Skip to main content

Practical Fault Attacks on Minalpher: How to Recover Key with Minimum Faults?

  • Conference paper
  • First Online:
Security, Privacy, and Applied Cryptography Engineering (SPACE 2017)

Part of the book series: Lecture Notes in Computer Science ((LNSC,volume 10662))

Abstract

This work presents two differential fault attacks (or DFA) on Minalpher, a second round CAESAR candidate under practical fault model with as few faults as possible. Minalpher uses a new primitive called tweakable Even-Mansour, based on a permutation-based block-cipher proposed by Even and Mansour and to the best of our knowledge, no practical DFA has yet been reported on it. In the first DFA, only two random faults have been injected on two consecutive 4-bit nibbles (i.e. within total 8 bits) of a specific internal state. We show that (i) if both the faults are injected at the same nibble the key-space for the intermediate key can be reduced significantly from \(2^{256}\) to \(2^{32}\) and (ii) if the faults are injected at different positions, the key-space for the intermediate key can be reduced further to only \(2^{16}\). In the second DFA, we first consider two faults into a single nibble, which reduces the keyspace from \(2^{256}\) to \(2^{48}\). Moreover, we show that one additional fault (i.e. total three faults) helps to reduce the key-space significantly to \(2^{8}\). We can compute the correct intermediate key by observing a few more plain-text, cipher-text pairs, which helps in computing valid cipher-text, tag pairs for any message and associated data under a fixed nonce.

This is a preview of subscription content, log in via an institution to check access.

Access this chapter

Chapter
USD 29.95
Price excludes VAT (USA)
  • Available as PDF
  • Read on any device
  • Instant download
  • Own it forever
eBook
USD 39.99
Price excludes VAT (USA)
  • Available as EPUB and PDF
  • Read on any device
  • Instant download
  • Own it forever
Softcover Book
USD 54.99
Price excludes VAT (USA)
  • Compact, lightweight edition
  • Dispatched in 3 to 5 business days
  • Free shipping worldwide - see info

Tax calculation will be finalised at checkout

Purchases are for personal use only

Institutional subscriptions

References

  1. (no editor): CAESAR Competition. http://competitions.cr.yp.to/caesar.html

  2. Banik, S., Maitra, S.: A differential fault attack on MICKEY 2.0. In: Bertoni, G., Coron, J.-S. (eds.) CHES 2013. LNCS, vol. 8086, pp. 215–232. Springer, Heidelberg (2013). https://doi.org/10.1007/978-3-642-40349-1_13

    Chapter  Google Scholar 

  3. Banik, S., Maitra, S., Sarkar, S.: A differential fault attack on the grain family of stream ciphers. In: Prouff, E., Schaumont, P. (eds.) CHES 2012. LNCS, vol. 7428, pp. 122–139. Springer, Heidelberg (2012). https://doi.org/10.1007/978-3-642-33027-8_8

    Chapter  Google Scholar 

  4. Chakraborti, A., Nandi, M.: Differential fault analysis on Minalpher. Presented at DIAC (2015)

    Google Scholar 

  5. Banik, S., Maitra, S., Sarkar, S.: A differential fault attack on the grain family under reasonable assumptions. In: Galbraith, S., Nandi, M. (eds.) INDOCRYPT 2012. LNCS, vol. 7668, pp. 191–208. Springer, Heidelberg (2012). https://doi.org/10.1007/978-3-642-34931-7_12

    Chapter  Google Scholar 

  6. Yoshikawa, M., Nozaki, Y.: Two stage fault analysis against a falsification detection cipher Minalpher. In: IEEE International Conference on Smart Cloud (2016)

    Google Scholar 

  7. Bellare, M., Rogaway, P., Wagner, D.: The EAX mode of operation. In: Roy, B., Meier, W. (eds.) FSE 2004. LNCS, vol. 3017, pp. 389–407. Springer, Heidelberg (2004). https://doi.org/10.1007/978-3-540-25937-4_25

    Chapter  Google Scholar 

  8. Biham, E., Shamir, A.: Differential fault analysis of secret key cryptosystems. In: Kaliski, B.S. (ed.) CRYPTO 1997. LNCS, vol. 1294, pp. 513–525. Springer, Heidelberg (1997). https://doi.org/10.1007/BFb0052259

