# A Novel DFA on AES: Based on Two-Byte Fault Model with Discontiguous Rows
## 3 DFA on AES
### Proposed Attack on AES-256  
The process of cracking AES-192 through the fault model is described in Section 3.2 and Section 3.3. The difference between AES-192 and AES-256 is that the key length  
Figure 9: AES–192 key schedule process.  
is distinct. However, if the attacker wants to recover the key of AES-256, the last two round-keys must be found. For AES-256, K14 and K13 contains all information of the initial key, and the initial key could be recovered (the green part of Figure 10).  
The first stage is to crack the last round-key and then use the information from the penultimate round state to find the penultimate round-key. Algorithm 1 outlines the method of cracking the last round-key, making it easy to find K14. Figure 10 only shows the process of the last round-key schedule of AES-256, the key is 256 bits, and it contains all information of the initial key, therefore, the initial key can be recovered according to the last two round-key.  
The penultimate round \(S^{\text{R,i*}}\) contains the unknown value \(a\), \(b\), \(a^{\prime}\), and \(b^{\prime}\), but the equations can be listed as follows:  
\[\begin{array}{l}2a=\Delta S_{1}^{13,1}\overset{13;1;1}{\rightarrow}K_{1}^{ 13};\;b=\Delta S_{3}^{13,1}\overset{13;1;3}{\rightarrow}K_{3}^{13}\\ 3a=\Delta S_{1}^{13,1}\overset{13;15}{\rightarrow}K_{8}^{13};\;b=\Delta S_{7} ^{13,1}\overset{13;17}{\rightarrow}K_{6}^{13}\\ a=\Delta S_{9}^{13,1}\overset{13;13}{\rightarrow}K_{11}^{13};\;2b=\Delta S_{11} ^{13,1}\overset{13;11;17}{\rightarrow}K_{9}^{13}\\ a=\Delta S_{13}^{13,1}\overset{13;13;13}{\rightarrow}K_{14}^{13};\;3b=\Delta S _{15}^{13,1}\overset{13;14;15}{\rightarrow}K_{16}^{13}\end{array}, \tag{13}\]  
\[\begin{array}{l}b^{\prime}=\Delta S_{2}^{13,2}\overset{13;2}{\rightarrow}K_ {2}^{13};\;3a^{\prime}=\Delta S_{4}^{13,2}\overset{13;24}{\rightarrow}K_{4}^{ 13}\\ b^{\prime}=\Delta S_{6}^{13,2}\overset{13;23;6}{\rightarrow}K_{5}^{13};\;2a^{ \prime}=\Delta S_{8}^{13,2}\overset{13;28}{\rightarrow}K_{7}^{13}\\ 3b^{\prime}=\Delta S_{10}^{13,2}\overset{13;21;0}{\rightarrow}K_{12}^{13};\;a^{ \prime}=\Delta S_{12}^{13,2}\overset{13;21;21}{\rightarrow}K_{10}^{13}\\ 2b^{\prime}=\Delta S_{14}^{13,2}\overset{13;21;4}{\rightarrow}K_{15}^{13};\;a^{ \prime}=\Delta S_{16}^{13,2}\overset{13;21;6}{\rightarrow}K_{13}^{13}\end{array}. \tag{14}\]  
In comparison to AES-192, the values of \(a\), \(b\), \(a^{\prime}\), and \(b^{\prime}\) cannot be directly calculated as they are variables with a value range of 0 to 255. Therefore, an exhaustive search of \(2^{32}\) attempts is necessary to recover the key K13 after inducing faults twice at \(S^{\text{R}-2}\). If faults (\(5^{\prime}\) and \(`6^{\prime}\)) are induced at \(S_{12}^{12}\) and \(S_{9}^{12}\) (as shown in Figure 11), equations related to \(\{K_{1}^{13}\), \(K_{8}^{13}\), \(K_{11}^{13}\), \(K_{14}^{13}\}\) and \(\{K_{3}^{13}\), \(K_{6}^{13}\), \(K_{8}^{13}\), \(K_{16}^{13}\}\) can be obtained, thereby reducing the exhaustive search to \(2^{16}\) attempts once \(\{a\), \(a^{\prime}\}\) and \(\{b\), \(b^{\prime\prime}\}\) is solved.  
Figure 10: AES–256 key schedule process.  
However, to crack AES-256 without exhaustive search, faults 7\({}^{\prime}\) and '8\({}^{\prime}\) must be induced at \(S^{12}_{12}\) and \(S^{12}_{13}\) (as shown in Figure 12). This allows us to obtain equations related to {\(\{\)K\({}^{13}_{2}\), K\({}^{13}_{5}\), K\({}^{13}_{12}\), K\({}^{13}_{15}\)} and {\(\{\)K\({}^{13}_{4}\), K\({}^{13}_{7}\), K\({}^{13}_{10}\), K\({}^{13}_{13}\)}. The method to crack AES-256 is shown in Algorithm 3.