# A Novel DFA on AES: Based on Two-Byte Fault Model with Discontiguous Rows
## 3 DFA on AES  
### Fault Model Analysis  
In the previous works, the fault model is unfixed, and most of them are according to the fault location and the number of faults induced. We analyze the fault induced at the state, and the effect of the number of fault induction and the fault rounds are jointly considered. If the induced faults are in bytes, the number of induced faults ranges from 1 to 16, and the fault round ranges from 1 to R.  
In the beginning, the fault round is analyzed, due to the number of fault rounds determining whether the final output can be used to obtain the key information, if the number of induction rounds is not appropriate, the output information is not available. It is assumed that the attacker can induce \(\tau\)-byte (\(1\leq\tau\leq\) R) fault at round \(\psi\) (\(1\leq\psi\leq\) R), and obtain the number of differential fault equations, represented by \(\chi\). The three values (\(\tau\), \(\psi\), \(\chi\)) are considered to measure a fault model. A one-byte fault is easy to analyze, the fault will affect four bytes of the output (S\({}^{\psi}\)), and the value of \(\chi\) is 4. After the second round, a four-byte fault will affect 16-byte of the output (S\({}^{\psi+1}\)), up to now, all normal values are infected, see Figure 4. In Figure 4, \(F\) is a fault induced by the attacker, \(\{a,b,c,d,a1,b1,c1,d1,a2,b2,c2,d2,a3,b3,c3,d3,a4,b4,c4,d4\}\) belongs to {1, 2, 3}, and the specific value depends on the location of the fault between \(SR\) and \(MC\). Therefore, the value of \(\chi\) is 16. In the encryption process of AES, the last round is missing the \(MC\) operation, and the \(MC\) operation plays a diffusion role in the operation, the fault diffusion is also through the \(MC\) operation. If the next round contains the \(MC\), the second round faults will be transformed, and the result will be not available. Thus, the next round can be the last round of encryption, therefore, \(\psi=\) R\(-\)2 is suitable. Next, the values of \(\tau\) and \(\chi\) are considered, according to the above analysis, we list different \(\tau\) and to obtain the value of \(\chi\) in Table 3. \(Y\) means we can recover the key with the fault induction that does not exceed four times, and \(N\) means not. For example, when \(\tau=5\), after the first round, all values will be affected and there is a column with two faults. Thus, the output will contain five unknown fault values. To eliminate the excess unknowns, it is necessary to induce the fault again to obtain more differential equations. As a result, the number of fault induction times is more than four. Figure 4: The diagram of one-byte fault diffusion through two rounds. \begin{table}
\begin{tabular}{c c c c} \hline \hline \(\tau\) & **the First Round \(\chi\)** & **the Second Round \(\chi\)** & **the Third Round \(\chi\)** & **Is the Result Available?** \\ \hline
1 & 4 & 16 & 16 & \(Y\) \\ \hline
2 & 8 & 16 & 16 & \(Y\) \\ \hline
3 & 12 & 16 & 16 & \(Y\) \\ \hline
4 & 16 & 16 & 16 & \(Y\) \\ \hline
5 & 16 & 16 & 16 & \(N\) \\ \hline \(\ldots\) & \(\ldots\) & \(\ldots\) & \(\ldots\) \\ \hline
15 & 16 & 16 & 16 & \(N\) \\ \hline
16 & 16 & 16 & 16 & \(N\) \\ \hline \hline \end{tabular}
\end{table} 
Table 3: The three round values of \(\chi\) with different \(\tau\). Here, when \(1\leq\tau\leq 4\), for the first round, all fault values do not affect each other, that is, the fault value does not appear in the same column after SR operation. When \(\tau>4\), the fault value must be affected in the first round, and there will be superfluous unknowns in the result. As a result, the number of fault induction times will increase to offset the excess unknowns. For the AES-128, only the last round-key is recovered, but for the AES-192 and 256, we must obtain the last two round-keys and it is enough to recover the initial key. From Figure and Table, the second round is about the K\({}^{\text{R}-1}\), therefore, the differential fault equation must be obtained from the SR.