fault attacks on electronic circuits - télécom paristech · fault attacks on electronic circuits...
TRANSCRIPT
IntroductionFault Induction Attacks: FA and DFA on RSA & DES
DFA on AESCountermeasures
Fault Attacks on Electronic Circuits
Jean-Luc DANGER, Sylvain GUILLEY< [email protected]>
Master SETIInstitut TELECOM / TELECOM ParisTech
Cours SETI Fault attacks — 1
IntroductionFault Induction Attacks: FA and DFA on RSA & DES
DFA on AESCountermeasures
Presentation OutlinePhysical Faults
1 IntroductionPresentation OutlinePhysical Faults
2 Fault Induction Attacks: FA and DFA on RSA & DESThe Differential Fault AttackFaults Models and Tolerance
3 DFA on AESTheoretical Fault AttacksPractical AttacksFault Sensitivity Analysis (FSA)
4 Countermeasures
Cours SETI Fault attacks — 2
IntroductionFault Induction Attacks: FA and DFA on RSA & DES
DFA on AESCountermeasures
Presentation OutlinePhysical Faults
How Attackers Actually Inject Faults
Glitch Attacks on the Power or the Clock (synchronouscircuits)
High Energy Particles. However, they can be replaced by:
Focused Laser (spot ø ∼ 1 µm), front-side or back-side
Using bugged HW/SW Components (Intel R© Pentium flawedfloating point division, back to 1994)
Eddy currents ≈ EMI (ElectroMagnetic Injection)
etc.
See also: Fault Diagnosis and Tolerance in Cryptography (FDTC)
Cours SETI Fault attacks — 3
Realignement
[WISTP ’11, Guilley et al.] [GKLD11]2014 All rights reserved | Confidential document, property of Secure-IC S.A.S.
IntroductionFault Induction Attacks: FA and DFA on RSA & DES
DFA on AESCountermeasures
Presentation OutlinePhysical Faults
Laser station
Cours SETI Fault attacks — 5
IntroductionFault Induction Attacks: FA and DFA on RSA & DES
DFA on AESCountermeasures
Presentation OutlinePhysical Faults
[1/3] Example @ TELECOM-ParisTech . . . . . . . . . . . . . PCB
Cours SETI Fault attacks — 6
IntroductionFault Induction Attacks: FA and DFA on RSA & DES
DFA on AESCountermeasures
Presentation OutlinePhysical Faults
[2/3] Example @ TELECOM-ParisTech . . . . . . . . . . . . Setup
Cours SETI Fault attacks — 7
IntroductionFault Induction Attacks: FA and DFA on RSA & DES
DFA on AESCountermeasures
Presentation OutlinePhysical Faults
[3/3] Example @ TELECOM-ParisTech . . . . . . . . . . . . . ASIC
Cours SETI Fault attacks — 8
IntroductionFault Induction Attacks: FA and DFA on RSA & DES
DFA on AESCountermeasures
Presentation OutlinePhysical Faults
[3/3] Example @ TELECOM-ParisTech . . . . . . . . . . . . . ASIC
Cours SETI Fault attacks — 9
IntroductionFault Induction Attacks: FA and DFA on RSA & DES
DFA on AESCountermeasures
Presentation OutlinePhysical Faults
EMI disturbance system
Cours SETI Fault attacks — 10
IntroductionFault Induction Attacks: FA and DFA on RSA & DES
DFA on AESCountermeasures
Presentation OutlinePhysical Faults
Example of setup for EMI
Cours SETI Fault attacks — 11
IntroductionFault Induction Attacks: FA and DFA on RSA & DES
DFA on AESCountermeasures
Presentation OutlinePhysical Faults
Example of setup for EMI
Cours SETI Fault attacks — 12
IntroductionFault Induction Attacks: FA and DFA on RSA & DES
DFA on AESCountermeasures
Presentation OutlinePhysical Faults
Flipping Bits in Memory Without Accessing Them
http://users.ece.cmu.edu/~yoonguk/papers/kim-isca14.
pdf [KDK+14] — RowHammer.
