Differential Fault Attack on the Stream Cipher LIZARD

Chinese Journal of ElectronicsVolume 30, Issue 3 p. 534-541 Original Research PaperFree Access Differential Fault Attack on the Stream Cipher LIZARD MA Zhen, Corresponding Author MA Zhen zhen_ma@163.com National Digital Switching System Engineering Technological Research Center, P.O. Box 407, 62 Kexue Road, Zhengzhou, 450001 ChinaSearch for more papers by this authorTIAN Tian, Corresponding Author TIAN Tian tiantian_d@126.com National Digital Switching System Engineering Technological Research Center, P.O. Box 407, 62 Kexue Road, Zhengzhou, 450001 ChinaSearch for more papers by this authorQI Wenfeng, Corresponding Author QI Wenfeng wenfeng.qi@263.net National Digital Switching System Engineering Technological Research Center, P.O. Box 407, 62 Kexue Road, Zhengzhou, 450001 ChinaSearch for more papers by this author MA Zhen, Corresponding Author MA Zhen zhen_ma@163.com National Digital Switching System Engineering Technological Research Center, P.O. Box 407, 62 Kexue Road, Zhengzhou, 450001 ChinaSearch for more papers by this authorTIAN Tian, Corresponding Author TIAN Tian tiantian_d@126.com National Digital Switching System Engineering Technological Research Center, P.O. Box 407, 62 Kexue Road, Zhengzhou, 450001 ChinaSearch for more papers by this authorQI Wenfeng, Corresponding Author QI Wenfeng wenfeng.qi@263.net National Digital Switching System Engineering Technological Research Center, P.O. Box 407, 62 Kexue Road, Zhengzhou, 450001 ChinaSearch for more papers by this author First published: 01 May 2021 https://doi.org/10.1049/cje.2021.04.007 This work is supported by the National Natural Science Foundation of China (No.61521003, No.61672533, No. 61602510). AboutSectionsPDF ToolsRequest permissionExport citationAdd to favoritesTrack citation ShareShare Give accessShare full text accessShare full-text accessPlease review our Terms and Conditions of Use and check box below to share full-text version of article.I have read and accept the Wiley Online Library Terms and Conditions of UseShareable LinkUse the link below to share a full-text version of this article with your friends and colleagues. Learn more.Copy URL Share a linkShare onFacebookTwitterLinked InRedditWechat Abstract In this paper, we try to give a security evaluation of LIZARD stream cipher in regard to fault attacks, which, to the best of our knowledge, is the first fault analysis on LIZARD. We design a differential engine of LIZARD to track the differential trail of the keystreams. It is shown that the distributions of the keystream differences are heavily biased. Utilizing this characteristic, we propose an improved method to identify the fault location for LIZARD whose success probability approaches 1. Then we use the fault-free keystream and faulty keystreams to generate system of equations in internal state variables and solve it by SAT solver. The result shows that with 100 keystream bits, only 6 different faults are needed to recover the internal state. Finally, the comparison between LIZARD and Grain v1 shows that LIZARD is more resistable than Grain v1 in regard to fault attacks. I. Introduction In recent years, many efforts have been made to meet the increasing demand of secure lightweight stream ciphers targeting highly constrained resources. Recently at FSE 2017, a new design, LIZARD, was proposed by Hamann, Krause and Meier[1]. LIZARD adopts a Grain-like design but outperforms Grain v1 in area and power consumption. It introduces the secret key twice in the initialization process. LIZARD is the first instantiation of F P ( 1 ) -mode introduced in Ref.[2], which provides a method for designing stream ciphers with provable security of two-thirds the length of the internal state against Time-memory-data (TMD) tradeoff attacks aiming at key recovery. Thus with a 121-bit internal state, LIZARD offers an 80-bit security against key recovery attacks including Time-memory-data (TMD) tradeoff attacks. The cipher is also claimed to have 60-bit security against distinguishing attacks. Since the authors didn't provide any fault analysis against LIZARD, we try to give a fault attack on LIZARD in this paper. Fault attacks were first introduced by Biham, Shamir, et al. in Ref.[3] and Ref.[4] and have become one of the most efficient side channel attacks till now. At CHES 2004, Hoch and Shamir introduced the fault analysis to stream ciphers in Ref.[5]. Since then fault analysis on stream ciphers have received serious attention and related techniques developed rapidly. In general, a typical attack scenario for fault attack against stream cipher is that an attacker can inject a random fault (using methods like laser shots or clock glitches in Refs.