Differential Fault Attack on Rasta and $\text{FiLIP}_{\text{DSM}}$
R Radheshwar, Meenakshi Kansal, Pierrick Méaux, Dibyendu Roy
Abstract
In this paper we propose Differential Fault Attack (DFA) on two Fully Homomorphic Encryption (FHE) friendly stream ciphers Rasta and <inline-formula><tex-math notation="LaTeX">$\text{FiLIP}_{\text{DSM}}$</tex-math></inline-formula> . Design criteria of Rasta rely on affine layers and nonlinear layers, whereas <inline-formula><tex-math notation="LaTeX">$\text{FiLIP}_{\text{DSM}}$</tex-math></inline-formula> relies on permutations and a nonlinear filter function. Here we show that the secret key of these two ciphers can be recovered by injecting only 1 bit fault in the initial state. Our DFA on full round (# rounds <inline-formula><tex-math notation="LaTeX">$=6$</tex-math></inline-formula> ) Rasta with 219 block size requires only one block (i.e., 219 bits) of normal and faulty keystream bits. In the case of our DFA on FiLIP-430 (one instance of <inline-formula><tex-math notation="LaTeX">$\text{FiLIP}_{\text{DSM}}$</tex-math></inline-formula> ), we need 30000 normal and faulty keystream bits.