Improved differential fault analysis on lightweight block cipher LBlock for wireless sensor networks

Abstract

LBlock is a 64-bit lightweight block cipher which can be implemented in both constrained hardware environments, such as wireless sensor network, and software platforms. In this paper, we study the security of LBlock against a differential fault analysis. Based on a random nibble fault model, we propose two versions of the attack on LBlock. In the first attack, we inject random nibble faults to the input register of round 29. As a result, it can recover the secret key of LBlock using an exhaustive search of 2²⁵ and five random nibble fault injections on average. This attack can be simulated on a general PC within a few seconds. In the case of second attack, random nibble faults are induced to the input register of round 30. This attack can recover the secret key of LBlock using an exhaustive search of 2³⁰ and seven random nibble fault injection on average. This attack can be simulated on a general PC within 1 h. These results are superior to known differential fault analytic result on LBlock.

Introduction

Differential fault analysis (DFA), one of the side channel attacks, was first proposed by Biham and Shamir on DES in 1997 [1]. This attack exploits faults within the computation of a cryptographic algorithm to reveal the secret information. So far, DFAs on many block ciphers such as DES, Piccolo, LED, SEED, and ARIA have been proposed [2–7]. It means that DFA poses a major threat to the security on block ciphers.

LBlock [8] proposed in ACNS 2011 is a 64-bit lightweight block cipher suitable for both constrained hardware environments such as wireless sensor network and software platforms. It is based on the 32-round variant Feistel structure with 64-bit block size and 80-bit key size. There were several cryptanalytic results on LBlock. For example, the proposers of LBlock explored the strength of LBlock against some attacks such as differential cryptanalysis, integral attack, and related-key attack [8]. Also, Karakoc et al. [9] and Liu et al. [10] proposed impossible differential cryptanalysis on a reduced version of LBlock, respectively. On the other hand, in [11], a differential fault analysis on LBlock was proposed. Based on a random bit fault model, the proposed attack needs at least 7 fault injections.

In this paper, we propose a differential fault analysis on LBlock. Based on the random nibble fault model, we consider two fault assumptions. In the first attack (Attack 1), it is assumed that several random nibble faults are injected to the input register of round 29. We can compute the exact fault position by checking the corresponding ciphertext differences. Based on the simulation results, this attack requires an exhaustive search of 2²⁵ and five random nibble faults on average, and can recover the 80-bit secret key of LBlock within a few seconds on a general PC. In the case of second attack (Attack 2), to recover the 80-bit secret key of LBlock, we inject several random nibble faults to the input register of round 30. This attack requires an exhaustive search of 2³⁰ and seven random nibble faults on average. It can also recover the 80-bit secret key of LBlock within 1 h on a general PC. Considering that the proposed attack in [11] requires at least 7 fault injections, our results are superior to it (see Table 1).

Table 1 Comparison between DFA results on LBlock

This paper is organized as follows. In the ‘Description of LBlock’ section, we briefly introduce the structure of LBlock. In the ‘Attack 1 - fault position: round 29’ and ‘Attack 2 - fault position: round 30’ sections, our attacks on LBlock are presented. Finally, in the last section, we give our conclusion.

Description of LBlock

In this section, we introduce the structure of LBlock briefly. The notations used in this paper are as follows. Here, a 32-bit value X = (X₇, X₆, ⋯, X₀), where X _i is a nibble value.

• P = (P^L, P^R): a 64-bit plaintext.

• C = (C^L, C^R): a 64-bit ciphertext.

• $I_r=(I_r^L,I_r^R)$: a 64-bit input value of round r (r = 1, 2, ⋯, 32).

• K _r  = (K_{r, 7}, K_{r, 6}, ⋯, K_{r, 0}): a 64-bit round key of round r.

LBlock is a 64-bit block cipher and supports the 80-bit secret key. As shown in Figure 1, the structure of LBlock is a 32-round iterative structure which is a variant of Feistel network. To generate a 64-bit ciphertext C = (C^L, C^R) from a 64-bit plaintext P = (P^L, P^R), LBlock executes the following procedure. Here, ⋘ is a left circular rotation.

