Single-Byte Error-Based Practical Differential Fault Attack on Bit-Sliced Lightweight Block Cipher PIPO

Abstract

With the recent development of the Internet of Things (IoT), related device use is increasing rapidly. As a result, accessing and hijacking the devices is an increasing security threat. The challenges of side-channel security of IoT devices are having a way of coming to the surface due to this physical accessibility. Accordingly, there is active research on lightweight block ciphers to provide security even in resource-scarce environments situations such as IoT. The bit-sliced structure increases memory and time efficiency using an implementation method that replaces a lookup table with a bit-wise operation. Therefore, it is a widely-used design technique for lightweight block ciphers. In this paper, we show a differential fault attack study, a type of side-channel analysis, targeting bit-sliced block ciphers. In particular, it proposes a novel attack rationale on the recently proposed lightweight block cipher PIPO and shows that it applies sufficiently to other bit-sliced block ciphers. The proposed attack is based on a more alleviated attacker's assumption than the previously proposed attack, and it shows that less than 32 fewer fault ciphertext may fully recover the 128-bit of the PIPO 64/128 secret key. It proves that the attack is practical by verifying the attack through the actual electromagnetic fault injection. It also discusses the applicability of various bitsliced block ciphers and shows how redundancy-based countermeasures might improve fault-robustness. Therefore, when using the bit-sliced block ciphers on IoT devices, we recommend applying appropriate countermeasures against fault injection attacks.

Physical-Layer Security for Energy-Constrained Integrated Systems: Challenges and Design Perspectives

“…An increased budget means higher quality equipment, meaning higher precision attacks. For instance, a fault injection attack where the adversary targets a memory to flip the stored bits can be modeled by having the capability to do a bit-flip (high precision), byteflip, or a word-flip (low precision), to a specific location (high precision) or a random location (low precision) [34]. As securing against a stronger threat model usually comes with a trade-off in power and area, it may not be possible to secure every device against it.…”

Differential fault analysis on the lightweight block cipher plug‐in plug‐out

“…They also simulate the recovery of the correct secret key with about 98% probability through 64 fault ciphertexts, which shows that PIPO cipher does not provide security against DFA. Recently, KIM et al further alleviated attacker's assumption 20 . In particular, after observing the weakening of random byte‐fault model than specific bit‐fault model, they proposed a novel attack rationale on the DFA on PIPO and also showed the possibility of applying it to other bit‐sliced block ciphers.…”

“…In ICISC '20,Kim et al proposed a new lightweight versatile block cipher: PIPO (PIPO stands for "plug-in plug-out"), which is a byte-oriented and bit-sliced cipher and offers excellent performance in 8-bit AVR software implementations. 9 Meanwhile, PIPO allows for efficient higher-order masking implementations because the using of minimal number of nonlinear operations.…”

“…Recently, KIM et al further alleviated attacker's assumption. 20 In particular, after observing the weakening of random byte-fault model than specific bit-fault model, they proposed a novel attack rationale on the DFA on PIPO and also showed the possibility of applying it to other bit-sliced block ciphers.…”