Open Access

Improved differential fault analysis on lightweight block cipher LBlock for wireless sensor networks

EURASIP Journal on Wireless Communications and Networking20132013:151

https://doi.org/10.1186/1687-1499-2013-151

Received: 3 April 2013

Accepted: 22 May 2013

Published: 3 June 2013

Abstract

LBlock is a 64-bit lightweight block cipher which can be implemented in both constrained hardware environments, such as wireless sensor network, and software platforms. In this paper, we study the security of LBlock against a differential fault analysis. Based on a random nibble fault model, we propose two versions of the attack on LBlock. In the first attack, we inject random nibble faults to the input register of round 29. As a result, it can recover the secret key of LBlock using an exhaustive search of 225 and five random nibble fault injections on average. This attack can be simulated on a general PC within a few seconds. In the case of second attack, random nibble faults are induced to the input register of round 30. This attack can recover the secret key of LBlock using an exhaustive search of 230 and seven random nibble fault injection on average. This attack can be simulated on a general PC within 1 h. These results are superior to known differential fault analytic result on LBlock.

Introduction

Differential fault analysis (DFA), one of the side channel attacks, was first proposed by Biham and Shamir on DES in 1997 [1]. This attack exploits faults within the computation of a cryptographic algorithm to reveal the secret information. So far, DFAs on many block ciphers such as DES, Piccolo, LED, SEED, and ARIA have been proposed [27]. It means that DFA poses a major threat to the security on block ciphers.

LBlock [8] proposed in ACNS 2011 is a 64-bit lightweight block cipher suitable for both constrained hardware environments such as wireless sensor network and software platforms. It is based on the 32-round variant Feistel structure with 64-bit block size and 80-bit key size. There were several cryptanalytic results on LBlock. For example, the proposers of LBlock explored the strength of LBlock against some attacks such as differential cryptanalysis, integral attack, and related-key attack [8]. Also, Karakoc et al. [9] and Liu et al. [10] proposed impossible differential cryptanalysis on a reduced version of LBlock, respectively. On the other hand, in [11], a differential fault analysis on LBlock was proposed. Based on a random bit fault model, the proposed attack needs at least 7 fault injections.

In this paper, we propose a differential fault analysis on LBlock. Based on the random nibble fault model, we consider two fault assumptions. In the first attack (Attack 1), it is assumed that several random nibble faults are injected to the input register of round 29. We can compute the exact fault position by checking the corresponding ciphertext differences. Based on the simulation results, this attack requires an exhaustive search of 225 and five random nibble faults on average, and can recover the 80-bit secret key of LBlock within a few seconds on a general PC. In the case of second attack (Attack 2), to recover the 80-bit secret key of LBlock, we inject several random nibble faults to the input register of round 30. This attack requires an exhaustive search of 230 and seven random nibble faults on average. It can also recover the 80-bit secret key of LBlock within 1 h on a general PC. Considering that the proposed attack in [11] requires at least 7 fault injections, our results are superior to it (see Table 1).
Table 1

Comparison between DFA results on LBlock

Reference

Fault

Fault

Number of

Exhaustive

 

assumption

position

fault injection

search

[11]

Random bit

Round 25 to 31

7

-

This paper

Random nibble

Round 29

5

225

(Attack 1)

    

This paper

Random nibble

Round 30

7

230

(Attack 2)

    

This paper is organized as follows. In the ‘Description of LBlock’ section, we briefly introduce the structure of LBlock. In the ‘Attack 1 - fault position: round 29’ and ‘Attack 2 - fault position: round 30’ sections, our attacks on LBlock are presented. Finally, in the last section, we give our conclusion.

Description of LBlock

In this section, we introduce the structure of LBlock briefly. The notations used in this paper are as follows. Here, a 32-bit value X = (X7, X6, , X0), where X i is a nibble value.

  • P = (P L , P R ): a 64-bit plaintext.

  • C = (C L , C R ): a 64-bit ciphertext.

  • I r = ( I r L , I r R ) : a 64-bit input value of round r (r = 1, 2, , 32).

  • K r  = (Kr, 7, Kr, 6, , Kr, 0): a 64-bit round key of round r.

LBlock is a 64-bit block cipher and supports the 80-bit secret key. As shown in Figure 1, the structure of LBlock is a 32-round iterative structure which is a variant of Feistel network. To generate a 64-bit ciphertext C = (C L , C R ) from a 64-bit plaintext P = (P L , P R ), LBlock executes the following procedure. Here, is a left circular rotation.
  1. (1)

    I 1 = ( I 1 L , I r 1 ) ( P L , P R ) .

