Cryptography Reference
In-Depth Information
assumed to know the set of possible errors
E
as well as an associated set of
r
-round
ε
.
Once a faulty ciphertext
C
is obtained from a plaintext
P
, the attacker searches
for a plaintext
P
-characteristics
{
Ω
ε
;
ε
∈
E
}
P
)
such that
(
P
,
is a right pair with respect to an
r
-round
ε
-
characteristic
Ω
ε
(where
ε
is the induced fault). Note that a correct pair with respect
to
Ω
ε
satisfies
L
r
,
R
r
),
L
r
,
R
r
)
=
(
(
L
r
⊕
ε,
R
r
)
=
(
and consequently
C
=
16
i
C
.
1
F
K
i
(
L
r
⊕
ε,
R
r
)
=
=
r
+
Therefore, to determine a plaintext
P
such that
P
)
(
P
,
is a right pair with respect to
Ω
ε
while the error vector
ε
is a priori unknown, the attacker asks for the encryption
. If one of the obtained ciphertexts
C
equals
C
,
of
P
=
P
⊕
Ω
ε,
0
for every
ε
∈
E
P
)
then the attacker considers that
(
P
,
may be a correct pair with respect to
Ω
ε
.The
probability that this process successfully outputs a correct pair is
p
suc
=
[
ε
=
ε
]
p
Ω
ε
.
Pr
ε
∈
E
C
may be returned which is not
a correct pair. Such a wrong pair can result from a plaintext
P
P
)
such that
C
=
On the other hand, a pair
(
P
,
=
P
⊕
Ω
ε,
0
such
that
(Δ
L
r
,Δ
R
r
)
=
(ε,
0
)
but
ε
=
ε
or such that
(Δ
L
r
,Δ
R
r
)
=
(ε,
0
)
=
(ε,
0
)
but
(Δ
L
i
,Δ
R
i
)
=
Ω
ε,
i
for some
i
. Such a wrong pair occurs with a probability
C
]−
p
err
=
Pr
[
DES
K
(
P
⊕
Ω
ε,
0
)
=
p
suc
.
ε
∈
E
However, if the characteristics are well chosen, namely if they are chosen with high
probabilities
p
Ω
ε
, then the error probability is negligible compared to the success
probability (the choice of the characteristics is addressed later in Sect.
3.5.4
).
Once a correct pair
P
)
Ω
ε
has been
obtained, it is used to infer some information on the first round key. As illustrated in
Fig.
3.8
, such pair satisfies
(
P
,
with respect to an
r
-round
ε
-characteristic
R
0
)
=
Ω
L
R
f
K
1
(
R
0
)
⊕
f
K
1
(
ε,
0
⊕
Ω
ε,
1
.
(3.9)
This equation enables an attacker to distinguish the value of the first round key
K
1
.
In practice, since wrong pairs may occur, one does not discard key guesses as in
the original DFA presented in Sect.
3.3
but rather uses a counting strategy. More
precisely, every subkey
K
1
,
i
is recovered separately by updating 64 counters
c
(
k
)
,
6
. For every selected pair
P
)
k
∈{
0
,
1
}
(
P
,
and associated
r
-round
ε
-characteristic
Ω
ε
, the attacker tests whether a guess
k
for
K
1
,
i
is consistent with respect to (
3.9
).
Namely, he tests whether
k
satisfies
