A novel differential fault analysis using two‐byte fault model on AES Key schedule

IET Circuits, Devices & SystemsVolume 13, Issue 5 p. 661-666 Research ArticleFree Access A novel differential fault analysis using two-byte fault model on AES Key schedule Jinbao Zhang, Jinbao Zhang College of Electronic and Information Engineering, Nanjing University of Aeronautics and Astronautics, Nanjing, 211106 People's Republic of ChinaSearch for more papers by this authorNing Wu, Corresponding Author Ning Wu wunee@nuaa.edu.cn College of Electronic and Information Engineering, Nanjing University of Aeronautics and Astronautics, Nanjing, 211106 People's Republic of ChinaSearch for more papers by this authorJianhua Li, Jianhua Li Institute of computer Application, Taizhou University, Linhai, 317000 People's Republic of ChinaSearch for more papers by this authorFang Zhou, Fang Zhou College of Electronic and Information Engineering, Nanjing University of Aeronautics and Astronautics, Nanjing, 211106 People's Republic of ChinaSearch for more papers by this author Jinbao Zhang, Jinbao Zhang College of Electronic and Information Engineering, Nanjing University of Aeronautics and Astronautics, Nanjing, 211106 People's Republic of ChinaSearch for more papers by this authorNing Wu, Corresponding Author Ning Wu wunee@nuaa.edu.cn College of Electronic and Information Engineering, Nanjing University of Aeronautics and Astronautics, Nanjing, 211106 People's Republic of ChinaSearch for more papers by this authorJianhua Li, Jianhua Li Institute of computer Application, Taizhou University, Linhai, 317000 People's Republic of ChinaSearch for more papers by this authorFang Zhou, Fang Zhou College of Electronic and Information Engineering, Nanjing University of Aeronautics and Astronautics, Nanjing, 211106 People's Republic of ChinaSearch for more papers by this author First published: 01 July 2019 https://doi.org/10.1049/iet-cds.2018.5428Citations: 10AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onFacebookTwitterLinkedInRedditWechat Abstract One of the well-known physical attacks, i.e. differential fault analysis (DFA), can break the secret key of cryptographic device by using differential information between faulty and correct ciphertexts. Here, the authors propose a random 2-byte fault model, present a novel DFA on AES key schedule, and show how an entire AES-128 key can be cracked by using two pairs of faulty and correct ciphertexts. By inducing a random 2-byte fault in the first column of 9th round key with discontiguous rows, the authors can obtain 64 bits of AES-128 key using one pair of faulty and correct ciphertexts, two pairs of them can retrieve the entire 128-bit key without exhaustive search. The authors implement the proposed attack on HP Intel(R) Core i5-7300HQ Quad-Core 2.5 GHz CPU, 8G RAM. It takes <2 min on average to break the key. Considering the number of faulty ciphertexts, fault-induced depth, and fault model, authors' attack is the most efficient DFA as compared to existing schemes on AES-128 key schedule. 1 Introduction In recent decades, information technology has been developing rapidly, and study for information security has become a research hotspot. To ensure the security of information, cryptographic hardware devices such as smart cards are widely used. Due to the strict mathematical structure of advance encryption standards (AES) [1], AES-based cryptosystem has been proved to immune against most conventional attacks. However, with the development of physical attacks such as side-channel attack (SCA) [2, 3] and fault attacks (FA) [4], it has shown vulnerabilities for hardware implementation of AES [5-9]. As one of the typical FAs, differential fault analysis (DFA) [10, 11] can make use of the erroneous calculations induced by the adversary to crack the secret key of a block encryption algorithm, it was first proposed by Biham and Shamir as an attack to recover the key of DES in 1997 [12], since then it has been greatly developed and poses a great threat to hardware cryptographic devices. Due to the wide use of AES, AES-based cryptosystem has become its main attack object, illustrated in [9, 10, 13-17]. When considering DFA on AES, we can classify it into two categories according to the location of induced fault: First, the faults are performed in the intermediate State during a round. Second, the attacks