Cours SETI Fault attacks — 13
IntroductionFault Induction Attacks: FA and DFA on RSA & DES
DFA on AESCountermeasures
Presentation OutlinePhysical Faults
Other faults on the RAM [Ver06]
Thermo--meter
Hot
Air
Gun
RAM module
Motherboard
PC case
Cours SETI Fault attacks — 14
IntroductionFault Induction Attacks: FA and DFA on RSA & DES
DFA on AESCountermeasures
Presentation OutlinePhysical Faults
Other faults on the RAM [Ver06]
Hot air gun ON
Hot air gun OFF
Cours SETI Fault attacks — 15
IntroductionFault Induction Attacks: FA and DFA on RSA & DES
DFA on AESCountermeasures
The Differential Fault AttackFaults Models and Tolerance
The So-Called “Bellcore” Attack
Bellcore = Bell Communications Research
Three employees of Bellcore (and Pr. @ Stanford) find anattack that breaks RSA by injecting a single fault.
Reference: “On the importance of checking cryptographicprotocols for faults”. by D. Boneh, R. DeMillo, and R. Lipton.Journal of Cryptology, Springer-Verlag, Vol. 14, No. 2, pp.101–119, 2001. Extended abstract in Proceedings ofEurocrypt’97, Lecture Notes in Computer Science, Vol. 1233,Springer-Verlag, pp. 37–51, 1997.
http://crypto.stanford.edu/~dabo/papers/faults.ps.gz
Cours SETI Fault attacks — 16
IntroductionFault Induction Attacks: FA and DFA on RSA & DES
DFA on AESCountermeasures
The Differential Fault AttackFaults Models and Tolerance
Bellcore attack against RSA signatures with CRT
Signature S of message x : S.
= xd mod N, with N = p · q.
Using Chinese Remainder Theorem (CRT), the signature canbe simplified as:
S1 = xd mod (p−1) mod p andS2 = xd mod (q−1) mod q, both operations working on halfbitwidth.
The signature is obtained back using the two constants:{a = 0 mod qa = 1 mod p
and
{b = 1 mod qb = 0 mod p
S = a · S1 + b · S2 mod N.
Now, if S1 happens to be faulty: S1 → S1 for whatever reason,
gcd(S − S ,N) = gcd(a · (S1 − S1),N) = q.
Cours SETI Fault attacks — 17
IntroductionFault Induction Attacks: FA and DFA on RSA & DES
DFA on AESCountermeasures
The Differential Fault AttackFaults Models and Tolerance
The Almost Universal Differential Fault Attack
Bellcore attack targets public key cryptosystems
It needs algebraic properties to work
DFA targets almost whatever algorithm (known or evenunknown)
It works on complex bit operations, such as the ones involvedin secret key cryptographyIt is demonstrated on DES
Reference: “Differential Fault Analysis of Secret KeyCryptosystems”, by Eli Biham, Adi Shamir, CRYPTO 1997,LNCS 1294, pp. 513–525.
Cours SETI Fault attacks — 18
IntroductionFault Induction Attacks: FA and DFA on RSA & DES
DFA on AESCountermeasures
The Differential Fault AttackFaults Models and Tolerance
DFA Attack Setting
L15 R15
P S E
32 48 48 3232
32 32
K16
L14 R14
P S E
32 48 48 3232
32 32
K15
Round 16
Round 15
Ciphertext knownby the attacker
64
64
R16 L16
FP
32 32
DFA Assumptions
Unrolled implementation.
Single bit-flips on any rightregister Ri , for i ∈ [1, 16].
Ciphertext-only attack.
DES Properties
All the DES constitutiveboxes, but the S, are linear:f (x ⊕ a) = f (x)⊕ f (a), forf ∈ {Id,P,E,FP}.L16 = R15.
Cours SETI Fault attacks — 19
IntroductionFault Induction Attacks: FA and DFA on RSA & DES
DFA on AESCountermeasures
The Differential Fault AttackFaults Models and Tolerance
One Fault Occurs in R15
L14 R14
L15 R15
R16 L16
FP
P S E
K15
P S E
K160↔1
What Has Happened?
Bit b ∈ [1, 32] of R15 is flipped.
Attack Scenario
Find b by looking in L16.
Deduce which Si , i ∈ [1, 8],(there can be two of them)has output a wrong value.
Solve the equation couple:{R16 = L15⊕Si (K16⊕R15),
R16 = L15⊕Si (K16⊕R15).
It has ≈ four 6-bit solutions.
Cours SETI Fault attacks — 20
IntroductionFault Induction Attacks: FA and DFA on RSA & DES
DFA on AESCountermeasures
The Differential Fault AttackFaults Models and Tolerance
One Fault Occurs in R14
L14 R14
L15 R15
R16 L16
FP
P S E
K15
P S E
K16Round 16
Round 15 0↔1
What Has Happened?