     
  2. (2)
    For r = 1, 2, , 32, do the following:
    I r + 1 = ( I r + 1 L , I r + 1 R ) = F ( I r L , K r ) ( I r R 8 ) , I r L .
     
  3. (3)

    ( C L , C R ) ( I 33 R , I 33 L ) .

     
  4. (4)

    Output C = (C L , C R ) as a 64-bit ciphertext.

     
Figure 1

The structure of LBlock.

The round function F is defined as follows (see Figure 2). Here, S and P denote the confusion and diffusion functions.
F : { 0 , 1 } 32 × { 0 , 1 } 32 { 0 , 1 } 32 ( X , K r ) U = P ( S ( X K r ) )
Figure 2

Round function F of LBlock.

The confusion function S denotes the nonlinear layer of round function F. It consists of eight 4 × 4 S-boxes S i in parallel (i = 1, 2, , 8). The contents of these S-boxes are listed in Table 2.
S : { 0 , 1 } 32 { 0 , 1 } 32 Y = ( Y 7 , Y 6 , , Y 0 ) Z = ( Z 7 , Z 6 , , Z 0 ) Z 7 = S 7 ( Y 7 ) , Z 6 = S 6 ( Y 6 ) , Z 5 = S 5 ( Y 5 ) , Z 4 = S 4 ( Y 4 ) Z 3 = S 3 ( Y 3 ) , Z 2 = S 2 ( Y 2 ) , Z 1 = S 1 ( Y 1 ) , Z 0 = S 0 ( Y 0 ) .
Table 2

Contents of S-boxes used in LBlock

S-box

Contents

S 0

14, 9, 15, 0, 13, 4, 10, 11, 1, 2, 8, 3, 7, 6, 12, 5

S 1

4, 11, 14, 9, 15, 13, 0, 10, 7, 12, 5, 6, 2, 8, 1, 3

S 2

1, 14, 7, 12, 15, 13, 0, 6, 11, 5, 9, 3, 2, 4, 8, 10

S 3

7, 6, 8, 11, 0, 15, 3, 14, 9, 10, 12, 13, 5, 2, 4, 1

S 4

14, 5, 15, 0, 7, 2, 12, 13, 1, 8, 4, 9, 11, 10, 6, 3

S 5

2, 13, 11, 12, 15, 14, 0, 9, 7, 10, 6, 3, 1, 8, 4, 5

S 6

11, 9, 4, 14, 0, 15, 10, 13, 6, 12, 5, 7, 3, 8, 1, 2

S 7

13, 10, 15, 0, 14, 4, 9, 11, 2, 1, 8, 3, 7, 5, 12, 6

S 8

14, 9, 15, 0, 13, 4, 10, 11, 1, 2, 8, 3, 7, 6, 12, 5

S 9

4, 11, 14, 9, 15, 13, 0, 10, 7, 12, 5, 6, 2, 8, 1, 3

The diffusion function P is defined as a permutation of eight nibble words, and it can be expressed as the following equations:
P : { 0 , 1 } 32 { 0 , 1 } 32 Z = ( Z 7 , Z 6 , , Z 0 ) U = ( U 7 , U 6 , , U 0 ) U 7 = Z 6 , U 6 = Z 4 , U 5 = Z 7 , U 4 = Z 5 U 3 = Z 2 , U 2 = Z 0 , U 1 = Z 3 , U 0 = Z 1 .

The 80-bit secret key K is stored in a key register and denoted as K = (k79, k78, k77, k76, , k1, k0). Output the leftmost 32 bits of current content of register K as round subkey K1, and then operate as follows:

For i = 1, 2, , 31, update the key register K as follows:
  1. (1)

    K ← (K 29).

     
  2. (2)

    (k 79, k 78, k 77, k 76) = S 9((k 79, k 78, k 77, k 76)).

     
  3. (3)

    (k 75, k 74, k 73, k 72) = S 9((k 75, k 74, k 73, k 72)).

     
  4. (4)

    (k 50, k 49, k 48, k 47, k 46) ← ((k 50, k 49, k 48, k 47, k 46) i).

     
  5. (5)

    Output the leftmost 32 bits of current content of register K as a round key K i + 1 of round i + 1.