provoke faults in the key schedule. Here, we mainly focus our discussion on the second category. In 2004, Giraud proposed DFA on AES key schedule for the first time [9]. Later, Chen and Yen further improved this kind of attack in [18]. However, due to selection of both the intermediate State and key schedule as the location of induced faults in their work, these attacks require too many pairs of faulty and correct ciphertexts. After that, a different DFA on AES key schedule was proposed by Peacham , et al., they assumed a random multi-byte fault was induced (i.e. assuming multi-byte faults are induced at once) and succeed in reducing the required pairs of faulty and correct ciphertexts to 12 without brute-force search [13]. Further, Takahashi , et al. presented a general attack form based on the DFA proposed in [13], and showed that they could succeed in retrieving the AES-128 key use 2 pairs of faulty and correct ciphertexts with exhaustive search of 248, or seven pairs no exhaustive search [14]. In 2008, a random 3-byte fault model was proposed in [19], where the faults were injected in the first column of 9th round key. Reference [19] claimed that only using two pairs with an exhaustive search of 232 or four pairs without exhaustive search could entirely recover the key. In a following work, an improved DFA on AES key schedule using a single-byte fault model was presented by Ali , et al. [16]. Through assuming a random single-byte fault was induced in the first column of 8th round key, they pointed out the entire key of AES could be retrieved by using one pair of faulty and correct ciphertexts with a 28 exhaustive search. Soon after that a similar DFA on the key schedule was presented by Chong , et al. [17]. Based on the same fault model as proposed in [16], reference [17] also assumed that a random one-byte fault was induced in the first column of 8th round key. However, it could break the entire key by using only two pairs of faulty and correct ciphertexts without exhaustive search. Here, we present a novel DFA on AES key schedule. Different from the existed fault model used in [14], in which a random two-byte fault model was assumed and the location of induced fault was in the second column of 9th round key with contiguous rows (Here, contiguous rows mean the positions of the two rows are adjacent to each other, such as the 1st and 2nd rows are contiguous rows. Corresponding, the 1st and 3rd rows are discontiguous rows), our fault model assumes that the adversary induces a random two-byte fault in the first column of 9th round key with discontiguous rows. Based on the proposed fault model, we prove that we can break the entire AES-128 key without exhaustive search by using only two pairs of faulty and correct ciphertexts, one pair of them can obtain 64 bits of 128-bit key and reduce the possible key hypotheses to 264. Compared to these previous works, the major contributions of our work are: The least faults and minimum fault-induced depth (Here, we call the location of induced fault as the fault induced depth) are required when the number of faulty ciphertexts and fault-induced depth are taken into comprehensive consideration. Up to now, two pairs of faulty and correct ciphertexts by Chong , et al. [17] are the best, while the fault-induced depth is 8th round key. Although our attack requires as the same two pairs, our fault-induced depth is 9th round. When considering the same fault-induced depth (i.e. 9th round), to entirely recover the key, reference [14] requires seven pairs on the assumption of a random two-byte fault model. Reference [19] requires four pairs on the assumption of a random three-byte fault model. However, our attack only requires two pairs on the assumption of a random two-byte fault model. No brute-force search is required. Thus, the plaintexts do not need to be known when breaking the key. Two-byte fault model with discontiguous rows is used. When considering DFA on AES key schedule, most existing ones assume three- or four-bytes fault model. Such as references [13] and [19], assume three-byte fault model, and reference [20] assumes four-byte fault model. Although reference [14] assumes two-byte fault model (which based on the contiguous rows), our fault model is the first one which based on the discontiguous rows. The rest of the paper is arranged as follows. The AES cryptographic algorithm is briefly introduced in Section 2, including the round transformation and key scheduling. Then, Section 3 proposes and discusses our novel DFA mechanism on AES key schedule. We first propose a new two-byte fault model with discontiguous rows, then present specific processes of restoring the entire AES-128 key. Experimental results and comparison are presented in Section 4. Section 5 concludes this paper. 