Bit b ∈ [1, 32] of R14 is flipped.
Attack Scenario
Previous attack on R15
allowed a straightforwardsubkey K16 retrieval at theinput of (b − 1)/8th S-box.
Current attack requires adifferential analysis of thelast two rounds of DES.
Details to come. . .
Cours SETI Fault attacks — 21
IntroductionFault Induction Attacks: FA and DFA on RSA & DES
DFA on AESCountermeasures
The Differential Fault AttackFaults Models and Tolerance
Solving the “R14 bit flip” plot (1/2)
Notations
Tilded symbols, e.g. L16, denote faulted quantities.
R14⊕ R14 = 00 · · · 010 · · · 00.
= 1b, the “1” lying at position b.
Which bit b was flipped?
Notice that ∆.
= L16 ⊕ L16 is also the difference at the outputof S, at round 15.
For each S-box i , Si (x)⊕ Si (x ⊕ 1b) = ∆, x being theunknown value (R14 ⊕ K15) [8·i , 8·(i + 1)[, has few solutions b.
Validate potential b by verifying that ∆ passed through S, at
round 16, can generate the difference R16 ⊕(
R16 ⊕ 1b
).
Cours SETI Fault attacks — 22
IntroductionFault Induction Attacks: FA and DFA on RSA & DES
DFA on AESCountermeasures
The Differential Fault AttackFaults Models and Tolerance
Solving the “R14 bit flip” plot (2/2)
Retrieving Information on K16 subkey
Now that flipped bit b in R14 is known, the differences beforeand after S-boxes in round 16 are known.
This property allows to eliminate many subkeys K16 6-bitparts at the input of activated S-boxes (6 out of 8.)
Attack Extension
Basically the same differential attack can be used if the erroroccurs in round 14 (but not higher. . . ).
Not surprisingly, Eli Biham and Adi Shamir, inceptors of theDFA, are also the fathers of the differential cryptanalysis.
7→ “Differential Cryptanalysis of the Full 16-Round DES”, CS 708,
December 1991, Proceedings of Crypto’92, LNCS 740.
Cours SETI Fault attacks — 23
IntroductionFault Induction Attacks: FA and DFA on RSA & DES
DFA on AESCountermeasures
The Differential Fault AttackFaults Models and Tolerance
The DFA Efficiency
A Powerful Attack!
According to authors, between 50 and 200 faults on whateverround are required to fully expose the last round subkey.
Once K16 is known, the key K can be retrieved by anexhaustive search attacks on the 56− 48 = 8 remaining bits.
Generalization
If K16 is known, the DFA can be applied to the 15-round DESvariant. . .
The rounds are peeled off (and detected faults corrected).
Thus, Triple-DES and DES with independent subkeys(768 bit) can be attacked.
Cours SETI Fault attacks — 24
IntroductionFault Induction Attacks: FA and DFA on RSA & DES
DFA on AESCountermeasures
The Differential Fault AttackFaults Models and Tolerance
Single Event Effects (SEE)
SET: Single Event TransientFault.
SEU: Single Event Upsets.Permanent Fault. Memorypoint inversion by currentpeak (soft error) It was thefault model of the DFA.
SEL: Single Event Latchups.Short-circuit between Vss
and Vdd, causing apermanent fault (harderror)
Data courtesy of the MARS project.7→ http://www.comelec.enst.fr/recherche/mars/
Cours SETI Fault attacks — 25
IntroductionFault Induction Attacks: FA and DFA on RSA & DES
DFA on AESCountermeasures
The Differential Fault AttackFaults Models and Tolerance
SEUs Can Be Modeled at Various Levels
Physical
Creation ofe−/h+ pairs.
Electrical
Current orvoltage pulse.
Logical
Bit flips, signalinversion.
Behavioral
Erroneoustransitions.