     
Table 3 presents the partial secret keys used in each round key of LBlock. For example, a round key K29 of round 29 includes a 32-bit partial secret key (k67, k66, , k37, k36).
Table 3

Partial secret key used in round keys

Round

Partial secret key

1

(k79, k78, , k49, k48)

2

(k50, k49, , k20, k19)

29

(k67, k66, , k37, k36)

30

(k38, k37, , k8, k7)

31

(k9, k8, , k0, k79, k78, , k58)

32

(k60, k59, , k30, k29)

Attack 1 - fault position: round 29

In this section, we propose DFA on LBlock, where the fault position is the input register of round 29. Our fault assumption includes the following assumptions:

  • The attacker has the capability to choose one plaintext to encrypt and obtain the corresponding right/faulty ciphertexts.

  • The attacker can induce random byte faults to the input register of round 29.

  • The location and value of faults are both unknown.

From the above assumptions, a random nibble fault can be induced to the input byte register I 29 , i L of round 29 (i = 0, 1, , 7). Note that in Attack 1, we do not consider events injecting random nibble faults to I 29 , i R . They are considered in Attack 2, where random nibble faults are injected to I 30 , i L . Thus, the number of all possible fault positions is 8. For the simplicity of notations, we denote each case by E 29 , i L . For example, E 29 , 7 L means an event that a random nibble fault is injected to I 29 , 7 L .

Computation of the exact fault position

First, we assume that a random nibble fault was injected to I 29 , 7 L , that, is an event E 29 , 7 L was occurred. Figure 3 presents the differential propagation under this assumption.
Figure 3

Attack 1 - event E 29 , 7 L .

According to our fault assumption, the input difference Δ I29 of I29 has the following pattern. Here, a ≠ 0.
Δ I 29 = Δ I 29 L , Δ I 29 R = ( a , 0 , 0 , 0 , 0 , 0 , 0 , 0 ) , ( 0 , 0 , 0 , 0 , 0 , 0 , 0 , 0 ) .
Then, as shown in Figure 3, the output difference of round function F of round 29 is computed as follows. Here, b is an output difference of S-box S7 taking a as an input difference (b = S7(a)). Thus, the input difference of round 30 has the following pattern:
Δ I 30 = Δ I 30 L , Δ I 30 R = ( 0 , 0 , b , 0 , 0 , 0 , 0 , 0 ) , ( a , 0 , 0 , 0 , 0 , 0 , 0 , 0 ) .
The input difference Δ I31 of round 31 is computed as follows. Here, c is an output difference of S-box S5 taking b as an input difference (c = S5(b)). Note that, in round 30, a was moved from Δ I 30 , 7 R to Δ I 31 , 1 L by an 8-bit left circular rotation.
Δ I 31 = Δ I 31 L , Δ I 31 R = ( 0 , 0 , 0 , c , 0 , 0 , a , 0 ) , ( 0 , 0 , b , 0 , 0 , 0 , 0 , 0 ) .
Similarly, the input difference Δ I32 of round 32 has the following pattern. Here, d = S4(a) and e = S1(a).
Δ I 32 = Δ I 32 L , Δ I 32 R = ( b , d , 0 , 0 , 0 , 0 , 0 , e ) , ( 0 , 0 , 0 , c , 0 , 0 , a , 0 ) .

Hence, when a random nibble fault was injected to I 29 , 7 L , that is an event E 29 , 7 L , the ciphertext difference has the following pattern.

Here, f = S6(d), g = S7(b), and h = S0(e).
ΔC = ( b , d , 0 , 0 , 0 , 0 , 0 , e ) , ( f , c , g , 0 , a , h , 0 , 0 ) .
Other events E 29 , i L can be explained in a similar fashion (i = 0, 1, , 6). Table 4 shows the patterns of ciphertext differences for the positions of fault injections. Here, ‘?’ means a nonzero value. From this table, we can check that the patterns of the ciphertext differences for each event are different from each other. Thus, we can compute the exact fault position from the patterns of the ciphertext differences.
Table 4

Attack 1 - ciphertext differences for the positions of fault injections

Event

Ciphertext difference

E 29 , 7 L

[(?, ?, 0, 0, 0, 0, 0, ?), (?, ?, ?, 0, ?, ?, 0, 0)]

E 29 , 6 L

[(0, 0, 0, ?, 0, ?, ?, 0), (?, ?, 0, 0, ?, ?, 0, ?)]

E 29 , 5 L

[(?, ?, ?, 0, 0, 0, 0, 0), (?, 0, ?, ?, 0, 0, ?, ?)]

