All You Need Is Fault: Zero-Value Attacks on AES and a New λ-Detection M&M

Authors

  • Haruka Hirata The University of Electro-Communications, Chofu, Japan
  • Daiki Miyahara The University of Electro-Communications, Chofu, Japan
  • Victor Arribas KU Leuven, imec - COSIC, Leuven, Belgium; Rambus Inc. San Jose CA, USA
  • Yang Li The University of Electro-Communications, Chofu, Japan
  • Noriyuki Miura Osaka University, Suita, Japan
  • Svetla Nikova KU Leuven, imec - COSIC, Leuven, Belgium; University of Bergen, Bergen, Norway
  • Kazuo Sakiyama The University of Electro-Communications, Chofu, Japan

DOI:

https://doi.org/10.46586/tches.v2024.i1.133-156

Keywords:

AES, fault attacks, zero-value attacks, SIFA2, FTA, masking, detection, M&M

Abstract

Deploying cryptography on embedded systems requires security against physical attacks. At CHES 2019, M&M was proposed as a combined countermeasure applying masking against SCAs and information-theoretic MAC tags against FAs. In this paper, we show that one of the protected AES implementations in the M&M paper is vulnerable to a zero-value SIFA2-like attack. A practical attack is demonstrated on an ASIC board. We propose two versions of the attack: the first follows the SIFA approach to inject faults in the last round, while the second one is an extension of SIFA and FTA but applied to the first round with chosen plaintext. The two versions work at the byte level, but the latter version considerably improves the efficiency of the attack. Moreover, we show that this zero-value SIFA2 attack is specific to the AES tower-field decomposed S-box design. Hence, such attacks are applicable to any implementation featuring this AES S-box architecture.
Then, we propose a countermeasure that prevents these attacks. We extend M&M with a fine-grained detection-based feature capable of detecting the zero-value glitch attacks. In this effort, we also solve the problem of a combined attack on the ciphertext output check of M&M scheme by using Kronecker’s delta function. We deploy the countermeasure on FPGA and verify its security against both fault and side-channel analysis with practical experiments.

Downloads

Published

2023-12-04

Issue

Section

Articles

How to Cite

All You Need Is Fault: Zero-Value Attacks on AES and a New λ-Detection M&M. (2023). IACR Transactions on Cryptographic Hardware and Embedded Systems, 2024(1), 133-156. https://doi.org/10.46586/tches.v2024.i1.133-156