Fault Injection as an Oscilloscope: Fault Correlation Analysis

Abstract

Fault Injection (FI) attacks have become a practical threat to modern cryptographic implementations. Such attacks have recently focused more on exploitation of implementation-centric and device-specific properties of the faults. In this paper, we consider the parallel between SCA attacks and FI attacks; specifically, that many FI attacks rely on the data-dependency of activation and propagation of a fault, and SCA attacks similarly rely on data-dependent power usage. In fact, these are so closely related that we show that existing SCA attacks can be directly applied in a purely FI setting, by translating power FI results to generate FI ‘probability traces’ as an analogue of power traces. We impose only the requirements of the equivalent SCA attack (e.g., knowledge of the input plaintext for CPA on the first round), along with a way to observe the status of the target (whether or not it has failed and been “muted” after a fault). We also analyse existing attacks such as Fault Template Analysis in the light of this parallel, and discuss the limitations of our methodology. To demonstrate that our attacks are practical, we first show that SPA can be used to recover RSA private exponents using FI attacks. Subsequently, we show the generic nature of our attacks by performing DPA on AES after applying FI attacks to several different targets (with AVR, 32-bit ARM and RISC-V CPUs), using different software on each target, and do so with a low-cost (i.e., less than $50) power fault injection setup. We call this technique Fault Correlation Analysis (FCA), since we perform CPA on fault probability traces. To show that this technique is not limited to software, we also present FCA results against the hardware AES engine supported by one of our targets. Our results show that even without access to the ciphertext (e.g., where an FI redundancy countermeasure is in place, or where ciphertext is simply not exposed to an attacker in any circumstance) and in the presence of light jitter, FCA attacks can successfully recover keys on each of these targets.

Efficient Noninvasive Fault Injection Method Utilizing Intentional Electromagnetic Interference

“…Moreover, in the case of fault injection under conditions where the cryptographic equipment is not directly accessible, the secret key extraction methods that can be used are limited because the faults occur randomly [6]. However, since the proposed method can cause faults at arbitrary times, various analysis methods proposed in past studies [12], [13], [14], [15] may be applicable, and secret keys may be analyzed in a shorter time.…”

“…The attack requires an injection method that induces a temporary computational fault in the operation of the cryptographic module, and an analysis method that can extract the secret key from the faulty output obtained. Based on these requirements, existing research include theoretical methods that hypothesize the occurrence of a fault in a specific intermediate process of the cryptographic algorithm, they then use the faulty output to estimate the secret key [9], [10], [11], [12], [13], [14], [15]. Research focused on injection methods has investigated specific approaches for generating faults required for secret key estimation in real cryptographic modules.…”

VERICA - Verification of Combined Attacks

“…In the following, we write (d, k)-combined security when we do not restrict the fault type and location. Further, we emphasize the adversarial knowledge on faults, since injecting faults is strongly linked to placing probes [Cla07,SMC21]. Remark 1 (Adversarial Knowledge on Faults).…”

When the Decoder Has to Look Twice: Glitching a PUF Error Correction

“…Several physical glitching set-ups have been proposed [OC,KKM + 18,SMC20]. Furthermore, Krautter et al were even able to show that on-chip power glitching is feasible even without a physical glitching set-up [KGT18].…”