# Novel Fault Injection Attack without Artificial Trigger
## 5 Conclusions  
In present paper, we proposed a system aimed to relax an attacker's assumption for triggering. As mentioned in Section 3.1, the attacker's assumption could be easy by using the existing I/O signal as a trigger instead of generating an artificial one. To identify the operation time, the specific algorithm was used, which implied registering an emission electromagnetic trace and applying simple power analysis. As we set the entire 9 th round of SubBytes and ShiftRows as the target operation, a fault could be injected into each input byte of 9 th round of MixColumns. Therefore, various fault-injected ciphertexts could be acquired to generate a 16-byte 10-round key. Moreover, we proposed an algorithm to analyze the generated key without knowing the index of a byte injected by a fault using the fault-injected ciphertexts. The system proposed in this paper can be used to relax an attacker's assumption by applying not only the previously tested AES cryptographic algorithm, but also other fault injection attacks.  
\begin{table}
\begin{tabular}{c c c c c c c c c c c c c c c c c} \hline \hline \multirow{2}{*}{**Number**} & \multicolumn{11}{c}{**Index of Byte**} \\ \cline{2-13}  & **1** & **2** & **3** & **4** & **5** & **6** & **7** & **8** & **9** & **10** & **11** & **12** & **13** & **14** & **15** & **16** \\ \hline \multirow{3}{*}{\(\oplus\)} & 39 & 25 & 84 & 1D & 02 & DC & 09 & FB & DC & 11 & 85 & 97 & 19 & 6A & 0B & 32 \\  & 39 & 25 & 84 & 88 & 02 & DC & 09 & FB & DC & 11 & 85 & 97 & E8 & 6A & 0B & 32 \\  & 39 & 25 & B4 & 1D & 02 & ED & 0 & 09 & FB & 64 & 11 & 85 & 97 & 19 & 6A & 0B & 59 \\  & 39 & B0 & * & 84 & 1D & BC & * & DC & 09 & FB & DC & 11 & 85 & F6 & * & 19 & 6A & 27 * & 32 \\  & 89 & * & 25 & 84 & 1D & 02 & DC & 09 & 68 & * & DC & 11 & 55 & * & 97 & 19 & A8 * & 0B & 32 \\  & 74 & * & 25 & 9D & * & 1D & 02 & 5C & * & 09 & 97 & * & 05 & * & 11 & 01 * & 97 & 19 & 2D * & 0B & FB * \\  & 44 & * & 8B & * & 4F & * & 1D & A9 & * & 73 & * & 09 & E6 & * & 77 & * & 11 & 82 * & 2B * & 19 & 4A * & C4 * & FB * \\  & 3B & * & 5E & * & D4 & 22 & * & AF & 52 & 78 & * & 12 & * & AF & 88 & * & 9B * & A4 * & 74 * & 70 * & 1D * & 64 * \\ \hline \hline \end{tabular}  
* The bytes are affected by the fault injection attack.  
\end{table}
Table 2: Experimental results.  
\begin{table}
\begin{tabular}{c c} \hline \hline \multicolumn{1}{c}{**Fault Byte**} & **Formula Type** \\ \hline \multirow{3}{*}{\(\oplus\)} & \multicolumn{1}{c}{Normal Cipher} \\ \cline{2-3}  & Input Fault: 2, 7,12, 13 \\  & Output Fault: 4, 7, 10, 13 \\ \hline \multirow{3}{*}{\(\oplus\)} & Input Fault: 3, 8, 9, 14 \\  & Output Fault: 3, 6, 9, 16 \\ \hline \multirow{3}{*}{\(\oplus\)} & Input Fault: 4, 5, 10, 15 \\  & Output Fault: 2, 5, 12, 15 \\ \hline \multirow{3}{*}{\(\oplus\)} & Input Fault: 1, 6, 11, 16 \\  & Output Fault: 1, 8, 11, 14 \\ \hline \multirow{3}{*}{\(\oplus\)} & two-column fault injection} \\ \cline{2-3}  & \multicolumn{1}{c}{three-column fault injection} \\ \cline{2-3}  & four-column fault injection or malfunction due to error \\ \hline \hline \end{tabular}
\end{table}
Table 3: Fault types  
**Author Contributions:** These authors contributed equally to this work. All authors have read and agreed to the published version of the manuscript.  
**Funding:** This work was supported by Institute of Information & communications Technology Planning & Evaluation(IITP) grant funded by the Korea government(MSIT) (No.2020-0-00913, Study on Wireless Covert Channel Risk Verification).  
**Conflicts of Interest:** The authors declare no conflict of interest.