    Chapter  Google Scholar 

  9. Biham, E., Granboulan, L., Nguyên, P.Q.: Impossible fault analysis of RC4 and differential fault analysis of RC4. In: Gilbert, H., Handschuh, H. (eds.) FSE 2005. LNCS, vol. 3557, pp. 359–367. Springer, Heidelberg (2005). https://doi.org/10.1007/11502760_24

    Chapter  Google Scholar 

  10. Daemen, J., Rijmen, V.: The Design of Rijndael: AES - The Advanced Encryption Standard. Information Security and Cryptography. Springer, Heidelberg (2002). https://doi.org/10.1007/978-3-662-04722-4

    Book  MATH  Google Scholar 

  11. Dusart, P., Letourneux, G., Vivolo, O.: Differential fault analysis on A.E.S. In: Zhou, J., Yung, M., Han, Y. (eds.) ACNS 2003. LNCS, vol. 2846, pp. 293–306. Springer, Heidelberg (2003). https://doi.org/10.1007/978-3-540-45203-4_23

    Chapter  Google Scholar 

  12. Bossuet, L., Datta, N., Mancillas-López, C., Nandi, M.: ELmD: a pipelineable authenticated encryption and its hardware implementation. IEEE Trans. Comput. 65, 3318–3331 (2016)

    Article  MathSciNet  MATH  Google Scholar 

  13. Viega, J., McGraw, D.: The use of Galois/Counter Mode (GCM) in IPsec Encapsulating Security Payload (ESP), RFC Editor, United States (2005)

    Google Scholar 

  14. Krovetz, T., Rogaway, P.: The software performance of authenticated-encryption modes. In: Joux, A. (ed.) FSE 2011. LNCS, vol. 6733, pp. 306–327. Springer, Heidelberg (2011). https://doi.org/10.1007/978-3-642-21702-9_18

    Chapter  Google Scholar 

  15. Dobraunig, C., Eichlseder, M., Korak, T., Lomné, V., Mendel, F.: Statistical fault attacks on nonce-based authenticated encryption schemes. In: Cheon, J.H., Takagi, T. (eds.) ASIACRYPT 2016. LNCS, vol. 10031, pp. 369–395. Springer, Heidelberg (2016). https://doi.org/10.1007/978-3-662-53887-6_14

    Chapter  Google Scholar 

  16. Hojsík, M., Rudolf, B.: Floating fault analysis of Trivium. In: Chowdhury, D.R., Rijmen, V., Das, A. (eds.) INDOCRYPT 2008. LNCS, vol. 5365, pp. 239–250. Springer, Heidelberg (2008). https://doi.org/10.1007/978-3-540-89754-5_19

    Chapter  Google Scholar 

  17. Hojsík, M., Rudolf, B.: Differential fault analysis of Trivium. In: Nyberg, K. (ed.) FSE 2008. LNCS, vol. 5086, pp. 158–172. Springer, Heidelberg (2008). https://doi.org/10.1007/978-3-540-71039-4_10

    Chapter  Google Scholar 

  18. Iwata, T., Minematsu, K., Guo, J., Morioka, S., Kobayashi, E.: SILC: SImple Lightweight CFB (2014). http://competitions.cr.yp.to/round1/silcv1.pdf

  19. Iwata, T., Minematsu, K., Guo, J., Morioka, S., Kobayashi, E.: CLOC: compact low-overhead CFB (2014). http://competitions.cr.yp.to/round1/clocv1.pdf

  20. Jeong, K., Lee, C.: Differential fault analysis on block cipher LED-64. In: (Jong Hyuk) Park, J.J., Leung, V., Wang, C.L., Shon, T. (eds.) Future Information Technology, Application and Service. LNEE, vol. 164, pp. 747–755. Springer, Dordrecht (2012). https://doi.org/10.1007/978-94-007-4516-2_79

    Chapter  Google Scholar 

  21. Jovanovic, P., Kreuzer, M., Polian, I.: A fault attack on the LED block cipher. In: Schindler, W., Huss, S.A. (eds.) COSADE 2012. LNCS, vol. 7275, pp. 120–134. Springer, Heidelberg (2012). https://doi.org/10.1007/978-3-642-29912-4_10