E 29 , 4 L

[(?, 0, ?, 0, 0, 0, 0, ?), (0, 0, ?, ?, 0, ?, ?, ?)]

E 29 , 3 L

[(0, 0, 0, ?, ?, ?, 0, 0), (?, ?, 0, 0, ?, ?, ?, 0)]

E 29 , 2 L

[(0, ?, ?, 0, 0, 0, 0, ?), (?, ?, 0, ?, ?, ?, 0, 0)]

E 29 , 1 L

[(0, 0, 0, 0, ?, ?, ?, 0), (0, 0, ?, ?, ?, 0, ?, ?)]

E 29 , 0 L

[(0, 0, 0, ?, ?, 0, ?, 0), (0, ?, ?, ?, 0, 0, ?, ?)]

Computation of round keys for each fault position

We assume that an event E 29 , 7 L has occurred. That is, it is assumed that a random nibble fault was induced to I 29 , 7 L . In this case, we can compute 228 candidates of the 56-bit round key by executing the following procedure:
  1. (1)

    K 32,7. Guess 4-bit K 32,7 and compute the output difference of S-box S 7 in round 32 (see red lines in Figure 3). Then, check that this value is equal to Δ C 5 R . The probability passing this test is 2−4. Thus, we can expect that only the right K 32,7 has survived.

     
  2. (2)

    K 32,6. Guess 4-bit K 32,6 and compute the output difference of S-box S 6 in round 32 (see red lines in Figure 3). Then, check that this value is equal to Δ C 7 R . Since the filtering probability is 2−4, we can compute the right K 32,6.

     
  3. (3)

    K 32,0. Guess 4-bit K 32,0 and compute the output difference of S-box S 0 in round 32 (see red lines in Figure 3). Then, check that this value is equal to Δ C 2 R . The probability passing this test is 2−4. Thus, we can expect that only the right K 32,0 has survived.

     
  4. (4)

    (K 31,4, K 32,4). Guess 8-bit (K 31,4, K 32,4) and compute the output difference of S-box S 4 in round 31 (see blue lines in Figure 3). Then, check that this value is equal to Δ C 6 L . Since the filtering probability is 2−4, we can get 24 candidates of (K 31,4, K 32,4).

     
  5. (5)

    (K 31,1, K 32,2). Guess 8-bit (K 31,1, K 32,2) and compute the output difference of S-box S 1 in round 31 (see blue lines in Figure 3). Then, check that this value is equal to Δ C 0 L . Since the filtering probability is 2−4, we can get 24 candidates of (K 31,1, K 32,2).

     
  6. (6)

    (K 30,5, K 31,6, K 32,1). Guess 12-bit (K 30,5, K 31,6, K 32,1) and compute the output difference of S-box S 5 in round 30 (see green lines in Figure 3). Then, check that this value is equal to Δ C 6 R . Since the filtering probability is 2−4, we can get 28 candidates of (K 30,5, K 31,6, K 32,1).

     
  7. (7)

    (K 29,7, K 30,3, K 31,7, K 32,3). Guess 16-bit (K 29,7, K 30,3, K 31,7, K 32,3) and compute the output difference of S-box S 7 in round 29 (see bold black lines in Figure 3). Then, check that this value is equal to Δ C 7 L . Since the filtering probability is 2−4, we can obtain 212 candidates of (K 29,7, K 30,3, K 31,7, K 32,3).

     
According to the above procedure, we can obtain 2 28 candidates of the following 56-bit round key by using one random nibble fault injected to I 29 , 7 L .
  1. (1)

    Round 29: K 29,7.

     
  2. (2)

    Round 30: (K 30,3, K 30,5).

     
  3. (3)

    Round 31: (K 31,1, K 31,4, K 31,6, K 31,7).

     
  4. (4)

    Round 32: (K 32,0, K 32,1, K 32,2, K 32,3, K 32,4, K 32,6, K 32,7).

     

Other events E 29 , i L can be explained in a similar fashion (i = 0, 1, , 6). In detail, in each event, we can get 2 28 candidates of the 56-bit round keyp

  • E 29 , 6 L
    • Round 29: K 29,6.

    • Round 30: (K 30,1, K 30,7).

    • Round 31: (K 31,0, K 31,2, K 31,3, K 31,5).

    • Round 32: (K 32,0, K 32,1, K 32,2, K 32,4, K 32,5, K 32,6, K 32,7).

  • E 29 , 5 L
    • Round 29: K 29,5.

    • Round 30: (K 30,4, K 30,6).

