# Hardware Countermeasures Benchmarking against Fault Attacks
## 4 Countermeasures against DFA
On the other hand, depending on the type of parity predictor and the types of considered faults covered, different solutions with different resource consumption can be obtained, such as [40; 52]. These works attacks both at bit and byte  
Figure 4: Representation of temporal redundancy, (**a**) Total redundancy, (**b**) partial redundancy. level, being applicable to the KeySchedule(). In [48; 51], the authors present different approaches in which the S-box() is implemented in composite fields and faults can be detected as data transformations result in odd faults being changed to even faults. Another possible approach is to divide the detection logic between linear and nonlinear layers [49]. In the first case, a simple linear code can be used, while in the second case, by computing the inverse operation, the necessary fault detection can be provided. In addition, since the S-boxes are based on the computation of the multiplicative inverse, it is possible to compute the least significant bits of the inverse product as proof of the accuracy of the result. The number of computed bits can be adjusted according to the desired cost/protection ratio. This scheme requires the intermediate result of the inverse multiplication and cannot be applied to memory-based S-box() implementations as the intermediate result is not accessible. To solve this problem, it is possible to develop a new mathematical formulation for the S-box() that considers both the inverse multiplication and the affine transformation and therefore does not matter the way in which the S-box() is implemented [43]. On the other hand, it is possible to develop a fault detection scheme based on a nonlinear \((n,k)-code\) and a robust cubic network [50]. In this solution, the length of the signature used to verify the data is configurable, so that it is possible to achieve the desired coverage/cost ratio, depending on the number of bits used for the signature. A solution based on the use of polynomial residue number systems (PRNS) is presented in [52]. In PRNS, irreducible polynomials over \(GF(2^{4})\) are used and error detection is achieved by applying redundant modules. Due to the independence between PRNS operations, the cipher has intrinsic resistance to attacks, being able to detect up to 4-bit errors that may occur in a single \(GF(2^{4})\) AES core. 4. A combination of techniques [53; 54] can be used to mitigate the limitations that each one of them presents individually. Figure 6 depicts the combination between hardware redundancy with the use of a parity bit. The combination of different countermeasures depends on the balance between resource consumption and security. Depending on the targeted protection level, different schemes can be obtained. Three types of protection can be designed, being these at the algorithm level, at the round level, or at the operation level. The first consists of performing the complete process of encryption and decryption, the second compares the result of encryption and decryption for each round and the third performs the comparison after each operation of each round [53]. Figure 5: Representation of information redundancy. Another possible approach is the combination of hardware and temporal redundancy, i.e., each encryption or decryption operation is duplicated and performed one after the other in each round. Each round is divided into two, one half being used for encryption and the other for decryption, in an alternate mode, thus allowing the check to be carried out. This type of approach doubles the number of cycles required to encrypt the information, but is able to balance it since it is able to operate at a higher frequency [54]. Table 4 lists the different protection proposals and their classification. This table shows the block or function where each countermeasure offers protection (state matrix, S-box() or KeySchedule()), type of fault injection that is able to detect, and, finally, the fault coverage against the type of fault considered.