CN113206734B - Method for detecting and resisting differential fault attack - Google Patents
Method for detecting and resisting differential fault attack Download PDFInfo
- Publication number
- CN113206734B CN113206734B CN202110483728.4A CN202110483728A CN113206734B CN 113206734 B CN113206734 B CN 113206734B CN 202110483728 A CN202110483728 A CN 202110483728A CN 113206734 B CN113206734 B CN 113206734B
- Authority
- CN
- China
- Prior art keywords
- fault
- ciphertext
- redundant
- round
- differential
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active
Links
- 238000000034 method Methods 0.000 title claims abstract description 38
- 238000001514 detection method Methods 0.000 claims abstract description 47
- 208000015181 infectious disease Diseases 0.000 claims abstract description 34
- 238000002347 injection Methods 0.000 claims abstract description 23
- 239000007924 injection Substances 0.000 claims abstract description 23
- 238000000926 separation method Methods 0.000 claims description 3
- 238000010276 construction Methods 0.000 claims description 2
- 238000004364 calculation method Methods 0.000 description 4
- 230000009286 beneficial effect Effects 0.000 description 1
- 238000011156 evaluation Methods 0.000 description 1
- 230000001524 infective effect Effects 0.000 description 1
Images
Classifications
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L9/00—Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols
- H04L9/002—Countermeasures against attacks on cryptographic mechanisms
- H04L9/004—Countermeasures against attacks on cryptographic mechanisms for fault attacks
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
- H04L63/1466—Active attacks involving interception, injection, modification, spoofing of data unit addresses, e.g. hijacking, packet injection or TCP sequence number attacks
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L2463/00—Additional details relating to network architectures or network communication protocols for network security covered by H04L63/00
- H04L2463/146—Tracing the source of attacks
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- Computer Networks & Wireless Communication (AREA)
- Signal Processing (AREA)
- Computer Hardware Design (AREA)
- Computing Systems (AREA)
- General Engineering & Computer Science (AREA)
- Storage Device Security (AREA)
- Data Exchanges In Wide-Area Networks (AREA)
Abstract
The invention discloses a method for detecting and resisting differential fault attack, which comprises the steps of firstly constructing a redundant encryption module according to an original encryption module; secondly, detecting whether the redundant encryption module has fault injection or not based on a message authentication code method, comparing the redundant encryption module with the original encryption module, and detecting whether the original encryption module has fault injection or not, so as to finish double differential fault attack or differential fault attack detection; and finally, after the differential fault injection is determined, based on the ciphertext differential value and each round of ciphertext differential value of the infection function detection target algorithm, positioning a fault source injected by an attacker, and hiding the ciphertext differential value by using a random number and an infection function to realize protection. The method can quickly determine the specific position of the differential fault injected by the attacker in the target algorithm, and protects the injected differential fault by using the random number and the infection function, so that the attacker cannot attack the differential fault.
Description
Technical Field
The invention relates to the field of information security, in particular to a method for detecting and resisting differential fault attack.
Background
Fault Attack (FA) can enable an attacker to randomly select the value and the position of an injected Fault aiming at the password equipment, thereby greatly reducing the data volume required for acquiring the key information and realizing the target of the attacker in a shorter time. Differential Fault Attack (DFA) is a very effective Attack technique in FA, and mainly relies on malicious Fault injection during the execution of encryption equipment, and then related key information is derived by analyzing the difference between Fault output and non-Fault output, and the DFA has the characteristics of flexible Fault injection, high analysis efficiency, low Attack complexity and the like. How to design an effective protection method to resist the threat of such attacks and protect the password equipment is of great importance.
