Improved differential fault analysis on lightweight block cipher LBlock for wireless sensor networks

LBlock is a 64-bit lightweight block cipher which can be implemented in both constrained hardware environments, such as wireless sensor network, and software platforms. In this paper, we study the security of LBlock against a differential fault analysis. Based on a random nibble fault model, we propose two versions of the attack on LBlock. In the first attack, we inject random nibble faults to the input register of round 29. As a result, it can recover the secret key of LBlock using an exhaustive search of 225 and five random nibble fault injections on average. This attack can be simulated on a general PC within a few seconds. In the case of second attack, random nibble faults are induced to the input register of round 30. This attack can recover the secret key of LBlock using an exhaustive search of 230 and seven random nibble fault injection on average. This attack can be simulated on a general PC within 1 h. These results are superior to known differential fault analytic result on LBlock.


Introduction
Differential fault analysis (DFA), one of the side channel attacks, was first proposed by Biham and Shamir on DES in 1997 [1]. This attack exploits faults within the computation of a cryptographic algorithm to reveal the secret information. So far, DFAs on many block ciphers such as DES, Piccolo, LED, SEED, and ARIA have been proposed [2][3][4][5][6][7]. It means that DFA poses a major threat to the security on block ciphers.
LBlock [8] proposed in ACNS 2011 is a 64-bit lightweight block cipher suitable for both constrained hardware environments such as wireless sensor network and software platforms. It is based on the 32-round variant Feistel structure with 64-bit block size and 80bit key size. There were several cryptanalytic results on LBlock. For example, the proposers of LBlock explored the strength of LBlock against some attacks such as differential cryptanalysis, integral attack, and related-key attack [8]. Also, Karakoc et al. [9] and Liu et al. [10] proposed impossible differential cryptanalysis on a reduced version *Correspondence: chlee@seoultech.ac.kr 2 Department of Computer Science and Engineering, Seoul National University of Science and Technology, Gongneung-ro, Nowon-gu, Seoul, 139-743, South Korea Full list of author information is available at the end of the article of LBlock, respectively. On the other hand, in [11], a differential fault analysis on LBlock was proposed. Based on a random bit fault model, the proposed attack needs at least 7 fault injections.
In this paper, we propose a differential fault analysis on LBlock. Based on the random nibble fault model, we consider two fault assumptions. In the first attack (Attack 1), it is assumed that several random nibble faults are injected to the input register of round 29. We can compute the exact fault position by checking the corresponding ciphertext differences. Based on the simulation results, this attack requires an exhaustive search of 2 25 and five random nibble faults on average, and can recover the 80bit secret key of LBlock within a few seconds on a general PC. In the case of second attack (Attack 2), to recover the 80-bit secret key of LBlock, we inject several random nibble faults to the input register of round 30. This attack requires an exhaustive search of 2 30 and seven random nibble faults on average. It can also recover the 80-bit secret key of LBlock within 1 h on a general PC. Considering that the proposed attack in [11] requires at least 7 fault injections, our results are superior to it (see Table 1). This paper is organized as follows. In the 'Description of LBlock' section, we briefly introduce the structure of LBlock. In the 'Attack 1 -fault position: round 29' and http://jwcn.eurasipjournals.com/content/2013/1/151

Description of LBlock
In this section, we introduce the structure of LBlock briefly. The notations used in this paper are as follows.
LBlock is a 64-bit block cipher and supports the 80-bit secret key. As shown in Figure 1, the structure of LBlock is a 32-round iterative structure which is a variant of Feistel network. To generate a 64-bit ciphertext C = (C L , C R ) from a 64-bit plaintext P = (P L , P R ), LBlock executes the following procedure. Here, ≪ is a left circular rotation.
The confusion function S denotes the nonlinear layer of round function F. It consists of eight 4 × 4 S-boxes S i in parallel (i = 1, 2, · · · , 8). The contents of these S-boxes are listed in Table 2.
The diffusion function P is defined as a permutation of eight nibble words, and it can be expressed as the following equations: The 80-bit secret key K is stored in a key register and denoted as K = (k 79 , k 78 , k 77 , k 76 , · · · , k 1 , k 0 ). Output the leftmost 32 bits of current content of register K as round subkey K 1 , and then operate as follows: For i = 1, 2, · · · , 31, update the key register K as follows: (2) (k 79 , k 78 , k 77 , k 76 ) = S 9 ((k 79 , k 78 , k 77 , k 76 )).
Output the leftmost 32 bits of current content of register K as a round key K i+1 of round i + 1. Table 3 presents the partial secret keys used in each round key of LBlock. For example, a round key K 29 of round 29 includes a 32-bit partial secret key (k 67 , k 66 , · · · , k 37 , k 36 ).

