Package: phoenixAES
phoenixAES: a tool to perform differential fault analysis attacks (DFA) against AESCurrently phoenixAES contains the following ciphers and fault models:simple DFA R9:AES 128 encryption or decryptionAt least 4*2 faults in round 9 (between the last two MixCols)Ref:G. Piret and J.-J. Quisquater. A Differential Fault Attack Technique against SPN Structures, with Application to the AES and Khazad, CHES 2003 (pdf)Current implementation discards automatically unexploitable outputs but may fail if more than one fault occur on the same column so be careful to record only outputs from single faulted implementations.simple DFA R8:AES 128 encryption or decryption2 single faults in round 8Ref: same paper as aboveIt simply converts the ciphertexts as if they were faulted in round 9 so the previous attack can be appliedSeehttps://blog.quarkslab.com/differential-fault-analysis-on-white-box-aes-implementations.htmlfor more background.InstallationThere is no dependencies, it requires only Python 3.python3 -m pip install phoenixAESUsageIt takes a file of recorded outputs, optionally preceded by inputs (which will be ignored).
First record must be with the correct output, to be used as reference.E.g. for AES:#!/usr/bin/env python3importphoenixAESwithopen('tracefile','wb')ast:t.write("""74657374746573747465737474657374 BF9B06F11DF478145B8300FE440B0D0674657374746573747465737474657374 BF9BDDF11D527814568300FE440B0DFA74657374746573747465737474657374 BF9BF9F11DAC78145F8300FE440B0D6774657374746573747465737474657374 BF9BF0F11DBB78140C8300FE440B0DEE74657374746573747465737474657374 BF9BF9F11DAC78145F8300FE440B0D6774657374746573747465737474657374 BF9B69F11DBD7814E68300FE440B0DAE74657374746573747465737474657374 BF9BF0F11DBB78140C8300FE440B0DEE74657374746573747465737474657374 BF9B90F11D4178149D8300FE440B0DE274657374746573747465737474657374 BF9BCFF11D0478140E8300FE440B0D2874657374746573747465737474657374 FD9B06F11DF478E15B831AFE44C40D0674657374746573747465737474657374 BA9B06F11DF4787B5B83E8FE44020D0674657374746573747465737474657374 579B06F11DF478565B8364FE446F0D0674657374746573747465737474657374 579B06F11DF478565B8364FE446F0D0674657374746573747465737474657374 BF9B065C1DF4B6145B1800FE9E0B0D0674657374746573747465737474657374 BF9B065C1DF4B6145B1800FE9E0B0D0674657374746573747465737474657374 BF9B06251DF454145BC200FE060B0D0674657374746573747465737474657374 BF9B06941DF4C3145BFB00FED20B0D0674657374746573747465737474657374 BF9B12F11D977814DD8300FE440B0D2174657374746573747465737474657374 BF9B90F11D4178149D8300FE440B0DE274657374746573747465737474657374 BF9BCFF11D0478140E8300FE440B0D2874657374746573747465737474657374 BF9BDDF11D527814568300FE440B0DFA74657374746573747465737474657374 BFFB06F1E2F478145B8300AB440B790674657374746573747465737474657374 BF5D06F142F478145B830049440B7306""".encode('utf8'))phoenixAES.crack_file('tracefile')After ~50 ms:Last round key #N found:
D014F9A8C9EE2589E13F0CC8B6630CA6For two single faults in round 8:#!/usr/bin/env python3importphoenixAESwithopen("r8faults","w")asf:f.write("bf9b06f11df478145b8300fe440b0d06\n")f.write("fdfbf95ce2acb6e15f181aab9ec47967\n")f.write("ba5df02542bb547b0cc2e849060273ee\n")phoenixAES.convert_r8faults_file("r8faults","r9faults")phoenixAES.crack_file("r9faults")After ~50 ms:Last round key #N found:
D014F9A8C9EE2589E13F0CC8B6630CA6