• (1) $I_1=(I_1^L,I_r^1)\leftarrow (P^L,P^R)$.

• (2) For r = 1, 2, ⋯, 32, do the following:

  $$I_{r+1}=(I_{r+1}^L,I_{r+1}^R)=\left(F(I_r^L,K_r)\oplus (I_r^R⋘8),I_r^L\right).$$

• (3) $(C^L,C^R)\leftarrow (I_{33}^R,I_{33}^L)$.

• (4) Output C = (C ^L, C ^R) as a 64-bit ciphertext.

Figure 1

The structure of LBlock.

The round function F is defined as follows (see Figure 2). Here, S and P denote the confusion and diffusion functions.

$$\begin{array}{ll}F:{\{0,1\}}^{32}\times {\{0,1\}}^{32}& \to {\{0,1\}}^{32}\\ (X,K_r)& \mapsto U=P\left(S\right(X\oplus K_r\left)\right)\end{array}$$

Figure 2

Round function F of LBlock.

The confusion function S denotes the nonlinear layer of round function F. It consists of eight 4 × 4 S-boxes S _i in parallel (i = 1, 2, ⋯, 8). The contents of these S-boxes are listed in Table 2.

$$\begin{array}{ll}S:{\{0,1\}}^{32}& \to {\{0,1\}}^{32}\\ Y=(Y_7,Y_6,\cdots ,Y_0)& \mapsto Z=(Z_7,Z_6,\cdots ,Z_0)\\ Z_7=S_7\left(Y_7\right),Z_6=S_6\left(Y_6\right),& Z_5=S_5\left(Y_5\right),Z_4=S_4\left(Y_4\right)\\ Z_3=S_3\left(Y_3\right),Z_2=S_2\left(Y_2\right),& Z_1=S_1\left(Y_1\right),Z_0=S_0\left(Y_0\right).\end{array}$$

Table 2 Contents of S-boxes used in LBlock

The diffusion function P is defined as a permutation of eight nibble words, and it can be expressed as the following equations:

$$\begin{array}{ll}P:{\{0,1\}}^{32}& \to {\{0,1\}}^{32}\\ Z=(Z_7,Z_6,\cdots ,Z_0)& \mapsto U=(U_7,U_6,\cdots ,U_0)\\ U_7=Z_6,U_6=Z_4,& U_5=Z_7,U_4=Z_5\\ U_3=Z_2,U_2=Z_0,& U_1=Z_3,U_0=Z_1.\end{array}$$

The 80-bit secret key K is stored in a key register and denoted as K = (k₇₉, k₇₈, k₇₇, k₇₆, ⋯, k₁, k₀). Output the leftmost 32 bits of current content of register K as round subkey K₁, and then operate as follows:

For i = 1, 2, ⋯, 31, update the key register K as follows:

• (1) K ← (K ⋘ 29).

• (2) (k ₇₉, k ₇₈, k ₇₇, k ₇₆) = S ₉((k ₇₉, k ₇₈, k ₇₇, k ₇₆)).

• (3) (k ₇₅, k ₇₄, k ₇₃, k ₇₂) = S ₉((k ₇₅, k ₇₄, k ₇₃, k ₇₂)).

• (4) (k ₅₀, k ₄₉, k ₄₈, k ₄₇, k ₄₆) ← ((k ₅₀, k ₄₉, k ₄₈, k ₄₇, k ₄₆) ⊕ i).

• (5) Output the leftmost 32 bits of current content of register K as a round key K _i + 1 of round i + 1.

Table 3 presents the partial secret keys used in each round key of LBlock. For example, a round key K₂₉ of round 29 includes a 32-bit partial secret key (k₆₇, k₆₆, ⋯, k₃₇, k₃₆).