2 AES As an iterated symmetric block cipher algorithm, AES can encrypt and decrypt a 128-bit data block with three different keys: 128/192/256 bits, known as AES-128, AES-192, and AES-256, respectively [1]. The intermediate computation result of AES is usually transformed into a 4 × 4 matrix of bytes, called as State. The encryption process for AES consists of two parts: round transformations and key schedule. Here, our main focus is AES-128, as many fault attacks have been suggested. The corresponding correct (C) and faulty ciphertexts (C*) are, respectively, defined as: where Ci ∈ {0, … , 255}, ∀i∈ {1, … , 16}. 2.1 Round As shown in Fig. 1, there are 10 rounds for AES-128 encryption. Each round is composed of four transformations: SubBytes (SB), ShiftRows (SR), MixColumns (MC), and AddRoundKey (ARK), except for the last round which excludes the MC transformation. SB: A non-linear byte substitution where each byte of the input is replaced with another according to a non-linear permutation S-box. We denote inverse SB as SB−1. SR: A cyclic shifts operation for State. First row is not shifted, second row is shifted by 1 byte to the left, third row by 2 bytes and the fourth row by 3 bytes. We denote inverse SR as SR−1. MC: A mixing column operation mixes column j, 0 ≤ j ≤ 3. Considering c(x) as a polynomial over GF(28), by multiplying fixed polynomial a(x) = 03 × 3 + 01 × 2 + 01x + 02 with c(x) modulo (x4 + 1). We denote inverse MC as MC−1. ARK: A bit-wise exclusive or operation (denoted as XOR) between each byte of round key and State. Using a key schedule, each round key is exported from the cipher key. Fig. 1Open in figure viewerPowerPoint AES encryption 2.2 Key scheduling The key scheduling provides round keys Ki,0 ≤ i ≤ 10, and K0 is theinitial input key. It produces next round key through the current one.Fig. 2 shows the last two rounds ofAES-128 key scheduling process. The key scheduling divides the 128-bit input key(i.e. the 8th round key K8) into four 4-bytecolumns. In 9th round, the first 4-byte column propagates to next column andthen generates second column, and 2nd and 3rd complete the same operation.Through the functions of RotWord and SubWord, and XOR a round constant wordarray RCi., fourth column propagates tofirst column of next round. RotWord: a cyclic rotation operation. For example, afour-byte input (x1,x2, x3,x4) produces four-byte output(x2, x3,x4,x1). Table 1. Round constant for each round I 1 2 3 4 5 6 7 8 9 10 xi 01 02 04 08 10 20 40 80 1B 36 Fig. 2Open in figure viewerPowerPoint AES-128 key scheduling process for the last tworounds SubWord: a byte substitution where each byte of aninput is replaced with another according to a non-linear permutationS-box. RCi: a round constant word array, whichis defined byRCi = (xi,{00}, {00}, {00}). The value of xi inthe field GF(2)8 is shown in Table 1, irepresents the number of round, and 1 ≤ i ≤ 10. The key scheduling is invertible, and, therefore, we can calculate K9 from K10 as follows: (1) 3 DFA on AES 3.1 Assumption of Our fault model According to the location of induced fault, the DFA on AES can be generally divided into two classes: Faults are performed in the intermediate State during a round and faults in the key schedule. In here, we assume that the adversary induces a random two-byte fault in the first column of K9 with discontiguous rows. This fault model is different from the ones used in existed DFAs which are also on the key schedule. Our attack includes two cases: Case one, a random two-byte fault is induced in and ; Case two, a random two-byte fault is induced in and . From the two cases mentioned above, two pairs of faulty and correct ciphertexts can be obtained, which are being denoted as (C1*, C1) and (C2*, C2), respectively. 