Questions tagged [fault-attack]

Attacks using errors injected at runtime into an implementation of cryptographic algorithms to cause misbehavior that leak information about keys or (plaintext) data, instead of (or additional to) using cryptographic weaknesses. The countermeasures against such attacks also belong here.

Filter by
Sorted by
Tagged with
2 votes
0 answers

Information Leakage Due to Fault Propagation in XOR gates

In the concept of Automatic Test Pattern Generation (ATPG), two events are required to perform in sequence: Fault Activation and Fault Propagation. In the case of a linear 2-input XOR gate, without ...
Mohammadsadeq Borjiyan's user avatar
1 vote
0 answers

Could a private key recovery via modulus fault attacks be optimised by being able to choose the faulty moduli?

The paper 'Why One Should Also Secure RSA Public Key Elements' describes an attack where an adversary can fully recover a private key by injecting faults into the modulus before exponentiation takes ...
Aaron K's user avatar
  • 11
5 votes
1 answer

Protecting Ed448 against DPA and fault attacks

There are some papers (1, 2) describing fault attacks in EdDSA. One suggested countermeasure is to add randomness to the input of the first hash call, which outputs a scalar. This paper describes a ...
Conrado's user avatar
  • 6,404
2 votes
1 answer

Fault attacks inside a loop

I am working on an attack that involves changing a constant inside a loop. Consider the simplified example is as below, ...
Rick's user avatar
  • 1,265
2 votes
1 answer

Statistical (innefective) Fault Attacks on DES

I read this paper: Exploiting Ineffective Fault Inductions on Symmetric Cryptography. I was wondering if the same idea is applicable for DES. I know both algorithms are symmetric but the idea is not ...
albert's user avatar
  • 21
2 votes
2 answers

Fault attack on RSA-CRT

I am trying to understand fault attack on RSA-CRT, and I found some example, which I don't know how to solve it. I know public modulus $N$, public exponent $e$, a value of faulty signature (where ...
Max's user avatar
  • 121
1 vote
0 answers

AES Fault Attack

Induce random fault (non-zero) error in one byte before MixColumns in Round 9 I get last round key with 32 bit (4 bytes) missing (Missing are bytes 1, 8, 11, 14) How can I recover these key bytes ...
nWinter's user avatar
  • 11
19 votes
3 answers

Can deterministic ECDSA be protected against fault attacks?

In a paper by Barenghi and Pelosi, it was described that fault attacks could be used to derive the secret key when using deterministic ECDSA as described in RFC6979 by @Thomas_Pornin Deterministic (...
Yustack's user avatar
  • 361
2 votes
1 answer

The Boneh-DeMillo-Lipton fault attack (RSA CRT)

I am trying to understand the Boneh-DeMillo-Lipton fault attack on RSA CRT signature. Suppose that we sign a message $m$ with RSA-CRT : $d_p = d \bmod (p-1)$ and $d_q = d \bmod (q-1)$ $s_p = h(m)^{...
Raoul722's user avatar
  • 2,826