Over the past decade, many countermeasures have been proposed to protect the security of cryptographic devices against DFA attacks. For example, Beierle et al [1] propose a tunable block cipher algorithm CRAFT and use a tunable model to protect against differential fault attacks. Aghaie et al [2] propose a scheme based on bottom layer error detection coding to achieve the goal of hundreds of percent detection of faults. Feng et al [3] proposed an idea to separate the infective function from the unprotected cryptographic algorithm as an evaluation framework applicable to various infection countermeasures and attack scenarios. These protection strategies can be roughly classified into two types, i.e., detection-based protection strategies and infection-based protection strategies. The protection strategy based on detection mainly judges whether a fault is injected in the execution process of the cryptographic equipment by explicitly checking whether a difference value delta between a fault ciphertext and a non-fault ciphertext is equal to 0, if the fault is injected, the ciphertext difference value delta is not equal to 0, the detection strategy can inhibit output or randomize the output to prevent the cryptographic equipment from generating a wrong output value, and therefore the purpose of preventing an attacker from obtaining any valid information is achieved. The idea of detection is generally accomplished by knowledge of the coding and information theory, such as linear parity check, non-linear [ n, k ] coding, etc. However, the detection strategy is usually only specific to a certain target algorithm and has no generality. Infection countermeasures have been proposed to remedy this disadvantage of detection countermeasures, mainly by implicitly checking whether the ciphertext difference value Δ is equal to 0, and likewise Δ ≠ 0 implies faulty injection. In contrast, after the infection countermeasure detects a failure, an infection function is introduced to randomize the ciphertext differential value Δ and output the original value after the infection to an attacker, so that the attacker cannot perform DFA on the encryption device.
The working process of the infection scheme mainly relies on the (non-zero) difference between the actual and redundant calculations of the cryptographic algorithm. If both the actual calculation and the redundant calculation are affected by the same fault, the outputs of both calculations will be the same, i.e. the corresponding differential value Δ is 0. In this case, the infection scheme would assume that the encryption algorithm was not injecting a failure, and would output the failed ciphertext for use by an attacker. This type of failure can render the infection protection scheme ineffective, referred to as a double failure. Therefore, how to effectively detect the attack of the double differential fault, quickly find the fault source and protect the fault source is a problem to be solved urgently at present.
Reference documents:
[1]C.Beierle,G.Leander,A.Moradi,S.Rasoolzadeh.CRAFT:Lightweight Tweakable Block Cipher with Efficient Protection Against DFA Attacks[J].IACR Trans.Symmetric Cryptol.,2019(1)5-45。
[2]A.Aghaie,A.Moradi,S.Rasoolzadeh,A.R.Shahmirzadi,F.Schellenberg,T.Schneider.Impeccable Circuits[J].IEEE Transactions on Computers,2020,69(3)361-376。
[3]J.Feng,H.Chen,Y.Li,Z.P.Jiao,W.Xi.A Framework for Evaluation and Analysis on Infection Countermeasures Against Fault Attacks.IEEE Transactions on Information Forensics and Security,(2020)391-406。
disclosure of Invention
The invention aims to provide a novel method for detecting and resisting differential fault attack in a universal mode. The method can detect double differential fault attacks, and can locate and protect a fault source aiming at the differential fault attacks.
The technical scheme for realizing the purpose of the invention is as follows:
a method for detecting and defending against differential fault attacks, characterized in that the method comprises three parts:
(1) constructing redundancy;
constructing a redundant encryption module according to the original encryption module;
(2) double differential fault detection;
detecting whether the redundant encryption module has fault injection or not based on a message authentication code method, comparing the redundant encryption module with the original encryption module, and detecting whether the original encryption module has fault injection or not, so as to complete double differential fault attack or differential fault attack detection;
(3) positioning a fault source and protecting;
after the differential fault injection is determined, based on the ciphertext differential value and each round of ciphertext differential value of the infection function detection target algorithm, the fault source injected by an attacker is located, and the ciphertext differential value is hidden by using a random number and an infection function to realize protection.