3.2 Mechanism of the proposed attack We recover the entire 128-bit key in two phases based on the proposed attack. In the first phase, we induce a random two-byte fault in and to break eight bytes of the final round key K10 and reduce the possible key hypotheses to 264. In the second phase, we assume another random two-byte fault is injected in and , so as to retrieve the remaining eight bytes of K10. First phase of the proposed attack: random two-byte fault is induced in and . The corruption process of inducted fault in key scheduling in this case is as described in Fig. 3. Fig. 3Open in figure viewerPowerPoint Propagation of induced fault in AES key scheduling for and As shown in Fig. 3, we assume two key bytes: and are induced differences. We denote by m and n the two random faulty values. Then, all bytes of the first and third row of K9 are corrupted by the same faulty values m and n, respectively. Subsequently, the induced fault propagates to K10. The RotWord and SubWord are applied to the final column of K9 to compute the first column of K10. This will transform the faulty value m to value o and value n to value p. According to the (1) and the principle of key scheduling, the faulty value o can be expressed by m as follows: (2) The faulty value p can be expressed by n as follows: (3) In (2) and (3): m∈{1, … , 255}, n∈{1, … , 255}. If m or n is equal to zero, then it means no fault has been injected. Once there is some fault being induced in the round keys, the fault will be diffused to the intermediate States through the ARK transformation. The corruption process of inducted faults in the last round is as shown in Fig. 4. Fig. 4Open in figure viewerPowerPoint Corruption process of faults in the last round of AES encryption owing to 2-byte fault induction in and As we can obtain the faulty and correct ciphertexts (C1*, C1), the fault values o and p in State matrix S4 (as described in Fig. 4) can be expressed as follows: (4) According to the (2)–(4), it can be deduced that: (5) (6) The fault values (m, m, m, m) in State matrix S1 can be written in terms of K10 and (C1*, C1), as: (7) Similarly, the fault values (n, n, n, n) in State matrix S1 can be described by using the following expression: (8) Based on both the (5) and the set of (7), we can determine the values of , , and by Algorithm 1. The detailed description for Algorithm 1 is as described in Table 2. Table 2. Algorithm 1 for DFA on AES-128 key scheduling Algorithm 1 Input: C*, C.Output: the quartet bytes of 128-bit key: ,, and 1. for m = 1–255 2. get {, , , } from the set (7) 3. test the (5) 4. if satisfied, then do 5 else return to step 1 5. save According to the (6) and the set of (8), we can determine another quartet bytes of 128-bit AES key: , , , and by similar algorithm called Algorithm 2, which can be described in Table 3. Table 3. Algorithm 2 for DFA on AES-128 key scheduling Algorithm 2 Input: C*, C.Output: the quartet bytes of 128-bit key: ,, and 1. for n = 1–255 2. get from the set (8) 3. test the (6) 4. if satisfied, then do 5 else return to step 1 5. save {,,, } Through the first phase, we can obtain eight bytes of the key: , , , , , , , and . In other words, we can retrieve eightbytes of AES-128 key with one pair of faulty and correct ciphertexts and reducethe possible key hypotheses to 264. Second phase of the proposed attack: random two-byte fault is induced in and . Fig. 5Open in figure viewerPowerPoint Propagation of induced Fault in AES key schedulingforand In this case, the corruption process of inducted fault in keyscheduling and the last round are as shown in Figs. 5 and 6, respectively. Table 4. Summary for existing DFA on AES-128 key schedule Reference DFA on keyschedule [16] [17] [13] [20] [19] [14] Our attack fault model Single-byte Multi-byte 1 byte 1 byte 4 bytes 4 bytes 3 bytes 2 bytes: contiguous rows 2 bytes: discontiguous rows fault location 8th round 8th round 9th round 9th round 9th round 9th round 9th round no. of faults 1 2 12 1 2 2 4 2 4 7 1 2 exhaustive search 28 N.A N.A 232 N.A 232 N.A 248 216 N.A 264 N.A Fig. 6Open in figure viewerPowerPoint Corruption process of faults in the last round of AESencryption owing to 2-byte fault induction inand Similar to the discussion in first phase, we can describe c and d by the fault values a and b as below equations. (9) (10) Since we can obtain the faulty and correct ciphertexts (C2*, C2), the fault values c and d in State matrix S4 (as described in Fig. 6) can be expressed as follows: (11) According to the (9)–(11), we can get: (12) (13) The fault values (a, a, a, a) in State