[6–7]) in a cryptographic device to flip one or more bits in the cipher state. By observing the difference between the keystream generated from this altered internal state (called faulty keystream) and the fault-free keystream, the attacker tries to identify the fault location. Then the attacker utilizes these keystreams together with the information of fault location to deduce the internal state. Although some prerequisites are required for fault attacks, like the requirement to re-key the device, fault attacks have been successfully implemented against a number of cryptographic primitives[8]. Researches show that stream ciphers are susceptible to fault attacks. All the three hardware finalists in the final portfolio of eSTREAM, namely Grain v1, Mickey 2.0 and Trivium, have been successfully cryptanalyzed against fault attacks[6–16]. Since the initialization processes of these ciphers are reversible, key recovery attacks can be mounted once the internal states are obtained in fault attacks. In this paper, we focus on the fault attack on LIZARD. One note that the algebraic expressions of the differences between fault-free keystreams and faulty keystreams of LIZARD is much more complicated than those of Grain v1 due to heavier output function and update functions of two NFSRs. Thus fault attack on LIZARD is expected to be more complicated than that on Grain v1. To observe the statistical characteristics of the distributions of the differential keystreams of LIZARD with different faults, we design a differential engine Δ ϕ L I Z A R D to derive the differential trails of the keystreams of LIZARD. The fault attack on LIZARD mainly consists of two parts, i.e., identifying the fault location and then recovering the internal state. To identify the fault location for LIZARD, we review two existing techniques, i.e., four signature vector method and near collision attack method, which are effective to identify the fault location for Grain v1. However, when we apply these two techniques to identifying fault locations for LIZARD, neither the success probability exceeds 0.6. Thus we try to derive a new method to identify the fault location for LIZARD. Using the differential engine Δ ϕ L I Z A R D we observe that although the differential keystreams of LIZARD exhibit more random behaviors than those of Grain v1, the distributions are far from balanced and some are heavily biased. Utilizing this characteristic, we derive an improved technique to identify the fault location for LIZARD. Experimental data shows the success probability of the proposed technique greatly increased and approaches 1. Next we show how to deduce the internal state of LIZARD after identifying the fault locations. We use the fault-free keystream and faulty keystreams to generate system of equations in internal state variables. Then we convert the system of equations into SAT instance and use CryptoMiniSat 2.9.6[16], which is a SAT solver, to solve the SAT instance. The experiments are tested with different numbers of faults and different numbers of keystream bits. It is shown that with 100 (note that the full length of registers is 121) keystream bits, only 6 different faults are needed to make SAT solver return a solution within 12 minutes. Finally, we compare the abilities of LIZARD and of Grain v1 to resist fault attacks. The results show that although with a shorter internal state, LIZARD is more resistable than Grain v1 in regard to fault attacks. The paper is organised as follows. In Section II, we introduce some preliminaries, including the description of LIZARD and the two methods to identify fault location. In Section III, we propose a fault attack on LIZARD. In Section IV, we present the experimental results of our attack. In Section V, we analyze the time complexity of the attack. In Section VI, we conclude the paper by comparing the abilities to resist fault attack of LIZARD and Grain v1. II. Preliminaries In this section, we give the algebraic description of the stream cipher LIZARD, and introduce the four signature vector method and near collision attack method which are used in our attack. 1. Algebraic description of LIZARD LIZARD accepts a 120-bit secret key K = ( k 0 , . . . , k 119 ) and a 64-bit public IV I V = ( i v 0 , . . . , i v 63 ) . It consists of three main building blocks including two NFSRs of length 31 and 90 respectively and an output function. The general design of the cipher is depicted in Fig. 1. Fig. 1Open in figure viewerPowerPoint An overview of LIZARD's keystream generation algorithm Let us denote the content of the NFSR1 and that of the NFSR2 at round t by S t = [ s 0 t , . . . , s 30 t ] and B t = [ b 0 t , . . . , b 89 t ] , respectively. For t ≥ 0 , the update functions of the NFSR1 and the NFSR2 are s 30 t + 1 = f 1 ( S t ) , and b 89 t + 1 = f 2 ( B t ) ⊕ s 0 t respectively, where f 1 ( S t ) is a Boolean function in 17 variables of 4 degree and f 2 ( B t ) is a Boolean function in 29 variables of 4 degree. For 0 ≤ i ≤ 29 , we have s i t + 1 = s i + 1 t and for 0 ≤ j ≤ 88 , we have b j t + 1 = b j + 1 t . The output function is taken as z t = ⊕ k ∈ A b k t ⊕ h ( S t , B t ) where A = { 5 , 7 , 11 , 30 , 40 , 45 , 54 , 71 } and h ( S t , B t ) is a Boolean function in 45 variables of 7 degree. 