This may be the author’s version of a work that was submitted/acceptedfor publication in the following source:

Wong, Kenneth, Bartlett, Harry, Simpson, Leonie, & Dawson, Ed(2019)Differential random fault attacks on certain CAESAR stream ciphers. InInternational Conference on Information Security and Cryptology, 2019-01-01. (In Press)

This file was downloaded from: https://eprints.qut.edu.au/197054/

c© Springer Nature Switzerland AG

This work is covered by copyright. Unless the document is being made available under aCreative Commons Licence, you must assume that re-use is limited to personal use andthat permission from the copyright owner must be obtained for all other uses. If the docu-ment is available under a Creative Commons License (or other specified license) then referto the Licence for details of permitted re-use. It is a condition of access that users recog-nise and abide by the legal requirements associated with these rights. If you believe thatthis work infringes copyright please provide details by email to qut.copyright@qut.edu.au

Notice: Please note that this document may not be the Version of Record(i.e. published version) of the work. Author manuscript versions (as Sub-mitted for peer review or as Accepted for publication after peer review) canbe identified by an absence of publisher branding and/or typeset appear-ance. If there is any doubt, please refer to the published source.

Differential random fault attacks on certainCAESAR stream ciphers

Kenneth Koon-Ho Wong, Harry Bartlett, Leonie Simpson, and Ed Dawson

Queensland University of Technology, Brisbane, Australia

Abstract. We show that a particular class of stream ciphers – namelythose in which the output function contains a bitwise AND operation– are susceptible to a differential fault attack using random faults. Sev-eral finalists and other candidates from the recent CAESAR competitionfall into this category, including the AEGIS variants, Tiaoxin and theMORUS family. Attack outcomes range from key or full state recoveryfor Tiaoxin, to full state recovery for the AEGIS family and partial staterecovery for MORUS. We present attack requirements and success prob-abilities on these ciphers, along with design considerations to mitigateagainst this attack.

Keywords: Fault attack · Differential fault attack · Random faults ·Stream ciphers · CAESAR competition · Tiaoxin · AEGIS · Side-channelattack

1 Introduction

Given an implementation of a cryptographic algorithm, a fault occurring duringits operation will result in an erroneous output. Differential fault attacks exploitthis by comparing the output of the fault-free operation of the algorithm with thefaulty output after an error is induced during the operation [1]. The differencebetween fault-free and faulty outputs reveals information about the encryption,which may lead to the recovery of internal state or even secret key values. Notethat this implies a nonce-reuse scenario, as the same nonce must be used togenerate the fault-free and faulty outputs. In 1997, Boneh et al. [1] used faultattacks against an implementation of RSA. Since then, fault attacks have beenwidely used against many encryption algorithms, including DES [2] and AES [3].Fault attacks can be very powerful, such that an entire AES key can be retrievedusing only a single fault injection [4].

When applying a fault attack on the implementation of a cryptographic al-gorithm, there are a number of aspects to consider. These include:

– Number of bits to be faulted: One bit, a few bits, one byte or multiple bytes;– Modification type: Whether the faulted bits are stuck-at-zero, stuck-at-one,

bit-flipped or affected randomly;– Fault precision: How tightly the location and/or timing of the fault can be

controlled;

– Fault duration: Whether the fault will be transient or permanent.

Combinations of these parameters determine the feasibility of a fault attack.For example, an attack performed under the assumption that a fault results inflipping every bit in a targeted variable implies a very strong adversary. Thisbit-flipping approach is considered unrealistic in practice [5]. A random faultmodel, in which a fault is injected but the adversary does not know in advancethe effect of the fault on a variable value, is considered more realistic since lessprecise control of the fault outcome by the attacker is required [5].

The fault attack described in this paper is a differential random fault attackon one targeted word at a time. Note that we have not implemented the attack,but instead we present a theoretical analysis on its feasibility and success rate,and rely on the fact that the practicality of applying such attacks has previouslybeen demonstrated in other literature such as [5, 6]. The attack we describe canbe applied to stream ciphers where the keystream output function includes atleast one bitwise AND operation. Several stream ciphers from the Competitionfor Authenticated Encryption: Security, Applicability and Robustness (CAE-SAR) have output functions of this form. These include Tiaoxin [7], the AEGISfamily of stream ciphers [8] and the MORUS family of stream ciphers [9].

This paper extends on several previous fault attacks. Firstly, the bit-flippingfault attack on Tiaoxin and AEGIS in [10] used a similar approach, but assumedthat the attacker could induce bit-flipping faults. For Tiaoxin, bit-flip faults onthree words were required to recover the 128-bit secret key in a known plaintextscenario. For AEGIS-128, AEGIS-256 and AEGIS-128L, the internal state couldbe recovered using bit-flip faults on 3, 4 and 4 words, respectively (also in aknown plaintext scenario). Secondly, the random fault attack applied to Tiaoxinand AEGIS-128L in [11] demonstrated that a similar attack using random faultsrather than bit-flips could be applied to recover the Tiaoxin key or the AEGIS-128L internal state. A requirement for both attacks from [10, 11] is that theoutput function includes the bitwise AND of two state words. However, [11]has an additional requirement that the cipher must have two separate outputfunctions, and at least one output function included the bitwise XOR of oneof the state words that was used in the AND operation of the other ciphertextword. This additional structure allowed the values of the random faults to bedetermined. Hence, the attack in [11] requires less control of the induced faultscompared to [10], but is more restrictive on the required cipher structure.