The redundancy construction is that a certain block encryption algorithm E is completely copied to be an E ', namely the E is an original encryption module, and the E' is a redundant encryption module; e and E' are respectively input with the same plaintext P and key K for encryption, and the output original ciphertext is C-EK(P), the redundant ciphertext is C ═ E'K(P)。
The double differential fault detection adopts a message authentication code for detection, and the specific process is as follows:
(2.1) in order to detect whether fault injection exists in the redundant encryption, a detection module is added in the redundant encryption module and is used for detecting the message authentication code;
(2.2) before redundant encryption, the redundant encryption module calculates the message authentication code MAC of the plaintext P of E' according to the key K by adopting a Hash function, sends MAC (P) to the detection module, and the detection module receives and stores the MAC (P); the redundant encryption module combines the plaintext P and the MAC (P) together and takes the combined plaintext P and MAC (P) as x as input to carry out redundant encryption;
(2.3) the detection module acquires input data x ' subjected to redundant encryption from the redundant encryption module and performs data separation on the input data x ', and since whether the original plaintext information P is uncertain to change or not, the separated plaintext information is marked as P ', and the MAC value of P ' is calculated by adopting a hash function and a secret key K and is marked as MAC (P ');
(2.4) the detection module judges whether the MAC (P) value is consistent with the MAC (P ') value, if the MAC (P) value is the same with the MAC (P'), the operation is switched to (2.5); if the two are different, turning to (2.6);
(2.5) if MAC (P) ═ MAC (P ') indicates that the information P in the redundant cryptographic module has not been tampered and has not been failed, normal encryption is performed, and after the message authentication code is removed, the redundantly encrypted ciphertext C' ═ E 'is output'K(P), turn (2.7);
(2.6) if MAC (P) ≠ MAC (P ') indicates that the information P in the redundant cryptographic module has been tampered with, and if there is a failure in the redundant cryptographic module, the plaintext information with the failure is recorded as P ', and a redundantly encrypted ciphertext C ' ═ E ' is output 'K(P'), go (2.11);
(2.7) converting the original encrypted ciphertext C to EK(P) and redundant encrypted ciphertext C '═ E'K(P) XOR-ing to obtain ciphertext difference value
C is an original ciphertext, and C' is a redundant ciphertext;
(2.8) judging whether delta is 0, and if delta is 0, rotating (2.9); if Δ ≠ 0, turn (2.10);
(2.9) if Δ is 0, indicating that no fault is injected in the original encryption algorithm E, and ending the detection;
(2.10) if the delta is not equal to 0, indicating that a fault is injected in the original encryption algorithm E, and turning to (2.15);
(2.11) converting the original encrypted ciphertext C to EK(P) and redundant encrypted ciphertext C '═ E'K(P') XOR-ing the ciphertext difference values to obtain ciphertext difference values
(2.12) judging whether delta is 0, and if delta is 0, rotating (2.13); if Δ ≠ 0, go (2.14);
(2.13) if Δ is 0, indicating that the same fault as the redundant encryption algorithm E' is injected into the original encryption algorithm E, that is, detecting a double fault, and ending the detection;
(2.14) if the delta is not equal to 0, indicating that no fault is injected in the original encryption algorithm E, and the fault only exists in the redundant encryption module E';
and (2.15) positioning the fault source and protecting operation, and finishing detection.
Aiming at existing fault injection, the fault injection needs to be positioned, and the fault source and protection are positioned, the specific process is as follows:
(3.1) setting the total round number of the encryption algorithm E as r rounds, sequentially detecting each round of the encryption algorithm E from high to low, and setting the detected round number as i, wherein i is r-1;
(3.2) calculating ciphertext difference value of the ith round
Wherein, CiThe encrypted ciphertext of the ith round of the original encryption algorithm E, Ci'is the encrypted ciphertext of the ith round of the redundant encryption algorithm E';
(3.3) determination of ΔiIf it is 0, if Δ i0, turn (3.4); if ΔiNot equal to 0, turn (3.5);
(3.4) if.DELTA.i0, indicating that the fault injected is in round i +1, revolution (3.7);
(3.5) if.DELTA.iNot equal to 0, to prevent attackers from obtaining ciphertext difference value ΔiCarrying out differential fault attack and infecting the ciphertext of the ith round with a value
Outputting and storing, wherein CiFor the correctly encrypted ciphertext of the ith round of the original encryption algorithm E, Z (-) is an infection function, ΔiIs the ciphertext differential value of the ith round, alphaiAnd betaiThe two different random values are respectively of the ith round, and i represents that the number of the detected rounds is the ith round;
(3.6) converting i to i-1 to (3.2);
(3.7) ciphertext differential value Delta according to round i +1i+1Is bit queried to find Δi+1The bit n of which is not 0 is the encryption algorithmE, determining a positioning result according to the bit position injected with the fault;
(3.8) outputting a positioning result, namely, the fault is positioned at the nth bit of the (i + 1) th round;
(3.9) to avoid attackers obtaining ciphertext differential value delta after fault injectioni+1Using random numbers and an infection function vs. deltai+1Hiding and outputting the ciphertext infection value of the (i + 1) th round
Wherein, Ci+1The ciphertext correctly encrypted in round i +1 of the original encryption algorithm E, Z (-) is an infection function, Deltai+1The ciphertext differential value, alpha, of the original encryption algorithm E and the redundant encryption algorithm E' in the (i + 1) th roundi+1And betai+1The two different random values of the (i + 1) th round are respectively, and for the ciphertext infection value output after being hidden, an attacker cannot carry out differential fault attack, and the positioning process is ended.
