2
$\begingroup$

Let's say: an error is induced into an implementation of the AES-128 to produce a faulty ciphertext. The error is a one-byte eror and is always induced on the last state byte, during round9, before the MixColumns operation. The induced errors are unknown and can be different. However the key is the same in both cases.

Then how can I recover 4 bytes of the last round key? Which bytes of that round key can I recover and what's their value?

ciphertext1 = 0xe719f8ab9e0b846f0cf2e5c32a0e5b45
faultytext1 = 0xe719f86f9e0beb6f0c97e5c38b0e5b45

ciphertext2 = 0x78f272c7cf5383085fa240236d97130f
faultytext2 = 0x78f27277cf53e7085f944023fa97130f
Improve this question
$\endgroup$

1 Answer 1

Reset to default
4
$\begingroup$

Your fault attack scenario correspond to this paper :

A Differential Attack Technique Against SPN Structures with Application to AES and KHAZAD (Piret & Quisquater - CHES 2003)

This paper describe how to retrieve four bytes of the last round key with at least two pairs of ciphertext/faultytext.

Each pair of ciphertext $C$ and faultytext $C^*$ could be written as $C^* = C \oplus E$, where $E$ contains 4 bytes $\neq 0$.

For more details, the attack consists on several steps :

  • Compute a list $L$ of 4x255 possible differences after the MixColumns of Round 9

  • Guess 4 parts of $K_{10}$

  • Compute $d = SB^{-1} (C \oplus K_{10}) \oplus SB^{-1} (C^* \oplus K_{10})$

  • If $d$ in $L$, add guessed $K$ in a list of possible candidates of $K_{10}$

  • Repeat for each pair, considering only guessed $K$ in the list of possible candidates, if $d$ is not in $L$ for the new pair, remove the candidate.

  • Repeat until the list of possible candidates is reduced to one.

Improve this answer
$\endgroup$
4
  • $\begingroup$ A short description of the technique used should be part of the answer, so if you can add it we would be grateful. $\endgroup$
    – Maarten Bodewes ♦
    Commented Mar 16, 2015 at 21:11
  • $\begingroup$ Ah, wow, wecome to Crypto, Miss Seeluna :) $\endgroup$
    – Maarten Bodewes ♦
    Commented Mar 17, 2015 at 13:13
  • $\begingroup$ What do you mean by Guess 4 parts of K10, you mean 4 bytes right? And you should already know the location of that 4 bytes right? $\endgroup$
    – byteBiter
    Commented Mar 17, 2015 at 19:23
  • $\begingroup$ Yes sorry : by parts, I mean bytes. And for the location of 4 bytes corresponds to the location of the differences between $C$ and $C^*$. $\endgroup$
    – Miss Seeluna
    Commented Mar 18, 2015 at 8:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.