New differential fault analysis on AES key schedule: two faults are enough
(2008) Smart Card Research and Advanced Applications. 8th IFIP WG 8.8/11.2 International Conference, CARDIS 2008 — Location: London, UK (8.September.2008)
Files
No attached file found for this publication.
Details
- Authors
- Abstract
- In this paper we show a new differential fault analysis (DFA) on the AES-128 key scheduling process. We can obtain 96 bits of the key with 2 pairs of correct and faulty ciphertexts enabling an easy exhaustive key search of 232 keys. Furthermore we can retrieve the entire 128 bits with 4 pairs. To the authors' best knowledge, it is the smallest number of pairs to find the entire AES-128 key with a fault attack on the key scheduling process. Up to now 7 pairs by Takahashi et al. were the best. By corrupting state, not the key schedule, Piret and Quisquater showed 2 pairs are enough to break AES-128 in 2003. The advantage of DFA on the key schedule is that it can defeat some fault-protected AES implementations where the round keys are not rescheduled prior to the check. We implemented our algorithm on a 3.2 GHz Pentium 4 PC. With 4 pairs of correct and faulty ciphertexts, we could find 128 bits less than 2.3 seconds.
- Affiliations
Citations
Chong Hee Kim, & Quisquater, J.-J. (2008). New differential fault analysis on AES key schedule: two faults are enough. In Grimaud, G.; Standaert, F.-X.; (ed.), Smart Card Research and Advanced Applications. 8th IFIP WG 8.8/11.2 International Conference, CARDIS 2008 (p. p. 48-60). Springer-verlag. https://hdl.handle.net/2078.5/219050