The attack presented in this paper is a random fault attack which requiresonly that the output function includes the bitwise AND of two state words.Unlike the attacks of [11], it does not require two ciphertext words to be pro-duced by separate output functions at each time step, and the attacker does notneed to know the values of the random faults. In fact, we show that all ciphersattacked in [10] can also be attacked with random faults, in place of the lessrealistic bit-flipping faults that were used. Our attack also provides partial stateinformation in the case of other CAESAR candidates, for example the MORUSfamily. The applicability of our attack on these ciphers highlights the importanceof preventing nonce-reuse with ciphers of this type.

The remainder of this paper is organised as follows. Section 2 introduces thenotation used and presents the attack algorithm. Section 3 provides an analysison the probabilities for successful recovery of underlying state bits. Section 4presents the results on the application of this random fault attack to severalCAESAR candidates, namely the AEGIS family and Tiaoxin, where full key orstate recovery can be achieved. Section 5 provides a summary of the results,including a discussion on a possible partial state recovery attack on MORUS.Section 6 concludes the paper and provides suggestions for future work.

2 Random Fault Attacks

In this section, we first introduce the notation used, and then present our randomfault attack in a general form. Theoretical details of the attack and an attackalgorithm then follows.

2.1 Notation

The following notation will be used throughout the paper unless otherwise stated.Let P , C, and S be the plaintext, ciphertext and internal state of the streamcipher, respectively. At each timestep t, these values are denoted by P t, Ct, andSt. Where multiple words are present, the i-th word of these values are shownas P t[i], Ct[i] and St[i]. We also use the common notations ⊕ and ⊗ to denotethe bitwise XOR and bitwise AND operations respectively.

Some ciphers in this paper use the AES round function in their state updates.The function R is used to refer to the the standard AES round function [12]without the AddSubKey operation i.e.

R(x) = MixColumns(ShiftRows(SubBytes(x))) (1)

Note that this transformation is invertible. This is an important property forstate recovery, and in some cases, key recovery using this random fault attack,as it allows the internal state to be clocked backwards.

2.2 Attack outline

As stated previously, the attack presented in this paper is a differential attack.That is, the plaintext is first encrypted without error and the ciphertext out-put noted. The encryption is then repeated with a random fault injected intoa chosen state word. A comparison of the fault free and faulty ciphertexts re-veals information about the underlying state value, which in some cases maylead to recovery of key bits. Repeating the encryption with the same key andinitialisation vector is referred to as nonce reuse or misuse.

Suppose a keystream generator has a ciphertext output function of the form

Ct = f(St)⊕ (g(St)⊗ St[u] ) (2)

where f(St) and g(St) are functions in St that do not depend on St[u]. Let ebe a randomly generated word unknown to the attacker. This random fault eis injected into the state word St[u] such that its contents become faulty. Therelationship between the fault-free state word St[u] and the faulty state word,denoted as St[u], is given by:

St[u] = St[u]⊕ e

The difference between the fault-free ciphertext Ct and faulty ciphertext, de-noted as Ct, is then given by:

Ct ⊕ Ct = f(St)⊕ (g(St)⊗ St[u] )⊕ f(St)⊕ (g(St)⊗ St[u] )

Ct ⊕ Ct = g(St)⊗ (St[u]⊕ St[u]⊕ e)

Ct ⊕ Ct = g(St)⊗ e (3)

From Equation 3, it can be observed that for all bits in Ct⊕ Ct that are equal toone, those bits in g(St) in the corresponding positions must also be one. Thus,the difference in the ciphertexts reveals information about the underlying statewords that appear in g(St).

Unlike the attacks in [10, 11], the full effect of these faults are unknown to theattacker. In fact, the attacker can only determine that a given bit of e equals oneif the corresponding bit value of g(St) is also one. Apart from this, the attackerdoes not know whether the remaining bits of e are one or zero. Therefore, thesuccess of this attack in recovering all bits of g(St) depends on repeating therandom fault injection multiple times, so that every bit in e is one for at leastone of these faults with high probability, thus revealing all non-zero bits of g(St).Algorithm 1 outlines the random fault attack procedure.

Algorithm 1 Random fault attack

1: Load key and initialisation vector and perform the initialisation phase.2: Obtain the fault free ciphertext Ct.3: Repeat Steps 1 and 2 but inject a random multi-byte fault e into the state word

St[u] to obtain the faulty ciphertext Ct.4: Compute Ct ⊕ Ct.5: Record all bits of Ct⊕Ct that are equal to one, which implies that the corresponding

bits in g(St) are also ones.6: Repeat Steps 3 to 5 until all of the bits that equal one in g(St) are likely to have

been observed. The remaining bits are assumed to be zero with high probability.

As discussed in Section 1, random faults are considered easier to implementthan bit flips and thus the attacks we present are more practical than the bit-flipping attacks in [10]. The tradeoff is that random fault attacks are probabilis-tic, whereas the bit-flipping fault attacks are deterministic. However, as we willshow in Section 3, very high success rates can be achieved with a feasible numberof repeated random faults.

3 Probability Calculations

In this section, we consider the probability of determining the contents of g(St)after applying various numbers of random faults. In doing this, we focus on thescenario discussed above, in which the attacker has only limited knowledge ofthe values of the faulted bits in e. In this scenario, the attacker learns that a bitof g(St) is equal to one when the corresponding fault bit equals one, but cannotknow for sure when a bit of g(St) is zero. Note that the zero bits in Ct ⊕ Ct

do not reveal zeros in g(St) deterministically, as the attacker does not knowwhether this is due to a zero value in the corresponding bit of g(St) or a zerovalue in the relevant bit of the error word e.

