Week 8: Fault Injection

Question 1

What do Fault Models consist of?

Answer 1

Location, Effects and Timing.

Question 2

What are the possible Locations in a Fault Model?

Answer 2

Random position/width.
Specific bit/byte/instruction.

Question 3

What are the possible Effects in a Fault Model?

Answer 3

Bit flip.
Bit stuck at zero or one.
Statistical (75% chance -> 0, etc.).
Skip instructions.

Question 4

What are the possible Timings in Fault Model?

Answer 4

Number of affected cycles/instructions.
Timing jitter.

Question 5

Describe a Generic Attack for keyed crypto algorithms?

Answer 5

1. Get fault-free ciphertext c_ref.
2. Inject fault (stuck-at-zero) for bit 0 in c_0.
   2a. If c_0 = c_ref, key bit 0 = 0.
   2b. Else = 1.
3. Repeat for all key bits.

Question 6

Describe the Bellcore attack?

Answer 6

q = gcd(s - faulty_s, n), p=n/q

Question 7

Describe the Lenstra attack?

Answer 7

q = gcd((faulty_sig^e) - x, n), p=n/q
Only one fault signature needed.

Question 8

What are some detection-based countermeasures for fault injections?

Answer 8

Monitor environment - detect injection.
Detect faulty result - parallel or sequential.
Detect unusual usage patterns.

Question 9

What are some algorithmic countermeasures for fault injections?

Answer 9

RSA/ECC - verify signature after signing.
AES - backwards rounds (check intermediate values).
Randomization in time - added delays = harder to inject.
Infective computation - fault randomizes result.

Question 10

What are the prerequisites for Rowhammer?

Answer 10

Uncached memory access - write to RAM.
Fast memory access.
Specific row targeting - reverse engineer mapping functions.

Question 11

Describe a DFA attack on AES?

Answer 11

Injected fault - diff(z, z’) (before SubBytes in final round)
Observe outputs y, y’
Find k that satisfy:
S^-1(k XOR y) XOR S^-1(k XOR y’) = diff(z, z’)
Repeat new inputs until found.

Question 12

What is the fault model for a generic attack on keyed algorithms?

Answer 12

Location: specific key bit
Timing: specific bit
Effect: bit stuck at zero

Question 13

What is the fault model for Bellcore/Lenstra?

Answer 13

Location: random
Timing: only one sub exp.
Effect: any

Question 14

What is the fault model for an attack on AES?

Answer 14

Location: specific bit
Timing: before SubBytes in final round
Effect: flip bit

Question 15

Explain Rowhammer?

Answer 15

1.) Find target location and release back to OS.
2.) Make page table appear at target location.
3.) Fill physical memory with page tables.
4.) Flip in target PTE likely gives access to page table -> now has kernel privilages.

Question 15

Explain Rowhammer?

Answer 15

1.) Find target location and release back to OS.
2.) Make page table appear at target location.
3.) Fill physical memory with page tables.
4.) Flip in target PTE likely gives access to page table -> now has kernel privilages.