Attack 1 -fault position: round 29
In this section, we propose DFA on LBlock, where the fault position is the input register of round 29. Our fault assumption includes the following assumptions: http://jwcn.eurasipjournals.com/content/2013/1/151 (1) The attacker has the capability to choose one plaintext to encrypt and obtain the corresponding right/faulty ciphertexts. From the above assumptions, a random nibble fault can be induced to the input byte register I L 29,i of round 29 (i = 0, 1, · · · , 7). Note that in Attack 1, we do not consider events injecting random nibble faults to I R 29,i . They are considered in Attack 2, where random nibble faults are injected to I L 30,i . Thus, the number of all possible fault positions is 8. For the simplicity of notations, we denote each case by E L 29,i . For example, E L 29,7 means an event that a random nibble fault is injected to I L 29,7 .

Computation of the exact fault position
First, we assume that a random nibble fault was injected to I L 29,7 , that, is an event E L 29,7 was occurred. Figure 3 presents the differential propagation under this assumption.
According to our fault assumption, the input difference I 29 of I 29 has the following pattern. Here, a = 0.
Then, as shown in Figure 3, the output difference of round function F of round 29 is computed as follows.
Here, b is an output difference of S-box S 7 taking a as an input difference (b = S 7 (a)). Thus, the input difference of round 30 has the following pattern: The input difference I 31 of round 31 is computed as follows. Here, c is an output difference of S-box S 5 taking b as an input difference (c = S 5 (b)). Note that, in round 30, a was moved from I R 30,7 to I L 31,1 by an 8-bit left circular rotation.
Similarly, the input difference I 32 of round 32 has the following pattern. Here, d = S 4 (a) and e = S 1 (a).
Hence, when a random nibble fault was injected to I L 29,7 , that is an event E L 29,7 , the ciphertext difference has the following pattern.
Other events E L 29,i can be explained in a similar fashion (i = 0, 1, · · · , 6). Table 4 shows the patterns of ciphertext differences for the positions of fault injections. Here, '?' means a nonzero value. From this table, we can check that the patterns of the ciphertext differences for each event are different from each other. Thus, we can compute the http://jwcn.eurasipjournals.com/content/2013/1/151

Computation of round keys for each fault position
We assume that an event E L 29,7 has occurred. That is, it is assumed that a random nibble fault was induced to I L 29,7 . In this case, we can compute 2 28 candidates of the 56-bit round key by executing the following procedure: (1) K 32,7 . Guess 4-bit K 32,7 and compute the output difference of S-box S 7 in round 32 (see red lines in Figure 3). Then, check that this value is equal to C R 5 . The probability passing this test is 2 −4 . Thus, we can expect that only the right K 32,7 has survived.
(2) K 32,6 . Guess 4-bit K 32,6 and compute the output difference of S-box S 6 in round 32 (see red lines in Figure 3). Then, check that this value is equal to C R 7 . Since the filtering probability is 2 −4 , we can compute the right K 32,6 .
According to the above procedure, we can obtain 2 28 candidates of the following 56-bit round key by using one random nibble fault injected to I L 29,7 .
From the above relation, (K 29 , K 30 , K 31 , K 32 ) includes all 80-bit secret key information. Thus, from the keyschedule of LBlock, we can easily compute candidates of the secret key of LBlock by using candidates of round keys computed in the previous subsection. However, in the case that the number of candidates of round keys is very large, we require the exhaustive search with the large computational complexity. On the other hand, from the above relation, we can check that each round key include the common partial secret key information. Thus, if equations are constructed by using this property, we can decrease the number of candidates of the secret key of LBlock.
To decrease the number of candidates of the secret key, we consider equations as shown in Table 5. The total filtering probability is 2 −41 . Here, '&' means ' AND' operation, and S −1 9 and S −1 8 are the inverse functions of the S-boxes S 9 and S 8 , respectively.

DFA on LBlock (Attack 1)
Now, we are ready to propose a differential fault analysis on LBlock under an assumption that random nibble faults are injected to the input register of round 29. Our attack procedure is as follows: (1) Collection of right ciphertext. Choose a plaintext P and obtain the corresponding right ciphertext C = (C L , C R ). (2) Collection of faulty ciphertext. After inducing an i th random nibble fault to I L 29 = (I L 29,7 , I L 29,6 , · · · , I L 29,0 ) of round 29, get the corresponding faulty ciphertext C i (i = 1, · · · , n).
(3) Computation of fault positions. Compute C i by using (C, C i ) and then compute the exact fault positions from Table 4. (4) Computation of the candidates of (K 29 , K 30 , K 31 , K 32 ). According to the fault positions computed in step 3, compute the candidates of (K 29 , K 30 , K 31 , K 32 ) by using the method in 'Computation of round keys for each fault position' section. (5) Recovery of the 80-bit secret key. Using the method in 'Recovery of the secret key from candidates of round keys' section, compute the candidates of the secret key by using the candidates of (K 29 , K 30 , K 31 , K 32 ). Then, recover the 80-bit secret key of LBlock by using one trial encryption.
We simulated our attack on a general PC 10, 000 times. Based on the simulation results, we can obtain about 2 25 candidates of the secret key by using five fault injections on average. Thus, we do an exhaustive search for them. Since the filtering probability is 2 −64 , the expected number of wrong secret keys passing our attack algorithm is 2 −39 (= 2 25 · 2 −64 ). It means that the possibility that a wrong key can pass our attack algorithm is very low. Based on the simulation results, we can always recover the 80-bit secret key of LBlock within a few seconds by using five fault injections on average.