The attacker’s aim is to find the value of g(St), which can be achieved bycorrectly locating all of the ones in g(St). However, the attacker does not knowhow many of the bits in g(St) are actually ones. We define success for the attackerto be the event that the value of g(St) has been correctly determined, and ouranalysis of the probability of success must take into account that the number ofones in g(St) is unknown by conditioning on this random variable.

We assume initially that g(St) is a single state word of length w bits, andalso note the following assumptions:

I. Since the fault e is assumed to be random, we assume that the probabilitythat a given bit of e is equal to one is exactly 0.5, independently of the valuesof all other bits.

II. Assuming that the attacker has no prior knowledge of the state contents, wemay also assume that each bit in the state is equally likely to be a one or azero, independently of all other bits in the state.

From these assumptions, we argue as follows:

1. Consider first a single bit in g(St). If the value of this bit is zero, then (asdiscussed above) we cannot detect this directly. However, if the value of thisbit is one, then the probability pb,1(s) that the value of this bit has not beendetermined after applying s faults is simply the probability that this bit isequal to zero in all s instances of e, namely pb,1(s) = 0.5s.

2. Now consider the entire word g(St) containing w independent bits andsuppose that the number of ones in this word happens to be N (with0 ≤ N ≤ w). Then:(a) The probability pN (k; s) that exactly k ones in this word have not yet

been recovered after applying s random (multi-byte) faults is given bythe binomial distribution Bi(N, pb,1(s)); specifically,

pN (k; s) =(Nk

)pb,1(s)k(1− pb,1(s))N−k =

(Nk

)0.5sk(1− 0.5s)N−k.

(b) The probability of recovering at least m ones out of N after applyings random (multi-byte) faults is equal to the probability that N −m orfewer ones remain undiscovered after applying this number of faults. Wedenote this probability as PN (m; s); it can be calculated by using thecumulative form of the binomial distribution described above, namely asPN (m; s) =

∑N−mk=0 pN (k; s).

Table 1. Success Rate PS(s;w) for w = 128 with Different Numbers of Faults

Number of Faults (s) 6 8 10 12 14 16

Success Rate PS(s; 128) 36.64% 77.86% 93.94% 98.45% 99.61% 99.90%

Table 2. Success Rate for Full Recovery of 128-bit Words Using Attacks from [11]

Number of Faults 6 8 10 12 14

Calculated Success Rate 13.32% 60.59% 88.24% 96.92% 99.22%

Simulated Results: Tiaoxin [11, Table 2] 12.81% 61.72% 87.64% 96.78% 99.16%

Simulated Results: AEGIS-128L [11, Table 5] 13.18% 59.58% 88.35% 96.70% 99.07%

(c) The probability of discovering all N ones in a w-bit word after s (orfewer) multi-byte faults is then equal toPN (N ; s) = pN (0; s) = (1− 0.5s)N .

3. It follows from Assumption II that the number of ones (N) in the state wordof Step 2 has a binomial distribution Bi(w, 0.5) withPr(N = n) =

(wn

)0.5n 0.5w−n =

(wn

)0.5w.

4. Finally, let PS(s;w) denote the probability that the attacker has discoveredall the ones in a w-bit state word after applying s random (multi-byte) faults(and without knowing how many ones there are to find). This probability isgiven by the following expression (conditioning on the value of N):

PS(s;w) =

w∑n=0

PN (N ; s|N = n) Pr(N = n)

=

w∑n=0

pn(0; s) Pr(N = n)

=

w∑n=0

(w

n

)0.5w−n0.5n(1− 0.5s)n (4)

=

w∑n=0

(w

n

)0.5w−n(0.5− 0.5s+1)n = (1− 0.5s+1)w

Table 1 presents some calculated values of PS(s;w) for the case w = 128 andvarious values of s. Note that the success rate exceeds 99% for 14 or morefaults. To verify the applicability of our theoretical analysis, we applied a similarprocess to determine the theoretical probabilities of the attacks from [11]. Table 2shows that our calculated success rates agree closely with the simulation resultsreported in [11].

We now relax the assumption that g(St) is a single state word. Assumingthat the attacker has no prior knowledge of the state contents St, AssumptionII still holds for any state word. Provided that g(St) contains only bitwise oper-ations, the contents of each bit of g(St) are then statistically independent of oneanother. Now suppose that the probability that a particular bit in g(St) equals

one (independently of all other bits) is p(g)b,1 . The distribution of N in step 3 then

becomes Bi(w, p(g)b,1) with Pr(N = n) =

(wn

)(p

(g)b,1)n(1− p

(g)b,1)w−n and Equation 4

becomes:

PS(s;w) =

w∑n=0

(w

n

)(1− p

(g)b,1)w−n(p

(g)b,1)n(1− 0.5s)n

=

w∑n=0

(w

n

)(1− p

(g)b,1)w−n(p

(g)b,1 − p

(g)b,1×0.5s)n

= (1− p(g)b,1×0.5s)w

Now, provided that g(St) contains at least one linear term, we may assume from

II that p(g)b,1 = 0.5 and the same result is obtained as before. On the other hand,

if g(St) is purely quadratic, then p(g)b,1 = 0.25 and PS(s;w) becomes PS(s;w) =

(1 − 0.25×0.5s)w = (1 − 0.5s+2)w. Similar analyses can also be given for otherforms of g(St).