Table 3 Partial secret key used in round keys

Attack 1 - fault position: round 29

In this section, we propose DFA on LBlock, where the fault position is the input register of round 29. Our fault assumption includes the following assumptions:

• The attacker has the capability to choose one plaintext to encrypt and obtain the corresponding right/faulty ciphertexts.

• The attacker can induce random byte faults to the input register of round 29.

• The location and value of faults are both unknown.

From the above assumptions, a random nibble fault can be induced to the input byte register $I_{29,i}^L$ of round 29 (i = 0, 1, ⋯, 7). Note that in Attack 1, we do not consider events injecting random nibble faults to $I_{29,i}^R$. They are considered in Attack 2, where random nibble faults are injected to $I_{30,i}^L$. Thus, the number of all possible fault positions is 8. For the simplicity of notations, we denote each case by $E_{29,i}^L$. For example, $E_{29,7}^L$ means an event that a random nibble fault is injected to $I_{29,7}^L$.

Computation of the exact fault position

First, we assume that a random nibble fault was injected to $I_{29,7}^L$, that, is an event $E_{29,7}^L$ was occurred. Figure 3 presents the differential propagation under this assumption.

Figure 3

Attack 1 - event ${\mathit{E}}_{\mathbf{29}\mathbf{,}\mathbf{7}}^{\mathit{L}}$ .

According to our fault assumption, the input difference Δ I₂₉ of I₂₉ has the following pattern. Here, a ≠ 0.

$$\begin{array}{ll}\Delta I_{29}=\left[\Delta I_{29}^L,\Delta I_{29}^R\right]=& \left[(a,0,0,0,0,0,0,0),\right.\\ \left.(0,0,0,0,0,0,0,0)\right].\end{array}$$

Then, as shown in Figure 3, the output difference of round function F of round 29 is computed as follows. Here, b is an output difference of S-box S₇ taking a as an input difference (b = S₇(a)). Thus, the input difference of round 30 has the following pattern:

$$\begin{array}{ll}\Delta I_{30}=\left[\Delta I_{30}^L,\Delta I_{30}^R\right]=& \left[(0,0,b,0,0,0,0,0),\right.\\ \left.(a,0,0,0,0,0,0,0)\right].\end{array}$$

The input difference Δ I₃₁ of round 31 is computed as follows. Here, c is an output difference of S-box S₅ taking b as an input difference (c = S₅(b)). Note that, in round 30, a was moved from$\Delta I_{30,7}^R$ to$\Delta I_{31,1}^L$ by an 8-bit left circular rotation.

$$\begin{array}{ll}\Delta I_{31}=\left[\Delta I_{31}^L,\Delta I_{31}^R\right]=& \left[(0,0,0,c,0,0,a,0),\right.\\ \left.(0,0,b,0,0,0,0,0)\right].\end{array}$$

Similarly, the input difference Δ I₃₂ of round 32 has the following pattern. Here, d = S₄(a) and e = S₁(a).

$$\begin{array}{ll}\Delta I_{32}=\left[\Delta I_{32}^L,\Delta I_{32}^R\right]=& \left[(b,d,0,0,0,0,0,e),\right.\\ \left.(0,0,0,c,0,0,a,0)\right].\end{array}$$

Hence, when a random nibble fault was injected to$I_{29,7}^L$, that is an event$E_{29,7}^L$, the ciphertext difference has the following pattern.

Here, f = S₆(d), g = S₇(b), and h = S₀(e).

$$\mathrm{\Delta C}=\left[(b,d,0,0,0,0,0,e),(f,c,g,0,a,h,0,0)\right].$$

Other events$E_{29,i}^L$can be explained in a similar fashion (i = 0, 1, ⋯, 6). Table 4 shows the patterns of ciphertext differences for the positions of fault injections. Here, ‘?’ means a nonzero value. From this table, we can check that the patterns of the ciphertext differences for each event are different from each other. Thus, we can compute the exact fault position from the patterns of the ciphertext differences.

