scholarly journals An Automated Framework for Exploitable Fault Identification in Block Ciphers – A Data Mining Approach

10.29007/fmzl ◽  
2018 ◽  
Author(s):  
Sayandeep Saha ◽  
Ujjawal Kumar ◽  
Debdeep Mukhopadhyay ◽  
Pallab Dasgupta
Keyword(s):  
Data Mining ◽  
Complexity Analysis ◽  
Practical Interest ◽  
Block Ciphers ◽  
Fault Analysis ◽  
Fault Attacks ◽  
Differential Fault Analysis ◽  
Analysis Scheme ◽  
Fault Characterization

Characterization of all possible faults in a cryptosystem exploitable for fault attacks is a problem which is of both theoretical and practical interest for the cryptographic community. The complete knowledge of exploitable fault space is desirable while designing optimal countermeasures for any given crypto-implementation. In this paper, we address the exploitable fault characterization problem in the context of Differential Fault Analysis (DFA) attacks on block ciphers. The formidable size of the fault spaces demands an automated albeit fast mechanism for verifying each individual fault instance and neither thetraditional, cipher-specific, manual DFA techniques nor the generic and automated Algebraic Fault Attacks (AFA) [10] fulfill these criteria. Further, the diversified structures of different block ciphers suggest that such an automation should be equally applicable to any block cipher. This work presents an automatedframework for DFA identification, fulfilling all aforementioned criteria, which, instead of performing the attack just estimates the attack complexity for each individual fault instance. A generic and extendable data-mining assisted dynamic analysis framework capable of capturing a large class of DFA distinguishersis devised, along with a graph-based complexity analysis scheme. The framework significantly outperforms another recently proposed one [6], in terms of attack class coverage and automation effort. Experimental evaluation on AES and PRESENT establishes the effectiveness of the proposed framework in detectingmost of the known DFAs, which eventually enables the characterization of the exploitable fault space.

scholarly journals ExpFault: An Automated Framework for Exploitable Fault Characterization in Block Ciphers

2018 ◽  
pp. 242-276 ◽  
Author(s):  
Sayandeep Saha ◽  
Debdeep Mukhopadhyay ◽  
Pallab Dasgupta
Keyword(s):  
Defense Mechanisms ◽  
Block Ciphers ◽  
Fault Analysis ◽  
Proof Of Concept ◽  
Secret Key ◽  
Cryptographic Primitives ◽  
Differential Fault Analysis ◽  
Comprehensive Knowledge ◽  
Fault Characterization ◽  
First Time

Malicious exploitation of faults for extracting secrets is one of the most practical and potent threats to modern cryptographic primitives. Interestingly, not every possible fault for a cryptosystem is maliciously exploitable, and evaluation of the exploitability of a fault is nontrivial. In order to devise precise defense mechanisms against such rogue faults, a comprehensive knowledge is required about the exploitable part of the fault space of a cryptosystem. Unfortunately, the fault space is diversified and of formidable size even while a single cryptoprimitive is considered and traditional manual fault analysis techniques may often fall short to practically cover such a fault space within reasonable time. An automation for analyzing individual fault instances for their exploitability is thus inevitable. Such an automation is supposed to work as the core engine for analyzing the fault spaces of cryptographic primitives. In this paper, we propose an automation for evaluating the exploitability status of fault instances from block ciphers, mainly in the context of Differential Fault Analysis (DFA) attacks. The proposed framework is generic and scalable, which are perhaps the two most important features for covering diversified fault spaces of formidable size originating from different ciphers. As a proof-of-concept, we reconstruct some known attack examples on AES and PRESENT using the framework and finally analyze a recently proposed cipher GIFT [BPP+17] for the first time. It is found that the secret key of GIFT can be uniquely determined with 1 nibble fault instance injected at the beginning of the 25th round with a reasonable computational complexity of 214.

scholarly journals Fully Automated Differential Fault Analysis on Software Implementations of Block Ciphers

2019 ◽  
pp. 1-29 ◽  
Author(s):  
Xiaolu Hou ◽  
Jakub Breier ◽  
Fuyuan Zhang ◽  
Yang Liu
Keyword(s):  
Block Ciphers ◽  
Fault Analysis ◽  
Smt Solver ◽  
Multiplication Operation ◽  
Analysis Methodology ◽  
Differential Fault Analysis ◽  
Software Implementations ◽  
Symmetric Block ◽  
Assembly Analysis ◽  
Effective Description