4 Key and State Recovery Attacks

In this section, we describe key recovery and full state recovery attacks on twoCAESAR competition candidates using random fault injections. These are theAEGIS family of stream ciphers [8] and Tiaoxin [7]. Within the AEGIS family,AEGIS-128 (version 1.1) is in the final portfolio of the CAESAR competition forUse Case 2 (High-performance applications), whereas AEGIS-256 and AEGIS-128L are finalists for the same use case. Tiaoxin (version 2) is a third roundcandidate. In the cases of AEGIS-128L and Tiaoxin, ciphertext-only attacks arepossible. Our cipher descriptions mostly focus on the encryption phase, whichis where the random faults are injected. For details of the other phases, such asinitialisation, associated data processing finalisation and tag generation, pleaserefer to the respective cipher specification documents.

4.1 AEGIS-128

AEGIS-128 has an internal state with five 128-bit register stages St[0], St[1], . . .,St[4], and thus has a total state size of 5 × 128 = 640 bits. The internal stateis updated at each timestep using a nonlinear state update function defined asfollows.

St+1[i] =

{R(St[4])⊕ St[0]⊕M t for i = 0R(St[i− 1])⊕ St[i] for 1 ≤ i ≤ 4

(5)

This update function has one external input, M t, and nonlinearity is provided byapplying the transformation R to the contents of each register stage, as shownin Figure 1. During the encryption phase, each 128-bit plaintext block P t isencrypted to obtain the corresponding ciphertext block Ct as per the AEGIS-128 output function:

Ct = P t ⊕ St[1]⊕ St[4]⊕ St[2]St[3] (6)

Fig. 1. AEGIS-128 state update and output

This function is of the form identified in Equation 2, which means that therandom fault attack described in Section 2.2 can be applied to this cipher.

Attack Procedure Comparing with the generic form in Equation 2, we canobtain the following parameter sets:

(f(St), g(St), St[u]) = (P t ⊕ St[1]⊕ St[4], St[2], St[3]) (7)

(f(St), g(St), St[u]) = (P t ⊕ St[1]⊕ St[4], St[3], St[2]) (8)

Therefore, using the parameter set given in Equation 7, the attacker can ap-ply random faults on St[3] to recover the contents of St[2] as per the analysispresented in Section 2.2. Alternatively, using Equation 8, random faults can beapplied on St[2] to recover St[3] in a similar manner.

State Recovery To extend the recovery of single stages to the entire internalstate, observe from Equation 5 that

St[2] = R(St−1[1])⊕ St−1[2])

St−1[1] = R−1(St[2]⊕ St−1[2])

Therefore, recovering of S[2] over two consecutive timesteps permits the recoveryof S[1] on the earlier timestep. The process continues into St−2[0] as follows.

St−1[1] = R(St−2[0])⊕ St−2[1]

St−2[0] = R−1(St−1[1]⊕ St−2[1])

= R−1(R−1(St[2]⊕ St−1[2])⊕R−1(St−1[2]⊕ St−2[2]))

In summary, applying random faults on St[2] with Equation 7 on three con-secutive timesteps t, t − 1, t − 2 allows recovery of the stages St−2[0], St−2[1],St−2[2] at timestep t − 2. Additionally, applying the attack with Equation 8allows recovery of St−2[3].

To complete the full state recovery, the value St−3[4] needs to be computed.Using one known plaintext block P t−2 and Equation 6 gives

St−2[4] = P t−2 ⊕ Ct−2 ⊕ St−2[1]⊕ St−2[2]St−2[3] (9)

Once the entire internal state is known at a certain timestep t, the cipher can beclocked forwards to recover all subsequent plaintext using known ciphertext andstate contents. This attack strategy improves on the requirement of two knownplaintext blocks in [10], at the expense of injecting faults across three roundsinstead of two.

Success rate For the above attack strategy, we require four targets stages,namely St[2], St−1[2], St−2[2], St−2[3], to recover the entire AEGIS-128 internalstate. From the analysis in Section 3, assuming that we require a 99.9% proba-bility of correctly recovering the contents of each target state, 16 random faultswould be injected for each target state, so a total of 64 random faults wouldbe carried out. The success probability of the full state recovery attack is about0.9994 ≈ 0.996. Higher probabilities can be achieved if more random faults aremade on each target stage.

4.2 AEGIS-256

AEGIS-256 has an internal state with six 128-bit register stages St[0], St[1], . . .,St[5], and thus has a total state size of 6 × 128 = 768 bits. The internal stateis updated at each timestep using a nonlinear state update function defined asfollows.

St+1[i] =

{R(St[5])⊕ St[0]⊕M t for i = 0R(St[i− 1])⊕ St[i] for 1 ≤ i ≤ 5

(10)

This update function has one external input M t, and nonlinearity is providedby applying the AES round function R to the contents of each register stage, asshown in Figure 2. During the encryption phase, each 128-bit plaintext block P t

Fig. 2. AEGIS-256 state update and output

is encrypted to obtain the corresponding ciphertext block Ct as per the AEGIS-256 output function:

Ct = P t ⊕ St[1]⊕ St[4]⊕ St[5]⊕ St[2]St[3] (11)

This function is of the form identified in Equation 2, which means that therandom fault attack described in Section 2.2 can be applied to this cipher.