Table 4 Attack 1 - ciphertext differences for the positions of fault injections

Computation of round keys for each fault position

We assume that an event$E_{29,7}^L$ has occurred. That is, it is assumed that a random nibble fault was induced to$I_{29,7}^L$. In this case, we can compute 2²⁸ candidates of the 56-bit round key by executing the following procedure:

• (1) K _32,7. Guess 4-bit K _32,7 and compute the output difference of S-box S ₇ in round 32 (see red lines in Figure 3). Then, check that this value is equal to$\Delta C_5^R$. The probability passing this test is 2⁻⁴. Thus, we can expect that only the right K _32,7 has survived.

• (2) K _32,6. Guess 4-bit K _32,6 and compute the output difference of S-box S ₆ in round 32 (see red lines in Figure 3). Then, check that this value is equal to$\Delta C_7^R$. Since the filtering probability is 2⁻⁴, we can compute the right K _32,6.

• (3) K _32,0. Guess 4-bit K _32,0 and compute the output difference of S-box S ₀ in round 32 (see red lines in Figure 3). Then, check that this value is equal to$\Delta C_2^R$. The probability passing this test is 2⁻⁴. Thus, we can expect that only the right K _32,0 has survived.

• (4) (K _31,4, K _32,4). Guess 8-bit (K _31,4, K _32,4) and compute the output difference of S-box S ₄ in round 31 (see blue lines in Figure 3). Then, check that this value is equal to$\Delta C_6^L$. Since the filtering probability is 2⁻⁴, we can get 2⁴ candidates of (K _31,4, K _32,4).

• (5) (K _31,1, K _32,2). Guess 8-bit (K _31,1, K _32,2) and compute the output difference of S-box S ₁ in round 31 (see blue lines in Figure 3). Then, check that this value is equal to$\Delta C_0^L$. Since the filtering probability is 2⁻⁴, we can get 2⁴ candidates of (K _31,1, K _32,2).

• (6) (K _30,5, K _31,6, K _32,1). Guess 12-bit (K _30,5, K _31,6, K _32,1) and compute the output difference of S-box S ₅ in round 30 (see green lines in Figure 3). Then, check that this value is equal to$\Delta C_6^R$. Since the filtering probability is 2⁻⁴, we can get 2⁸ candidates of (K _30,5, K _31,6, K _32,1).

• (7) (K _29,7, K _30,3, K _31,7, K _32,3). Guess 16-bit (K _29,7, K _30,3, K _31,7, K _32,3) and compute the output difference of S-box S ₇ in round 29 (see bold black lines in Figure 3). Then, check that this value is equal to$\Delta C_7^L$. Since the filtering probability is 2⁻⁴, we can obtain 2¹² candidates of (K _29,7, K _30,3, K _31,7, K _32,3).

According to the above procedure, we can obtain 2²⁸ candidates of the following 56-bit round key by using one random nibble fault injected to$I_{29,7}^L$.

• (1) Round 29: K _29,7.

• (2) Round 30: (K _30,3, K _30,5).

• (3) Round 31: (K _31,1, K _31,4, K _31,6, K _31,7).

• (4) Round 32: (K _32,0, K _32,1, K _32,2, K _32,3, K _32,4, K _32,6, K _32,7).

Other events$E_{29,i}^L$ can be explained in a similar fashion (i = 0, 1, ⋯, 6). In detail, in each event, we can get 2²⁸ candidates of the 56-bit round keyp

• $E_{29,6}^L$

  • Round 29: K _29,6.

  • Round 30: (K _30,1, K _30,7).

  • Round 31: (K _31,0, K _31,2, K _31,3, K _31,5).

  • Round 32: (K _32,0, K _32,1, K _32,2, K _32,4, K _32,5, K _32,6, K _32,7).

• $E_{29,5}^L$

  • Round 29: K _29,5.

  • Round 30: (K _30,4, K _30,6).

  • Round 31: (K _31,1, K _31,4, K _31,6, K _31,7).