Differential Fault Analysis (DFA) is considered as the most popular fault analysis method. While there are techniques that provide a fault analysis automation on the cipher level to some degree, it can be shown that when it comes to software implementations, there are new vulnerabilities, which cannot be found by observing the cipher design specification.This work bridges the gap by providing a fully automated way to carry out DFA on assembly implementations of symmetric block ciphers. We use a customized data flow graph to represent the program and develop a novel fault analysis methodology to capture the program behavior under faults. We establish an effective description of DFA as constraints that are passed to an SMT solver. We create a tool that takes assembly code as input, analyzes the dependencies among instructions, automatically attacks vulnerable instructions using SMT solver and outputs the attack details that recover the last round key (and possibly the earlier keys). We support our design with evaluations on lightweight ciphers SIMON, SPECK, and PRIDE, and a current NIST standard, AES. By automated assembly analysis, we were able to find new efficient DFA attacks on SPECK and PRIDE, exploiting implementation specific vulnerabilities, and previously published DFA on SIMON and AES. Moreover, we present a novel DFA on multiplication operation that has never been shown for symmetric block ciphers before. Our experimental evaluation also shows reasonable execution times that are scalable to current cipher designs and can easily outclass the manual analysis. Moreover, we present a method to check the countermeasure-protected implementations in a way that helps implementers to decide how many rounds should be protected. We note that this is the first work that automatically carries out DFA on cipher implementations without any plaintext or ciphertext information and therefore, can be generally applied to any input data to the cipher.

scholarly journals FPGAhammer: Remote Voltage Fault Attacks on Shared FPGAs, suitable for DFA on AES

2018 ◽  
pp. 44-68 ◽  
Author(s):  
Jonas Krautter ◽  
Dennis R. E. Gnad ◽  
Mehdi B. Tahoori
Keyword(s):  
Voltage Drop ◽  
Timing Analysis ◽  
New Technology ◽  
Denial Of Service ◽  
Fault Analysis ◽  
Cloud Services ◽  
Fault Attacks ◽  
Multiple Users ◽  
Technology Generation ◽  
Differential Fault Analysis

With each new technology generation, the available resources on Field Programmable Gate Arrays increase, making them more attractive for partial access from multiple users. They get increasingly adopted as accelerators in various application domains, embedded in shared Systems on Chip or remote cloud services. Thus, some recent works have already explored Denial-of-Service and side-channel attacks, where an FPGA fabric is shared among multiple users. In this work, we show how fault attacks can be launched within an FPGA, through software-provided bitstreams alone. Excessive voltage drops can be generated from legitimate logic mapped into the FPGA to cause timing faults, reaching from spatially and logically isolated partitions of one to another user of the FPGA fabric. To cause this voltage drop, we first show how specific patterns to activate Ring Oscillators can cause timing failures in simple test designs on various FPGA boards. Subsequently, we analyze and adapt an existing fault model for the Advanced Encryption Standard to match the accuracy of our fault attack. In the same multi-user scenario, we show as a proof-of-concept how a successful Differential Fault Analysis attack on an AES module can be launched. We perform experiments on three FPGA boards of the same model and confirm that the attack adapts to all systems and is successful under process variation, but with different susceptibility to faults. The paper is concluded by validating the attack on another platform, and analyzing the vulnerability based on a timing analysis, proving the applicability to different devices.

scholarly journals A Novel Differential Fault Analysis on the Key Schedule of SIMON Family

Electronics ◽  
2019 ◽  
Vol 8 (1) ◽  
pp. 93 ◽  
Author(s):  
Jinbao Zhang ◽  
Ning Wu ◽  
Fang Zhou ◽  
Muhammad Yahya ◽  
Jianhua Li
Keyword(s):  
Block Ciphers ◽  
Fault Model ◽  
Fault Analysis ◽  
Research Attention ◽  
Key Schedule ◽  
Differential Fault Analysis ◽  
Detailed Simulation ◽  
Exact Position ◽  
Propagation Properties ◽  
Fourth Round

As a family of lightweight block ciphers, SIMON has attracted lots of research attention since its publication in 2013. Recent works show that SIMON is vulnerable to differential fault analysis (DFA) and existing DFAs on SIMON assume the location of induced faults are on the cipher states. In this paper, a novel DFA on SIMON is proposed where the key schedule is selected as the location of induced faults. Firstly, we assume a random one-bit fault is induced in the fourth round key KT−4 to the last. Then, by utilizing the key schedule propagation properties of SIMON, we determine the exact position of induced fault and demonstrate that the proposed DFA can retrieve 4 bits of the last round key KT−1 on average using one-bit fault. Till now this is the largest number of bits that can be cracked as compared to DFAs based on random bit fault model. Furthermore, by reusing the induced fault, we prove that 2 bits of the penultimate round key KT−2 could be retrieved. To the best of our knowledge, the proposed attack is the first one which extracts a key from SIMON based upon DFA on the key schedule. Finally, correctness and validity of our proposed attack is verified through detailed simulation and analysis.