Cours SETI Fault attacks — 26
IntroductionFault Induction Attacks: FA and DFA on RSA & DES
DFA on AESCountermeasures
The Differential Fault AttackFaults Models and Tolerance
Observable impacts on an inverter
Cours SETI Fault attacks — 27
IntroductionFault Induction Attacks: FA and DFA on RSA & DES
DFA on AESCountermeasures
The Differential Fault AttackFaults Models and Tolerance
SRAM cell (two inverters)
Cours SETI Fault attacks — 28
IntroductionFault Induction Attacks: FA and DFA on RSA & DES
DFA on AESCountermeasures
The Differential Fault AttackFaults Models and Tolerance
Laser beam impact (if ‘1’, → 0 / if ‘0’, → 1)
Cours SETI Fault attacks — 29
IntroductionFault Induction Attacks: FA and DFA on RSA & DES
DFA on AESCountermeasures
The Differential Fault AttackFaults Models and Tolerance
Laser cartography
Cours SETI Fault attacks — 30
IntroductionFault Induction Attacks: FA and DFA on RSA & DES
DFA on AESCountermeasures
Theoretical Fault AttacksPractical AttacksFault Sensitivity Analysis (FSA)
State-of-the-Art of Fault Attacks against AES
Giraud in 2003: (50 faults) [Gir04]
Dusart, Letourneux & Vivolo in 2002: (5× 4 faults) [DLV03]
Piret & Quisquater in 2004: 2 faults [PQ03]
Tunstall, Mukhopadhyay & Ali: 1 fault [TMA11]
Cours SETI Fault attacks — 31
IntroductionFault Induction Attacks: FA and DFA on RSA & DES
DFA on AESCountermeasures
Theoretical Fault AttacksPractical AttacksFault Sensitivity Analysis (FSA)
Ch. Giraud in 2003
Bit-fault ej attack on the last round
Regular encryption (C):
CShiftRow(i) = SubBytes(M9i )⊕ K 10
ShiftRow(i) for i ∈ [1, 16]
Faulted encryption (D):
DShiftRow(i) = SubBytes(M9i )⊕ K 10
ShiftRow(i) for i ∈ [1, 16]\{j}and
CShiftRow(j) = SubBytes(M9j ⊕ ej)⊕ K 10
ShiftRow(j).
Attack:
CShiftRow(j) ⊕ DShiftRow(j) =SubBytes(M9
j )⊕ SubBytes(M9j ⊕ ej).
Cours SETI Fault attacks — 32
IntroductionFault Induction Attacks: FA and DFA on RSA & DES
DFA on AESCountermeasures
Theoretical Fault AttacksPractical AttacksFault Sensitivity Analysis (FSA)
Detail of Ch. Giraud’s attack
Goal: finding the value of M9j .
CShiftRows(j) ⊕ DShiftRows(j) = ∆ =SubBytes(M9
j )⊕ SubBytes(M9j ⊕ ej) has between 2 and 14
solutions in (ej ,M9j ) (set of 8× 28 unknown), and 8 in
average.
However, the exact value of ej is of no importance.
Attack Strength
Thus, with 2 faults, there is 50 % chance to get one M9j .
With 3 faults, there is 97 % chance to get one M9j .
Once M9j is known, we have K 10
j = Cj ⊕ SubBytes(M9j ).
Cours SETI Fault attacks — 33
IntroductionFault Induction Attacks: FA and DFA on RSA & DES
DFA on AESCountermeasures
Theoretical Fault AttacksPractical AttacksFault Sensitivity Analysis (FSA)
G. Piret & J.-J. Quisquater in 2003
SubBytes
ShiftRows
AddRoundKey
SubBytes
ShiftRows
MixColumns
AddRoundKey
Rou
nd10
Rou
nd9
d9()[0]
differenceprecomputed
Cours SETI Fault attacks — 34
IntroductionFault Induction Attacks: FA and DFA on RSA & DES
DFA on AESCountermeasures
Theoretical Fault AttacksPractical AttacksFault Sensitivity Analysis (FSA)
G. Piret & J.-J. Quisquater in 2003
differencereturned state
=
=
=
SubBytes
ShiftRows
AddRoundKey
SubBytes
ShiftRows
MixColumns
AddRoundKey
SubBytes
ShiftRows
MixColumns
AddRoundKey
Rou
nd10
Rou
nd9
Rou
nd8
d8()d9()[0]
differences change!
Kill 4 birds withone stone
A fault at round 8yields 4 faults atround 9! This isoptimal. . .
Cours SETI Fault attacks — 35
IntroductionFault Induction Attacks: FA and DFA on RSA & DES
DFA on AESCountermeasures
Theoretical Fault AttacksPractical AttacksFault Sensitivity Analysis (FSA)
G. Piret & J.-J. Quisquater in 2003: AES-192 andAES-256
Extension of Piret’s attack to AES-192 and AES-256:
MixColumns and AddRoundKey are “commutative”.
Let’s note MCK r−1 the value of MC−1(K r−1).