  • Round 32: (K _32,1, K _32,2, K _32,3, K _32,4, K _32,5, K _32,6, K _32,7).

• $E_{29,4}^L$

  • Round 29: K _29,4.

  • Round 30: (K _30,4, K _30,6).

  • Round 31: (K _31,1, K _31,4, K _31,6, K _31,7).

  • Round 32: (K _32,0, K _32,1, K _32,2, K _32,3, K _32,4, K _32,5, K _32,7).

• $E_{29,3}^L$

  • Round 29: K _29,3.

  • Round 30: (K _30,1, K _30,7).

  • Round 31: (K _31,0, K _31,2, K _31,3, K _31,5).

  • Round 32: (K _32,0, K _32,2, K _32,3, K _32,4, K _32,5, K _32,6, K _32,7).

• $E_{29,2}^L$

  • Round 29: K _29,2.

  • Round 30: (K _30,3, K _30,5).

  • Round 31: (K _31,1, K _31,4, K _31,6, K _31,7).

  • Round 32: (K _32,0, K _32,1, K _32,2, K _32,3, K _32,4, K _32,5, K _32,6).

• $E_{29,1}^L$

  • Round 29: K _29,1.

  • Round 30: (K _30,0, K _30,2).

  • Round 31: (K _31,0, K _31,2, K _31,3, K _31,5).

  • Round 32: (K _32,0, K _32,1, K _32,2, K _32,3, K _32,5, K _32,6, K _32,7).

• $E_{29,0}^L$

  • Round 29: K _29,0.

  • Round 30: (K _30,0, K _30,2).

  • Round 31: (K _31,0, K _31,2, K _31,3, K _31,5).

  • Round 32: (K _32,0, K _32,1, K _32,3, K _32,4, K _32,5, K _32,6, K _32,7).

Recovery of the secret key from candidates of round keys

In the previous subsection, we presented the method to obtain the candidates of round keys by injecting random nibble faults to the input register of round 29. In this subsection, we explain the method to recover candidates of the secret key of LBlock using candidates of round keys.

As shown in Table 3, the partial secret key used in (K₂₉, K₃₀, K₃₁, K₃₂) is as follows:

• K₂₉: (k₆₇, k₆₆, ⋯, k₃₇, k₃₆).

• K₃₀: (k₃₈, k₃₇, ⋯, k₈,k₇).

• K₃₁: (k₉, k₈, ⋯, k₀, k₇₉, k₇₈, ⋯, k₅₈).

• K₃₂: (k₆₀, k₅₉, ⋯, k₃₀, k₂₉).

From the above relation, (K₂₉, K₃₀, K₃₁, K₃₂) includes all 80-bit secret key information. Thus, from the keyschedule of LBlock, we can easily compute candidates of the secret key of LBlock by using candidates of round keys computed in the previous subsection. However, in the case that the number of candidates of round keys is very large, we require the exhaustive search with the large computational complexity. On the other hand, from the above relation, we can check that each round key include the common partial secret key information. Thus, if equations are constructed by using this property, we can decrease the number of candidates of the secret key of LBlock.

To decrease the number of candidates of the secret key, we consider equations as shown in Table 5. The total filtering probability is 2⁻⁴¹. Here, ‘ &’ means ‘AND’ operation, and$S_9^{-1}$ and$S_8^{-1}$ are the inverse functions of the S-boxes S₉ and S₈, respectively.

Table 5 Attack 1 - equations to decrease the number of candidates of the secret key

DFA on LBlock (Attack 1)

Now, we are ready to propose a differential fault analysis on LBlock under an assumption that random nibble faults are injected to the input register of round 29. Our attack procedure is as follows:

• (1) Collection of right ciphertext. Choose a plaintext P and obtain the corresponding right ciphertext C = (C ^L, C ^R).