    • Round 31: (K 31,1, K 31,4, K 31,6, K 31,7).

    • Round 32: (K 32,1, K 32,2, K 32,3, K 32,4, K 32,5, K 32,6, K 32,7).

  • E 29 , 4 L
    • Round 29: K 29,4.

    • Round 30: (K 30,4, K 30,6).

    • Round 31: (K 31,1, K 31,4, K 31,6, K 31,7).

    • Round 32: (K 32,0, K 32,1, K 32,2, K 32,3, K 32,4, K 32,5, K 32,7).

  • E 29 , 3 L
    • Round 29: K 29,3.

    • Round 30: (K 30,1, K 30,7).

    • Round 31: (K 31,0, K 31,2, K 31,3, K 31,5).

    • Round 32: (K 32,0, K 32,2, K 32,3, K 32,4, K 32,5, K 32,6, K 32,7).

  • E 29 , 2 L
    • Round 29: K 29,2.

    • Round 30: (K 30,3, K 30,5).

    • Round 31: (K 31,1, K 31,4, K 31,6, K 31,7).

    • Round 32: (K 32,0, K 32,1, K 32,2, K 32,3, K 32,4, K 32,5, K 32,6).

  • E 29 , 1 L
    • Round 29: K 29,1.

    • Round 30: (K 30,0, K 30,2).

    • Round 31: (K 31,0, K 31,2, K 31,3, K 31,5).

    • Round 32: (K 32,0, K 32,1, K 32,2, K 32,3, K 32,5, K 32,6, K 32,7).

  • E 29 , 0 L
    • Round 29: K 29,0.

    • Round 30: (K 30,0, K 30,2).

    • Round 31: (K 31,0, K 31,2, K 31,3, K 31,5).

    • Round 32: (K 32,0, K 32,1, K 32,3, K 32,4, K 32,5, K 32,6, K 32,7).

Recovery of the secret key from candidates of round keys

In the previous subsection, we presented the method to obtain the candidates of round keys by injecting random nibble faults to the input register of round 29. In this subsection, we explain the method to recover candidates of the secret key of LBlock using candidates of round keys.

As shown in Table 3, the partial secret key used in (K29, K30, K31, K32) is as follows:

  • K29: (k67, k66, , k37, k36).

  • K30: (k38, k37, , k8,k7).

  • K31: (k9, k8, , k0, k79, k78, , k58).

  • K32: (k60, k59, , k30, k29).

From the above relation, (K29, K30, K31, K32) includes all 80-bit secret key information. Thus, from the keyschedule of LBlock, we can easily compute candidates of the secret key of LBlock by using candidates of round keys computed in the previous subsection. However, in the case that the number of candidates of round keys is very large, we require the exhaustive search with the large computational complexity. On the other hand, from the above relation, we can check that each round key include the common partial secret key information. Thus, if equations are constructed by using this property, we can decrease the number of candidates of the secret key of LBlock.

To decrease the number of candidates of the secret key, we consider equations as shown in Table 5. The total filtering probability is 2−41. Here, ‘ &’ means ‘AND’ operation, and S 9 1 and S 8 1 are the inverse functions of the S-boxes S9 and S8, respectively.
Table 5

Attack 1 - equations to decrease the number of candidates of the secret key

Related secret key

Equation

Filtering probability

(k58, k59, k60)

{ ( S 9 1 [ K 32 , 7 ] ) 1 } = ( K 32 , 0 & 0 x 7 )

2 −3

(k37, k38)

(K32,2&0x 3) = (K30,7 2)

2 −2

(k35, k36)

(K32,12) = (K30,7&0x 3)

2 −2

(k33, k34)

(K32,1&0x 3) = (K30,6 2)

2 −2

(k31, k32)

{(K32,0 2)  0x 1} = (K30,6&0x 3)

2 −2

(k29, k30)

{(K32,0&0x 3)  0x 3} = (K30,5 2)

2 −2

(k7, k8, k9)

{ ( S 9 1 [ K 31 , 7 ] ) 1 } = ( K 30 , 0 & 0 x 7 )

2 −3

k 60

[ { ( S 9 1 [ K 32 , 7 ] ) 3 } 0 x 1 ] = ( K 29 , 6 & 0 x 1 )

2 −1

(k57, k58, k59)

[ { ( S 9 1 [ K 32 , 7 ] ) & 0 x 7 } 0 x 7 ] = ( K 29 , 5 1 )

2 −3

k 56

{ ( S 8 1 [ K 32 , 6 ] ) 3 } = ( K 29 , 5 & 0 x 1 )