    Chapter  Google Scholar 

  22. Piret, G., Quisquater, J.-J.: A differential fault attack technique against SPN structures, with application to the AES and Khazad. In: Walter, C.D., Koç, Ç.K., Paar, C. (eds.) CHES 2003. LNCS, vol. 2779, pp. 77–88. Springer, Heidelberg (2003). https://doi.org/10.1007/978-3-540-45238-6_7

    Chapter  Google Scholar 

  23. Saha, D., Kuila, S., Roy Chowdhury, D.: EscApe: diagonal fault analysis of APE. In: Meier, W., Mukhopadhyay, D. (eds.) INDOCRYPT 2014. LNCS, vol. 8885, pp. 197–216. Springer, Cham (2014). https://doi.org/10.1007/978-3-319-13039-2_12

    Google Scholar 

  24. Sasaki, Y., Todo, Y., Aoki, K., Naito, Y., Sugawara, T., Murakami, Y., Matsui, M., Hirose, S.: Minalpher v1 (2014). http://competitions.cr.yp.to/round1/minalpherv1.pdf

  25. Tunstall, M., Mukhopadhyay, D., Ali, S.: Differential fault analysis of the advanced encryption standard using a single fault. In: Ardagna, C.A., Zhou, J. (eds.) WISTP 2011. LNCS, vol. 6633, pp. 224–233. Springer, Heidelberg (2011). https://doi.org/10.1007/978-3-642-21040-2_15

    Chapter  Google Scholar 

  26. Whiting, D., Houeley, R., Ferguson, N.: Counter with CBC-MAC. Submission to NIST 2002 (2002). http://csrc.nist.gov/groups/ST/toolkit/BCM/modesdevelopment.html

Download references

Author information

Authors and Affiliations

Authors

Corresponding author

Correspondence to Nilanjan Datta .

Editor information

Editors and Affiliations

A Appendix

A Appendix

1.1 A.1 Backward Propagation of the Ciphertext Differences Along with the Keys

Fig. 13.
figure 13

Backward propagation of the ciphertext differences along with I and K

1.2 A.2 Three Sets of Equations for the First Fault

First Set of Equations

$$\begin{aligned} R_1= & {} SN^{I, X, 0}_{03} \oplus SN^{I, X, A}_{03}, \ T_1^3 = SN^{I, X, 0}_{12} \oplus SN^{I, X, A}_{12} \end{aligned}$$
$$\begin{aligned} T_1^3= & {} SN^{I, X, 0}_{26} \oplus SN^{I, X, A}_{26}, \ P_3 = SN^{I, X, 0}_{34} \oplus SN^{I, X, A}_{34} \end{aligned}$$
$$\begin{aligned} S_1= & {} SN^{I, X, 0}_{02} \oplus SN^{I, X, A}_{02}, \ U_1^3 = SN^{I, X, 0}_{13} \oplus SN^{I, X, A}_{13} \end{aligned}$$
$$\begin{aligned} U_1^3= & {} SN^{I, X, 0}_{27} \oplus SN^{I, X, A}_{27}, \ Q_3 = SN^{I, X, 0}_{35} \oplus SN^{I, X, A}_{35} \end{aligned}$$
$$\begin{aligned} P_2= & {} SN^{I, X, 0}_{04} \oplus SN^{I, X, A}_{04}, \ P_2 = SN^{I, X, 0}_{16} \oplus SN^{I, X, A}_{16} \end{aligned}$$
$$\begin{aligned} P_2= & {} SN^{I, X, 0}_{21} \oplus SN^{I, X, A}_{21} \end{aligned}$$
$$\begin{aligned} Q_2= & {} SN^{I, X, 0}_{05} \oplus SN^{I, X, A}_{05}, \ Q_2 = SN^{I, X, 0}_{17} \oplus SN^{I, X, A}_{17} \end{aligned}$$
$$\begin{aligned} Q_2= & {} SN^{I, X, 0}_{20} \oplus SN^{I, X, A}_{20} \end{aligned}$$
$$\begin{aligned} V_1^4= & {} SN^{I, X, 0}_{06} \oplus SN^{I, X, A}_{06}, \ T_2^1 = SN^{I, X, 0}_{10} \oplus SN^{I, X, A}_{10} \end{aligned}$$
$$\begin{aligned} W_2^4= & {} SN^{I, X, 0}_{22} \oplus SN^{I, X, A}_{22},\ Y = SN^{I, X, 0}_{37} \oplus SN^{I, X, A}_{37} \end{aligned}$$
$$\begin{aligned} V_4^1= & {} SN^{I, X, 0}_{07} \oplus SN^{I, X, A}_{07},\ U_2^3 = SN^{I, X, 0}_{11} \oplus SN^{I, X, A}_{11} \end{aligned}$$
$$\begin{aligned} X_2^4= & {} SN^{I, X, 0}_{23} \oplus SN^{I, X, A}_{23},\ Z = SN^{I, X, 0}_{36} \oplus SN^{I, X, A}_{36} \end{aligned}$$
$$\begin{aligned} R_3= & {} SN^{I, X, 0}_{00} \oplus SN^{I, X, A}_{00},\ R_3 = SN^{I, X, 0}_{24} \oplus SN^{I, X, A}_{24} \end{aligned}$$
$$\begin{aligned} R_3= & {} SN^{I, X, 0}_{32} \oplus SN^{I, X, A}_{32} \end{aligned}$$
$$\begin{aligned} S_3= & {} SN^{I, X, 0}_{01} \oplus SN^{I, X, A}_{01},\ S_3 = SN^{I, X, 0}_{25} \oplus SN^{I, X, A}_{25} \end{aligned}$$
$$\begin{aligned} S_3= & {} SN^{I, X, 0}_{33} \oplus SN^{I, X, A}_{33} \end{aligned}$$

