Questions tagged [fault-attack]
Attacks using errors injected at runtime into an implementation of cryptographic algorithms to cause misbehavior that leak information about keys or (plaintext) data, instead of (or additional to) using cryptographic weaknesses. The countermeasures against such attacks also belong here.
9
questions
2
votes
0
answers
44
views
Information Leakage Due to Fault Propagation in XOR gates
In the concept of Automatic Test Pattern Generation (ATPG), two events are required to perform in sequence: Fault Activation and Fault Propagation.
In the case of a linear 2-input XOR gate, without ...
1
vote
0
answers
58
views
Could a private key recovery via modulus fault attacks be optimised by being able to choose the faulty moduli?
The paper 'Why One Should Also Secure RSA Public Key Elements' describes an attack where an adversary can fully recover a private key by injecting faults into the modulus before exponentiation takes ...
- 11
5
votes
1
answer
278
views
Protecting Ed448 against DPA and fault attacks
There are some papers (1, 2) describing fault attacks in EdDSA. One suggested countermeasure is to add randomness to the input of the first hash call, which outputs a scalar.
This paper describes a ...
- 6,404
2
votes
1
answer
99
views
Fault attacks inside a loop
I am working on an attack that involves changing a constant inside a loop. Consider the simplified example is as below,
...
- 1,265
2
votes
1
answer
132
views
Statistical (innefective) Fault Attacks on DES
I read this paper: Exploiting Ineffective Fault Inductions on Symmetric Cryptography.
I was wondering if the same idea is applicable for DES. I know both algorithms are symmetric but the idea is not ...
- 21
2
votes
2
answers
4k
views
Fault attack on RSA-CRT
I am trying to understand fault attack on RSA-CRT, and I found some example, which I don't know how to solve it.
I know public modulus $N$, public exponent $e$, a value of faulty signature (where ...
- 121
1
vote
0
answers
174
views
AES Fault Attack
Induce random fault (non-zero) error in one
byte before MixColumns in Round 9
I get last round key with 32 bit (4 bytes) missing
(Missing are bytes 1, 8, 11, 14)
How can I recover these key bytes ...
- 11
19
votes
3
answers
2k
views
Can deterministic ECDSA be protected against fault attacks?
In a paper by Barenghi and Pelosi, it was described that fault attacks could be used to derive the secret key when using deterministic ECDSA as described in RFC6979 by @Thomas_Pornin
Deterministic (...
- 361
2
votes
1
answer
1k
views
The Boneh-DeMillo-Lipton fault attack (RSA CRT)
I am trying to understand the Boneh-DeMillo-Lipton fault attack on RSA CRT signature.
Suppose that we sign a message $m$ with RSA-CRT :
$d_p = d \bmod (p-1)$ and $d_q = d \bmod (q-1)$
$s_p = h(m)^{...
- 2,826