2 −1

(k53, k54, k55)

{ ( S 8 1 [ K 32 , 6 ] ) & 0 x 7 } = ( K 29 , 4 3 )

2 −3

k 52

(K32,5 3) = (K29,4&0x 1)

2 −1

(k49, k50, k51)

(K32,5&0x 7) = (K29,3 1)

2 −3

k 48

(K32,4 3) = (K29,3&0x 1)

2 −1

(k45, k46, k47)

(K32,4&0x 7) = (K29,2 1)

2 −3

k 44

(K32,3 3) = (K29,2&0x 1)

2 −1

(k41, k42, k43)

(K32,3&0x 7) = (K29,1 1)

2 −3

k 40

(K32,2 3) = (K29,1&0x 1)

2 −1

k 39

{(K32,2 2)&0x 1} = (K29,0 3)

2 −1

(k36, k37, k38)

{ ( S 9 1 [ K 30 , 7 ] ) 1 } = ( K 29 , 0 & 0 x 7 )

2 −3

DFA on LBlock (Attack 1)

Now, we are ready to propose a differential fault analysis on LBlock under an assumption that random nibble faults are injected to the input register of round 29. Our attack procedure is as follows:
  1. (1)

    Collection of right ciphertext. Choose a plaintext P and obtain the corresponding right ciphertext C = (C L , C R ).

     
  2. (2)

    Collection of faulty ciphertext. After inducing an i th random nibble fault to I 29 L = ( I 29 , 7 L , I 29 , 6 L , , I 29 , 0 L ) of round 29, get the corresponding faulty ciphertext C i (i = 1, , n).

     
  3. (3)

    Computation of fault positions. Compute Δ C i by using (C, C i ) and then compute the exact fault positions from Table 4.

     
  4. (4)

    Computation of the candidates of (K 29, K 30, K 31, K 32). According to the fault positions computed in step 3, compute the candidates of (K 29, K 30, K 31, K 32) by using the method in ‘Computation of round keys for each fault position’ section.

     
  5. (5)

    Recovery of the 80-bit secret key. Using the method in ‘Recovery of the secret key from candidates of round keys’ section, compute the candidates of the secret key by using the candidates of (K 29, K 30, K 31, K 32). Then, recover the 80-bit secret key of LBlock by using one trial encryption.

     

We simulated our attack on a general PC 10,000 times. Based on the simulation results, we can obtain about 2 25 candidates of the secret key by using five fault injections on average. Thus, we do an exhaustive search for them. Since the filtering probability is 2 −64 , the expected number of wrong secret keys passing our attack algorithm is 2 −39 (= 2 25 ·2 −64 ). It means that the possibility that a wrong key can pass our attack algorithm is very low. Based on the simulation results, we can always recover the 80-bit secret key of LBlock within a few seconds by using five fault injections on average.

Attack 2 - fault position: round 30

In this section, we propose the second attack (Attack 2) where random nibble faults are induced to the input register of round 30. Since the attack procedure of Attack 2 is similar to that of Attack 1, we briefly discuss the attack procedure of Attack 2.

Our fault assumption is as follows.

  • The attacker has the capability to choose one plaintext to encrypt and obtain the corresponding right/faulty ciphertexts.

  • The attacker can induce random byte faults to the input register of round 30.

  • The location and value of faults are both unknown.

From the above assumptions, a random nibble fault can be induced to the input byte register I 30 , i L of round 30 (i = 0, 1, , 7). Note that, similarly to Attack 1, we do not also consider events injecting random nibble faults to I 30 , i R in Attack 2. Thus, the number of all possible fault positions is 8.

Table 6 shows the patterns of ciphertext differences for the positions of fault injections in Attack 2. Here, ‘ ?’ means a nonzero value. For example, the differential propagation under an event E 30 , 7 L is shown in Figure 4. From this table, we can check that the patterns of the ciphertext differences for each event are different from each other. Thus, in Attack 2, we can compute the exact fault position from the patterns of ciphertext differences.
Table 6

Attack 2 - ciphertext differences for the positions of fault injections

Event

Ciphertext difference

E 30 , 7 L

[(0, 0, 0, ?, 0, 0, ?, 0), (?, ?, 0, 0, 0, 0, 0, ?)]

E 30 , 6 L

[(0, 0, ?, 0, 0, 0, 0, ?), (0, 0, 0, ?, 0, 0, ?, ?)]