2. The four signature vector method The signature vector method has been used in a series of fault attacks on Grain[14–16]. Its basic principle is to compare the real differential keystream with certain pre-computed signature vectors to determine the fault location. The four signature vectors, i.e., the First, Second, Third and Fourth signature vector, consider some "deterministic" characteristics of the differential keystream with each fault. This method has proved to be extremely effective for Grain that the author in Ref.[15] could identify the locations of faults for Grain v1 and Grain-128 with probabilities close to 1 and for Grain-128a with probability about 0.81. Suppose at the beginning of the keystream generation process, a single-bit fault is injected to the internal state I of the cipher which causes one-bit flip at location δ. Let the fault-free and faulty keystream be denoted by Z = [ z 0 , z 1 , z 2 , . . . ] and Z δ = [ z 0 δ , z 1 δ , z 2 δ , . . . ] respectively. Then the differential keystream is denoted by Δ Z δ = [ Δ z 0 δ , Δ z 1 δ , Δ z 2 δ , . . . ] . The First and Second signature vectors collect the "certain" differences in the differential keystream which are deterministic to be 0 or 1. The Third and Fourth signature vectors consider pairs of uncertain differences at different rounds i and j which are deterministically equal (Third signature vector) or unequal (Fourth signature vector). From this understanding, we define the four signature vectors in a different way but essentially the same as those in Ref.[15]. Definition 1.For fault δ injected in the internal state I of LIZARD, the First and Second signature vectors are defined as follows: Λ δ 1 = { i | Δ z i δ = 0 for ∀ I } , Λ δ 2 = { i | Δ z i δ = 1 for ∀ I } . Definition 2.For fault δ ( 0 ≤ δ ≤ 120 ) injected in the internal state I of LIZARD, the Third and Fourth signature vectors are defined as follows: Λ δ 3 = { ( i , j ) | Δ z i δ = 2 , Δ z i δ = Δ z j δ , for ∀ I } , Λ δ 4 = { ( i , j ) | Δ z i δ = 2 , Δ z i δ = Δ z j δ ⊕ 1 for ∀ I } . Then in a real attack, by comparing these four signature vectors and the real differential keystreams, an attacker could obtain several candidate faults. If the candidate fault is unique, then he successfully determine the fault location. 3. The near collision attack method In Ref.[17], a method based on the idea of Near collision attack (NCA for short) is used to identify the fault location in fault attack on Grain v1. NCA was first proposed by Zhang et al. at FSE 2014 which could mount a key recovery attack on Grain v1[18]. The attack utilizes a characteristic of Grain v1 that when two internal states only differ in a small number of positions, the output keystream they generate are very similar to each other. In fact, the distribution of the differential keystream of Grain v1 in this case is heavily biased and some values of the segments even do not occur. Using the NCA method, the authors in Ref.[17] successfully identified the fault location for Grain v1 with probability 0.975 in case the fault flips at most 8 internal state bits. The NCA method works as follows: before a fault attack, the attacker pre-computes the distributions of certain segments of differential keystream for each fault and stores them in different tables. When an actual fault attack is performed, the attacker compares the real segment with those in pre-computed tables. Then he determines the fault location to be the one in whose table the segment occurs with the highest frequency. Note that the basis of utilizing this method to identify the fault location for Grain v1 is that the distribution of the certain segments of differential keystream is heavily biased. Thus one should first check whether the cipher has this characteristic. III. The proposed fault attack on LIZARD Fault attacks on stream ciphers mainly consist of two phases. In Phase 1, the attacker randomly injects a fault in the internal state of the cipher and obtains the faulty keystream. Then the attacker uses the difference between the fault-free keystream and the faulty keystream to identify the fault location. This is the most complex part of the attack and several techniques to identify the fault location have been proposed in the previous works. In Phase 2, the attacker derives a large number of equations in internal state variables from both fault-free keystream and faulty keystreams. Then the attackers solve these equations and recover the internal state of cipher. Before proposing our fault attack on LIZARD, we give the assumptions of the attack model. Next we design a tool Δ ϕ L I Z A R D which helps to track the differential trail of the output keystream. Then a lot of space is taken to discuss how to identify the fault location for LIZARD. Finally we introduce how we recover the internal state of LIZARD using the differential keystream. 