In order to prevent the Advanced Encryption Standard (AES) from suffering from differential fault attacks, the technique of error detection can be adopted to detect the errors during encryption or decryption and then to provide the information for taking further action, such as interrupting the AES process or redoing the process. Because errors occur within a function, it is not easy to predict the output. Therefore, general error control codes are not suited for AES operations. In this work, several error-detection schemes have been proposed. These schemes are based on the (n+1, n) cyclic redundancy check (CRC) over GF(28), where nisin{4,8,16}. Because of the good algebraic properties of AES, specifically the MixColumns operation, these error detection schemes are suitable for AES and efficient for the hardware implementation; they may be designed using round-level, operation-level, or algorithm-level detection. The proposed schemes have high fault coverage. In addition, the schemes proposed are scalable and symmetrical. The scalability makes these schemes suitable for an AES circuit implemented in 8-bit, 32-bit, or 128-bit architecture. Symmetry also benefits the implementation of the proposed schemes to achieve that the encryption process and the decryption process can share the same error detection hardware. These schemes are also suitable for encryption-only or decryption-only cases. Error detection for the key schedule in AES is also proposed and is based on the derived results in the data procedure of AES

https://ir.nctu.edu.tw:443/bitstream/11536/12177/1/000236929800006.pdf

Simple error detection methods for hardware implementation of Advanced Encryption Standard

We present a new low-cost concurrent checking method for the advanced encryption standard (AES) encryption algorithm. In this method, the parity of the 128-bit input is determined and modified step-by-step into the parity of the 128-bit output according to the processing steps of the AES encryption. For the parity-preserving AES steps shift-rows and mix-column no parity modifications are necessary. The modified parity is compared in any round with the actual parity of the outputs of the round. To obtain the hardware costs we implemented this method on a Xilinx Virtex 1000 FPGA. For this implementation, the hardware overhead is about 8% and the additional time delay is about 5%. The method detects technical faults and deliberately injected faults during normal operation.

Low cost concurrent error detection for the advanced encryption standard

Deliberate injection of faults into cryptographic devices is an effective cryptanalysis technique against symmetric and asymmetric encryption algorithms. To protect cryptographic implementations (e.g. of the recent AES which will be our running example) against these attacks, a number of innovative countermeasures have been proposed, usually based on the use of space and time redundancies (e.g. error detection/correction techniques, repeated computations). In this paper, we take the next natural step in engineering studies where alternative methods exist, namely, we take a comparative perspective. For this purpose, we use unified security and efficiency metrics to evaluate various recent protections against fault attacks. The comparative study reveals security weaknesses in some of the countermeasures (e.g. intentional malicious fault injection that are unrealistically modelled). The study also demonstrates that, if fair performance evaluations are performed, many countermeasures are not better than the naive solutions, namely duplication or repetition. We finally suggest certain design improvements for some countermeasures, and further discuss security/efficiency tradeoffs.

/pdf/a-comparative-cost-security-analysis-of-fault-attack-25umdufqp3.pdf

A comparative cost/security analysis of fault attack countermeasures

The Advanced Encryption Standard (AES) has been lately accepted as the symmetric cryptography standard for confidential data transmission. However, the natural and malicious injected faults reduce its reliability and may cause confidential information leakage. In this paper, we study concurrent fault detection schemes for reaching a reliable AES architecture. Specifically, we propose low-cost structure-independent fault detection schemes for the AES encryption and decryption. We have obtained new formulations for the fault detection of SubBytes and inverse SubBytes using the relation between the input and the output of the S-box and the inverse S-box. The proposed schemes are independent of the way the S-box and the inverse S-box are constructed. Therefore, they can be used for both the S-boxes and the inverse S-boxes using lookup tables and those utilizing logic gates based on composite fields. Our simulation results show the error coverage of greater than 99 percent for the proposed schemes. Moreover, the proposed and the previously reported fault detection schemes have been implemented on the most recent Xilinx Virtex FPGAs. Their area and delay overheads have been compared and it is shown that the proposed schemes outperform the previously reported ones.

Concurrent Structure-Independent Fault Detection Schemes for the Advanced Encryption Standard

Deliberate injection of faults into cryptographic devices is an effective cryptanalysis technique against symmetric and asymmetric encryption algorithms. In this paper we will describe parity code based concurrent error detection (CED) approach against such attacks in substitution-permutation network (SPN) symmetric block ciphers [22]. The basic idea compares a carefully modified parity of the input plain text with that of the output cipher text resulting in a simple CED circuitry. An analysis of the SPN symmetric block ciphers reveals that on one hand, permutation of the round outputs does not alter the parity from its input to its output. On the other hand, exclusive-or with the round key and the non-linear substitution function (s-box) modify the parity from their inputs to their outputs. In order to change the parity of the inputs into the parity of outputs of an SPN encryption, we exclusive-or the parity of the SPN round function output with the parity of the round key. We also add to all s-boxes an additional 1-bit binary function that implements the combined parity of the inputs and outputs to the s-box for all its (input, output) pairs. These two modifications are used only by the CED circuitry and do not impact the SPN encryption or decryption. The proposed CED approach is demonstrated on a 16-input, 16-output SPN symmetric block cipher from [1].

Parity-based concurrent error detection of substitution-permutation network block ciphers

/pdf/parity-based-concurrent-error-detection-of-substitution-5f5tvtr0a7.pdf

Parity-Based Concurrent Error Detection of Substitution-Permutation Network Block Ciphers

Deliberate injection of faults into cryptographic devices is an effective cryptanalysis technique against symmetric and asymmetric encryption. We will describe a general concurrent error detection (CEO) approach against such attacks on symmetric block ciphers using CS-cipher as an example. The proposed CED compares a carefully modified parity of the input plain text with that of the output cipher text. An analysis of the CS-Cipher shows that on one hand the parity of its inputs is modijied by a constant one or zero by component-wise exclusive-or of inputs with the round keys and with the round constants; if the parity of the round keys and of the round constants is odd (even) the parity of the inputs is mod$ed by one (not modijied). On the other hand, the diffusion network based on the Fast Fourier Transform does not alter the parity. Finally, the 16-bit to 16-bit non-linear mixing function does not have any simple relation between the parity of its inputs and of its outputs. The mixing function is composed of a linear function q and a non-linear function p. In order to maintain the invariance of the parity from the inputs to the outputs of each CS-cipher encryption round, we added a parity correction term (exclusive-or of the parity of its inputs and outputs) to the non-linear function p and slightb modijied the parity function due to the linear function p Faults introduced into the CS-cipher design are detected by comparing the overall parity of the input mod$ed by the parity of the round keys, round constants and correction terms of the mixing functions with the parity of the (intermediate) cipher text obtained ajer every step of an encryption round.

Grigori Kuznetsov

Papers

Low cost concurrent error detection for the advanced encryption standard

Parity-based concurrent error detection of substitution-permutation network block ciphers

Parity-Based Concurrent Error Detection of Substitution-Permutation Network Block Ciphers

Parity-based concurrent error detection in symmetric block ciphers