Second Set of Equations

$$\begin{aligned} R_1= & {} SN^{IK, XY, 0}_{06} \oplus SN^{IK, XY, AB}_{06}, \ T_1^3 = SN^{IK, XY, 0}_{14} \oplus SN^{IK, XY, AB}_{14} \end{aligned}$$
$$\begin{aligned} T_1^3= & {} SN^{IK, XY, 0}_{23} \oplus SN^{IK, XY, AB}_{23}, \ P_3 = SN^{IK, XY, 0}_{32} \oplus SN^{IK, XY, AB}_{32} \end{aligned}$$
$$\begin{aligned} S_1= & {} SN^{IK, XY, 0}_{07} \oplus SN^{IK, XY, AB}_{07}, \ U_1^3 = SN^{IK, XY, 0}_{15} \oplus SN^{IK, XY, AB}_{15} \end{aligned}$$
$$\begin{aligned} U_1^3= & {} SN^{IK, XY, 0}_{22} \oplus SN^{IK, XY, AB}_{22}, \ Q_3 = SN^{IK, XY, 0}_{33} \oplus SN^{IK, XY, AB}_{33} \end{aligned}$$
$$\begin{aligned} P_2= & {} SN^{IK, XY, 0}_{01} \oplus SN^{IK, XY, AB}_{01}, \ P_2 = SN^{IK, XY, 0}_{10} \oplus SN^{IK, XY, AB}_{10} \ \end{aligned}$$
$$\begin{aligned} P_2= & {} SN^{IK, XY, 0}_{24} \oplus SN^{IK, XY, AB}_{24} \end{aligned}$$
$$\begin{aligned} Q_2= & {} SN^{IK, XY, 0}_{00} \oplus SN^{IK, XY, AB}_{00}, \ Q_2 = SN^{IK, XY, 0}_{11} \oplus SN^{IK, XY, AB}_{11} \end{aligned}$$
$$\begin{aligned} Q_2= & {} SN^{IK, XY, 0}_{25} \oplus SN^{IK, XY, AB}_{25} \end{aligned}$$
$$\begin{aligned} V_1^4= & {} SN^{IK, XY, 0}_{02} \oplus SN^{IK, XY, AB}_{02}, \ T_2^1 = SN^{IK, XY, 0}_{17} \oplus SN^{IK, XY, AB}_{17} \end{aligned}$$
$$\begin{aligned} W_2^4= & {} SN^{IK, XY, 0}_{26} \oplus SN^{IK, XY, AB}_{26}, \ Y = SN^{IK, XY, 0}_{30} \oplus SN^{IK, XY, AB}_{30} \end{aligned}$$
$$\begin{aligned} V_4^1= & {} SN^{IK, XY, 0}_{03} \oplus SN^{IK, XY, AB}_{03}, \ U_2^3 = SN^{IK, XY, 0}_{16} \oplus SN^{IK, XY, AB}_{16} \end{aligned}$$
$$\begin{aligned} X_2^4= & {} SN^{IK, XY, 0}_{27} \oplus SN^{IK, XY, AB}_{27}, \ Z = SN^{IK, XY, 0}_{31} \oplus SN^{IK, XY, AB}_{31} \end{aligned}$$
$$\begin{aligned} R_3= & {} SN^{IK, XY, 0}_{04} \oplus SN^{IK, XY, AB}_{04}, \ R_3 = SN^{IK, XY, 0}_{20} \oplus SN^{IK, XY, AB}_{20} \end{aligned}$$
$$\begin{aligned} R_3= & {} SN^{IK, XY, 0}_{35} \oplus SN^{IK, XY, AB}_{35} \nonumber \end{aligned}$$
$$\begin{aligned} S_3= & {} SN^{IK, XY, 0}_{05} \oplus SN^{IK, XY, AB}_{05}, \ S_3 = SN^{IK, XY, 0}_{21} \oplus SN^{IK, XY, AB}_{21} \end{aligned}$$
$$\begin{aligned} S_3= & {} SN^{IK, XY, 0}_{34} \oplus SN^{IK, XY, AB}_{34} \nonumber \end{aligned}$$