Then the end of AES can be expressed as:
SB → MC → SR → MC → ARK (K r−1)→ SB → SR →ARK (K r ) or
MC → SB → SR → ARK (MCK r−1)→ MC → SB → SR →ARK (K r )
And do a Piret’s attack using:
MC−1(SR−1(SB−1(C ⊕ K r ))) andMC−1(SR−1(SB−1(C ∗ ⊕ K r ))), instead of
C and C ∗.Cours SETI Fault attacks — 36
IntroductionFault Induction Attacks: FA and DFA on RSA & DES
DFA on AESCountermeasures
Theoretical Fault AttacksPractical AttacksFault Sensitivity Analysis (FSA)
Faults injection: Local Over-Clocking
jitter
step
jitter
jitter
Cours SETI Fault attacks — 37
IntroductionFault Induction Attacks: FA and DFA on RSA & DES
DFA on AESCountermeasures
Theoretical Fault AttacksPractical AttacksFault Sensitivity Analysis (FSA)
Faults injection: Setup-Time Violation Attack Sketch
������������
������������
��������
��������
1.2
U
V
0.6
01.20
0.6
UV
Setup met Setup violated
Q’
QD
Q’
QD
clk clk
V ↓ ⇒ Tpropagation ↑
Cours SETI Fault attacks — 38
IntroductionFault Induction Attacks: FA and DFA on RSA & DES
DFA on AESCountermeasures
Theoretical Fault AttacksPractical AttacksFault Sensitivity Analysis (FSA)
Occurrence (nominal voltage is 3.3 V)
0
10
20
30
40
50
60
70
80
90
100
760 770 780 790 800 810 820 830
Occ
urre
nce
[%]
Voltage [mV]
FaultsSingle errors
Multiple errors
Cours SETI Fault attacks — 39
IntroductionFault Induction Attacks: FA and DFA on RSA & DES
DFA on AESCountermeasures
Theoretical Fault AttacksPractical AttacksFault Sensitivity Analysis (FSA)
Coverage
0
10
20
30
40
50
60
70
80
90
100
760 770 780 790 800 810 820 830
Cov
erag
e [%
]
Voltage [mV]
Detected errorsExploitable errors R8Exploitable errors R9
Cours SETI Fault attacks — 40
IntroductionFault Induction Attacks: FA and DFA on RSA & DES
DFA on AESCountermeasures
Theoretical Fault AttacksPractical AttacksFault Sensitivity Analysis (FSA)
Round statistics
0
5
10
15
20
25
10 9 8 7 6 5 4 3 2 1
% o
f fau
lts
Round
Temporal localization
Cours SETI Fault attacks — 41
IntroductionFault Induction Attacks: FA and DFA on RSA & DES
DFA on AESCountermeasures
Theoretical Fault AttacksPractical AttacksFault Sensitivity Analysis (FSA)
Sbox statistics
0
5
10
15
20
25
30
S15
S14
S13
S12
S11
S10 S
9
S8
S7
S6
S5
S4
S3
S2
S1
S0
% o
f fau
lts
Sbox
Spatial localization
Cours SETI Fault attacks — 42
IntroductionFault Induction Attacks: FA and DFA on RSA & DES
DFA on AESCountermeasures
Theoretical Fault AttacksPractical AttacksFault Sensitivity Analysis (FSA)
FSA: Principle [LSG+10]
The stress level at which a fault occurs...
... might be related to the computed value.
Ex: any combinational circuit
Ex: DPL circuit with early evaluation (e.g. WDDL)
Ex: Key-dependent clock-wise collisions [NLS+12]
Cours SETI Fault attacks — 43
IntroductionFault Induction Attacks: FA and DFA on RSA & DES
DFA on AESCountermeasures
Redundance
Time
Space
Information
Authenticated encryption is one protocol-level solution(see CAESAR competition).
Resilience
Let the system output erroneous errors, as long as they conveyno information about the internal sensitive values [GSDS10]
Cours SETI Fault attacks — 44
IntroductionFault Induction Attacks: FA and DFA on RSA & DES
DFA on AESCountermeasures
Digital Sensor [SBGD11]
tchain (N buffers) > tcrit
00
OIerror(I = O)
Monitoring DFF
0 0 1
Cours SETI Fault attacks — 46
IntroductionFault Induction Attacks: FA and DFA on RSA & DES
DFA on AESCountermeasures
EM pulses should not be too long!