scholarly journals SIFA: Exploiting Ineffective Fault Inductions on Symmetric Cryptography

2018 ◽  
pp. 547-572 ◽  
Author(s):  
Christoph Dobraunig ◽  
Maria Eichlseder ◽  
Thomas Korak ◽  
Stefan Mangard ◽  
Florian Mendel ◽  
...  
Keyword(s):  
Low Cost ◽  
Fault Analysis ◽  
Intensity Analysis ◽  
Fault Attacks ◽  
A Value ◽  
Differential Fault Analysis ◽  
Fault Sensitivity ◽  
Software Implementations ◽  
Symmetric Ciphers ◽  
Intermediate Value

Since the seminal work of Boneh et al., the threat of fault attacks has been widely known and techniques for fault attacks and countermeasures have been studied extensively. The vast majority of the literature on fault attacks focuses on the ability of fault attacks to change an intermediate value to a faulty one, such as differential fault analysis (DFA), collision fault analysis, statistical fault attack (SFA), fault sensitivity analysis, or differential fault intensity analysis (DFIA). The other aspect of faults—that faults can be induced and do not change a value—has been researched far less. In case of symmetric ciphers, ineffective fault attacks (IFA) exploit this aspect. However, IFA relies on the ability of an attacker to reliably induce reproducible deterministic faults like stuck-at faults on parts of small values (e.g., one bit or byte), which is often considered to be impracticable.As a consequence, most countermeasures against fault attacks do not focus on such attacks, but on attacks exploiting changes of intermediate values and usually try to detect such a change (detection-based), or to destroy the exploitable information if a fault happens (infective countermeasures). Such countermeasures implicitly assume that the release of “fault-free” ciphertexts in the presence of a fault-inducing attacker does not reveal any exploitable information. In this work, we show that this assumption is not valid and we present novel fault attacks that work in the presence of detection-based and infective countermeasures. The attacks exploit the fact that intermediate values leading to “fault-free” ciphertexts show a non-uniform distribution, while they should be distributed uniformly. The presented attacks are entirely practical and are demonstrated to work for software implementations of AES and for a hardware co-processor. These practical attacks rely on fault induction by means of clock glitches and hence, are achieved using only low-cost equipment. This is feasible because our attack is very robust under noisy fault induction attempts and does not require the attacker to model or profile the exact fault effect. We target two types of countermeasures as examples: simple time redundancy with comparison and several infective countermeasures. However, our attacks can be applied to a wider range of countermeasures and are not restricted to these two countermeasures.

scholarly journals Persistent Fault Analysis on Block Ciphers

2018 ◽  
pp. 150-172 ◽  
Author(s):  
Fan Zhang ◽  
Xiaoxuan Lou ◽  
Xinjie Zhao ◽  
Shivam Bhasin ◽  
Wei He ◽  
...  
Keyword(s):  
Time Synchronization ◽  
Fault Injection ◽  
Block Ciphers ◽  
Fault Analysis ◽  
Experimental Results ◽  
Fault Attacks ◽  
Intrinsic Nature ◽  
Fault Attack ◽  
Modular Redundancy

Persistence is an intrinsic nature for many errors yet has not been caught enough attractions for years. In this paper, the feature of persistence is applied to fault attacks, and the persistent fault attack is proposed. Different from traditional fault attacks, adversaries can prepare the fault injection stage before the encryption stage, which relaxes the constraint of the tight-coupled time synchronization. The persistent fault analysis (PFA) is elaborated on different implementations of AES-128, specially fault hardened implementations based on Dual Modular Redundancy (DMR). Our experimental results show that PFA is quite simple and efficient in breaking these typical implementations. To show the feasibility and practicability of our attack, a case study is illustrated on the shared library Libgcrypt with rowhammer technique. Approximately 8200 ciphertexts are enough to extract the master key of AES-128 when PFA is applied to Libgcrypt1.6.3 with redundant encryption based DMR. This work puts forward a new direction of fault attacks and can be extended to attack other implementations under more interesting scenarios.

Sign in / Sign up

Export Citation Format

Share Document