E 30 , 5 L

[(?, ?, 0, 0, 0, 0, 0, 0), (?, ?, ?, 0, 0, 0, 0, 0)]

E 30 , 4 L

[(?, ?, 0, 0, 0, 0, 0, 0), (?, 0, ?, 0, 0, 0, 0, ?)]

E 30 , 3 L

[(0, 0, ?, 0, 0, 0, 0, ?), (0, 0, 0, ?, ?, ?, 0, 0)]

E 30 , 2 L

[(0, 0, 0, ?, 0, 0, ?, 0), (0, ?, ?, 0, 0, 0, 0, ?)]

E 30 , 1 L

[(0, 0, 0, 0, ?, ?, 0, 0), (0, 0, 0, 0, ?, ?, ?, 0)]

E 30 , 0 L

[(0, 0, 0, 0, ?, ?, 0, 0), (0, 0, 0, ?, ?, 0, ?, 0)]

Figure 4

Attack 2 - event E 30 , 7 L .

Recall that, in Attack 1, we get 228 candidates of the 56-bit round key from one random nibble fault injection. In Attack 2, we obtain 212 candidates of the 28-bit round key from one random nibble fault injection.

  • E 30 , 7 L
    • Round 30: K 30,7.

    • Round 31: (K 31,3,K 31,5).

    • Round 32: (K 32,1, K 32,4, K 32,5, K 32,6).

  • E 30 , 6 L
    • Round 30: K 30,6.

    • Round 31: (K 31,1, K 31,7).

    • Round 32: (K 32,0, K 32,2, K 32,3, K 32,5).

  • E 30 , 5 L
    • Round 30: K 30,5.

    • Round 31: (K 31,4, K 31,6).

    • Round 32: (K 32,1, K 32,4, K 32,6, K 32,7).

  • E 30 , 4 L
    • Round 30: K 30,4.

    • Round 31: (K 31,4, K 31,6).

    • Round 32: (K 32,1, K 32,4, K 32,6, K 32,7).

  • E 30 , 3 L
    • Round 30: K 30,3.

    • Round 31: (K 31,1, K 31,5).

    • Round 32: (K 32,0, K 32,2, K 32,5, K 32,6).

  • E 30 , 2 L
    • Round 30: K 30,2.

    • Round 31: (K 31,3, K 31,5).

    • Round 32: (K 32,1, K 32,4, K 32,6, K 32,7).

  • E 30 , 1 L
    • Round 30: K 30,1.

    • Round 31: (K 31,0, K 31,2).

    • Round 32: (K 32,0, K 32,2, K 32,3, K 32,5).

  • E 30 , 0 L
    • Round 30: K 30,0.

    • Round 31: (K 31,0, K 31,2).

    • Round 32: (K 32,0, K 32,2, K 32,3, K 32,5).

Using the candidates of round keys, the method to compute the candidates of the secret key of LBlock in Attack 2 is similar to that in Attack 1. Recall that the partial secret key used in (K30, K31, K32) is as follows:

  • K30: (k38, k37, , k8, k7).

  • K31: (k9, k8, , k0, k79, k78, , k58).

  • K32: (k60, k59, , k30, k29).

From the above relation, (K30, K31, K32) includes all 80-bit secret key information. Thus, from the keyschedule of LBlock, we can easily compute candidates of the secret key of LBlock by using candidates of the round keys. To decrease the number of candidates of the secret key, we consider seven equations related to round 30 to 32 as shown in Table 5. The total filtering probability is 2−16.

The attack procedure of Attack 2 is as follows:
  1. (1)

    Collection of right ciphertext. Choose a plaintext P and obtain the corresponding right ciphertext C = (C L , C R ).

     
  2. (2)

    Collection of faulty ciphertext. After inducing an i th random nibble fault to I 30 L = ( I 30 , 7 L , I 30 , 6 L , , I 30 , 0 L ) of round 30, get the corresponding faulty ciphertext C i (i = 1, , n).

     
  3. (3)

    Computation of fault positions. Compute Δ C i by using (C, C i ) and then compute the exact fault positions from Table 6.

     
  4. (4)

    Computation of candidates of (K 30, K 31, K 32). According to the fault positions computed in step 3, compute candidates of (K 30, K 31, K 32).

     
  5. (5)

    Recovery of the 80-bit secret key. Compute candidates of the secret key by using the candidates of (K 30, K 31, K 32). Then, recover the 80-bit secret key of LBlock by using one trial encryption.

