# A Novel DFA on AES: Based on Two-Byte Fault Model with Discontiguous Rows
## 3 DFA on AES
### Fault Model  
In the above analysis, the fault model of DFA is typed due to two parameters: the number of faults induced and the fault location (including the difference of fault round at the state or the key schedule). The multi-byte fault (M0, M1, M2, and M3 in [17]) is assessed before constructing the Dcor fault model. The term 'diagonal' (\(D_{i}\)) refers to a group of four state bytes. \(D_{0}\), \(D_{1}\), \(D_{2}\), and \(D_{3}\) can therefore be stated as follows:  
\[D_{0}=\{S_{1},S_{6},S_{11},S_{16}\},\]  
\[D_{1}=\{S_{2},S_{7},S_{12},S_{13}\},\]  
\[D_{2}=\{S_{3},S_{8},S_{9},S_{14}\},\]  
\[D_{3}=\{S_{4},S_{5},S_{10},S_{15}\}.\]  
The fault models M0, M1, M2, and M3 are described in [17]. Examples of M0, M1, M2, and M3 are shown in Figure 5.  
The Dcor fault model is now introduced. It is assumed that a two-byte fault is corrupted by fault induced at the first column of the R\(-2\) round of AES state, in which the value is random and unknown to the attacker. However, the position of the fault is controlled by the attacker and the fault value can be deduced by a set of equations. This Dcor fault model can be described as inducing two-byte faults at discontiguous rows of state \(S^{\text{R}-2}\). Namely, the first two-byte fault is induced at \(S_{1}^{R}\) and \(S_{9}^{R}\). Second, it is induced at \(S_{5}^{R}\) and \(S_{13}^{R}\). Two-byte fault (Dcor fault, see Figure 6) model is used to break AES. There are two phases to breaking AES. First, the fault is induced at \(S_{1}^{\text{R}-2}\) and \(S_{9}^{\text{R}-2}\); Then, another fault is induced at \(S_{5}^{\text{R}-2}\) and \(S_{13}^{\text{R}-2}\). Finally, the source of the fault will infect all 128 bytes of the state \(S^{\text{R}}\). We can obtain the faulty ciphertext C\({}^{1*}\) and C\({}^{2*}\), and the propagation of the Dcor fault is shown in Figures 7 and 8. Without loss of generality, the two-byte Dcor faults  
Figure 5: The example of fault models. (**M0**) The random fault is induced in one of the diagonals; (**M1**) a random non–zero fault occurs at most across two diagonals; (**M2**) a random non–zero fault occurs at most across three diagonals; (**M3**) a random non–zero fault occurs at most across four diagonals. From (2) and (6), for the corresponding byte of \(\mathrm{K}^{\mathrm{R}}\), such as \(\{\mathrm{K}^{\mathrm{R}}_{1},\mathrm{K}^{\mathrm{R}}_{8},\mathrm{K}^{\mathrm{R}}_ {11},\mathrm{K}^{\mathrm{R}}_{14}\}\) and \(\{c,i,d^{\prime},j^{\prime}\}\), there are eight equations, thus, \(\{\mathrm{K}^{\mathrm{R}}_{1},\mathrm{K}^{\mathrm{R}}_{8},\mathrm{K}^{\mathrm{R}}_ {11},\mathrm{K}^{\mathrm{R}}_{14}\}\) can be retrieved, and other information about the key can be found. ```
Input: The PCFCs \((C^{1},C^{1*})\) and \((C^{2},C^{2*})\). Output: \(\mathrm{K}^{\mathrm{R}}\). Construct \(\Delta S^{\mathrm{R,1}}_{j}\overset{\mathrm{R,1}}{\rightarrow}\mathrm{K}^{ \mathrm{R}}_{j\
eq\mathrm{c,a}}\) and \(\Delta S^{\mathrm{R,2}}_{j}\overset{\mathrm{R,2}}{\rightarrow}\mathrm{K}^{ \mathrm{R}}_{j\
eq\mathrm{c,a}}\) (\(j=1,5,9,13\)) and find \(\{\mathrm{K}^{\mathrm{R}}_{1},\mathrm{K}^{\mathrm{R}}_{8},\mathrm{K}^{\mathrm{R}}_ {11},\mathrm{K}^{\mathrm{R}}_{14}\}\). For the other three columns of \(\Delta S^{\mathrm{R}}\), construct similar \(\Delta S^{\mathrm{R,i}}_{j}\) and solve them. Return \(\mathrm{K}^{\mathrm{R}}\). ```  
**Algorithm 1** Recovering the last round-key of AES. For AES-128, the initial key can be found by algorithm 1, it is not enough to break AES-192 and AES-256. Since the length of the key is inconsistent, breaking AES-192 and 256 is needed to retrieve the right values of \(\mathrm{K}^{11}\) and \(\mathrm{K}^{13}\), respectively. When \(\mathrm{K}^{\mathrm{R}}\) is known, and two equations can be exploited to break AES-192 and AES-256.