Attack 2 -fault position: round 30
In this section, we propose the second attack (Attack 2) where random nibble faults are induced to the input register of round 30. Since the attack procedure of Attack 2 is similar to that of Attack 1, we briefly discuss the attack procedure of Attack 2.
Our fault assumption is as follows.
• The attacker has the capability to choose one plaintext to encrypt and obtain the corresponding right/faulty ciphertexts. • The attacker can induce random byte faults to the input register of round 30. • The location and value of faults are both unknown.
From the above assumptions, a random nibble fault can be induced to the input byte register I L 30,i of round 30 (i = 0, 1, · · · , 7). Note that, similarly to Attack 1, we do not also http://jwcn.eurasipjournals.com/content/2013/1/151 consider events injecting random nibble faults to I R 30,i in Attack 2. Thus, the number of all possible fault positions is 8. Table 6 shows the patterns of ciphertext differences for the positions of fault injections in Attack 2. Here, '?' means a nonzero value. For example, the differential propagation under an event E L 30,7 is shown in Figure 4. From this table, we can check that the patterns of the ciphertext differences for each event are different from each other. Thus, in Attack 2, we can compute the exact fault position from the patterns of ciphertext differences.  Recall that, in Attack 1, we get 2 28 candidates of the 56bit round key from one random nibble fault injection. In Attack 2, we obtain 2 12 candidates of the 28-bit round key from one random nibble fault injection. Using the candidates of round keys, the method to compute the candidates of the secret key of LBlock in Attack 2 is similar to that in Attack 1. Recall that the partial secret key used in (K 30 , K 31 , K 32 ) is as follows: • K 30 : (k 38 , k 37 , · · · , k 8 , k 7 ). • K 31 : (k 9 , k 8 , · · · , k 0 , k 79 , k 78 , · · · , k 58 ).
From the above relation, (K 30 , K 31 , K 32 ) includes all 80-bit secret key information. Thus, from the keyschedule of LBlock, we can easily compute candidates of the secret key of LBlock by using candidates of the round keys. To decrease the number of candidates of the secret key, we consider seven equations related to round 30 to 32 as shown in Table 5. The total filtering probability is 2 −16 .
The attack procedure of Attack 2 is as follows: (1) Collection of right ciphertext. Choose a plaintext P and obtain the corresponding right ciphertext C = (C L , C R ). (2) Collection of faulty ciphertext. After inducing an i th random nibble fault to I L 30 = (I L 30,7 , I L 30,6 , · · · , I L 30,0 ) of round 30, get the corresponding faulty ciphertext C i (i = 1, · · · , n).
(3) Computation of fault positions. Compute C i by using (C, C i ) and then compute the exact fault positions from Table 6.
According to the fault positions computed in step 3, compute candidates of (K 30 , K 31 , K 32 ). (5) Recovery of the 80-bit secret key. Compute candidates of the secret key by using the candidates of (K 30 , K 31 , K 32 ). Then, recover the 80-bit secret key of LBlock by using one trial encryption.
We simulated our attack on a general PC 10, 000 times. Based on the simulation results, we can obtain about 2 30 candidates of the secret key by using seven fault injections on average. Recall that we obtain 2 12 candidates of the 28-bit round key from one random nibble fault injection under Attack 2. Thus, to get the small number of candidates of the secret key, we need more fault injections than Attack 1. We do an exhaustive search for these candidates. Since the filtering probability is 2 −64 , the expected number of wrong secret keys http://jwcn.eurasipjournals.com/content/2013/1/151 passing our attack algorithm is 2 −34 (= 2 30 · 2 −64 ). It means that the possibility that a wrong key can pass our attack algorithm is very low. Based on the simulation results, we can always recover the 80-bit secret key of LBlock within 1 h by using seven fault injections on average.

Conclusion
In this paper, we have presented DFA on LBlock suitable for wireless sensor networks. The proposed attack has two versions, Attack 1 and Attack 2. To recover the 80-bit LBlock, Attack 1 requires an exhaustive search of 2 25 and five random nibble fault injections on average. It is executed within a few seconds on a general PC. In the case of Attack 2, this attack is executed within 1 h by using seven random nibble faults. These results are superior to known differential fault analytic result on LBlock.