     

We simulated our attack on a general PC 10,000 times. Based on the simulation results, we can obtain about 230 candidates of the secret key by using seven fault injections on average. Recall that we obtain 212 candidates of the 28-bit round key from one random nibble fault injection under Attack 2. Thus, to get the small number of candidates of the secret key, we need more fault injections than Attack 1. We do an exhaustive search for these candidates. Since the filtering probability is 2−64, the expected number of wrong secret keys passing our attack algorithm is 2−34(=230·2−64). It means that the possibility that a wrong key can pass our attack algorithm is very low. Based on the simulation results, we can always recover the 80-bit secret key of LBlock within 1 h by using seven fault injections on average.

Conclusion

In this paper, we have presented DFA on LBlock suitable for wireless sensor networks. The proposed attack has two versions, Attack 1 and Attack 2. To recover the 80-bit LBlock, Attack 1 requires an exhaustive search of 225 and five random nibble fault injections on average. It is executed within a few seconds on a general PC. In the case of Attack 2, this attack is executed within 1 h by using seven random nibble faults. These results are superior to known differential fault analytic result on LBlock.

Declarations

Acknowledgements

This work was supported by a Korea University grant for author KJ. Also, this research was supported by the The Ministry of Knowledge Economy (MKE), Korea, under the Information Technology Research Center (ITRC) support program (NIPA-2013-H0301–13-3007) supervised by the National IT Industry Promotion Agency (NIPA).

Authors’ Affiliations

(1)
Center for Information Security Technologies (CIST), Korea University
(2)
Department of Computer Science and Engineering, Seoul National University of Science and Technology

References

  1. Biham E, Shamir A: Differential fault analysis of secret key cryptosystems. In Proceedings of Advances in Cryptology - CRYPTO 1997. Edited by: Kaliski B. Berlin: Springer; 1997:513-525.Google Scholar
  2. Jeong K, Sung J, Hong S, Lee C: A new approach of differential fault analysis on block ciphers with s-box. Inf. - An Int. Interdiscip. J 2013, 16(3(A):1915-1928.MathSciNetMATHGoogle Scholar
  3. Jeong K: Security analysis of block cipher piccolo suitable for wireless sensor networks. Peer-to-Peer Netw. Appl 2013. 10.1007/s12,083--012--0196--9Google Scholar
  4. Jeong K, Lee C: Differential fault analysis on block cipher led-64. In Proceedings of The 6th International Symposium on Digital Forensics and Information Security(DFIS-12). Edited by: Park J, Leung V, Wang C, Shon T. Netherlands: Springer; 2012:747-755.Google Scholar
  5. Jeong K, Lee Y, Sung J, Hong S: Differential fault analysis on block cipher seed. Math. Comput. Model 2012, 55(1–2):26-34.MathSciNetView ArticleMATHGoogle Scholar
  6. Li W, Gu D, Li J: Differential fault analysis on the aria algorithm. Inf. Sci 2008, 178(19):3727-3737. 10.1016/j.ins.2008.05.031View ArticleGoogle Scholar
  7. Malhotra R, Jain A: Fault prediction using statistical and machine learning methods for improving software quality. JIPS 2012, 8(2):241-262.Google Scholar
  8. Wu W, Zhang L: Lblock: A lightweight block cipher. In Proceedings of ACNS 2011. Edited by: Lopez J, Tsudik G. Berlin: Springer; 2011:327-344.Google Scholar
  9. Karakoc F, Demirci J, Harmanci A: Impossible differential cryptanalysis on reduced-round Lblock. In Proceedings of WISTP 2012. Edited by: Posegga J, Askoxylakis I, Pohls H. Berlin: Springer; 2012:179-188.Google Scholar
  10. Liu Y, Gu D, Liu Z, Li W: Impossible differential attacks on reduced-round Lblock. In Proceedings of ISPEC 2012. Edited by: Ryan M, Smyth B, Wang G. Berlin: Springer; 2012:97-108.Google Scholar
  11. Zhao L, Nishide T, Sakurai K: Differential fault analysis of full Lblock. In Proceedings of COSADE 2012. Edited by: Huss S, Schindler W. Berlin: Springer; 2012:135-150.Google Scholar

Copyright

© Jeong et al.; licensee Springer. 2013

This article is published under license to BioMed Central Ltd. This is an Open Access article distributed under the terms of the Creative Commons Attribution License (http://creativecommons.org/licenses/by/2.0), which permits unrestricted use, distribution, and reproduction in any medium, provided the original work is properly cited.