1. Assumptions of the attack model In our fault attack on LIZARD, we have the following assumptions. 1) Attackers are able to inject faults at random positions of both NFSRs of LIZARD. The exact position is unknown. 2) The fault causes exact one-bit flip. 3) Attackers can reset the cipher with different key-IV pairs and reproduce the fault at the same position. 4) Attackers can control the timing of fault injection. In our attack, faults are assumed to inject at round 0 in the keystream generation process. 2. Δϕ LIZARD a tool to calculate differential keystream In a differential fault attack, differential keystreams are often used to identify the fault location and deduce the internal state. Thus before presenting our attack, we first derive a differential engine Δ ϕ L I Z A R D to calculate the differential keystream of LIZARD, which outputs a difference list whose items are 0, 1, or "2". The item 0 or 1 indicates the output difference is deterministic to be 0 or 1 for all internal states, while the item "2" indicates the output difference is probabilistic to be 0 or 1 as the internal state varies. The major principle used by Δ ϕ L I Z A R D to determine whether the differential keystream bit Δ z t is 0,1 or "2" is as follows: for the output function, 1) if the difference of any of its linear term is uncertain or the difference of any variable in its non-linear terms is non-zero, then we have Δ z t = 2 ; 2) otherwise, Δ z t equals the sum of differences of all its linear terms. 3. How to identify the location of a random fault In the previous works, several techniques have been introduced to identify the fault location for stream ciphers [ 14 − 16 , 19 , 21 , 22 ] . Among these techniques, we mainly focus on the signature vector technique and the NCA method (introduced in Section II.2 and II.3), which are effective for Grain family of stream ciphers. In the following we shall show that although extremely effective for Grain, these two methods cannot achieve the same effect when applied to LIZARD. This implies that to identify the fault location for LIZARD is much more complicated than that for Grain. 4. Application of the four signature vectors to LIZARD Suppose at the beginning of the keystream generation process, a single-bit fault is injected to the internal state I of the cipher which causes one-bit flip at location 0 ≤ δ ≤ 120 (we label from location 0 in NFSR2 to location 30 in NFSR1 by 0 to 120). Let the fault-free and faulty keystream be denoted by Z = [ z 0 , z 1 , z 2 , . . . ] and Z δ = [ z 0 δ , z 1 δ , z 2 δ , . . . ] respectively. Then the differential keystream is denoted by Δ Z δ = [ Δ z 0 δ , Δ z 1 δ , Δ z 2 δ , . . . ] . We first pre-compute the First and Second signature vectors of all single-bit faults for LIZARD using Δ ϕ L I Z A R D , denoted by Λ δ 1 and Λ δ 2 where 0 ≤ δ ≤ 120 . Then in a real fault attack, we collect the certain differences of the differential keystream after a random fault injection ϕ: V 1 = { i | Δ z i ϕ = 0 } , V 2 = { i | Δ z i ϕ = 1 } . We compare V 1 and V 2 with Λ δ 1 and Λ δ 1 respectively for all 0 ≤ δ ≤ 120 . Then the set of candidate locations is defined as L = { δ | Λ δ 1 ⊆ V 1 , Λ δ 2 ⊆ V 2 } . If | L | = 1 , the location of the injected fault is uniquely determined; otherwise, one needs to further identify the exact fault location from the candidate set L. We test the method of the First and Second signature vectors to identify fault location for LIZARD in 100 experiments. In each experiment, secret key and IV are randomly chosen and the fault is also randomly injected. It is shown that only five fault locations can be determined uniquely, i.e., whose candidate sets L include only one element. This implies that by using the First and Second signature vectors, one can hardly identify the exact location of a random fault for LIZARD. Thus we use the Third and Fourth signature vectors to further determine the fault location in L. The authors in Ref.[15] gave three conditions to calculate the Third and Fourth signature vectors for a fault. According to these conditions, we design an algorithm based on Δ δ L I Z A R D to calculate the Third and Fourth signature vectors for all faults 0 ≤ δ ≤ 120 . Unfortunately we find that these two signature vectors are empty for all faults of LIZARD. This implies that LIZARD does not possess the deterministic characteristic depicted by the third and fourth signature vectors. Thus the method of the four signature vectors to determine fault location for LIZARD fail and the success probability is less than 0.1. 