High Rate Robust Codes with Low Implementation Complexity

Error control scheme for malicious and natural faults in cryptographic modules

“…While the QS code is an optimum robust code when k = 2sr and q is any power of a prime number, and the PC code is a close to optimum robust code for any 1 < r ≤ k and q is a power of two. Another high rate robust code is the Compact Protection Code (CPC) which exists for any set of parameters and has low implementation cost [28]. However, neither of these codes have correction capabilities.…”

“…The outer CPC predictor adds r o redundant bits to the k = k q • m output bits of the original component. Since a CPC code exists for every word length and security parameter Q [28], r o can take any value, it is not restricted to multiples of m. For the simplicity of computation, we used as a ground code a binary Punctured Cubic code whose error masking probability equalsQ pc = 2 1−r o . The RK-based predictor generates r q redundant symbols which together with the k q + r o / log 2 (q) symbols form an RK codeword.…”

“…The architectures are especially effective when they combine codes with a distance larger than 3 and an additional system-level validation by an outer code. -The experimental results indicate that a system level fault manager that employs a Compact Protection Code (CPC) [28] as an outer code is able to detect erroneous RK corrections with high probability. It can decrease the probability that a malicious fault will not be detected (at the first cycle it effects that computation), exponentially with the number of the CPC's redundant bits.…”

A comment on information leakage from robust code-based checkers detecting fault attacks on cryptographic primitives

“…There are very few high rate optimum or close to optimum robust error detecting codes; most are variants of two basic structures: the Quadratic-Sum (QS) code [28] and Punctured-Square (PS)/ Punctured-Cubic (PC) codes [29,30]. Punctured codes exist for any (k, r) pair but their implementation cost is high, whereas the QS based codes have low implementation costs but impose restrictions on the relationship between k and r. The best robust code known so far is the compact protection code (CPC), which provides a high rate and low implementation cost, and exists for any k and r [15].…”

“…If a robust code is used, any attempt to tamper with the combinational logic or to flip the content of the registers will be detected by the checkers with a guaranteed probability. For example, a Compact Protection Code (CPC) [15] can protect any number of state bits with a worst-case probability of an undetected fault being 2 −r+1 where r is the number of redundant bits. An attacker like the one in [13] who aims to extract only 8 state bits at a time cannot acquire information from the r redundant bits because they depend on the complete state and not only on its 8-bit portion; the relationship between 8 bits and the redundancy bits appears as totally random.…”