The invention has the beneficial effects that:
(1) the method can effectively detect the attack of the double differential fault.
(2) The method can quickly determine the specific position of the differential fault injected by the attacker in the target algorithm, and protects the injected differential fault by using the random number and the infection function, so that the attacker cannot attack the differential fault.
(3) The method of the invention has relatively small calculated amount under the condition of single data block.
(4) The method has high accuracy and universality, and is suitable for all encryption algorithms.
Drawings
FIG. 1 is a flow chart of a method of detecting and defending against differential fault attacks in accordance with the present invention;
FIG. 2 is a flow chart of double differential fault detection in the method of the present invention;
FIG. 3 is a flow chart of the method of locating a fault source and protection of the present invention.
Detailed Description
The present invention will be described in further detail with reference to the following examples and drawings, but the present invention is not limited thereto.
Examples
Referring to fig. 1, the invention is a method for detecting and defending differential fault attack, the method includes three parts:
(1) constructing redundancy; constructing a redundant encryption module according to the original encryption module;
(2) double differential fault detection;
detecting whether the redundant encryption module has fault injection or not based on a message authentication code method, comparing the redundant encryption module with the original encryption module, and detecting whether the original encryption module has fault injection or not, so as to complete double differential fault attack or differential fault attack detection;
(3) positioning a fault source and protecting;
after the differential fault injection is determined, based on the ciphertext differential value and each round of ciphertext differential value of the infection function detection target algorithm, the fault source injected by an attacker is located, and the ciphertext differential value is hidden by using a random number and an infection function to realize protection.
Referring to fig. 2, the double differential fault detection is performed by using a message authentication code, and the specific process is as follows:
(2.1) in order to detect whether fault injection exists in the redundant encryption, a detection module is added in the redundant encryption module and is used for detecting the message authentication code;
(2.2) before redundant encryption, the redundant encryption module calculates the message authentication code MAC of the plaintext P of E' according to the key K by adopting a Hash function, sends MAC (P) to the detection module, and the detection module receives and stores the MAC (P); the redundant encryption module combines the plaintext P and the MAC (P) together and takes the combined plaintext P and MAC (P) as x as input to carry out redundant encryption;
(2.3) the detection module acquires input data x ' subjected to redundant encryption from the redundant encryption module and performs data separation on the input data x ', and since whether the original plaintext information P is uncertain to change or not, the separated plaintext information is marked as P ', and the MAC value of P ' is calculated by adopting a hash function and a secret key K and is marked as MAC (P ');
(2.4) the detection module judges whether the MAC (P) value is consistent with the MAC (P ') value, if the MAC (P) value is the same with the MAC (P'), the operation is switched to (2.5); if the two are different, turning to (2.6);
(2.5) if MAC (P) ═ MAC (P ') indicates that the information P in the redundant cryptographic module has not been tampered and has not been failed, normal encryption is performed, and after the message authentication code is removed, the redundantly encrypted ciphertext C' ═ E 'is output'K(P), turn (2.7);
(2.6) if MAC (P) ≠ MAC (P ') indicates that the information P in the redundant cryptographic module has been tampered with, and if there is a failure in the redundant cryptographic module, the plaintext information with the failure is recorded as P ', and a redundantly encrypted ciphertext C ' ═ E ' is output 'K(P'), go (2.11);
(2.7) converting the original encrypted ciphertext C to EK(P) and redundant encrypted ciphertext C '═ E'K(P) XOR-ing to obtain ciphertext difference value
C is an original ciphertext, and C' is a redundant ciphertext;
(2.8) judging whether delta is 0, and if delta is 0, rotating (2.9); if Δ ≠ 0, turn (2.10);
(2.9) if Δ is 0, indicating that no fault is injected in the original encryption algorithm E, and ending the detection;
(2.10) if the delta is not equal to 0, indicating that a fault is injected in the original encryption algorithm E, and turning to (2.15);
(2.11) converting the original encrypted ciphertext C to EK(P) and redundant encrypted ciphertext C '═ E'K(P') XOR-ing the ciphertext difference values to obtain ciphertext difference values
(2.12) judging whether delta is 0, and if delta is 0, rotating (2.13); if Δ ≠ 0, go (2.14);
(2.13) if Δ is 0, indicating that the same fault as the redundant encryption algorithm E' is injected into the original encryption algorithm E, that is, detecting a double fault, and ending the detection;
(2.14) if the delta is not equal to 0, indicating that no fault is injected in the original encryption algorithm E, and the fault only exists in the redundant encryption module E';
and (2.15) positioning the fault source and protecting operation, and finishing detection.
