Mutant Differential Fault Analysis of Trivium MDFA

Abstract

Abstract. In this paper we present improvements to the differential fault analysis (DFA) of the stream cipher Trivium proposed in the work of M. Hojsík and B. Rudolf. In particular, we optimize the algebraic representation of obtained DFA information applying the concept of Mutants, which represent low degree equations derived after processing of DFA information. As a result, we are able to minimize the number of fault injections necessary for retrieving the secret key. Therefore, we introduce a new algebraic framework that combines the power of different algebraic techniques for handling additional information received from a physical attack. Using this framework, we are able to recover the secret key by only an one-bit fault injection. In fact, this is the first attack on stream ciphers utilizing minimal amount of DFA information. We study the efficiency of our improved attack by comparing the size of gathered DFA information with previous attacks.

Fault attack on FPGA implementations of Trivium stream cipher

“…A new analysis called Mutant Differential Fault Analysis of Trivium (MDFA), based on [3] is presented in [7]. They affirm that it is possible to break the system with only one fault injection.…”

“…In [6], an Improved Differential Fault Analysis of Trivium is introduced, where they are able to retrieve the secret key with two fault injections over the inner state. A new analysis called Mutant Differential Fault Analysis of Trivium (MDFA), based on [3] is presented in [7].…”

A Differential Fault Attack on MICKEY 2.0

“…For a very brief introduction in this, one may refer [19,Section 5]. The DFA on Trivium [19] requires only 2 faults.…”

“…For a very brief introduction in this, one may refer [19,Section 5]. The DFA on Trivium [19] requires only 2 faults. Our very recent work on DFA against Grain family [20] also shows that the number of faults can be reduced significantly (not more than 10).…”

Algebraic Fault Attack on the SHA-256 Compression Function

“…An important advantage of AFA over DFA is that AFA does not rely on the manual analysis of differential propagations. By applying AFA, the previous DFA attacks on block and stream ciphers have been improved, such as AES [30], LED [26,31], Piccolo [4], Trivium [29].…”