5. Application of the NCA method to LIZARD To apply the NCA method to LIZARD, we collect enough samples of the segments of the differential keystream of LIZARD for each fault and observe the characteristics of their distributions. The length of the segment is chosen to be 15 bits since the outputs of Δ δ L I Z A R D show that most of the certain differences occur before the 15th round. This implies that the first 15-bit segment cannot take all the possible values for most of the faults. In fact, after we collect a large quantity ( N = 2 15 ) of the first 15-bit segments for each fault, we observe that lots of values do not occur, and even for the possible segments, the distributions are far from uniform. The following experimental data illustrates this phenomenon. For each fault, we pre-compute N = 2 15 samples of the first 15-bit segment of the differential keystream and store the results in a table according to the frequency of occurrence from high to low. The tables are labeled δ = 0 , 1 , . . . , 120 . Part of the tables are presented in Table 1. It can be seen that heavy biases occur in these distributions of the segments. For example, in Table δ = 1 and δ = 2 , the total frequency of occurrence of two segments is close to 1 and all the other segments rarely occur. Similar phenomenon occurs for other faults. Thus we try to use the NCA method proposed in Ref.[17] to identify the fault location for LIZARD as follows. Table 1. Part of the pre-computed tables fault segment frequency fault segment frequency δ = 0 0×4100 25.08% δ = 1 0×0200 48.67% 0×0100 24.53% 0×0000 48.19% 0×0000 24.41% 0×2200 0.80% 0×4000 24.39% 0×2000 0.31% ⋯ ⋯ ⋯ ⋯ δ = 2 0×0000 42.95% δ = 3 0×0800 27.11% 0×0400 42.35% 0×0000 26.73% 0×0401 5.87% 0×4900 5.40% 0×0001 5.68% 0×0100 5.32% After a random fault injection, we obtain the first 15-bit segment of the real differential keystream, say 0 xabcd , and compare it with the segments in each table. A set C including the candidate fault locations is then derived as follows C = { i | ( 0 xabcd , y i ) is in the table labeled δ = i } , where y i is the frequency of occurrence of 0 xabcd in Table δ = i . Then the exact fault location is thus determined to be δ which satisfies y δ = max { y i | i ∈ C } . For example, if the obtained segment of the differential keystream is 0 x 0000 , then the set C is derived as follows C = { 0 , 1 , 2 , 3 , . . . } , where the corresponding y i are y 0 = 0 . 2441 , y 1 = 0 . 4819 , y 2 = 0 . 4295 , y 3 = 0 . 2673 , . . . Suppose the largest value of y i in C is 0.4819. Then the fault location is determined to be 1. We test this method for 100 experiments. The success probability to correctly identify the fault location for LIZARD is about 0.6. This implies that this method cannot achieve the same effect for LIZARD as that for Grain v1 with success probability close to 1. 6. Improving the success probability to identify fault location In this subsection, we further improve the NCA method to identify the fault location for LIZARD. The basic idea is that we select a representative segment and compare it with the pre-computed tables. In specific, we reset the cipher with different key-IVs and inject the fault at the same position more than once. After each reset, we record the first 15-bit segment of the differential keystream and finally select the segment with the highest frequency of occurrence. Then we compare this segment with the pre-computed tables. We take the following example to illustrate the difference between our method and the original NCA method introduced in Subsection II.3. Example 1.We inject a fault at position δ = 0 and obtain a segment 0 x 0000 . If we use the NCA method introduced in Subsection II.3, then the fault location is determined to be δ = 1 . But using the improved NCA method the result will be different. After we reset the cipher and reproduce the fault for 10 times, we obtain the distribution of the segments in Table 2. Table 2. Distribution of the obtained segments Segment 0×0100 0×4000 0×0000 0×4100 Frequency 4 3 2 1 Then we select the representative segment as 0 x 0100 . After checking all the pre-computed tables, the highest frequency of occurrence of 0 x 0100 exists in the Table labeled with δ = 0 (please refer to Table 1). Thus the fault location is correctly determined to be δ = 0 . It is easy to know that the more times we reset the cipher, the more accurate result we will get. In fact, the experimental data shows that if we reset the cipher for only a few times, the success probability will