Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
I read this paper: Exploiting Ineffective Fault Inductions on Symmetric Cryptography.
I was wondering if the same idea is applicable for DES. I know both algorithms are symmetric but the idea is not the same.
I thought if an attacker shot the left part of the penultimate round, but the final permutation on the Feistel function is a problem for me.
Does anyone have some information about this topic?
In case you are still wondering, the answer to this question is "Yes". DES can also be targeted by the same sort of attack.
This was actually already almost entirely done against DES in a paper from 2006, by F. Amiel, C. Clavier and M. Tunstall called "Fault analysis of DPA-resistant algorithms", you can look at section 6 and the next ones, in which they show that both known and unknown faults against the S-Boxes of DES can lead to a full key recovery. What they did not cover is the case where you have a fault countermeasure in place, either a detection or an infective one.
Now, if you have some fault countermeasure, but are able to target specific location of your S-Boxes, then performing this attack remains easy. But, if you are in the unknown fault setting, with fault countermeasure, you'll need to use the same statistical tools as in the SIFA paper, but would eventually also be able to recover the key. It just needs some tweaking.
