Cryptology ePrint Archive: Report 2021/712

DEFAULT: Cipher Level Resistance Against Differential Fault Attack

Anubhab Baksi and Shivam Bhasin and Jakub Breier and Mustafa Khairallah and Thomas Peyrin and Sumanta Sarkar and Siang Meng Sim

Abstract: Differential Fault Analysis (DFA) is a well known cryptanalytic technique that exploits faulty outputs of an encryption device. Despite its popularity and similarity with the classical Differential Analysis (DA), a thorough analysis explaining DFA from a designer's point of view is missing in the literature. To the best of our knowledge, no DFA immune cipher at an algorithmic level has been proposed so far. Furthermore, all known DFA countermeasures somehow depend on the device/protocol or on the implementation such as duplication/comparison. As all of these are outside the scope of the cipher designer, we focus on designing a primitive which can protect from DFA on its own. We present the first concept of cipher level DFA resistance which does not rely on any device/protocol related assumption, nor does it depend on any form of duplication. Our construction is simple, software/hardware friendly and DFA security scales up with the state size. It can be plugged before and/or after (almost) any symmetric key cipher and will ensure a non-trivial search complexity against DFA. One key component in our DFA protection layer is an SBox with linear structures. Such SBoxes have never been used in cipher design as they generally perform poorly against differential attacks. We argue that they in fact represent an interesting trade-off between good cryptographic properties and DFA resistance. As a proof of concept, we construct a DFA protecting layer, named DEFAULT-LAYER, as well as a full-fledged block cipher DEFAULT. Our solutions compare favourably to the state-of-the-art, offering advantages over the sophisticated duplication based solutions like impeccable circuits/CRAFT or infective countermeasures.

Category / Keywords: secret-key cryptography / differential fault attack, protection, SBox, differential attack, DEFAULT

Original Publication (with minor differences): IACR-ASIACRYPT-2021

Date: received 28 May 2021, last revised 20 Sep 2021

Contact author: crypto s m sim at gmail com

Available format(s): PDF | BibTeX Citation

Note: Updated version of DEFAULT cipher (stronger key schedule) to avoid information combining attacks

Version: 20210920:215612 (All versions of this report)

Short URL: ia.cr/2021/712


[ Cryptology ePrint archive ]