Attack Procedure The AEGIS-256 output function differs from the AEGIS-128 output function by only a linear term St[5], so the same random fault attackstrategy applies. Comparing with the generic form in Equation 2, we can obtain:

(f(St), g(St), St[u]) = (P t ⊕ St[1]⊕ St[4]⊕ St[5], St[2], St[3]) (12)

(f(St), g(St), St[u]) = (P t ⊕ St[1]⊕ St[4]⊕ St[5], St[3], St[2]) (13)

Therefore, applying random faults on St[3] allows an attacker to recover thecontents of St[2] as per the analysis presented in Section 2.2. Alternatively,random faults can be applied on St[2] to recover St[3] in a similar manner.

State Recovery The process for full state recovery is also similar to that forAEGIS-128 as we also have, for 1 ≤ i ≤ 2:

St−i[2− i] = R−1

(i⊕

k=0

R−1(St−k[2]⊕ St−k−1[2])

)(14)

This means that applying the random fault attack on three consecutive timestepst, t − 1, t − 2 allows recovery of the stages St−2[0], St−2[1], St−2[2] at timestept − 2. Additionally, applying the attack with Equation 13 allows recovery ofSt−2[3]. In total, the attack is applied four times.

To complete the full state recovery, the values of St−2[4], St−2[5] need to becomputed. Using one known plaintext block P t−2 gives

St−2[4]⊕ St−2[5] = P t−2 ⊕ Ct−2 ⊕ St−2[1]⊕ St−2[2]St−2[3] (15)

This cannot uniquely determine St−3[4] and St−3[5]. However, from the stateupdate function it is also known that

St−1[0] = R(St−2[5])⊕ St−2[0]⊕ P t−2 (16)

Therefore, it is possible to calculate St−2[5] if an extra fault attack is carried outat time t+ 1 to recover St+1[2], so that St−1[0] can be computed from Equation14. Once St−2[5] is known, St−2[4] can be readily computed via Equation 15.

Similar to AEGIS-128, once the entire state is known at a certain timestept, the cipher can be clocked forwards to recover all subsequent plaintext us-ing known ciphertext and state contents. This attack strategy requires only oneknown plaintext block, which improves on the requirement of three known plain-text blocks in [10], at the expense of injecting faults across four rounds insteadof three.

Success rate For the above attack strategy, we require five targets stages,namely St+1[2], St[2], St−1[2], St−2[2], St−2[3], to recover the entire AEGIS-128internal state. From the analysis in Section 3, assuming that we require a 99.9%probability of correctly recovering the contents of each target stage, 16 randomfaults would be injected for each target state, so a total of 80 random faultswould be carried out. The success probability of the full state recovery attackis about 0.9995 ≈ 0.995. Higher probabilities can be achieved if more randomfaults are made on each target stage.

4.3 AEGIS-128L

AEGIS-128L has an internal state with eight 128-bit register stages St[0], St[1],. . ., St[7], and thus has a total state size of 8 × 128 = 1024 bits. The internalstate is updated at each time instant using a nonlinear state update functionStateUpdate128L(St,M t

0,Mt1). This update function has two external inputs,

M t0 and M t

1, and nonlinearity is provided by applying the transformation func-tion R to the contents of each register stage, as shown in Figure 3. Under thisupdate function, the state of AEGIS-128L at time t + 1 is defined as:

St+1[i] =

R(St[7])⊕ St[0]⊕M t0 for i = 0

R(St[3])⊕ St[4]⊕M t1 for i = 4

R(St[i− 1])⊕ St[i] for i ∈ {1, 2, 3, 5, 6, 7}(17)

In contrast with AEGIS-128 and AEGIS-256, during the encryption phase each

Fig. 3. AEGIS-128L state update and output

256-bit plaintext block is split into two words: P t = P t[0]||P t[1], which areencrypted separately and then combined to obtain the corresponding ciphertextblock Ct = Ct[0]||Ct[1].

The output functions of AEGIS-128L for the two words in each block are

Ct[0] = P t[0]⊕ St[1]⊕ St[6]⊕ St[2]St[3] (18)

Ct[1] = P t[1]⊕ St[2]⊕ St[5]⊕ St[6]St[7] (19)

These function are of the form identified in Equation 2, which means that therandom fault attack described in Section 2.2 can be applied to this cipher.

Attack Procedure Comparing with the generic form in Equation 2, we canobtain four sets of attack parameters from the two output functions. From Equa-tion 18, the parameters corresponding to the first output function are:

(f0(St), g0(St), St[u]) = (P t[0]⊕ St[1]⊕ St[6], St[2], St[3]) (20)

(f0(St), g0(St), St[u]) = (P t[0]⊕ St[1]⊕ St[6], St[3], St[2]) (21)

From Equation 19, the parameters corresponding to the second output functionare:

(f1(St), g1(St), St[u]) = (P t[1]⊕ St[2]⊕ St[5], St[6], St[7]) (22)

(f1(St), g1(St), St[u]) = (P t[1]⊕ St[2]⊕ St[5], St[7], St[6]) (23)

Therefore, for example, at each timestep we can apply random faults to statesSt[3], St[7] to recover the contents of St[2], St[6] respectively. Alternatively, ap-plying random faults to states St[2], St[6] allows recovery of St[3], St[7] respec-tively.