• (2) Collection of faulty ciphertext. After inducing an i th random nibble fault to$I_{29}^L=(I_{29,7}^L,I_{29,6}^L,\cdots ,I_{29,0}^L)$ of round 29, get the corresponding faulty ciphertext C ⁱ(i = 1, ⋯, n).

• (3) Computation of fault positions. Compute Δ C ⁱ by using (C, C ⁱ) and then compute the exact fault positions from Table 4.

• (4) Computation of the candidates of (K ₂₉, K ₃₀, K ₃₁, K ₃₂). According to the fault positions computed in step 3, compute the candidates of (K ₂₉, K ₃₀, K ₃₁, K ₃₂) by using the method in ‘Computation of round keys for each fault position’ section.

• (5) Recovery of the 80-bit secret key. Using the method in ‘Recovery of the secret key from candidates of round keys’ section, compute the candidates of the secret key by using the candidates of (K ₂₉, K ₃₀, K ₃₁, K ₃₂). Then, recover the 80-bit secret key of LBlock by using one trial encryption.

We simulated our attack on a general PC 10,000 times. Based on the simulation results, we can obtain about 2²⁵ candidates of the secret key by using five fault injections on average. Thus, we do an exhaustive search for them. Since the filtering probability is 2⁻⁶⁴, the expected number of wrong secret keys passing our attack algorithm is 2⁻³⁹(= 2²⁵·2⁻⁶⁴). It means that the possibility that a wrong key can pass our attack algorithm is very low. Based on the simulation results, we can always recover the 80-bit secret key of LBlock within a few seconds by using five fault injections on average.

Attack 2 - fault position: round 30

In this section, we propose the second attack (Attack 2) where random nibble faults are induced to the input register of round 30. Since the attack procedure of Attack 2 is similar to that of Attack 1, we briefly discuss the attack procedure of Attack 2.

Our fault assumption is as follows.

• The attacker has the capability to choose one plaintext to encrypt and obtain the corresponding right/faulty ciphertexts.

• The attacker can induce random byte faults to the input register of round 30.

• The location and value of faults are both unknown.

From the above assumptions, a random nibble fault can be induced to the input byte register$I_{30,i}^L$ of round 30 (i = 0, 1, ⋯, 7). Note that, similarly to Attack 1, we do not also consider events injecting random nibble faults to$I_{30,i}^R$ in Attack 2. Thus, the number of all possible fault positions is 8.

Table 6 shows the patterns of ciphertext differences for the positions of fault injections in Attack 2. Here, ‘ ?’ means a nonzero value. For example, the differential propagation under an event$E_{30,7}^L$ is shown in Figure 4. From this table, we can check that the patterns of the ciphertext differences for each event are different from each other. Thus, in Attack 2, we can compute the exact fault position from the patterns of ciphertext differences.

Table 6 Attack 2 - ciphertext differences for the positions of fault injections

Figure 4

Attack 2 - event${\mathit{E}}_{\mathbf{30}\mathbf{,}\mathbf{7}}^{\mathit{L}}$.

Recall that, in Attack 1, we get 2²⁸ candidates of the 56-bit round key from one random nibble fault injection. In Attack 2, we obtain 2¹² candidates of the 28-bit round key from one random nibble fault injection.

• $E_{30,7}^L$

  • Round 30: K _30,7.

  • Round 31: (K _31,3,K _31,5).

  • Round 32: (K _32,1, K _32,4, K _32,5, K _32,6).

• $E_{30,6}^L$

  • Round 30: K _30,6.

  • Round 31: (K _31,1, K _31,7).

  • Round 32: (K _32,0, K _32,2, K _32,3, K _32,5).

• $E_{30,5}^L$

  • Round 30: K _30,5.

  • Round 31: (K _31,4, K _31,6).

  • Round 32: (K _32,1, K _32,4, K _32,6, K _32,7).

• $E_{30,4}^L$

  • Round 30: K _30,4.

  • Round 31: (K _31,4, K _31,6).

  • Round 32: (K _32,1, K _32,4, K _32,6, K _32,7).

