On Countermeasures Against Fault Attacks on the Advanced Encryption Standard - Fault Analysis in Cryptography - page 95

Fig. 6.5 Double parity for
S-Box [120]
Di Natale, Flottes and Rouzeyre propose another solution that focuses on S-Boxes.
The principle is to add two parity bits per S-Box, one parity bit for the input byte and
one for the output byte, and therefore the logic for predicting such information (see
Fig. 6.5 ). The actual output parity is compared with the predicted output parity bit,
and the actual input parity bit is compared with the predicted one [120]. When the
S-Box and the prediction circuits are synthesized as combinational logic, the area
overhead is 38.33 % with respect to the original S-Box. With respect to the solution
given in [34], where the authors also proposed the use of a double parity bit for the
S-Box, this solution allows detecting an additional 27 % of errors.
In Fig. 6.6 , the double parity checking on the S-Box is applied to the scheme
proposed in [424]. For each S-Box output, the prediction of the input parity bit is
calculated. This predicted input parity bit is then compared with the actual input
parity of each S-Box. Finally, the error indication flag of the SubByte operation is
obtained as the result of the logical OR of the sixteen indication flags issued from
the S-Boxes. We will refer to this architecture as “Parity for State + double parity for
S-Box”.
In Fig. 6.7 , the double parity checking on the S-Box is applied to the scheme
proposed in [34]. In the original solution there is a parity bit for each byte of the
State matrix. The principle of the proposed solution is that in the case of error
detection at the S-Box level, the corresponding parity bit, which is then propagated
to the ShiftRows operation, is deliberately forced to have the opposite value, so that
the detection mechanism will detect the error. We will refer to this architecture as
“Parity per byte + double parity for S-Box”.
Another approach that focuses on S-Boxes is presented in [219]. Using composite
field arithmetic, the S-Box is divided into five cascaded blocks, each of them designed