State Recovery If the plaintext words P t[0], P t[1], P t+1[0] and P t+1[1] are alsoknown, then the process used in [10] can be followed to obtain the whole statecontent at time t. However, our attack can also be modified to recover the entirestate even when the attacker does not have access to the plaintext, by followinga similar process to that used for AEGIS-128 and AEGIS-256. By recoveringthe values of St[6], St−1[6], St−2[6] using Equation 22, one can determine thevalues of St−2[5], St−2[4]. Likewise, by recovering St[2], St−1[2], St−2[2] usingEquation 20, one can determine St−2[1] and St−2[0]. Finally, St−2[3], St−2[7] canbe recovered by Equation 21 and Equation 23 respectively. This means the allstate contents at time t−2 are known without having to use any known plaintext.Thus, this attack is stronger than that reported in [10], being a ciphertext-onlyattack.

Success rate For the above attack strategy, we require eight target stages,namely St[2], St−1[2], St−2[2], St−2[3], St[6], St−1[6], St−2[6], St−2[7]. From theanalysis in Section 3, assuming that we require a 99.9% probability of correctlyrecovering the contents of each target state, 16 random faults would be injectedfor each target state, so a total of 128 random faults would be carried out. Thesuccess probability of the full state recovery attack is about 0.9998 ≈ 0.992.Higher probabilities can be achieved if more random faults are made on eachtarget stage.

4.4 Tiaoxin

Tiaoxin has an internal state consisting of three components T3, T4 and T6 withthree, four and six 128-bit stages respectively, and thus has a total state size of13 × 128 = 1664 bits. Tiaoxin uses a 128-bit key K and a 128-bit initialisationvector IV . The state update of Tiaoxin is defined as

T t+1s [i] =

R(T ts [s− 1])⊕ T t

s [0]⊕M ts for i = 0

R(T ts [0])⊕ Z0 for i = 1

T ts [i− 1] 0 ≤ i ≤ s− 1

(24)

where s ∈ {3, 4, 6}, and M t3,M

t4 and M t

6 are the external inputs to T3, T4 andT6, respectively. Therefore, all stages except for the first two stages in each com-ponent are updated by shifting, while the first two stages of each component are

updated nonlinearly using the transformation function R defined in Section 2.1.Figure 4 shows the initialisation and encryption process of Tiaoxin. As shown inthe figure, the plaintext P is divided into two blocks P t = P t[0]||P t[1], which aresuccessively loaded into the internal state of each component. Each ciphertextblock Ct is then computed after loading the corresponding plaintext block. At

Fig. 4. Tiaoxin-346 state update and output

the start of the initialisation phase, the state is loaded as

T3 = (K,K, IV ) T4 = (K,K, IV, Z0) T6 = (K,K, IV, Z1, 0, 0)

where K is the key, IV is the initialisation vector, and Z0, Z1 are known pub-lic constants. The state is then updated 15 times using the external inputs(M t

3,Mt4,M

t6) = (Z0, Z1, Z0) to obtain the initial state.

Once the initial state is obtained, the encryption phase begins. At eachtimestep, the external inputs are composed from plaintext blocks, namely(M t

3,Mt4,M

t6) = (P t[0], P t[1], P t[0]⊕P t[1]). The output functions of Tiaoxin for

the two blocks are

Ct[0] = T t+13 [0]⊕ T t+1

3 [2]⊕ T t+14 [1]⊕ T t+1

6 [3]T t+14 [3] (25)

Ct[1] = T t+16 [0]⊕ T t+1

4 [2]⊕ T t+13 [1]⊕ T t+1

6 [5]T t+13 [2] (26)

These functions are of the form identified in Equation 2, which means that therandom fault attack described in Section 2.2 can be applied to this cipher.

Attack Procedure Comparing with the generic form in Equation 2, we canobtain four sets of attack parameters from the two output functions. From Equa-tion 25, the parameters are:

(f0(St), g0(St), St[u]) = (T t3 [0]⊕ T t

3 [2]⊕ T t4 [1], T t

6 [3], T t4 [3]) (27)

(f0(St), g0(St), St[u]) = (T t3 [0]⊕ T t

3 [2]⊕ T t4 [1], T t

4 [3], T t6 [3]) (28)

From Equation 26, the parameters are:

(f1(St), g1(St), St[u]) = (T t6 [0]⊕ T t

4 [2]⊕ T t3 [1], T t

3 [2], T t6 [5]) (29)

(f1(St), g1(St), St[u]) = (T t6 [0]⊕ T t

4 [2]⊕ T t3 [1], T t

6 [5], T t3 [2]) (30)

Since the state updates of T3, T4, T6 are independent, it makes sense to targetthe shortest register, which is T3. One set of parameters allows recovery of astage in T3, namely Equation 29, through which T t[2] is recovered.

Key Recovery Similar to the AEGIS family of stream ciphers, the followingrecurrence relations hold for the state update of T3 in Tiaoxin:

T t−13 [i] =

{T t3 [i− 1] 1 ≤ i ≤ 2

R−1(T t3 [1]⊕ Z0) i = 0

(31)

This enables us to recover the entire state contents of T t−23 after recovering

T t3 [2], T t−1

3 [2], T t−23 [2] using the parameters in Equation 30 through random

faults on T t6 [5], T t−1

6 [5], T t−26 [5]. It is also possible to recover the secret key for

Tiaoxin by extending the attack into the initialisation phase provided that thesingle plaintext block P 0[0] is known. First, apply the above attack to recoverthe state contents of T 1

3 . Then, use the process shown in Figure 5 to recoverT 03 and subsequently the key. Note that the external input Z0 used during ini-

Fig. 5. Tiaoxin key recovery via random fault attack on T3

tialisation is public, so the updates of state component T3 can be reversed fromT 03 all the way to the beginning of the initialisation phase, which is T−15

3 . Thekey can then be readily obtained from the initial contents of T−15

3 [0] from theloaded state. From this point, all components in the state of Tiaoxin-346 can beinitialised with the known key K and initialisation vector IV , and the ciphercan then be clocked forwards to encrypt and verify any message chosen by theattacker.

