average. The factors affecting the total number of faulty ciphertexts includes parameters p, m, and n. The following conclusions are made: (1) The greater p is, the less is the total faulty ciphertexts. (2) The smaller m is, the less is the total faulty ciphertexts. By fixing p and m, we can get the value of n to minimise the total number of faulty ciphertexts by solving linear programing problems. Table 5 gives the expense of recovering key corresponding to different m and p, where the value of n is chosen to minimise the total number of faulty ciphertexts. TABLE 5. The expense of recovering key corresponding to different m and p m 98 108 p 0.9 0.8 0.7 0.9 0.8 0.7 n 5 7 11 5 7 11 Total number of Faulty ciphertexts 549 897 1399 612 1015 1583 Computation complexity 230.16 230.39 230.38 220.18 220.43 220.41 3.4 Fault injection Chakraborti et al. [17] provided the roun