# Hardware Countermeasures Benchmarking against Fault Attacks
## 4 Countermeasures against DFA  
In order to protect the cryptographic system against the attacks, there are different techniques and schemes that allow detecting if the circuit is being attacked by fault injection. It should be noted that in this paper, we will focus on fault detection schemes and not on correction schemes because in the literature most of the protection solutions are only fault detection oriented. Additionally, fault correction has a higher resource consumption and is out of our scope. These techniques are basically divided into three groups: hardware \begin{table}
\begin{tabular}{c c c c c c} \hline \hline \multirow{2}{*}{**Reference**} & **Attack on** & **Attack on** & **Attack on** & **Type of** & **Attack in** \\  & **State** & **S-Box** & **KeySchedule** & **Attack** & **Round** \\ \hline
[6] & \(\blacktriangledown\) & ✗ & ✗ & S.Bit \(\mid\)S.Byte & 8 and 9 \\ \hline
[7] & \(\blacktriangledown\) & \(\sim\) & ✗ & M.Bit (Same & 7, 8 and 9 \\
[8] & \(\blacktriangledown\) & ✗ & ✗ & S.Byte & 8 \\
[9] & \(\blacktriangledown\) & \(\sim\) & ✗ & S.Byte & 9 \\
[10] & ✗ & ✗ & ✗ & S.Byte & 8 and 9 \\
[11] & ✗ & ✗ & ✗ & S.Byte & 8 \\
[12] & ✗ & ✗ & ✗ & S.Byte & 7, 8 and 9 \\
[13] & ✗ & ✗ & ✗ & M.Byte & 9 \\
[14] & ✗ & ✗ & ✗ & M.Byte & 9 \\
[15] & ✗ & ✗ & ✗ & M.Byte & 9 \\
[16] & ✗ & ✗ & ✗ & S.Byte \(\mid\) M.Byte & 8 \\
[17] & ✗ & ✗ & ✗ & S.Byte \(\mid\) M.Byte & 8 \\ \hline \hline \end{tabular} \(\blacktriangledown=\) Applicable. ✗ = Not applicable. \(\sim\) = Maybe applicable. S.Bit and M.Bit = Single Bit and Multi Bit, respectively. S.Byte and M.Byte = Single Byte and Multi Byte, respectively.  
\end{table} 
Table 3: DFA on AES Classification. redundancy, temporal redundancy, information redundancy, or a combination between them. The following describes each type of protection. 1. The hardware redundancy [35; 36] countermeasure consists of duplicating the circuit to be protected or part of it in order to compare the result obtained after encryption or decryption to check if there is a difference. Figure 3 depicts the representation of two examples of hardware redundancy. Figure 3a the complete redundancy of the cryptographic circuit, while Figure 3b depicts an example of partial redundancy. This type of countermeasure is the most direct and simplest, but at the same time, it is the one with the highest resource cost. Given that in the AES cipher, the main vulnerability, regarding fault injection, is based on the propagation of faults in the last rounds, the protection against this type of countermeasures would consist of distorting this propagation. To do this, it is possible to use two redundant state matrixes and exchange their values with the aim of both distorting and detecting a possible fault [35]. Another protection solution using redundant logic is to duplicate vulnerable operations such as S-boxes. A scheme of this type allows to execute the same function on multiple data at the same time, i.e., duplicating the S-boxes for the same data and verifying the correct operation in an iterative way [36]. 2. The temporal redundancy [37; 38; 39] countermeasure is based on repeating operations of the cipher in a reverse way or by duplication, thus being able to check the result of an operation with its previous value or the one obtained from the second run. Figure 4 depicts two examples of temporal redundancy. Figure 4a) depicts the encryption and decryption, allowing to compare the result, after decryption, with the input value. In the case of Figure 4b), the reverse operation belonging to the decoding of a single function is repeated. This type of countermeasure takes advantage of the fact that most cryptographic circuits implement both encryption and decryption. While having a low resource cost, it significantly increases the time required since it needs to operate twice as long to perform the inverse operations for the verification. On the other hand, depending on the level of security and redundancy, protection can be achieved with greater or lesser resource consumption.