drastically increase. We test this method for 100 experiments and the experimental data shows that the success probability reaches 0.904 if we reset the cipher for 5 times. We also test the experiments for more reset times and the experimental result is presented in Table 3. Table 3. Success probabilities with different resetting times Reset Times 5 10 15 20 25 30 Success Probability 0.904 0.959 0.972 0.975 0.983 0.991 We have the following remarks about the improved NCA method. Remark 1.1) The reason that the original NCA method is not effective for LIZARD is that the distribution of the differential keystream segments of LIZARD is more balanced than that of Grain v1. But the experimental data (please refer to Table 1) shows this distribution is still heavily biased and far from a uniform distribution. For instance, some frequencies of occurrences of the differential keystream segments reach up to about 48 % . According to the law of large numbers, the more samples of the differential keystream segments we obtain, the closer approximation to the real distribution we will get. This is the theoretical basis of the effectiveness of the improved NCA method.2). The validity of the experimental results presented in Table 3 is mainly due to the completeness of the pre-computed tables (please refer to Table 1). Since we have completely pre-computed the frequencies of occurrences of 15-bit differential keystream segments for all the single-bit faults and stored them in the pre-computed table, the success probability to determine the location for a randomly selected fault is expected to be very close to the experimental results presented in Table 3 which is a summary of the experimental results of 100 randomly selected faults.It can be seen that to identify the fault location with success probability more than 0.975, the attacker should reset the cipher and reproduce the fault for more than 20 times. One note that the more times one injects the fault, the more stress one puts on the hardware. Thus in practice, one should choose suitable resetting times according to the hardware endurance. 7. Obtaining nonlinear equations in internal state variables After identifying the fault location, we deduce the internal state from the fault-free and faulty keystreams. Here we use algebraic cryptanalysis that solving the system of equations in internal state variables. First we derive equations from the keystream bits as follows. z t = ∑ k ∈ A b k t ⊕ h ( S t , B t ) (1) Here we introduce new variables to represent the updates of two NFSRs and obtain the following equations. 1) The update function of NFSR1: s 30 t + 1 = f 1 ( S t ) . 2) The update function of NFSR2: b 89 t + 1 = s 0 t ⊕ f 2 ( B t ) . Suppose we obtain l-bit differential keystream. Then the number of equations is 3 l and the number of variables is ( 121 + 2 l ) . Using the similar method, we can obtain 3 l equations from each faulty keystream with 2 l new variables. Assume we obtain v faulty keystreams. Then in total 3 ( v + 1 ) l equations are derived with ( 121 + 2 ( v + 1 ) l ) variables. 8. Solving the equations to recover the internal state To solve nonlinear equations, some frequently-used techniques include Gröbner Basis algorithm, XL algorithm, and SAT solver. Here we use SAT solver to solve the obtained nonlinear equations. We first convert these equations into SAT instance and use CryptoMiniSat 2.9.6 Ref.[16] to solve them. If the system of equations has no solution, then SAT solver will return that the SAT instance is unsatisfiable. Otherwise, it will return a solution. We use a trick to check whether the system of equations has a unique solution. After the SAT solver returns a solution, we randomly select a variable and add an equation to the system that the variable doesn't equal the returned value. Then we re-run SAT solver. If SAT solver also returns a solution, then this solution must fit the original equations. Repeat this process for many times. If one obtains a small number of solutions, then these solutions are considered as the all solutions to the system of equations. To select the correct internal state, one compares the generated keystream with the real one. IV. Experimental results In this subsection, we focus on the final experiments that using SAT solver CryptoMiniSat 2.9.6 to solve the system of equations. We should pay attention to the following details: 1) how many different faults are necessary to obtain the unique solution of the system of equations; 2) how many faulty keystream bits are required to solve the system of equations. The experiments were run on a 4.0 GHz Intel Core i7 CPU. Experimental data shows that at least 6 different faults are needed to make SAT solver return a solution. With 6,7,8,9 faults, we solve 20 systems of equations respectively