• $E_{30,3}^L$

  • Round 30: K _30,3.

  • Round 31: (K _31,1, K _31,5).

  • Round 32: (K _32,0, K _32,2, K _32,5, K _32,6).

• $E_{30,2}^L$

  • Round 30: K _30,2.

  • Round 31: (K _31,3, K _31,5).

  • Round 32: (K _32,1, K _32,4, K _32,6, K _32,7).

• $E_{30,1}^L$

  • Round 30: K _30,1.

  • Round 31: (K _31,0, K _31,2).

  • Round 32: (K _32,0, K _32,2, K _32,3, K _32,5).

• $E_{30,0}^L$

  • Round 30: K _30,0.

  • Round 31: (K _31,0, K _31,2).

  • Round 32: (K _32,0, K _32,2, K _32,3, K _32,5).

Using the candidates of round keys, the method to compute the candidates of the secret key of LBlock in Attack 2 is similar to that in Attack 1. Recall that the partial secret key used in (K₃₀, K₃₁, K₃₂) is as follows:

• K₃₀: (k₃₈, k₃₇, ⋯, k₈, k₇).

• K₃₁: (k₉, k₈, ⋯, k₀, k₇₉, k₇₈, ⋯, k₅₈).

• K₃₂: (k₆₀, k₅₉, ⋯, k₃₀, k₂₉).

From the above relation, (K₃₀, K₃₁, K₃₂) includes all 80-bit secret key information. Thus, from the keyschedule of LBlock, we can easily compute candidates of the secret key of LBlock by using candidates of the round keys. To decrease the number of candidates of the secret key, we consider seven equations related to round 30 to 32 as shown in Table 5. The total filtering probability is 2⁻¹⁶.

The attack procedure of Attack 2 is as follows:

• (1) Collection of right ciphertext. Choose a plaintext P and obtain the corresponding right ciphertext C = (C ^L, C ^R).

• (2) Collection of faulty ciphertext. After inducing an i th random nibble fault to $I_{30}^L=(I_{30,7}^L,I_{30,6}^L,\cdots ,I_{30,0}^L)$ of round 30, get the corresponding faulty ciphertext C ⁱ(i = 1, ⋯, n).

• (3) Computation of fault positions. Compute Δ C ⁱ by using (C, C ⁱ) and then compute the exact fault positions from Table 6.

• (4) Computation of candidates of (K ₃₀, K ₃₁, K ₃₂). According to the fault positions computed in step 3, compute candidates of (K ₃₀, K ₃₁, K ₃₂).

• (5) Recovery of the 80-bit secret key. Compute candidates of the secret key by using the candidates of (K ₃₀, K ₃₁, K ₃₂). Then, recover the 80-bit secret key of LBlock by using one trial encryption.

We simulated our attack on a general PC 10,000 times. Based on the simulation results, we can obtain about 2³⁰ candidates of the secret key by using seven fault injections on average. Recall that we obtain 2¹² candidates of the 28-bit round key from one random nibble fault injection under Attack 2. Thus, to get the small number of candidates of the secret key, we need more fault injections than Attack 1. We do an exhaustive search for these candidates. Since the filtering probability is 2⁻⁶⁴, the expected number of wrong secret keys passing our attack algorithm is 2⁻³⁴(=2³⁰·2⁻⁶⁴). It means that the possibility that a wrong key can pass our attack algorithm is very low. Based on the simulation results, we can always recover the 80-bit secret key of LBlock within 1 h by using seven fault injections on average.

Conclusion

In this paper, we have presented DFA on LBlock suitable for wireless sensor networks. The proposed attack has two versions, Attack 1 and Attack 2. To recover the 80-bit LBlock, Attack 1 requires an exhaustive search of 2²⁵ and five random nibble fault injections on average. It is executed within a few seconds on a general PC. In the case of Attack 2, this attack is executed within 1 h by using seven random nibble faults. These results are superior to known differential fault analytic result on LBlock.