In light of the above comments, the security of this cipher against our key re-covery attack depends entirely on maintaining the secrecy of the initial plaintextblock. In cases where the message format requires particular header informationto be included at the start of the message, this may be problematic.

State Recovery If the initial plaintext block is not known, a state recoveryattack is still possible. Using the attack parameters in Equations 29, 28, 30 al-lows recovery of T3[2], T4[3], T6[5] respectively. Observe that recurrence relationssimilar to T3 shown in Equation 31 also holds for T4, T6, namely:

T t−14 [i] =

{T t4 [i− 1] 1 ≤ i ≤ 3

R−1(T t3 [1]⊕ Z0) i = 0

T t−16 [i] =

{T t6 [i− 1] 1 ≤ i ≤ 5

R−1(T t3 [1]⊕ Z0) i = 0

Therefore, by recovering stages T t−33 [2], T t−4

3 [2], T t−53 [2] using Equation 29,

T t−24 [2], T t−3

4 [3], T t−44 [3], T t−5

4 [3] using Equation 27 or Equation 28, and T t6 [5],

T t−16 [5], T t−2

6 [5], T t−36 [5], T t−4

6 [5], T t−56 [5] using Equation 30, we can recover

the entire state (T t−53 , T t−5

4 , T t−56 ) at time t− 5 without the need of any known

plaintext.

Success rates For the key recovery attack, we require three target stages.From the analysis in Section 3, assuming that we require a 99.9% probability ofcorrectly recovering the contents of each target stage, 16 random faults wouldbe injected for each target state, so a total of 48 random faults would be carriedout. It can then be deduced that the success probability of the full key recoveryattack is about 0.9993 ≈ 0.997. For the state recovery attack, there are 13 targetstages and hence 208 random fault injections. The gives a success probability ofabout 0.99913 ≈ 0.987 if the same attack parameters as the key recovery attackare chosen. Higher probabilities can be achieved if more random faults are madeon each target stage.

5 Results

In this section, we summarise the results of our successful attacks on AEGISand Tiaoxin presented in Section 4, and also discuss a further application of ourattack on another CAESAR cipher, MORUS, where we achieve partial success.

5.1 Successful attacks

We first compare the random fault attacks presented in this paper on the AEGISfamily of ciphers and Tiaoxin with the bit-flipping fault attacks presented in [10]and the random fault attacks of [11]. Table 3 summarises the attack outcomesachieved and the corresponding attack requirements. In the table, “P’txt” de-notes the number of known plaintext blocks required for the attack, whereas

Table 3. Comparison of Fault Attacks on CAESAR candidates

CipherBit-flipping Random fault Random fault

Recovery attack [10] attack [11] attack (this work)Type P’txt Targets P’txt Targets P’txt Targets

AEGIS-128 State 2 3 N/A 1 4

AEGIS-256 State 2 4 N/A 1 5

AEGIS-128L State 4 4 0 8 0 8

Tiaoxin Key 1 3 2 6 1 3

Tiaoxin State N/A N/A 0 13

“Targets” denotes the number of state words into which random faults are tobe injected to implement the attack. For each targeted state word, each of theattacks requires a corresponding faulted ciphertext word to be observed.

The attack in [10] differs from the attack presented in this paper as it requiresbit-flipping faults rather than the more practical random faults. There are alsodifferences in the amount of plaintext required, with our attacks requiring fewerknown plaintext blocks. The attack presented in the current paper also requiresless plaintext than the attack of [11] while being applicable to a greater numberof ciphers, since our attack requires fewer conditions on the cipher’s structure.In addition, in the cases of AEGIS-128L and Tiaoxin state recovery, our attackis a ciphertext-only attack, requiring no knowledge of the plaintext.

5.2 Partially successful attacks

We now discuss briefly the potential application of this attack to the MORUS ci-pher family [9], which was a third-round candidate in the CAESAR competition.The ciphertext output function for each of the ciphers in this family has the formdescribed in Equation 2 so it is possible to obtain partial state information fromthese ciphers by applying the attack of Section 2. However, the overall structureof these ciphers prevents the attack from being extended to a full state recoveryor key recovery attack.

Each cipher in the MORUS family has a state comprising five state words,and the ciphertext output function for each of these ciphers operates at the wordlevel. In each case, our basic attack can be applied to obtain the contents of twoof the five state words at any time step during the encryption phase. If theattack is performed at two adjacent time steps, it is also possible to determinethe values of these two words through all the intermediate updates betweenthese time steps. However, there does not appear to be a straightforward wayto determine the contents of the remaining three state words from this knowninformation, due to the use of AND operations between state words during theupdate process introduces nonlinearity and prevents recovery of those unknownstate words.

For a full description on our attack on MORUS, the reader is referred to oursupplementary material available on the IACR Cryptology ePrint Archive.

6 Discussion and Conclusion

This paper shows that attacks based on random faults are possible, under thenonce reuse scenario, on ciphers where the output function includes a bitwiseAND operation. When using any such cipher, care must therefore be taken toavoid nonce reuse so that an attacker cannot obtain multiple encryptions usingthe same parameters. We demonstrated successful application of this randomfault attack to several CAESAR finalists and other candidates. In particular,ciphertext-only attacks resulting in state recovery are possible for AEGIS-128Land Tiaoxin whereas a single plaintext block allows key recovery in Tiaoxin andstate recovery in AEGIS-128 and AEGIS-256.