and record the average running time of CryptoMiniSat 2.9.6 in Table 4. Table 4. Experimental results of SAT solver Number of faults Number of keystream bits Average number of solutions Average running time 6 121 1 698.14s 7 121 1 407.57s 8 121 1 277.08s 9 121 1 87.90s Then according to the experimental data, we have the following theorem. Theorem 1.When the number of keystream bits is reduced to 100, at least 6 different faults are needed to make SAT solver return a solution and furthermore, the average number of solutions is still 1. V. Analysis of the time complexity We analyze the time complexity of the fault attack on LIZARD in the two phases respectively, i.e., the fault location phase and the internal state recovery phase. First, the time complexity of fault location can be ignored since the major work here is only to compare the 15-bit differential keystream segments. Second, in the internal state recovery phase, the time complexity is dominated by the running time of SAT solver. To test the running time of SAT solver with 100 keystream bits and 121 keystream bits respectively, we test 20 systems of equations for different numbers of fault injections respectively and record the average running time of SAT solver in Table 4. It can be seen that SAT solver will return solution in no more than 20 minutes with either 121 keystream bits or 100 keystream bits. VI. Discussion and conclusion In this paper, we outline a fault attack on LIZARD stream cipher aiming to recover the internal state. It consists of two phases, i.e., first to identify the location of a random fault and then to deduce the internal state. To identify the fault location, we tried two previously proposed methods but they turned out to be not applicable for LIZARD. Thus an improved method is derived which proves effective to identify fault location for LIZARD. From fault-free and faulty keystreams, we obtain lots of equations in internal state variables. Then we use SAT solver CryptoMiniSat 2.9.6 to solve them. Experimental data shows that, to identify a fault location with success probability more than 0.9, one should at least reset the cipher and reproduce the fault injection for 5 times. To make SAT solver return a solution, at least 6 faulty keystreams with different faults are needed. Thus to perform a successful fault attack with probability more than 0.9, an attacker should inject faults for at least 30 times. For a higher success probability, one needs to inject faults for more times according to Table 3. In Ref.[1], the designers compared the hardware performance of LIZARD with that of Grain v1. It is remarkable that the estimated power consumption of LIZARD is about 16 percent below that of Grain v1. This implies that LIZARD is extremely suitable for low-cost scenarios. They also argued that LIZARD resists several types of attacks against stream ciphers (and the Grain family in particular). But they didn't consider the fault analysis. In the following, we compare the abilities of LIZARD and Grain v1 to resist fault attacks. In specific, we make comparison of the fault attack against Grain v1 proposed in Ref.[15] and the fault attack against LIZARD in this paper. First we compare the abilities to resist fault location method and then compare the the abilities to resist internal state recovery after fault location in the following. 1) The comparison of the abilities to resist fault location methods We compare the success probabilities and the requirements of the three techniques applied to Grain v1 and LIZARD. The results are presented in Table 5. It can be seen from Table 5 that 1) while the method of signature vectors and the NCA method are very effective in the fault attacks against Grain v1, they are not applicable in the fault attack against LIZARD; 2) the proposed improved NCA method is more powerful than the other two methods, but it requires the fault injection at the same position for more than once. This makes the method less practical compared with the other two. Table 5. Comparison of the three techniques Signature vector NCA method Improved NCA method Grain v1LIZARD ≈ 1< 0.1 0.9750.6 >0.9} Times of 1 1 5 fault injection Thus LIZARD is more resistable than Grain v1 to the fault location method. 2) The comparison of the abilities to resist internal state recovery In Ref.