Cours SETI Fault attacks — 47
IntroductionFault Induction Attacks: FA and DFA on RSA & DES
DFA on AESCountermeasures
References on Fault Attacks I
[DLV03] Pierre Dusart, Gilles Letourneux, and Olivier Vivolo.Differential Fault Analysis on A.E.S.In Jianying Zhou, Moti Yung, and Yongfei Han, editors, ACNS, volume2846 of LNCS, pages 293–306. Springer, 2003.
[Gir04] Christophe Giraud.DFA on AES.In Hans Dobbertin, Vincent Rijmen, and Aleksandra Sowa, editors, AESConference, volume 3373 of Lecture Notes in Computer Science, pages27–41. Springer, 2004.
[GSDS10] Sylvain Guilley, Laurent Sauvage, Jean-Luc Danger, and Nidhal Selmane.Fault Injection Resilience.In FDTC, pages 51–65. IEEE Computer Society, August 21 2010.Santa Barbara, CA, USA. DOI: 10.1109/FDTC.2010.15; Completeversion: http://hal.archives-ouvertes.fr/hal-00482194/en/.
Cours SETI Fault attacks — 48
IntroductionFault Induction Attacks: FA and DFA on RSA & DES
DFA on AESCountermeasures
References on Fault Attacks II
[KDK+14] Yoongu Kim, Ross Daly, Jeremie Kim, Chris Fallin, Ji-Hye Lee, DonghyukLee, Chris Wilkerson, Konrad Lai, and Onur Mutlu.Flipping bits in memory without accessing them: An experimental study ofDRAM disturbance errors.In ACM/IEEE 41st International Symposium on Computer Architecture,ISCA 2014, Minneapolis, MN, USA, June 14-18, 2014, pages 361–372.IEEE Computer Society, 2014.
[KKT04] Mark G. Karpovsky, Konrad J. Kulikowski, and Alexander Taubin.Robust Protection against Fault Injection Attacks on Smart CardsImplementing the Advanced Encryption Standard.In DSN, pages 93–101. IEEE Computer Society, June 28 – July 01 2004.Florence, Italy.
[LSG+10] Yang Li, Kazuo Sakiyama, Shigeto Gomisawa, Toshinori Fukunaga, JunkoTakahashi, and Kazuo Ohta.Fault Sensitivity Analysis.In CHES, volume 6225 of Lecture Notes in Computer Science, pages320–334. Springer, August 17-20 2010.Santa Barbara, CA, USA.
Cours SETI Fault attacks — 49
IntroductionFault Induction Attacks: FA and DFA on RSA & DES
DFA on AESCountermeasures
References on Fault Attacks III
[NLS+12] Toshiki Nakasone, Yang Li, Yu Sasaki, Mitsugu Iwamoto, Kazuo Ohta,and Kazuo Sakiyama.Key-Dependent Weakness of AES-Based Ciphers under Clockwise CollisionDistinguisher.In Taekyoung Kwon, Mun-Kyu Lee, and Daesung Kwon, editors, ICISC,volume 7839 of Lecture Notes in Computer Science, pages 395–409.Springer, 2012.
[PQ03] Gilles Piret and Jean-Jacques Quisquater.A Differential Fault Attack Technique against SPN Structures, withApplication to the AES and Khazad.In CHES, volume 2779 of LNCS, pages 77–88. Springer, September 2003.Cologne, Germany.
[SBGD11] Nidhal Selmane, Shivam Bhasin, Sylvain Guilley, and Jean-Luc Danger.Security evaluation of application-specific integrated circuits and fieldprogrammable gate arrays against setup time violation attacks.IET Information Security, 5(4):181–190, December 2011.DOI: 10.1049/iet-ifs.2010.0238.
Cours SETI Fault attacks — 50
IntroductionFault Induction Attacks: FA and DFA on RSA & DES
DFA on AESCountermeasures
References on Fault Attacks IV
[TMA11] Michael Tunstall, Debdeep Mukhopadhyay, and Subidh Ali.Differential Fault Analysis of the Advanced Encryption Standard Using aSingle Fault.In Claudio Agostino Ardagna and Jianying Zhou, editors, WISTP, volume6633 of Lecture Notes in Computer Science, pages 224–233. Springer,2011.
[Ver06] Olli Vertanen.Java Type Confusion and Fault Attacks.In FTDC, volume 4236 of LNCS, pages 237–251. Springer, 2006.DOI: 10.1007/11889700, ISSN 0302-9743 (Print) 1611-3349 (Online),ISBN 978-3-540-46250-7.
Cours SETI Fault attacks — 51