This paper has demonstrated that our random fault attack strategy is par-ticularly applicable to ciphers where the following conditions are satisfied.

– The ciphertext output functions contains one quadratic term and is otherwiselinear.

– The internal state transitions contain linear paths across different stages anddo not have external input.

Our attack was less successful on ciphers in the MORUS family, which alsohave the form required for implementing the random fault attack. From ourexamination of these ciphers, we observe that a cipher’s overall susceptibilityto this random fault attack can be reduced by ensuring that the state updatefunction provides nonlinear mixing of state words when moving from one timestep to the next. Akin to this, it should not be possible to use the state updatefunction to determine the value of any state word that is not in an AND termin the output function purely from the knowledge (at one or more time steps)of state words that do appear in an AND term in the output function. Otherpotentially useful strategies for preventing partial recovery of state informationfrom leading to full state recovery or key recovery include the following:

– Any state word which appears within an AND term in the output functionshould occur in several such terms.

– State words which appear within AND terms in the output function shouldbe as close as possible to structural features (e.g. external input) which pre-vent them being clocked back to reveal information at the previous time step.(For example, changing the non-linear term in the output function for AEGIS-128 to St[0]St[1] would prevent the attacker from obtaining any of St[2], St[3]or St[4] without knowledge of additional plaintext blocks.)

– The state update function during the initialisation phase of the cipher shouldnot be reversible without knowledge of the secret key.

The first strategy restricts an attacker to obtaining the value of some combina-tion of state words from each run of the attack, rather than obtaining a singlestate word directly. The second strategy limits the amount of state that can berecovered from repeated applications of the attack at successive times steps, andthe third prevents the attacker from turning state recovery into key recovery.

This paper leaves several areas for future investigation. Firstly, further anal-ysis is required to determine whether the existing attacks on MORUS can beextended to retrieve further information, such as a full state recovery. Secondly,we have only analysed the application of this attack to three CAESAR candi-dates. There may be more ciphers with similar output functions that are there-fore susceptible to this attack. Finally, work is required to determine whetherthe mitigation strategies mentioned above introduce other vulnerabilities thatcould be exploited by alternative attacks.

References

1. Boneh, D., DeMillo, R.A., Lipton, R.J., On the Importance of Checking Crypto-graphic Protocols for Faults, In Fumy, W. (ed.), Advances in Cryptology — EU-ROCRYPT ’97 (LNCS, volume 1233), pp. 37-51, Springer Berlin Heidelberg, 1997.

2. Biham, E., Shamir, A., Differential fault analysis of secret key cryptosystems, InKaliski, B.S. (ed.) Advances in Cryptology — CRYPTO ’97 (LNCS, vol. 1294),pp. 513-525 , Springer Berlin Heidelberg, 1997.

3. Blomer, J., Seifert, J., Fault based cryptanalysis of the Advanced Encryption Stan-dard (AES), In Wright, R. (ed.), Financial Cryptography (LNCS, vol. 2742), pp.162-181, Springer Berlin Heidelberg, 2003.

4. Tunstall, M., Mukhopadhyay, D., Ali, S, Differential fault analysis of the AdvancedEncryption Standard using a single fault, In Ardagna, C.A., Zhou, J. (eds.), In-formation Security Theory and Practice. Security and Privacy of Mobile Devicesin Wireless Communication (LNCS, vol. 6633), pp. 224-233, Springer Berlin Hei-delber, 2011.

5. Barenghi, A., Breveglieri, L., Koren, I., Naccache, D. Fault injection attacks oncryptographic devices: theory, practice, and countermeasures. Proceedings of theIEEE, 100(11), pp. 3056-3076, 2012.

6. Skorobogatov, S.P., Anderson, R.J. Optical Fault Induction Attacks. In Kaliski,B.S., Koc, K., Paar, C. (eds.) Cryptographic Hardware and Embedded System -CHES 2002 (LNCS, volume 2523), pp. 2-12, Springer Berlin Heidelberg, 2003.

7. Nikolic, I. Tiaoxin-346 (version 2.1). CAESAR competition. Available from https:

//competitions.cr.yp.to/round3/tiaoxinv21.pdf.8. Wu, H., Preneel, B. AEGIS: A Fast Authenticated Encryption Algorithm (v1.1)

CAESAR competition. Available from https://competitions.cr.yp.to/round3/

aegisv11.pdf.9. Wu, H., Huang, T. The Authenticated Cipher MORUS (version 2). CAESAR com-

petition. Available from https://competitions.cr.yp.to/round3/morusv2.pdf.10. Dey, P., Rohit, R.S., Sarkar, S., Adhikari, A. Differential Fault Analysis on Tiaoxin

and AEGIS Family of Ciphers. In Mueller, P., Thampi, S., Alam, B. M., Ko, R.,Doss, R., Alcaraz, C. J. (eds.) Security in Computing and Communications - SSCC201 (CCIS vol. 625), pp. 74-86. Springer Singapore, 2016.

11. Bartlett, H., Dawson, E., Qahur Al Mahri, H., Salam. M.I., Simpson, L., Wong,K. K.-H., Random Fault Attacks on a Class of Stream Ciphers, Security and Com-munication Networks, vol. 2019, Article ID 1680263 (doi: 10.1155/2019/1680263),2019

12. Daemen J., Rijmen V., The Design of Rijndael. Springer, Berlin, Heidelberg, 2002.