# A Novel Encryption Scheme in Ship Remote Control against Differential Fault Attack
## 2 Preliminaries
### Differential Fault Attack  
As a type of fault attack, Differential Fault Attack (DFA) is a powerful attack strategy for block symmetric cryptographic algorithms. The attacker can inject fault into the algorithm's intermediate value, which drastically reduces the amount of data needed to decrypt the key information [12]. During the voyage of the intelligent ship, the ship's communication management personnel cannot be replaced in time. If an internal attacker is present, even if the key is frequently changed, the threat of such an attack cannot be ruled out [13]. The attacker obtains the key of ship encrypted communication through DFA, which will affect the navigation and remote control of the ship [14]. Consequently, it is crucial to provide an optimization technique to lower the risk of such attacks.  
In order to ease comprehension of the optimization strategy presented in this research, a class of fault modes provided in reference [15] is investigated in conjunction with the SM4 algorithm's fundamental principle:  
1. It is known that the ciphertext \(Y=(Y_{0},Y_{1},Y_{2},Y_{3})=(X_{35},X_{34},X_{33},X_{32})\) under the action of the random plaintext \(X\) and the key \(K\). Induce random byte failure in the word \(X_{32}\) in the input \((X_{31},X_{32},X_{33},X_{34})\) of the 32 nd round of encryption to obtain \(X_{32}^{*}\)and thus obtains the error ciphertext \(Y=(Y_{0}^{*},Y_{1}^{*},Y_{2}^{*},Y_{3}^{*})=(X_{35}^{*},X_{34}^{*},X_{33}^{*},X_{32}^{*})\).
2. By \(\triangle A_{32}=\triangle X_{32}\oplus\triangle X_{33}\oplus\triangle X_{34} \oplus rk_{31}=\triangle X_{32}=Y_{3}\oplus Y_{3}^{*}\), locate the fault byte position \(\triangle a_{32,i},j\in(0,1,2,3)\) in the input of S-box, which is also the position of induced byte fault in \(X_{32}\).
3. The fault byte position \(\triangle c_{32,i},j\in(0,1,2,3)\) in the output of linear transform \(L\) is located by the two same bytes in \(\triangle C_{32}=\triangle X_{35}\oplus\triangle X_{31}=\triangle X_{35}=Y_{0 }\oplus Y_{0}^{*}\). At the same time, \((\triangle C_{32})_{(j-1)mod4}=(\triangle C_{32})_{(j-2)mod4}=\triangle b_{32,j }<<2\) can be deduced to obtain \(\triangle b_{32,j}\) according to the shift and XOR operations in linear transform \(L\).
4. For the S-box transform of round \(i\) in the SM4 algorithm: \(IN(\triangle a_{32,i},\triangle b_{32,j})=\{z_{i,j}|z_{i,j}\in F_{2}^{*},S(z_{ i,j})\oplus S(z_{i,j}\oplus\triangle a_{i,j})=\triangle b_{i,j}\}\). According to the difference table of S-box (the input value can be derived from the known input difference and output difference), it can be determined that the jth byte value of \(rk_{31}\) meets \(rk_{31,j}\in(X_{32},X_{33},X_{34})\oplus IN(\triangle a_{32,j},\triangle b_{32,j})\) and then \(rk_{31}\) can be derived. In this step, two \(z_{i,j}\) meet the conditions, but only one can be used to recover the key.
5. Repeat 1\(\sim\)4 to recover all byte values of \(rk_{31}\).
6. All byte values of \(rk_{30}\), \(rk_{29}\) and \(rk_{28}\) are recovered by using the appeal method.
7. Using the key arrangement algorithm, the encryption key \(MK\) is recovered from the round keys \(rk_{31}\), \(rk_{30}\), \(rk_{29}\) and \(rk_{28}\) obtained from the appeal.