National Institute of Standards and Technology における超伝導研究及び生活

A most critical and important issue surrounding the design of automatic control systems with the successively increasing complexity is guaranteeing a high system performance over a wide operating range and meeting the requirements on system reliability and dependability. As one of the key technologies for the problem solutions, advanced fault detection and identification (FDI) technology is receiving considerable attention. The objective of this book is to introduce basic model-based FDI schemes, advanced analysis and design algorithms and the needed mathematical and control theory tools at a level for graduate students and researchers as well as for engineers.

Model-based Fault Diagnosis Techniques: Design Schemes, Algorithms, and Tools

In this paper we present a differential fault attack that can be applied to the AES using a single fault. We demonstrate that when a single random byte fault is induced at the input of the eighth round, the AES key can be deduced using a two stage algorithm. The first step has a statistical expectation of reducing the possible key hypotheses to 232, and the second step to a mere 28.

/pdf/differential-fault-analysis-of-the-advanced-encryption-3zvor19zvg.pdf

Differential fault analysis of the advanced encryption standard using a single fault

In this paper we present a differential fault attack that can be applied to the AES using a single fault. We demonstrate that when a single random byte fault is induced at the input of the eighth round, the AES key can be deduced using a two stage algorithm. The first step has a statistical expectation of reducing the possible key hypotheses to 2, and the second step to a mere 2. Furthermore, we show that, with certain faults, this can be reduced to two key hypothesis.

/pdf/differential-fault-analysis-of-the-advanced-encryption-10jq1df3lk.pdf

Differential Fault Analysis of the Advanced Encryption Standard using a Single Fault.

This paper proposes a new fault-based attack called the Fault Sensitivity Analysis (FSA) attack, which unlike most existing fault-based analyses including Differential Fault Analysis (DFA) does not use values of faulty ciphertexts. Fault sensitivity means the critical condition when a faulty output begins to exhibit some detectable characteristics, e.g., the clock frequency when fault operation begins to occur. We explain that the fault sensitivity exhibits sensitive-data dependency and can be used to retrieve the secret key. This paper presents two practical FSA attacks against two AES hardware implementations on SASEBO-R, PPRM1-AES and WDDL-AES. Different from previous work, we show that WDDL-AES is not perfectly secure against setup-time violation attacks. We also discuss a masking technique as a potential countermeasure against the proposed fault-based attack.

/pdf/fault-sensitivity-analysis-1o9l3x9y6e.pdf

Fault sensitivity analysis

Differential Fault Analysis against AES has been actively studied these years. Based on similar assumptions of the fault injection, different DFA attacks against AES have been proposed. However, it is difficult to understand how different attack results are obtained for the same fault injection. It is also difficult to understand the relationship between similar assumptions of fault injection and the corresponding attack results. This paper reviews the previous DFA attacks against AES based on the information theory, and gives a general and easy understanding of DFA attacks against AES. We apply the similar analysis on DFA attacks on AES-192 and AES-256, and we propose the attack procedures to reach the theoretical minimal number of fault injections.

/pdf/an-information-theoretic-perspective-on-the-differential-gha1uebor5.pdf

An Information Theoretic Perspective on the Differential Fault Analysis against AES.

This paper presents a new type of intentional electromagnetic interference (IEMI) which causes information leakage from cryptographic ICs (Integrated Circuits). As a recent threat, it is known that faults in cryptographic ICs such as Advanced Encryption Standard (AES) have significant influence on leakage of sensitive information. AES is a block cipher standardized by NIST (National Institute of Standards and Technology of the United States) that is a de-facto standard of smart card ICs and used for many security devices. In order to guarantee the tamper-resistance of AES hardware, this paper discusses the potential vulnerability against faults induced by IEMI via power cables. The contribution of the paper is twofold. (1) We find that, different from previous work of fault analysis, the electromagnetic (EM) faults from power cables are remotely-controllable and lead to the leakage of the secret key. (2) We show that the random EM faults can be managed with reasonable amount of measurements and its risk to the key leakage is high enough to be a real-life threat.

Intentional electromagnetic interference for fault analysis on AES block cipher IC

This chapter presents fault injection experiments using a side-channel evaluation board called SASEBO, which was developed to unify testing environments for side-channel analysis. We describe experiments where faults were injected into a cryptographic LSI mounted on a SASEBO board using a clock glitch. In this experiment, the faults can be induced at any desired point in time during the computation of an algorithm. We show the results of injecting faults into block cipher and public key modules implemented on the LSI. We also show the key retrieval from standard ciphers using the faulty outputs obtained in these experiments. This work contributes to the study of how a fault is injected into a target device, such as an LSI mounted on an evaluation board, and verifies various theoretical fault analyses using an experimental environment.

Fault Injection and Key Retrieval Experiments on an Evaluation Board

This paper proposes improved post analysis methods for Differential Fault Analysis (DFA) against AES. In detail, we propose three techniques to improve the attack efficiency as 1) combining previous DFA methods, 2) performing a divide-and-conquer attack by considering the AES key-schedule structure, and 3) taking the linearity of the MixColumns operation into account. As a result, the expectation of the analysis time in the previous work can be reduced to about one sixteenth. Notice that these improvements are based on the detailed analysis of the previous DFA methods and the calculation time and memory cost in practical implementations. Moreover, the proposed techniques can be widely applied to DFA attacks under different assumptions.

Shigeto Gomisawa

Papers

Fault sensitivity analysis

An Information Theoretic Perspective on the Differential Fault Analysis against AES.

Intentional electromagnetic interference for fault analysis on AES block cipher IC

Fault Injection and Key Retrieval Experiments on an Evaluation Board

Efficient Differential Fault Analysis for AES.