Fault analysis of Kuznyechik

R. AlTawy   ; O. Duman   ; A. M. Youssef

Matematičeskie voprosy kriptografii, Tome 7 (2016) no. 2, pp. 21-34

Résumé

We present two fault analysis attacks on the new cipher Kuznyechik. In the differential fault attack the attacker is assumed to be able to fault a random byte in rounds seven and eight. It enables the attacker to recover the master key using an average of four faults. Another attack considers the cipher with a secret S-box. Utilizing an ineffective fault analysis in the byte stuck-at-zero fault model, we present an attack to recover both the master key and the secret S-box parameters. Both attacks demonstrate the importance of protecting the hardware and software implementations of the new standard even if its S-box is kept secret.

Bibliographie

[1] GOST 28147-89. Information Processing Systems. Cryptographic Protection. Cryptographic Transformation Algorithm, USSR Gosstandart 1409, IPK Standards Publ., M., 1989 (in Russian)

[2] The National Standard of the Russian Federation GOST R 34.12-2015, Russian Federal Agency on Technical Regulation and Metrology report, , 2015 http://www.tc26.ru/en/standard/draft/ENG_GOST_R_bsh.pdf

[3] AlTawy R., Youssef A. M., “Differential fault analysis of Streebog”, Information Security Practice and Experience, ISPEC 2015, Lect. Notes Comput. Sci., 9065, 2015, 35–49 | DOI

[4] AlTawy R., Youssef A. M., Meet in the middle attacks on reduced round Kuznyechik, IACR Cryptology ePrint Archive, Report 2015/096, , 2015, 14 pp. http://eprint.iacr.org/2015/096

[5] Biham E., Shamir A., “Differential fault analysis of secret key cryptosystems”, Advances in Cryptology-CRYPTO'97, Lect. Notes Comput. Sci., 1294, 1997, 513–525 | DOI | Zbl

[6] Boneh D., DeMillo R., Lipton R., “On the importance of checking cryptographic protocols for faults”, Advances in Cryptology-EUROCRYPT '97, Lect. Notes Comput. Sci., 1233, 1997, 37–51 | DOI | MR

[7] Clavier C., Gierlichs B., Verbauwhede I., “Fault analysis study of IDEA”, Topics in Cryptology-CT-RSA 2008, Lect. Notes Comput. Sci., 4964, 2008, 274–287 | DOI | Zbl

[8] Clavier C., Wurcker A., “Reverse engineering of a secret AES-like cipher by ineffective fault analysis”, 10th Workshop on Fault Diagnosis and Tolerance in Cryptography FDTC 2013, IEEE Computer Soc., Los Alamitos, CA, 2013, 119–128 | DOI

[9] Courbon F., Loubet-Moundi P., Fournier J. J. A., Tria A., “Adjusting laser injections for fully controlled faults”, Constructive Side-Channel Analysis and Secure Design, Lect. Notes Comput. Sci., 8622, 2014, 229–242 | DOI

[10] Dinur I., Dunkelman O., Shamir A., “Improved attacks on full GOST”, Fast Software Encryption, Lect. Notes Comput. Sci., 7549, 2012, 9–28 | DOI | Zbl

[11] Giraud C., “DFA on AES”, Advanced Encryption Standard-AES, Lect. Notes Comput. Sci., 3373, 2005, 27–41 | DOI | Zbl

[12] Isobe T., “A single-key attack on the full GOST block cipher”, Fast Software Encryption, Lect. Notes Comput. Sci., 6733, 2011, 290–305 | DOI | MR | Zbl

[13] Kim C., Quisquater J.-J., “New differential fault analysis on AES key schedule: Two faults are enough”, Smart Card Research and Advanced Applications, CARDIS 2008, Lect. Notes Comput. Sci., 5189, 2008, 48–60 | DOI

[14] Kircanski A., Youssef A. M., “Differential fault analysis of Rabbit”, Selected Areas in Cryptography, SAC 2009, Lect. Notes Comput. Sci., 5867, 2009, 197–214 | DOI | MR | Zbl

[15] Moro N., Dehbaoui A., Heydemann K., Robisson B., Encrenaz E., “Electromagnetic fault injection: Towards a fault model on a 32-bit microcontroller”, 10th Workshop on Fault Diagnosis and Tolerance in Cryptography FDTC 2013, IEEE Computer Soc., Los Alamitos, CA, 2013, 77–88 | DOI

[16] Piret G., Quisquater J.-J., “A differential fault attack technique against SPN structures, with application to the AES and Khazad”, Cryptographic Hardware and Embedded Systems-CHES 2003, Lect. Notes Comput. Sci., 2779, 2003, 77–88 | DOI | Zbl

[17] Poschmann A., Ling S., Wang H., “256 bit standardized crypto for 650 GE-GOST revisited”, Cryptographic Hardware and Embedded Systems-CHES 2010, Lect. Notes Comput. Sci., 6225, 2010, 219–233 | DOI | Zbl

[18] Roscian C., Sarafianos A., Dutertre J.-M., Tria A., “Fault model analysis of laser-induced faults in SRAM memory cells”, 10th Workshop on Fault Diagnosis and Tolerance in Cryptography FDTC 2013, IEEE Computer Soc., Los Alamitos, CA, 2013, 89–98 | DOI

[19] A. A. Dmukh, D. M. Dygin, G. B. Marshalko, “A lightweight-friendly modification of GOST block cipher”, Math. Aspects Cryptogr., 5:2 (2014), 47–55 (in Russian)

[20] Skorobogatov S. P., Anderson R. J., “Optical fault induction attacks”, Cryptographic Hardware and Embedded Systems-CHES 2002, Lect. Notes Comput. Sci., 2523, 2003, 2–12 | DOI

[21] Tunstall M., Mukhopadhyay D., Ali S., “Differential fault analysis of the Advanced Encryption Standard using a single fault”, Information Security Theory and Practice. Security and Privacy of Mobile Devices in Wireless Communication, WISTP 2011, Lect. Notes Comput. Sci., 6633, 2011, 224–233 | DOI | MR

[22] Zhao X., Guo S., Zhang F., Wang T., Shi Z., Ma C., Gu D., “Algebraic fault analysis on GOST for key recovery and reverse engineering”, FDTC 2014, IEEE Computer Soc., Los Alamitos, CA, 2014, 29–39