Referring to fig. 3, the fault source and protection are located, and the specific process is as follows:
(3.1) setting the total round number of the encryption algorithm E as r rounds, sequentially detecting each round of the encryption algorithm E from high to low, and setting the detected round number as i, wherein i is r-1;
(3.2) calculating ciphertext difference value of the ith round
Wherein, CiThe encrypted ciphertext of the ith round of the original encryption algorithm E, Ci'is the encrypted ciphertext of the ith round of the redundant encryption algorithm E';
(3.3) determination of ΔiIf it is 0, if Δ i0, turn (3.4); if ΔiNot equal to 0, turn (3.5);
(3.4) if.DELTA.i0, indicating that the fault injected is in round i +1, revolution (3.7);
(3.5) if.DELTA.iNot equal to 0, to prevent attackers from obtaining ciphertext difference value ΔiCarrying out differential fault attack and infecting the ciphertext of the ith round with a value
Outputting and storing, wherein CiFor the correctly encrypted ciphertext of the ith round of the original encryption algorithm E, Z (-) is an infection function, ΔiIs the ciphertext differential value of the ith round, alphaiAnd betaiThe two different random values are respectively of the ith round, and i represents that the number of the detected rounds is the ith round;
(3.6) converting i to i-1 to (3.2);
(3.7) ciphertext differential value Delta according to round i +1i+1Is bit queried to find Δi+1The bit n which is not 0 in the encryption algorithm E is the bit with the fault injected in the encryption algorithm E, and a positioning result is determined;
(3.8) outputting a positioning result, namely, the fault is positioned at the nth bit of the (i + 1) th round;
(3.9) to avoid attackers obtaining ciphertext differential value delta after fault injectioni+1Using random numbers and an infection functionFor ai+1Hiding and outputting the ciphertext infection value of the (i + 1) th round
Wherein, Ci+1The ciphertext correctly encrypted in round i +1 of the original encryption algorithm E, Z (-) is an infection function, Deltai+1The ciphertext differential value, alpha, of the original encryption algorithm E and the redundant encryption algorithm E' in the (i + 1) th roundi+1And betai+1The two different random values of the (i + 1) th round are respectively, and for the ciphertext infection value output after being hidden, an attacker cannot carry out differential fault attack, and the positioning process is ended.
Claims (1)
1. A method for detecting and defending against differential fault attacks, characterized in that the method comprises three parts:
(1) constructing redundancy;
constructing a redundant encryption module according to the original encryption module;
(2) double differential fault detection;
detecting whether the redundant encryption module has fault injection or not based on a message authentication code method, comparing the redundant encryption module with the original encryption module, and detecting whether the original encryption module has fault injection or not, so as to complete double differential fault attack or differential fault attack detection;
(3) positioning a fault source and protecting;
after the differential fault injection is determined, based on the ciphertext differential value and each round of ciphertext differential value of an infection function detection target algorithm, locating a fault source injected by an attacker, and hiding the ciphertext differential value by using a random number and an infection function to realize protection;
the redundancy construction is that a certain block encryption algorithm E is completely copied to be an E ', namely the E is an original encryption module, and the E' is a redundant encryption module; e and E' are respectively input with the same plaintext P and key K for encryption, and the output original ciphertext is C-EK(P), the redundant ciphertext is C ═ E'K(P)；
The double differential fault detection comprises the following specific processes:
(2.1) in order to detect whether fault injection exists in the redundant encryption, a detection module is added in the redundant encryption module and is used for detecting the message authentication code;
(2.2) before redundant encryption, the redundant encryption module calculates the message authentication code MAC of the plaintext P of E' according to the key K by adopting a Hash function, sends MAC (P) to the detection module, and the detection module receives and stores the MAC (P); the redundant encryption module combines the plaintext P and the MAC (P) together and takes the combined plaintext P and MAC (P) as x as input to carry out redundant encryption;
(2.3) the detection module acquires input data x ' subjected to redundant encryption from the redundant encryption module and performs data separation on the input data x ', and since whether the original plaintext information P is uncertain to change or not, the separated plaintext information is marked as P ', and the MAC value of P ' is calculated by adopting a hash function and a secret key K and is marked as MAC (P ');
