On Countermeasures Against Fault Attacks on the Advanced Encryption Standard - Fault Analysis in Cryptography - page 101

Fig. 6.9 MixColumns implementation

Table 6.6 reports the number of pairs P leading to error multiplicities ranging
from 0 to 8 for each S-Box implementation. The first column (error multiplicity = 0)
corresponds to all the cases where the faults produce no errors. In all other columns,
the table cell reports, besides the number of pairs resulting in the corresponding error
multiplicity, the percentage that represents these pairs with respect to the overall
number of pairs and, in bold, the percentage that represents these pairs with respect
to the number of pairs that lead to at least one error on the S-Box output (i.e., pairs
falling in column 0 are discarded).
For instance, among the 19 % of fault simulations for which at least one output
bit is erroneous at the output of the SB1 (being that 81 % of experiments result in
no error), 78 % result in only one erroneous output bit, justifying therefore the use
of a code-based solution that exploits a simple parity bit. Moreover, a deep study
of the fault dictionary for the 14 pairs {input/fault} resulting in eight output errors
allowed us to find that they correspond to faults injected into the input of the S-Box.
Therefore, it might not be necessary to protect the S-Box with detection schemes
able to detect eight error bits in this case if these errors are detected at the input of
the S-Box.
Obviously, different S-Box implementations lead the series of fault injection to
different profiles in terms of error multiplicity. The presented implementations differ