# A Novel DFA on AES: Based on Two-Byte Fault Model with Discontiguous Rows
## 3 DFA on AES
### Proposed Attack on AES-192  
For AES-192, the Dcor fault model mentioned (see Section 3.2) is utilized to crack AES-192, \(\mathrm{K}^{12}\) and the right half of \(\mathrm{K}^{11}\) should be recovered. Firstly, we induced the fault at \(S^{10}_{1}\) and \(S^{10}_{9}\). Secondly, we induced the fault at \(S^{10}_{5}\) and \(S^{10}_{13}\). Different from AES-128, \(\mathrm{K}^{11}\) should be recovered, that says, the unknown values (\(a\), \(b\), \(a^{\prime}\) and \(b^{\prime}\) in \(S^{\mathrm{R-1},i*}\)) could be found to retrieve the right part of \(\mathrm{K}^{11}\) [\(w(46)\), \(w(47)\), \(w(48)\), \(w(49)\), \(w(50)\), \(w(51)\)] (the green part of Figure 9). Figure 9 only shows the process of the last two rounds' key schedules of AES-192, the key is 192 bits, and it contains all information of the initial key, therefore, the initial key can be recovered according to the last two round-key.  
As well, the PCFSs (pairs of correct and fault output of the penultimate round) are obtained for the attacker by using Equation (9). Therefore, the value of \(a\), \(b\), \(a^{\prime}\) and \(b^{\prime}\) in Figures 6 and 7 is expressed as:  
\[\begin{array}{l}2a=\Delta S^{11,1}_{1}\stackrel{{ 11;1;1}}{{\rightarrow}}\mathrm{K}^{11}_{1};\ b=\Delta S^{11,1}_{3} \stackrel{{ 11;1;1;3}}{{\rightarrow}}\mathrm{K}^{11}_{3}\\ 3a=\Delta S^{11,1}_{5}\stackrel{{ 11;1}}{{\rightarrow}}\mathrm{K}^{11}_{5};\ b= \Delta S^{11,1}_{7}\stackrel{{ 11;1;1;7}}{{\rightarrow}}\mathrm{K}^{11}_{6}\\ a=\Delta S^{11,1}_{9}\stackrel{{ 11;1;1;9}}{{\rightarrow}}\mathrm{K}^{11}_{11};\ 2b=\Delta S^{11,1}_{11}\stackrel{{ 1;1;1;1;1}}{{\rightarrow}}\mathrm{K}^{11}_{9}\\ a=\Delta S^{11,1}_{13}\stackrel{{ 11;1;1;1;1;3}}{{\rightarrow}}\mathrm{K}^{11}_{14};\ 3b= \Delta S^{11,1}_{15}\stackrel{{ 11;1;1;1;5}}{{\rightarrow}}\mathrm{K}^{11}_{16} \\ \\ b^{\prime}=\Delta S^{11,2}_{2}\stackrel{{ 11;2;2}}{{\rightarrow}}\mathrm{K}^{11}_{2};\ 3a^{\prime}= \Delta S^{11,2}_{4}\stackrel{{ 11;2;4}}{{\rightarrow}}\mathrm{K}^{11}_{4} \\ b^{\prime}=\Delta S^{11,2}_{5}\stackrel{{ 11;2;2}}{{\rightarrow}}\mathrm{K}^{11}_{5};\ 2a^{\prime}= \Delta S^{11,2}_{8}\stackrel{{ 11;2;2}}{{\rightarrow}}\mathrm{K}^{11}_{10}\\ 3b^{\prime}=\Delta S^{11,2}_{10}\stackrel{{ 11;2;1;4}}{{\rightarrow}}\mathrm{K}^{11}_{12};\ a^{\prime}= \Delta S^{11,2}_{16}\stackrel{{ 11;2;12;2}}{{\rightarrow}}\mathrm{K}^{11}_{10} \\ 2b^{\prime}=\Delta S^{11,2}_{14}\stackrel{{ 11;2;14}}{{\rightarrow}}\mathrm{K}^{11}_{15};\ a^{\prime}= \Delta S^{11,2}_{16}\stackrel{{ 11;2;16}}{{\rightarrow}}\mathrm{K}^{11}_{13} \\ \end{array}, \tag{11}\]  
Algorithm 2 outlines the process for cracking AES-192. The values of \(a\), \(b\), \(a^{\prime}\), \(b^{\prime}\) can be obtained using Equations (11) and (12). The remaining key information for \(\mathrm{K}^{11}\) can then be determined. For AES-192, all keys can be solved. In comparison to cracking AES-128, the penultimate round is used to find the right portion of \(\mathrm{K}^{11}\), and two PCFCs are required for cracking AES-128 and AES-192.  
```
Input: The PCFCs \(\left(\mathrm{C}^{\mathrm{I}},\ \mathrm{C}^{\mathrm{i+}}\right)\). Output:\(\mathrm{K}^{12}\) and the right part of \(\mathrm{K}^{11}\).
```  
**Algorithm 2** DFA on AES-192.