(2.4) the detection module judges whether the MAC (P) value is consistent with the MAC (P ') value, if the MAC (P) value is the same with the MAC (P'), the operation is switched to (2.5); if the two are different, turning to (2.6);
(2.5) if MAC (P) ═ MAC (P ') indicates that the information P in the redundant cryptographic module has not been tampered and has not been failed, normal encryption is performed, and after the message authentication code is removed, the redundantly encrypted ciphertext C' ═ E 'is output'K(P), turn (2.7);
(2.6) if MAC (P) ≠ MAC (P ') indicates that the information P in the redundant cryptographic module has been tampered with, and if there is a failure in the redundant cryptographic module, the plaintext information with the failure is recorded as P ', and a redundantly encrypted ciphertext C ' ═ E ' is output 'K(P'), go (2.11);
(2.7) converting the original encrypted ciphertext C to EK(P) and redundant encrypted ciphertext C '═ E'K(P) XOR-ing to obtain ciphertext difference value
C is an original ciphertext, and C' is a redundant ciphertext;
(2.8) judging whether delta is 0, and if delta is 0, rotating (2.9); if Δ ≠ 0, turn (2.10);
(2.9) if Δ is 0, indicating that no fault is injected in the original encryption algorithm E, and ending the detection;
(2.10) if delta is not equal to 0, indicating that a fault is injected in the original encryption algorithm E, and entering an operation (3) of positioning a fault source and protecting;
(2.11) converting the original encrypted ciphertext C to EK(P) and redundant encrypted ciphertext C '═ E'K(P') XOR-ing the ciphertext difference values to obtain ciphertext difference values
(2.12) judging whether delta is 0, and if delta is 0, rotating (2.13); if Δ ≠ 0, go (2.14);
(2.13) if Δ is 0, indicating that the same fault as the redundant encryption algorithm E' is injected into the original encryption algorithm E, that is, detecting a double fault, and ending the detection;
(2.14) if delta is not equal to 0, indicating that no fault is injected in the original encryption algorithm E, and the fault only exists in the redundant encryption module E', and entering an operation (3) of positioning a fault source and protecting;
the fault source positioning and protection method specifically comprises the following processes:
(3.1) setting the total round number of the encryption algorithm E as r rounds, sequentially detecting each round of the encryption algorithm E from high to low, and setting the detected round number as i, wherein i is r-1; (3.2) calculating ciphertext difference value of the ith round
Wherein, CiThe encrypted ciphertext of the ith round of the original encryption algorithm E, Ci'is the encrypted ciphertext of the ith round of the redundant encryption algorithm E';
(3.3) determination of ΔiIf it is 0, if Δi0, turn (3.4); if ΔiNot equal to 0, turn (3.5);
(3.4) if.DELTA.i0, indicating that the fault injected is in round i +1, revolution (3.7);
(3.5) if.DELTA.iNot equal to 0, to prevent attackers from obtaining ciphertext difference value ΔiCarrying out differential fault attack and infecting the ciphertext of the ith round with a value
Outputting and storing, wherein CiFor the correctly encrypted ciphertext of the ith round of the original encryption algorithm E, Z (-) is an infection function, ΔiIs the ciphertext differential value of the ith round, alphaiAnd betaiThe two different random values are respectively of the ith round, and i represents that the number of the detected rounds is the ith round;
(3.6) converting i to i-1 to (3.2);
(3.7) ciphertext differential value Delta according to round i +1i+1Is bit queried to find Δi+1The bit n which is not 0 in the encryption algorithm E is the bit with the fault injected in the encryption algorithm E, and a positioning result is determined;
(3.8) outputting a positioning result, namely, the fault is positioned at the nth bit of the (i + 1) th round;
(3.9) to avoid attackers obtaining ciphertext differential value delta after fault injectioni+1Using random numbers and an infection function vs. deltai+1Hiding and outputting the ciphertext infection value of the (i + 1) th round
Wherein, Ci+1The ciphertext correctly encrypted in round i +1 of the original encryption algorithm E, Z (-) is an infection function, Deltai+1The ciphertext differential value, alpha, of the original encryption algorithm E and the redundant encryption algorithm E' in the (i + 1) th roundi+1And betai+1The two different random values of the (i + 1) th round are respectively, and for the ciphertext infection value output after being hidden, an attacker cannot carry out differential fault attack, and the positioning process is ended.
