Cryptology ePrint Archive: Report 2018/295

ExpFault: An Automated Framework for Exploitable Fault Characterization in Block Ciphers (Revised Version)

Sayandeep Saha and Debdeep Mukhopadhyay and Pallab Dasgupta

Abstract: Malicious exploitation of faults for extracting secrets is one of the most practical and potent threats to modern cryptographic primitives. Interestingly, not every possible fault for a cryptosystem is maliciously exploitable, and evaluation of the exploitability of a fault is nontrivial. In order to devise precise defense mechanisms against such rogue faults, a comprehensive knowledge is required about the exploitable part of the fault space of a cryptosystem. Unfortunately, the fault space is diversified and of formidable size even while a single crypto-primitive is considered and traditional manual fault analysis techniques may often fall short to practically cover such a fault space within reasonable time. An automation for analyzing individual fault instances for their exploitability is thus inevitable. Such an automation is supposed to work as the core engine for analyzing the fault spaces of cryptographic primitives. In this paper, we propose an automation for evaluating the exploitability status of fault instances from block ciphers, mainly in the context of Differential Fault Analysis (DFA) attacks. The proposed framework is generic and scalable, which are perhaps the two most important features for covering diversified fault spaces of formidable size originating from different ciphers. As a proof-of-concept, we reconstruct some known attack examples on AES and PRESENT using the framework and finally analyze a recently proposed cipher GIFT [BPP + 17] for the first time. It is found that the secret key of GIFT can be determined with 2 nibble fault instances injected consecutively at the beginning of the 25th and 23rd round with remaining key space complexity of 2^7.06 .

Category / Keywords: Fault attack and Block cipher and Automation

Original Publication (with minor differences): IACR-CHES-2018
DOI: 10.13154/tches.v2018.i2.242-276

Date: received 22 Mar 2018, last revised 19 Sep 2018

Contact author: sayandeep iitkgp at gmail com

Available format(s): PDF | BibTeX Citation

Note: One attack described in this work was not well-explained in the CHES 2018 version, which may lead to misconceptions. So, we have revised that part (3-4 paragraphs in the paper).

Version: 20180920:031117 (All versions of this report)

Short URL: ia.cr/2018/295