Automatic Search of Meet-in-the-Middle Differential Fault Analysis on AES-like Ciphers

被引：0

作者：

Yu Q. ^{[1
,4
]}

Dong X. ^{[2
,3
,6
,7
]}

Qin L. ^{[3
,6
]}

Kang Y. ^{[1
,4
]}

Jia K. ^{[3
,5
,6
]}

Wang X. ^{[2
,3
,4
,6
]}

Zhang G. ^{[1
,4
,7
]}

机构：

[1] School of Cyber Science and Technology, Shandong University, Qingdao

[2] Institute for Advanced Study, BNRist, Tsinghua University, Beijing

[3] BNRist, Tsinghua University, Beijing

[4] Key Laboratory of Cryptologic Technology and Information Security, Ministry of Education, Shandong University, Jinan

[5] Institute for Network Sciences and Cyberspace, BNRist, Tsinghua University, Beijing

[6] Zhongguancun Laboratory, Beijing

[7] Shandong Institute of Blockchain, Jinan

来源：

IACR Transactions on Cryptographic Hardware and Embedded Systems | 2023年 / 2023卷 / 04期

基金：

中国国家自然科学基金;

关键词：

Automatic search; Differential fault analysis; Meet-in-the-middle;

D O I：

10.46586/tches.v2023.i4.1-31

中图分类号：

学科分类号：

摘要：

Fault analysis is a powerful technique to retrieve secret keys by exploiting side-channel information. Differential fault analysis (DFA) is one of the most powerful threats utilizing differential information between correct and faulty ciphertexts and can recover keys for symmetric-key cryptosystems efficiently. Since DFA usually targets the first or last few rounds of the block ciphers, some countermeasures against DFA only protect the first and last few rounds for efficiency. Therefore, to explore how many rounds DFA can affect is very important to make sure how many rounds to protect in practice. At CHES 2011, Derbez et al. proposed an improved DFA on AES based on MitM approach, which covers one more round than previous DFAs. To perform good (or optimal) MitM DFA on block ciphers, the good (or optimal) attack configurations should be identified, such as the location where the faults inject, the matching point with differential relationship, and the two independent computation paths where two independent subsets of the key are involved. In this paper, we formulate the essential ideas of the construction of the attack, and translate the problem of searching for the best MitM DFA into optimization problems under constraints in Mixed-Integer-Linear-Programming (MILP) models. With the models, we achieve more powerful and practical DFA attacks on SKINNY, CRAFT, QARMA, PRINCE, PRINCEv2, and MIDORI with faults injected in 1 to 9 earlier rounds than the best previous DFAs. © 2023, Ruhr-University of Bochum. All rights reserved.

引用

页码：1 / 31

页数：30