Priority Applications (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110483728.4A CN113206734B (en) | 2021-04-30 | 2021-04-30 | Method for detecting and resisting differential fault attack |
Applications Claiming Priority (1)
| Application Number | Priority Date | Filing Date | Title |
|---|---|---|---|
| CN202110483728.4A CN113206734B (en) | 2021-04-30 | 2021-04-30 | Method for detecting and resisting differential fault attack |
Publications (2)
| Publication Number | Publication Date |
|---|---|
| CN113206734A CN113206734A (en) | 2021-08-03 |
| CN113206734B true CN113206734B (en) | 2022-04-29 |
Family
ID=77030142
Family Applications (1)
| Application Number | Title | Priority Date | Filing Date |
|---|---|---|---|
| CN202110483728.4A Active CN113206734B (en) | 2021-04-30 | 2021-04-30 | Method for detecting and resisting differential fault attack |
Country Status (1)
| Country | Link |
|---|---|
| CN (1) | CN113206734B (en) |
Families Citing this family (3)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN114070560B (en) * | 2022-01-13 | 2022-06-24 | 浙江大学 | Algebraic persistent fault analysis method and device for block cipher |
| CN115795486B (en) * | 2023-02-07 | 2023-04-18 | 山东大学 | Fault injection protection method based on binary system rewriting |
| CN116232561B (en) * | 2023-05-09 | 2023-08-25 | 杭州海康威视数字技术股份有限公司 | Redundant encryption optimization method, device and equipment for resisting differential fault attack |
Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105591734A (en) * | 2015-04-24 | 2016-05-18 | 桂林电子科技大学 | White-box cryptograph non-linear encoding protection method based on table lookup |
| CN109842483A (en) * | 2019-03-18 | 2019-06-04 | 东华大学 | A method of detection AES-JAMBU resists differential fault attack |
| CN110401627A (en) * | 2019-01-31 | 2019-11-01 | 中国科学院软件研究所 | A kind of resisting differential fault attacks security assessment method and system suitable for block cipher protection against infection |
| CN112468283A (en) * | 2020-11-25 | 2021-03-09 | 东华大学 | Method for detecting iFeed [ AES ] algorithm to resist differential fault attack |
| CN112511291A (en) * | 2020-11-25 | 2021-03-16 | 东华大学 | Method for detecting OCB authentication encryption algorithm to resist differential fault attack |
Family Cites Families (2)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105227295A (en) * | 2015-10-10 | 2016-01-06 | 成都芯安尤里卡信息科技有限公司 | A kind of Differential fault injection attacks for SMS4 cryptographic algorithm |
| CN112532374A (en) * | 2020-11-25 | 2021-03-19 | 东华大学 | Method for detecting SILC authentication encryption algorithm to resist differential fault attack |
-
2021
- 2021-04-30 CN CN202110483728.4A patent/CN113206734B/en active Active
Patent Citations (5)
| Publication number | Priority date | Publication date | Assignee | Title |
|---|---|---|---|---|
| CN105591734A (en) * | 2015-04-24 | 2016-05-18 | 桂林电子科技大学 | White-box cryptograph non-linear encoding protection method based on table lookup |
| CN110401627A (en) * | 2019-01-31 | 2019-11-01 | 中国科学院软件研究所 | A kind of resisting differential fault attacks security assessment method and system suitable for block cipher protection against infection |
| CN109842483A (en) * | 2019-03-18 | 2019-06-04 | 东华大学 | A method of detection AES-JAMBU resists differential fault attack |
| CN112468283A (en) * | 2020-11-25 | 2021-03-09 | 东华大学 | Method for detecting iFeed [ AES ] algorithm to resist differential fault attack |
| CN112511291A (en) * | 2020-11-25 | 2021-03-16 | 东华大学 | Method for detecting OCB authentication encryption algorithm to resist differential fault attack |
Non-Patent Citations (6)
| Title |
|---|
| A Framework for Evaluation and Analysis on Infection Countermeasures Against Fault Attacks;Jingyi Feng ect.;《IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY》;20190320;全文 * |