matrix S1 can be written in terms of K10 and (C2*, C2) as (14). (14) Similarly, the fault values (b, b, b, b) in State matrix S1 can be represented by using the following expression: (15) Based on the (12), (13), and the set of (14) and (15), we can determine the values of { as well as by using the same algorithm (It only needs making a little change, such as change m and } in the Algorithm 1 to a and ) mentioned in the first phase of the proposed attack. From both the first and second phase, we can find total of the 128-bit key. In other words, based on a random two-byte fault model with discontiguous rows, our proposed DFA on AES-128 key schedule can obtain 64 bits of the 128-bit key and reduce the possible key hypotheses to 264 by using one pair of faulty and correct ciphertexts, two pairs of them can break the entire 128-bit key. 4 Experimental results and comparison In order to validate our attack, we have implemented the proposed attack under windows work environment, desktop with HP Intel(R) Core i5-7300HQ Quad-Core 2.5 GHz CPU, 8G RAM. First, we make use of Vivado software to obtain the valid corrupted ciphertexts. Second, by using Matlab simulation tools, we retrieve the AES-128 key based on Algorithms 1 and 2. The simulation has been carried out over 100 times on random AES key. It takes <2 min on average to break the entire AES-128 key by Matlab simulation tools. Table 4 summaries our proposed attack as well as these existing DFAs which are all on AES-128 key schedule. For entire retrieving the 128 bits key, our attack requires only two pairs of faulty and correct ciphertexts considering the location of induced fault is 9th round. From Table 4, we can see that reference [14] is based on a random two-byte fault model as same as our attack. Due to use of the random two-bye fault model with discontiguous rows, our attack is more efficient. Compared with these existing ones, the advantages of our attack are as follows. First, when comprehensively considering fault-induced depth, the number of faulty ciphertexts and exhaustive search, our attack requires only two pairs of faulty and correct ciphertexts without exhaustive search. Although reference [16] only requires one pair, it needs a 28 exhaustive search for retrieving the AES-128 key. References [19] and [14] require the same two pairs, but they need a 232 and 248 exhaustive search, respectively. Second, when considering no exhaustive search, two pairs of faulty and correct ciphertexts are the minimum requirement. However, the location of induced fault in our attack is 9th round compared with 8th round in [17]. In other words, our attack has a smaller fault-induced depth. Third, when considering the same fault-induced depth (i.e. the 9th round), our attack uses a two-byte fault model. Compared with the four-byte fault model used in [20], our fault model is more realistic. 5 Conclusion Here, a novel DFA on AES-128 key schedule is proposed. Based on a random 2-byte fault model, the novel attack can recover the entire 128-bit key using two pairs of faulty and correct ciphertexts. The location of induced fault is in the first column of K9 with discontiguous rows. When comprehensively considering the number of faulty ciphertexts, fault-induced depth, exhaustive search, and fault model, our attack is the most efficient DFA as compared to these existing ones which are all on AES-128 key schedule. Although our random two-byte fault model with discontiguous rows is designed for AES-128 here, our attack has well universal property and can be extended to AES-192 and AES-256. For example, to retrieve the AES-192 key, we need both K12 and the right half K11. When inducing a random two-byte fault with discontiguous rows in K11 (For the same attack location, we need encrypt two different plaintexts to obtain two pairs of faulty and correct ciphertexts), it is easy to deduce that eight bytes of K12 and 2 bits of the fourth column of K11 by using two pairs of faulty and correct ciphertexts. By using four pairs, the K12 and the fourth column of K11 could be retrieved. In other words, we can retrieve the AES-192 key by using four pairs of faulty and correct ciphertexts with a 232 exhaustive search. When considering AES-256, the K13 and K12 could be selected as the attack location, and the analysis processes are similar to AES-192. 