# Novel Fault Injection Attack without Artificial Trigger
## 3 Novel Fault Injection Attack System for Relaxing the Fault Injection Attack's Assumption
### AES DFA Method
Similarly, if three fault-injected ciphertexts are considered for each Fault Type, we can identify the 10 th round key of 16 bytes. In worst case, our proposed algorithm performs PGO DFA 84 times. Let the time complexity of PGO DFA be \(\mathcal{O}(\texttt{PGO DFA})\). Since PGO DFA performs \(2^{16}\) guesses for every four bytes, \(\mathcal{O}(\texttt{PGO DFA})\) is \(\mathcal{O}(2^{18})\). Therefore, \(\mathcal{O}(84\times 2^{18})\) guesses is finished in a couple of seconds. In this paper, we demonstrate that the attacker can analyze the confidential key information without knowing which byte index has been injected by a fault using the proposed algorithm. \begin{table}
\begin{tabular}{c c} \hline \hline
**Fault Byte** & **Formula Type** \\ \hline \multirow{4}{*}{1} & \(S(Y_{0})\oplus S(2Z\oplus Y_{0})=U_{1}\) \\  & \(S(Y_{1})\oplus S(Z\oplus Y_{1})=U_{14}\) \\  & \(S(Y_{2})\oplus S(Z\oplus Y_{2})=U_{11}\) \\  & \(S(Y_{3})\oplus S(3Z\oplus Y_{3})=U_{8}\) \\ \hline \multirow{4}{*}{6} & \(S(Y_{0})\oplus S(3Z\oplus Y_{0})=U_{1}\) \\  & \(S(Y_{1})\oplus S(2Z\oplus Y_{1})=U_{14}\) \\  & \(S(Y_{2})\oplus S(Z\oplus Y_{2})=U_{11}\) \\  & \(S(Y_{3})\oplus S(Z\oplus Y_{3})=U_{8}\) \\ \hline \multirow{4}{*}{11} & \(S(Y_{0})\oplus S(Z\oplus Y_{0})=U_{1}\) \\  & \(S(Y_{1})\oplus S(3Z\oplus Y_{1})=U_{14}\) \\  & \(S(Y_{2})\oplus S(2Z\oplus Y_{2})=U_{11}\) \\  & \(S(Y_{3})\oplus S(Z\oplus Y_{3})=U_{8}\) \\ \hline \multirow{4}{*}{16} & \(S(Y_{0})\oplus S(Z\oplus Y_{0})=U_{1}\) \\  & \(S(Y_{1})\oplus S(Z\oplus Y_{1})=U_{14}\) \\  & \(S(Y_{2})\oplus S(3Z\oplus Y_{2})=U_{11}\) \\  & \(S(Y_{3})\oplus S(2Z\oplus Y_{3})=U_{8}\) \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Formula classification by Fault Type1. ```
1:sequence set of \(C,C:=(C[0],C[1],...,C[15])\),
2:\(C:\) Normal ciphertext
3:\(C_{1}^{\prime},C_{2}^{\prime},C_{3}^{\prime}:\) Fault-injected ciphertext of the same Fault Type
4: Fault Type : Fault Type \(\in\{1,...,4\}\)
5: Fault-Injected Byte : Fault-injected input bytes corresponding Fault Type \[Type_{1}\{1,6,11,16\},Type_{2}\{4,5,10,15\},Type_{3}\{3,8,9,14\},Type_{4}\{2,7,12,13\}\]
6:\(Y:\) Possible Guessing Value, \(Y:=(Y_{0},Y_{1},Y_{2},Y_{3}),\ (Y_{i}\in\{0,255\},\ 0\leq i\leq 3)\)
7:\((K_{0},K_{1},K_{2},K_{3}):\) 4-byte 10 th round keys
8:procedureDFA(\(C,C_{1}^{\prime},C_{2}^{\prime},C_{3}^{\prime}\), Fault Type)
9: initialize \(Y\) to all of guessing values
10:\(T\leftarrow\) Fault Type
11:for\(i=0\)to\(3\)do
12:\(M\leftarrow\)PGO DFA\((C,C_{1}^{\prime},Type_{T}[i],Y)\)
13:for\(j=0\)to\(3\)do
14:\(N\leftarrow\)PGO DFA\((C,C_{2}^{\prime},Type_{T}[j],M)\)
15:for\(k=0\)to\(3\)do
16:\(O\leftarrow\)PGO DFA\((C,C_{3}^{\prime},Type_{T}[k],N)\)
17:if\(O\
eq\)NULL then
18:\(K_{0}\gets S(Y_{0})\)xor\(C[\alpha_{0}]\)
19:\(K_{1}\gets S(Y_{1})\)xor\(C[\alpha_{1}]\)
20:\(K_{2}\gets S(Y_{2})\)xor\(C[\alpha_{2}]\)
21:\(K_{3}\gets S(Y_{3})\)xor\(C[\alpha_{3}]\)
22:return\((K_{0},\ K_{1},\ K_{2},\ K_{3})\)
23:return FAILED
24:endprocedure
```  
**Algorithm 1** Key recovery algorithm