[15], the authors needed 10 faulty keystreams with different faults to recover the entire internal state of Grain v1 in a few minutes. In our attack on LIZARD, we need 6 faulty keystreams with different faults to do so. But to identify the fault locations with success probability 0.9, we need to repeatedly inject a fault for 5 times. Thus in total, we need to inject faults for 30 times. Note that the more times one injects faults, the more stress one puts on the hardware. Based on these analysis, we believe that fault attack on LIZARD will not be as efficient as that on Grain v1. According to the above analysis, we expect that LIZARD is more resistable than Grain v1 as far as the fault attack is concerned. Biographies MA Zhen was born in Zhengzhou, Henan. She received the Ph.D. degree in National Digital Switching System Engineering & Technological Research Center, China. Her research interests include symmetric ciphers and sequences. TIAN Tian was born in Wuhan, Hubei. She is an associate professor of National Digital Switching System Engineering & Technological Research Center. Her research interests include symmetric ciphers and sequences. QI Wenfeng (corresponding author) was born in Ningbo, Zhejiang. He is a professor of National Digital Switching System Engineering & Technological Research Center. His research interests include algebra, symmetric ciphers and sequences. References 1M. Hamann, M. Krause and W. Meier. " LIZARD - A lightweight stream cipher for power-constrained devices". IACR Transactions on Symmetric Cryptology, Tokyo, Japan, pp. 45– 79, March 2017. Google Scholar 2M. Hamann and M. Krause. " Stream cipher operation modes with improved security against generic collision attacks". http://eprint.iacr.org/2015/757, 2017-4-24. Google Scholar 3E. Biham and A. Shamir. " Differential fault analysis of secret key cryptosystems". Proc. of Advances in Cryptology – CRYPTO'97, Santa Barbara, California, USA, pp. 513– 525, August 1997. Google Scholar 4D. Boneh, R.A. DeMillo and R.J. Lipton. " On the importance of checking cryptographic protocols for faults". Proc. of Advances in Cryptology – EUROCRYPT '97, Konstanz, Germany, pp. 37– 51, May 1997. Google Scholar 5J.J. Hoch and A. Shamir. " Fault Analysis of Stream Ciphers". Proc. of Cryptographic Hardware and Embedded Systems - CHES 2004, MA, USA, pp. 1– 20, August 2004. Google Scholar 6S.P. Skorobogatov. " Optically enhanced position-locked power analysis". Proc. of Cryptographic Hardware and Embedded Systems - CHES 2006, Yokohama, Japan, pp. 61– 75, October 2006. Google Scholar 7S.P. Skorobogatov and R.J. Anderson. " Optical fault induction attacks". Proc. of Cryptographic Hardware and Embedded Systems - CHES 2002, San Francisco Bay, USA, pp. 2– 12, August 2002.Google Scholar 8A. Barenghi, L. Breveglieri and I. Koren, et al. " Fault injection attacks on cryptographic devices: theory, practice, and countermeasures". Proc. of IEEE, pp. 3053– 3055, November 2012. Google Scholar 9S. Banik and S. Maitra. "Improved differential fault attack on MICKEY 2.0". Journal of Cryptographic Engineering, Vol. 5, No. 1, pp. 13– 29, 2005. CrossrefGoogle Scholar 10M. Hojsík and B. Rudolf. " Differential fault analysis of Trivium". Proc. of FSE 2008, Lausanne, Switzerland, pp. 158– 172, February 2008. Google Scholar 11M. Hojsík and B. Rudolf. " Floating fault analysis of trivium". Proc. of Progress in Cryptology - INDOCRYPT 2008, Kharagpur, India, pp. 239– 250, December 2008. Google Scholar 12Y. Hu, J. Gao, Q. Liu. et al. "Fault analysis of Trivium". Designs, Codes and Cryptography, Vol. 62, No. 3, pp. 289– 311, 2012. CrossrefWeb of Science®Google Scholar 13S. Banik, S. Maitra and S. Sarkar. " A differential fault attack on the Grain family of stream ciphers". Proc. of Cryptographic Hardware and Embedded Systems - CHES 2012, Leuven, Belgium, pp. 122– 139, September 2012. Google Scholar 14S. Banik, S. Maitra and S. Sarkar. " A differential fault attack on the Grain family under reasonable assumptions". Proc. of Progress in Cryptology - INDOCRYPT 2012, Chennai, India, pp. 191– 208, December 2011. Google Scholar 15S. Sarkar, S. Banik and S. Maitra. "Differential fault attack against Grain family with very few faults and minimal assumptions". IEEE Transactions on Computers, Vol. 64, No. 6, pp. 1647– 1657, 2015. CrossrefWeb of Science®Google Scholar 16M. Soos. " Cryptominisat-2.9.6", http://www.msoos.org/cryptminisat2/, 2017-4-24. Google Scholar 17C. Ye, T. Tian. "Multi-bit differential fault analysis of Grain-v1". Journal of Cryptologic Research, Vol. 3, No. 3, pp. 258– 269, 2016. Google Scholar 18B. Zhang, Z. Li., D. Feng, et al. " Near collision attack on the Grain v1 stream cipher". Proc. of Fast Software Encryption 2013, London, UK, pp. 518– 538, March 2014. Google Scholar 19A. Berzati, C. Canovas, G. Castagnos, et al. " Fault analysis of Grain-128". Proc. of IEEE International Workshop on Hardware-Oriented Security and Trust 2009, pp. 7– 14, 2009. Google Scholar 20S. Karmakar, and D. Roy Chowdhury. " Fault analysis of Grain-128 by targeting NFSR". Proc. of International Conference on Progress in Cryptology in Africa 2011, Dakar, Senegal, pp. 298– 315, July 2011. Google Scholar Volume30, Issue3May 2021Pages 534-541 FiguresReferencesRelatedInformation