# A Novel DFA on AES: Based on Two-Byte Fault Model with Discontiguous Rows
## 5 Conclusions  
This paper presents an efficient DFA for AES using a two-byte fault induced in the state \(S^{\rm R-2}\) with discontiguous rows (Dcor fault model). The proposed method can retrieve the AES-128, 192, and 256 with two, two, and four pairs of correct and fault ciphertexts (PCFCs), respectively. Furthermore, when considering the exhaustive searches for AES-256, it is possible to extract AES-256 using two (or three) PCFCs and 2\({}^{32}\) (or 2\({}^{16}\)) exhaustive searches. Compared with these existing multi-byte fault models, the Dcor fault model proposed needs fewer PCFCs and reduces the exhaustive searches of keys when using identical PCFCs.  
The Dcor fault model could be extended to additional SPN ciphers like RC6 and SM4, which will be the subject of our future study, even if it only pertains to AES in this paper.  
Conceptualization, [PERSON] and J.Z.; methodology, X.W. and J.Z.; software, X.W.; validation, X.W., J.Z., and S.C.; formal analysis, X.W., J.Z., and W.W.; resources, J.W. and J.Z.; data curation, X.W.; writing--original draft preparation, X.W.; writing--review and editing, X.W. and J.Z.; supervision, S.C. and J.Z.; project administration, J.W. and J.Z.; funding acquisition, J.W., J.Z. and W.W. All authors have read and agreed to the published version of the manuscript.  
\begin{table}
\begin{tabular}{c c c c c c} \hline \hline
**Type** & **Ref** & **Fault Model** & **Fault Round** & **No. of Faults** & **Exhaustive Search** \\ \hline \multirow{8}{*}{AES–128} & [13] & Dcor & 9 & 2 & 1 \\ \cline{2-5}  & [21] & M0 & Between 7 and 8 & 4 & 1 \\  & & M1 & Between 7 and 8 & 2 & 1 \\  & & M2 & Between 7 and 8 & 1 & 1 \\ \cline{2-5}  & [22] & M1 & Between 7 and 8 & 2 & 1 \\  & & M2 & Between 7 and 8 & 3 & 1 \\ \cline{2-5}  & [26] & Multi-fault & 9 & \(\approx\)2.17 & 1 \\ \cline{2-5}  & Our work & Dcor & 8 & 2 & 1 \\ \hline \multirow{8}{*}{AES–192} & [19] & Method1 & 10 and 11 & 12 & 1 \\  & & Method2 & 10 and 11 & \(\approx\)3000 & 1 \\ \cline{2-5}  & [22] & M1 & Between 9 and 10 & 2 & 2\({}^{8}\) \\  & & M2 & Between 9 and 10 & 3 & 2\({}^{32}\) \\ \cline{2-5}  & Our work & Dcor & 10 & 2 & 1 \\ \hline \multirow{8}{*}{AES–256} & [19] & Method1 & 12 and 13 & 12 & 1 \\  & & Method2 & 12 and 13 & \(\approx\)3000 & 1 \\ \cline{2-5}  & [22] & M1 & Between 11 and 12 & 3 & 2\({}^{32}\) \\ \cline{1-1}  & & M2 & Between 11 and 12 & 4 & 1 \\ \cline{1-1} \cline{2-5}  & Our work & Dcor & 12 & 2 & 2\({}^{32}\) \\ \cline{1-1}  & & & & 3 & 2\({}^{16}\) \\ \cline{1-1}  & & & & 4 & 1 \\ \hline \hline \end{tabular}
\end{table}
Table 4: Comparison with existing DFA on AES.  
**Funding:** This work was supported in part by the Natural Science Research in Colleges of Jiangsu Province under Grant 21 KJB520040 and 22 KJD520006; the Basic Science Research Project of Nantong under Grant JC2020143.  
**Institutional Review Board Statement:** Not applicable.  
**Informed Consent Statement:** Not applicable.  
**Data Availability Statement:** Not applicable.  
**Acknowledgments:** The author would like to thank the anonymous reviewers for their valuable suggestions and comments that improved the quality of this paper.  
**Conflicts of Interest:** The authors declare no conflict of interest.