Fault Injection Attack Threat Analysis

Version: 1.0
Last Updated: 2025-01-02
Security Classification: PUBLIC

Overview

Fault injection attacks deliberately introduce errors during cryptographic operations to extract secrets or bypass security mechanisms. These attacks can be physical (voltage glitching, clock manipulation) or software-based (Rowhammer, exploitation of race conditions).

Attack Techniques

Physical Fault Injection

Voltage Glitching

Clock Manipulation

Electromagnetic Injection

Optical Injection

Software Fault Injection

Memory Attacks

Race Conditions

Vulnerable Cryptographic Operations

Operation Attack Goal Technique Impact
RSA-CRT Factor modulus Single fault Key recovery
AES rounds Skip rounds Clock glitch Reduced security
Signature verification Bypass check Instruction skip Authentication bypass
RNG seeding Predictable output Reset attack Weak randomness
Key derivation Known keys Computation fault Key recovery

Attack Examples

Bellcore Attack on RSA-CRT

def bellcore_attack_simulation():
    """Simulate Bellcore attack on RSA-CRT"""
    # Normal RSA-CRT signature
    s_p = m^d mod p
    s_q = m^d mod q
    s = CRT_combine(s_p, s_q)
    
    # Faulty signature (fault in s_p)
    s_p_fault = faulty_computation(m^d mod p)
    s_fault = CRT_combine(s_p_fault, s_q)
    
    # Factor recovery
    q = gcd(s - s_fault, n)
    p = n // q
    return p, q

AES Differential Fault Analysis

def aes_dfa_attack():
    """DFA on AES last round"""
    # Collect correct ciphertext
    c_correct = AES_encrypt(plaintext, key)
    
    # Inject fault before last round
    c_faulty = AES_encrypt_with_fault(plaintext, key, round=9)
    
    # Analyze differential
    diff = c_correct ^ c_faulty
    # Recover last round key from differential
    round_key = analyze_differential(diff)
    return round_key

Countermeasures

Detection Mechanisms

Redundancy Checks

// Dual computation with comparison
result1 = compute_crypto(input);
result2 = compute_crypto(input);
if (result1 != result2) {
    // Fault detected
    trigger_alarm();
    return ERROR;
}

Integrity Checks

// Add checksums to critical data
typedef struct {
    uint8_t key[32];
    uint32_t checksum;
} protected_key_t;

int verify_key(protected_key_t *pkey) {
    uint32_t calc_checksum = calculate_crc32(pkey->key, 32);
    return (calc_checksum == pkey->checksum);
}

Prevention Techniques

Temporal Redundancy

Spatial Redundancy

Algorithm-Level Protection

Implementation Guidelines

Protected Implementation Pattern

int protected_crypto_operation(void *input, void *output) {
    int result1, result2, result3;
    int fault_detected = 0;
    
    // Triple redundancy with different timing
    result1 = crypto_op(input, output);
    random_delay();
    result2 = crypto_op(input, output);
    random_delay();
    result3 = crypto_op(input, output);
    
    // Majority voting
    if (result1 == result2 || result1 == result3) {
        return result1;
    } else if (result2 == result3) {
        return result2;
    } else {
        // All different - severe fault
        panic("Multiple fault detection");
    }
}

Testing and Validation

Fault Simulation Tools

Test Methodologies

  1. Exhaustive fault testing: All possible single-bit faults
  2. Random fault injection: Statistical coverage
  3. Targeted fault models: Specific attack scenarios
  4. Multi-fault testing: Combined fault attacks

Real-World Incidents

Standards and Requirements

Certification Requirements

Industry Guidelines

Advanced Topics

Combined Attacks

Emerging Threats

References