| Design and Analysis of a Distributed and Fair Access (DFA) MAC Protocol for Multihop Wireless Networks;Lei Pan, Xiaojun Cao, and Hongyi Wu;《IEEE TRANSACTIONS ON WIRELESS COMMUNICATIONS》;20090526;全文 * |
| To Infect or Not to Infect: A Critical Analysis of Infective Countermeasures in Fault Attacks;Anubhab Baksi;《Journal of Cryptographic Engineering》;20200523;全文 * |
| 分组密码算法抗功耗攻击和故障攻击的方法;张海峰，于艳艳;《电子技术应用》;20150521;全文 * |
| 物联网环境中LED轻量级密码算法的统计故障分析研究;李玮等;《计算机研究与发展》;20171015(第10期);全文 * |
| 轻量级分组密码算法TWINE差分故障攻击的改进;高杨等;《通信学报》;20171130;全文 * |
Also Published As
| Publication number | Publication date |
|---|---|
| CN113206734A (en) | 2021-08-03 |
Similar Documents
| Publication | Publication Date | Title |
|---|---|---|
| CN113206734B (en) | Method for detecting and resisting differential fault attack | |
| Malkin et al. | A comparative cost/security analysis of fault attack countermeasures | |
| Dobraunig et al. | SIFA: exploiting ineffective fault inductions on symmetric cryptography | |
| Lomné et al. | On the need of randomness in fault attack countermeasures-application to AES | |
| Tupsamudre et al. | Destroying fault invariant with randomization: A countermeasure for aes against differential fault attacks | |
| CN110401627B (en) | Differential fault attack resistance security evaluation method and system suitable for block cipher algorithm infection protection | |
| Pahlevanzadeh et al. | Assessing CPA resistance of AES with different fault tolerance mechanisms | |
| Ramezanpour et al. | A statistical fault analysis methodology for the ascon authenticated cipher | |
| Carlet et al. | Analysis of the algebraic side channel attack | |
| Clavier et al. | Reverse engineering of a secret AES-like cipher by ineffective fault analysis | |
| D'Anvers et al. | Higher-order masked ciphertext comparison for lattice-based cryptography | |
| WO2010046251A1 (en) | Cryptographic algorithm fault protections | |
| CN106936563B (en) | Method and system for protecting cryptographic operations | |
| Clavier et al. | Fault analysis study of IDEA | |
| EP3697021B1 (en) | Secure and encrypted logging systems and methods with data recovery | |
| Battistello et al. | A note on the security of CHES 2014 symmetric infective countermeasure | |
| Baksi et al. | A Novel Duplication-Based Countermeasure to Statistical Ineffective Fault Analysis | |
| Gruber et al. | Statistical ineffective fault analysis of GIMLI | |
| Feng et al. | A framework for evaluation and analysis on infection countermeasures against fault attacks | |
| Clavier et al. | Complete reverse-engineering of AES-like block ciphers by SCARE and FIRE attacks | |
| Potestad-Ordóńez et al. | Hamming-code based fault detection design methodology for block ciphers | |
| Dofe et al. | Strengthening SIMON implementation against intelligent fault attacks | |
| US7826610B2 (en) | Method to secure an electronic assembly against attacks by error introduction | |
| Ramezanpour et al. | Fault intensity map analysis with neural network key distinguisher | |
| Breunesse et al. | Towards fully automated analysis of whiteboxes: perfect dimensionality reduction for perfect leakage |
Legal Events
| Date | Code | Title | Description |
|---|---|---|---|
| PB01 | Publication | ||
| PB01 | Publication | ||
| SE01 | Entry into force of request for substantive examination | ||
| SE01 | Entry into force of request for substantive examination | ||
| GR01 | Patent grant | ||
| GR01 | Patent grant | ||
| EE01 | Entry into force of recordation of patent licensing contract | ||
| EE01 | Entry into force of recordation of patent licensing contract |
Application publication date: 20210803 Assignee: Guangxi Huanzhi Technology Co.,Ltd. Assignor: GUILIN University OF ELECTRONIC TECHNOLOGY Contract record no.: X2023980046248 Denomination of invention: A method for detecting and resisting differential fault attacks Granted publication date: 20220429 License type: Common License Record date: 20231108 |