Citation Context

... circuit’s computation. Faults attacks were introduced in 1997 by Boneh et al. [5]. They consist in modifying a circuit environment in order to c© 2013 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works. change its behaviour or to induce faults into its computations [6] [7] [8]. Many means are of common use to inject such faults, especially laser shots [9] [10] [11], overclocking [12] [13], chip underpowering [14] [15], temperature increase [16] or electromagnetic glitches [10] [17]. There are three main subclasses of fault attacks: algorithm modifications, safe error and differential fault analysis. Algorithm modifications aim at skipping [18] or replacing [13] some instructions executed by a microcontroller to circumvent its security features. Safe-error attacks aim at evaluating whether or not a fault injection has an impact on the output [19]. Differential fault...

Citation Context

...ssible to note the differences in the key-stream 5bits to recover certain information about the state. This model of attack could be successfully employed against a number of cryptographic primitives =-=[7]-=-. Initial works in this direction appear in [8,10] and later such attacks on stream ciphers have been explored in [14]. Here, a typical attack scenario generally consists of an adversary who can injec...

Citation Context

...gatov [38] used a low-cost CCD camera to analyze the leakage of photons emitted from SRAM, EEPROM, and Flash memories. The temperature side-channel has been often cited in literature, see for example =-=[6,8,10,11,22,23,30,36,42]-=-. However, most of the publications only mention the existence and possibility to exploit this channel but without providing further investigations. In particular, H. Bar-El stated in [6] that tempera...

Citation Context

...tacks [23, 15], and power analysis attacks [26]) have shown that our traditional security definitions are not sufficient for most practical implementations of provably secure cryptographic primitives =-=[11, 12, 32, 5]-=-. ∗Stanford University. Email: {klewi,hartm,ananthr}@cs.stanford.edu 1 To deal with fault injection attacks, cryptographers have developed the notion of related-key attack (RKA) security. RKA security...

Citation Context

...ormation on the smart card while intercepting the victim’s password by using a malicious card reader, since the user is on the scene and the time is not sufficient for launching a side-channel attack =-=[4,58]-=-; S(v) M is not allowed to first compromise the user’s password and then compromise the smart card [54,58,61]. Clearly, if M has compromised both factors, there is no way to prevent M from impersonati...

Citation Context

...ediate computation results of the encryption or decryption process, the attacker can compromise the security level of the cipher by revealing the secret key that is used for encryption and decryption =-=[14]-=-. Suppose the intermediate computation results of one AES block is buffered in a 32-bit storage device, e.g. registers, caches, etc, and is protected by a robust duplication code C = {y, f(y)}, where ...

Citation Context

...processor and aim at injecting faults into an embedded program’s control flow [11] [12]. Those attack schemes rely on an attacker’s fault model which defines the set of faults an attacker can perform =-=[13,14]-=-. As a consequence, countermeasure schemes must take this fault model aspect into account. On microcontrollers and embedded processors, the fault model in which an attacker can skip an assembly instru...

Citation Context

...erving some physical characteristics which are modified during the circuit’s computation [25, 40, 39, 16, 9]. The second technique, called fault attacks, consists in disrupting the circuit’s behavior =-=[11, 35, 8, 37, 3, 17]-=-. The third one consists in getting information about the chip design by direct inspection of its structure [42]. This inspection may be performed by using any kind of imaging techniques or by using d...