6 Acknowledgments This work was supported by National Natural Science Foundation of China (No. 61774086, 61376025), Natural Science Foundation of Jiangsu Province (No. BK20160806), Funding of Jiangsu Innovation Program for Graduate Education under Grant (No. KYLX16_0373), Program of Teacher's Professional Development at Education Department of Zhejiang Province (No. JW2016001). 7 References 1Daemen, J., Rijmen, V.: ' The design of rijndael: AES, the advanced encryption standard' ( Springer-Verlag, Berlin, Germany, 2002) 2Weiwei, S., Xingyuan, F., Zhipeng, X.: 'A secure reconfigurable crypto IC with countermeasures against SPA, DPA, and EMA', IEEE Trans. Computer-Aided Des. Integr. Circuits Syst., 2015, 34, (7), pp. 1201– 1205 3Hou, S., Zhou, Y., Liu, H., et al.: 'Wavelet support vector machine algorithm in power analysis attacks', Radioengineering, 2017, 26, (3), pp. 890– 902 4Karaklajić, D., Schmidt, J.M., Verbauwhede, I.: 'Hardware designer's guide to fault attacks', IEEE Trans. Very Large Scale Integr. (VLSI) Syst., 2013, 21, (12), pp. 2295– 2306 5Schramm, K., Leander, G., Felke, P., et al.: ' A collision-attack on AES: combining side channel and differential attack'. Proc. of the Int. Workshop on Cryptographic Hardware and Embedded Systems – CHES 2004, Cambridge, Ma, USA, 2004, pp. 163– 175 6Martinasek, Z., Zeman, V.: 'Innovative method of the power analysis', Radioengineering, 2013, 22, (2), pp. 586– 594 7Dassance, F., Venelli, A.: ' Combined fault and side-channel attacks on the AES key schedule'. Proc. of the Int. Workshop on Fault Diagnosis Tolerance Cryptography – FDTC 2012. IEEE Int. Conf., Leuven, Belgium, 2012, pp. 63– 71 8Courbon, F., Fournier, J.J.A., Loubet-Moundi, P., et al.: 'Combining image processing and laser fault injections for characterizing a hardware AES', IEEE Trans. Comput.-Aided Des. Integr. Circuits Syst., 2015, 34, (6), pp. 928– 936 9Giraud, C.: ' DFA on AES'. (LNCS), 2004, pp. 27– 41 10Piret, G, Quisquater, J.J.: ' A differential fault attack technique against spn structures, with application to the AES and khazad'. Proc. of the Int. Workshop on Cryptographic Hardware and Embedded Systems – CHES 2003, Cologne, Germany, 2003, pp. 77– 88 11Barenghi, A., Breveglieri, L., Koren, I., et al.: 'Fault injection attacks on cryptographic devices: theory, practice, and countermeasures', Proc. IEEE, 2012, 100, (11), pp. 3056– 3076 12Biham, E., Shamir, A.: ' Differential fault analysis of secret key cryptosystems'. CRYPTO, Ser., Springer, Berlin, Heidelberg, 1997, (LNCS, 1294), pp. 513– 525 13Peacham, D., Thomas, B.: ' A DFA attack against the AES key schedule 2006'. Available at http://www.siventure.com/pdfs/AES/KeySchedule/DFA/whitepaper.pdf, SiVenture White Paper 001, 26 October 14Takahashi, J., Fukunaga, T., Yamakoshi, K.: ' DFA mechanism on the AES key schedule'. Proc. of the Int. Workshop on Fault Diagnosis Tolerance Cryptography – FDTC 2007. IEEE Int. Conf., Vienna, Austria, 2007, pp. 62– 74 15Tunstall, M., Mukhopadhyay, D., Ali, S.S.: ' Differential fault analysis of the advanced encryption standard using a single fault'. Information Security Theory and Practice. Security and Privacy of Mobile Devices in Wireless Communication, Berlin Heidelberg, 2011, vol. 6633, pp. 224– 233 16Ali, S.S., Mukhopadhyay, D.: ' A differential fault analysis on AES key schedule using single fault'. Proc. of the Int. Workshop on Fault Diagnosis Tolerance Cryptography – FDTC 2011. IEEE Int. Conf., Nara, Japan, 2011, pp. 35– 42 17Kim, C.H.: 'Improved differential fault analysis on AES Key schedule', IEEE Trans. Information Forensics & Security, 2012, 7, (1), pp. 41– 50 18Chen, C.H., Yen, S.M.: ' Differential fault analysis on AES key schedule and some countermeasures'. Australasian Conf. on Information Security and Privacy, Springer-Verlag, Berlin Heidelberg, 2003, vol. 2727, Springer, pp. 118– 129 19Kim, C.H., Quisquater, J.J.: ' New differential fault analysis on AES key schedule: two faults are enough'. Int. Conf. on Smart Card Research and Advanced Applications Springer-Verlag, London, UK, 2008, vol. 5189, pp. 48– 60 20Ali, S. S., Mukhopadhyay, D.: ' Differential fault analysis of AES-128 key schedule using a single multi-byte fault'. Int. Conf. on Smart Card Research and Advanced Applications, New York, USA, Springer-Verlag, 2011, vol. 7079, pp. 50– 64 Citing Literature Volume13, Issue5August 2019Pages 661-666 FiguresReferencesRelatedInformation