International Association for Cryptologic Research

International Association
for Cryptologic Research

CryptoDB

All You Need Is Fault: Zero-Value Attacks on AES and a New λ-Detection M&M

Authors:
Haruka Hirata , The University of Electro-Communications, Chofu, Japan
Daiki Miyahara , The University of Electro-Communications, Chofu, Japan
Victor Arribas , KU Leuven, imec - COSIC, Leuven, Belgium; Rambus Inc. San Jose CA, USA
Yang Li , The University of Electro-Communications, Chofu, Japan
Noriyuki Miura , Osaka University, Suita, Japan
Svetla Nikova , KU Leuven, imec - COSIC, Leuven, Belgium; University of Bergen, Bergen, Norway
Kazuo Sakiyama , The University of Electro-Communications, Chofu, Japan
Download:
DOI: 10.46586/tches.v2024.i1.133-156
URL: https://tches.iacr.org/index.php/TCHES/article/view/11246
Search ePrint
Search Google
Abstract: Deploying cryptography on embedded systems requires security against physical attacks. At CHES 2019, M&M was proposed as a combined countermeasure applying masking against SCAs and information-theoretic MAC tags against FAs. In this paper, we show that one of the protected AES implementations in the M&M paper is vulnerable to a zero-value SIFA2-like attack. A practical attack is demonstrated on an ASIC board. We propose two versions of the attack: the first follows the SIFA approach to inject faults in the last round, while the second one is an extension of SIFA and FTA but applied to the first round with chosen plaintext. The two versions work at the byte level, but the latter version considerably improves the efficiency of the attack. Moreover, we show that this zero-value SIFA2 attack is specific to the AES tower-field decomposed S-box design. Hence, such attacks are applicable to any implementation featuring this AES S-box architecture.Then, we propose a countermeasure that prevents these attacks. We extend M&M with a fine-grained detection-based feature capable of detecting the zero-value glitch attacks. In this effort, we also solve the problem of a combined attack on the ciphertext output check of M&M scheme by using Kronecker’s delta function. We deploy the countermeasure on FPGA and verify its security against both fault and side-channel analysis with practical experiments.
BibTeX
@article{tches-2023-33664,
  title={All You Need Is Fault: Zero-Value Attacks on AES and a New λ-Detection M&M},
  journal={IACR Transactions on Cryptographic Hardware and Embedded Systems},
  publisher={Ruhr-Universität Bochum},
  volume={024 No. 1},
  pages={133-156},
  url={https://tches.iacr.org/index.php/TCHES/article/view/11246},
  doi={10.46586/tches.v2024.i1.133-156},
  author={Haruka Hirata and Daiki Miyahara and Victor Arribas and Yang Li and Noriyuki Miura and Svetla Nikova and Kazuo Sakiyama},
  year=2023
}