Round Addition Using Faults for Generalized Feistel Network

Abstract

SUMMARYThis article presents a differential fault analysis (DFA) technique using round addition for a generalized Feistel network (GFN) including CLEFIA and RC6. Here the term "round addition" means that the round operation executes twice using the same round key. The proposed DFA needs bypassing of an operation to count the number of rounds such as increment or decrement. To verify the feasibility of our proposal, we implement several operations, including increment and decrement, on a microcontroller and experimentally confirm the operation bypassing. The proposed round addition technique works effectively for the generalized Feistel network with a partial whitening operation after the last round. In the case of a 128-bit CLEFIA, we show a procedure to reconstruct the round keys or a secret key using one correct ciphertext and two faulty ciphertexts. Our DFA also works for DES and RC6.

Round Addition DFA on 80-bit Piccolo and TWINE

“…By the above result, in TWINE, the secret key can be derived because all round data at the final round are not whitened. This is similar to 128-bit CLEFIA [2].…”

“…On the basis of this technique, we have shown that round addition DFA using a bypassing increment or decrement command is effective for attacks against cipher-implemented microcontrollers. Further, by supplying abnormal voltage, secret keys of DES and 128-bit CLEFIA can be derived using round addition DFA [2]. Recently, many lightweight block ciphers have been proposed for low-resource devices.…”

“…The round addition at round (n−1) is represented by "Round 1 | · · · |Round n−2 |Round n−1 |Round n−1 |Round n " where the added operation is denoted in boldface. In our previous result for 128-bit CLEFIA [2], not only the above operation bypassing, but also two operation bypassing is required in one cipher operation to obtain two faulty cipher operations, that is, "Round 1 | · · · |Round n−2 |Round n−1 |Round n−1 |Round n−1 | Round n ". Experimental results show that the success rate of this double operation bypassing is much lower than that of single operation bypassing.…”

Crashing Modulus Attack on Modular Squaring for Rabin Cryptosystem

“…Instruction skip is equivalent to replacing an instruction with a no operation in assembly language. Several researchers have investigated DFA using an instruction skip, or a bypass operation [29], [30], [31]. Instruction skip does not affect the registers, internal memory, and calculation process.…”

“…Instruction skip does not affect the registers, internal memory, and calculation process. Successful instruction skip attacks have been reported for PIC16F877 [29], ATmega 128 [30], and ATmega 168 [31] microcontrollers. Choukri-Tunstall [29] and Park et al [30] showed that an entire Advanced Encryption Standard secret key could be reconstructed by skipping a branch instruction used to check the number of rounds.…”