Third Set of Equations

$$\begin{aligned} F_2&= SN^{-1}(SN^{IK, XY, 0}_{06} \oplus SN^{IK, XY, 0}_{14} \oplus SN^{IK, XY, 0}_{23})\\&\oplus SN^{-1}(SN^{IK, XY, AB}_{06} \oplus SN^{IK, XY, AB}_{14} \oplus SN^{IK, XY, AB}_{23}) \end{aligned}$$
$$\begin{aligned} F_2&= SN^{-1}(SN^{IK, XY, 0}_{17} \oplus SN^{IK, XY, 0}_{26} \oplus SN^{IK, XY, 0}_{30}) \\&\oplus SN^{-1}(SN^{IK, XY, AB}_{17} \oplus SN^{IK, XY, AB}_{26} \oplus SN^{IK, XY, AB}_{30}) \end{aligned}$$
$$\begin{aligned} F_2&= SN^{-1}(SN^{IK, XY, 0}_{04} \oplus SN^{IK, XY, 0}_{20} \oplus SN^{IK, XY, 0}_{35}) \\&\oplus SN^{-1}(SN^{IK, XY, AB}_{04} \oplus SN^{IK, XY, AB}_{20} \oplus SN^{IK, XY, AB}_{35}) \end{aligned}$$
$$\begin{aligned} G_2&= SN^{-1}(SN^{IK, XY, 0}_{07} \oplus SN^{IK, XY, 0}_{15} \oplus SN^{IK, XY, 0}_{22}) \\&\oplus SN^{-1}(SN^{IK, XY, AB}_{07} \oplus SN^{IK, XY, AB}_{15} \oplus SN^{IK, XY, AB}_{22}) \end{aligned}$$
$$\begin{aligned} G_2&= SN^{-1}(SN^{IK, XY, 0}_{16} \oplus SN^{IK, XY, 0}_{27} \oplus SN^{IK, XY, 0}_{31}) \\&\oplus SN^{-1}(SN^{IK, XY, AB}_{16} \oplus SN^{IK, XY, AB}_{27} \oplus SN^{IK, XY, AB}_{31}) \end{aligned}$$
$$\begin{aligned} G_2&= SN^{-1}(SN^{IK, XY, 0}_{05} \oplus SN^{IK, XY, 0}_{21} \oplus SN^{IK, XY, 0}_{34}) \\&\oplus SN^{-1}(SN^{IK, XY, AB}_{05} \oplus SN^{IK, XY, AB}_{21} \oplus SN^{IK, XY, AB}_{34}) \end{aligned}$$
$$\begin{aligned} H_1&= SN^{-1}(SN^{IK, XY, 0}_{02} \oplus SN^{IK, XY, 0}_{17} \oplus SN^{IK, XY, 0}_{30}) \\&\oplus SN^{-1}(SN^{IK, XY, AB}_{02} \oplus SN^{IK, XY, AB}_{17} \oplus SN^{IK, XY, AB}_{30}) \end{aligned}$$
$$\begin{aligned} F_1&= SN^{-1}(SN^{IK, XY, 0}_{01} \oplus SN^{IK, XY, 0}_{10} \oplus SN^{IK, XY, 0}_{24}) \\&\oplus SN^{-1}(SN^{IK, XY, AB}_{01} \oplus SN^{IK, XY, AB}_{10} \oplus SN^{IK, XY, AB}_{24}) \end{aligned}$$
$$\begin{aligned} G_1&= SN^{-1}(SN^{IK, XY, 0}_{14} \oplus SN^{IK, XY, 0}_{23} \oplus SN^{IK, XY, 0}_{32}) \\&\oplus SN^{-1}(SN^{IK, XY, AB}_{14} \oplus SN^{IK, XY, AB}_{23} \oplus SN^{IK, XY, AB}_{32}) \end{aligned}$$
