Abstract: The existing differential fault attacks against the SKINNY algorithm have problems such as a large number of faults that need to be injected, high complexity in key searching, long attack execution time, and there may be remaining key in key space. To address the above issues, a new differential fault attack model based on double nibble/byte faults is proposed to implement differential fault attacks on the SKINNY-64-64 and SKINNY-128-128 algorithms. This model allows attackers to access and fully control the tweak (tweakable block cipher), assuming a fixed tweak for the tweak key input. By injecting double nibble and double byte faults into the R-3 and R-4 rounds of the key schedule algorithm for SKINNY-64-64 and SKINNY-128-128, respectively, the model recovers the main keys of SKINNY-64-64 and SKINNY-128-128 by establishing differential equations and computing equations according to constraints of the differential of S-box inputs in the last three rounds. The simulation results on software implementations show that, the proposed model can recover the main keys of SKINNY-64-64 and SKINNY-128-128 using only 5.9 and 6.7 pairs of faults, respectively. Compared with existing methods, the proposed model can maintain lower attack time overhead while injecting fewer faults to recover the unique keys of the algorithm.

Key words: differential fault attack, SKINNY, double nibble/byte fault, key schedule

摘要： 现有针对SKINNY算法的差分故障攻击存在需要注入的故障数量多、密钥搜索复杂度高及攻击执行时间长且密钥空间可能会有剩余等问题。针对上述问题，提出一种基于双半字节/双字节故障的差分故障攻击模型，实现对SKINNY-64-64算法和SKINNY-128-128算法的差分故障攻击。该模型允许攻击者对微调进行访问和完全控制，并假设可调密钥输入有一个固定的调整，在SKINNY-64-64算法和SKINNY-128-128算法的密钥编排算法的第R-3轮和R-4轮密钥中分别注入双半字节和双字节故障，利用最后三轮S盒输入差分中的约束建立差分方程，通过计算恢复SKINNY-64-64算法和SKINNY-128-128算法的主密钥。在软件实现上的仿真实验测试结果表明，新提出的模型分别利用5.9对和6.7对故障可以恢复出SKINNY-64-64算法和SKINNY-128-128的主密钥；相对于现有方法，新提出的模型可以在注入较少故障恢复算法唯一密钥的同时保持较低的攻击时间开销。

关键词: 差分故障攻击, SKINNY, 双半字节/字节故障, 密钥编排