Cryptology ePrint Archive: Report 2018/295
ExpFault: An Automated Framework for Exploitable Fault Characterization in Block Ciphers (Revised Version)
Sayandeep Saha and Debdeep Mukhopadhyay and Pallab Dasgupta
Abstract: Malicious exploitation of faults for extracting secrets is one of the most practical and potent threats to modern cryptographic primitives. Interestingly, not every possible fault for a cryptosystem is maliciously exploitable, and evaluation of the exploitability of a fault is nontrivial. In order to devise precise defense mechanisms against such rogue faults, a comprehensive knowledge is required about the exploitable part of the fault space of a cryptosystem.
Unfortunately, the fault space is diversified and of formidable size even while a single crypto-primitive is considered and traditional manual fault analysis techniques may often fall short
to practically cover such a fault space within reasonable time. An automation for analyzing individual fault instances for their exploitability is thus inevitable. Such an automation is
supposed to work as the core engine for analyzing the fault spaces of cryptographic primitives. In this paper, we propose an automation for evaluating the exploitability status of fault instances
from block ciphers, mainly in the context of Differential Fault Analysis (DFA) attacks. The proposed framework is generic and scalable, which are perhaps the two most important features
for covering diversified fault spaces of formidable size originating from different ciphers. As a proof-of-concept, we reconstruct some known attack examples on AES and PRESENT using
the framework and finally analyze a recently proposed cipher GIFT [BPP + 17] for the first time. It is found that the secret key of GIFT can be determined with 2 nibble fault instances injected
consecutively at the beginning of the 25th and 23rd round with remaining key space complexity of 2^7.06 .
Category / Keywords: Fault attack and Block cipher and Automation
Original Publication (with minor differences): IACR-CHES-2018
DOI: 10.13154/tches.v2018.i2.242-276
Date: received 22 Mar 2018, last revised 19 Sep 2018
Contact author: sayandeep iitkgp at gmail com
Available format(s): PDF | BibTeX Citation
Note: One attack described in this work was not well-explained in the CHES 2018 version, which may lead to misconceptions. So, we have revised that part (3-4 paragraphs in the paper).
Version: 20180920:031117 (All versions of this report)
Short URL: ia.cr/2018/295
[ Cryptology ePrint archive ]