$$\begin{aligned} H_1&= SN^{-1}(SN^{IK, XY, 0}_{03} \oplus SN^{IK, XY, 0}_{27} \oplus SN^{IK, XY, 0}_{31}) \\&\oplus SN^{-1}(SN^{IK, XY, AB}_{03} \oplus SN^{IK, XY, AB}_{27} \oplus SN^{IK, XY, AB}_{31}) \end{aligned}$$
$$\begin{aligned} I_1&= SN^{-1}(SN^{IK, XY, 0}_{03} \oplus SN^{IK, XY, 0}_{16} \oplus SN^{IK, XY, 0}_{31}) \\&\oplus SN^{-1}(SN^{IK, XY, AB}_{03} \oplus SN^{IK, XY, AB}_{16} \oplus SN^{IK, XY, AB}_{31}) \end{aligned}$$
$$\begin{aligned} G_1&= SN^{-1}(SN^{IK, XY, 0}_{00} \oplus SN^{IK, XY, 0}_{11} \oplus SN^{IK, XY, 0}_{25}) \\&\oplus SN^{-1}(SN^{IK, XY, AB}_{00} \oplus SN^{IK, XY, AB}_{11} \oplus SN^{IK, XY, AB}_{25}) \end{aligned}$$
$$\begin{aligned} F_3&= SN^{-1}(SN^{IK, XY, 0}_{15} \oplus SN^{IK, XY, 0}_{22} \oplus SN^{IK, XY, 0}_{33}) \\&\oplus SN^{-1}(SN^{IK, XY, AB}_{15} \oplus SN^{IK, XY, AB}_{22} \oplus SN^{IK, XY, AB}_{33}) \end{aligned}$$
$$\begin{aligned} I_1&= SN^{-1}(SN^{IK, XY, 0}_{02} \oplus SN^{IK, XY, 0}_{26} \oplus SN^{IK, XY, 0}_{30}) \\&\oplus SN^{-1}(SN^{IK, XY, AB}_{02} \oplus SN^{IK, XY, AB}_{26} \oplus SN^{IK, XY, AB}_{30}) \end{aligned}$$

Rights and permissions

Reprints and permissions

Copyright information

© 2017 Springer International Publishing AG

About this paper

Check for updates. Verify currency and authenticity via CrossMark

Cite this paper

Chakraborti, A., Datta, N., Nandi, M. (2017). Practical Fault Attacks on Minalpher: How to Recover Key with Minimum Faults?. In: Ali, S., Danger, JL., Eisenbarth, T. (eds) Security, Privacy, and Applied Cryptography Engineering. SPACE 2017. Lecture Notes in Computer Science(), vol 10662. Springer, Cham. https://doi.org/10.1007/978-3-319-71501-8_7

Download citation

  • DOI: https://doi.org/10.1007/978-3-319-71501-8_7

  • Published:

  • Publisher Name: Springer, Cham

  • Print ISBN: 978-3-319-71500-1

  • Online ISBN: 978-3-319-71501-8

  • eBook Packages: Computer ScienceComputer Science (R0)

Publish with us

Policies and ethics