# A Novel DFA on AES: Based on Two-Byte Fault Model with Discontiguous Rows
## 1 Introduction  
In 2001, The National Institute of Standards and Technology (NIST) adopted the advanced encryption standard, also known as AES, as a symmetric block cryptographic standard in 2001 [1]. The widespread adoption of AES is largely due to its reputation for being secure and tamper-resistant. As a result, it has been used as a cryptographic protocol for subscriber identity module (SIM) cards, wireless fidelity (WIFI) routing, and the encrypted delivery of sensitive data [2; 3; 4]. In wireless communication, data transmission is fault-tolerant, so an energy-efficient and cooperative fault-tolerant communication approach was proposed to improve fault-tolerance [5]. On the contrary, data encryption is essential to ensure data reliability. A vehicular network with an AES encoder circuit was designed to keep the vehicular data from attacking when the vehicle is running [6]. Researchers implemented AES using different tools, [PERSON] et al. proposed an efficient AES using VLSI [7]. In wireless sensor networks (WSN), [PERSON] et al. designed an improved C Language implementation of AES [8]. However, as technology has developed, numerous academics have examined AES's security. Potential dangers are present in real-world encryption systems and are vulnerable to side-channel and fault attacks. One FA technique proposed to crack block ciphers like AES [9; 10; 11; 12; 13; 14; 15; 16; 17; 18; 19; 20; 21; 22; 23; 24; 25; 26; 27], KLEIN [28; 29], SIMON [30; 31], and SIMECK [32; 33] is differential fault attack (DFA). It operates by taking advantage of differences in information between correct and fault ciphertexts, which poses a serious threat to the encryption executive equipment. However, the hardware devices need to be obtained and have the ability to induce a fault. Thus, it is assumed that these two prerequisites are fulfilled when DFA is implemented. The DFA was successfully used to crack DES after being first introduced by [PERSON] and [PERSON] [9]. The key schedule [10; 11; 12; 13; 14; 15; 16] and the state [17; 18; 19; 20; 21; 22; 23; 24; 25; 26] are two categories into which DFA on AES can be applied, depending on where the fault is introduced. In addition, a hybrid DFA model that considers faults caused at both the key schedule and state exists [27]. DFA is often classified into single-byte fault model and multi-byte fault model categories when reviewing fault models. In this article, discontiguous rows are referred to as Dcor, while PCFCs express pairs of correct and faulty ciphertexts. Previous DFA research in this area has been divided into several distinct aspects, including minimizing fault caused, utilizing various fault models, generating faults at early rounds, and extending AES-192 and AES-256. In 2011, [PERSON] et al. [23] described an analysis based on a single-byte fault induced at the state to crack AES-192 and AES-256, which require 16 and 16 PCFCs, respectively. In 2012, [PERSON] et al. [14] introduced a single-byte fault model, which could deduce the AES-129 key with 16 PCFCs. Meanwhile, AES-128 key retrieval was shown by [PERSON] et al. [21] using one PCFC and thorough searches of \(2^{8}\) candidates. In 2012, [PERSON] et al. [10] proposed a single-byte fault model to crack AES-128, AES-192, and AES-256 with two, four, and four PCFCs without exhaustive search, respectively, to decrease the number of PCFCs and the exhaustive search of key candidates. AES-192 was successfully broken in 2020 by [PERSON] et al. [18], who hypothesized a single-byte flaw in the key schedule. Moreover, multi-byte fault models have been applied. Two hypotheses were put up by the authors in 2006 [17]: one is that all four bytes in a column are faulty, while the other is that at most three bytes of a column are faulty. While the second type only requires six PCFCs, the first model requires roughly 1500 PCFCs. Four fault models, M0, M1, M2, and M3, were provided by the authors in 2009 (see Section 3.2), and M0, M1, and M2 are utilized to recover the AES-128 key with one, two, and four PCFCs, respectively [21].