Cryptography Reference
In-Depth Information
Table 4.4
Number of faulty ciphertexts required to successfully mount a DFA attack on AES-128 depending on the impact and the location of the faults
Ref.
Fault impact
Fault location
Number of faulty
Number of
ciphertexts
candidates left
[
426
]
Bit flip
Random on a chosen temporary variable (input of round 10)
32
1
[
55
]
Bit stuck at 0
Chosen (after the first round key addition)
128
1
Chosen (
K
9
,
K
8
and
M
8
)
2
16
[
160
]
Uniformly distributed random byte
31
Random on a chosen temporary variable (
K
9
,
K
8
and
M
8
)
2
16
248
[
127
]
Uniformly distributed random byte
Random between
MixColumns
of rounds 8 and 9
50
1
Chosen (
K
9
and
K
8
)
2
24
[
84
]
Uniformly distributed random byte
22
2
40
[
324
]
Random byte
Random between
MixColumns
of rounds 7 and 8
1
2
1
[
323
]
Uniformly distributed random byte
Fixed between
MixColumns
of rounds 6 and 7
255
1
[
51
]
Bit flip
Chosen
32
1
Random on a chosen byte
4,096
1
[
296
]
At most three bytes per column
Random on a chosen temporary variable (input of
MC
of round 9)
6
1
Each and every byte
Random on a chosen temporary variable (input of
MC
of round 9)
1,495
1
Chosen (
K
9
)
[
322
]
Uniformly distributed random word
12
1
Random on a chosen temporary variable (
K
8
)
2
40
[
392
]
Random word (column)
2
2
16
4
Chosen (
K
9
)
2
32
[
229
]
Three random bytes
2
4
1
2
40
[
148
]
Random byte
Random on a chosen temporary variable (input of round 8)
1
2
1
2
36
[
229
]
Random byte
Random on a chosen temporary variable (input of round 8)
1
2
1
2
12
[
]
403
Random byte
Random between
MixColumns
of rounds 7 and 8
1
2
34
[
352
]
Random word (diagonal)
Random between
MixColumns
of round 7 and
ShiftRows
of round 8
1
2
1
Three random words (three diagonals)
Random between
MixColumns
of round 7 and
ShiftRows
of round 8
4
1
