Differential Fault Analysis
Differential fault analysis (DFA) combines fault injection with differential cryptanalysis, recovering the key from the difference propagation between correct and faulty outputs.
Purpose
It provides a practical fault attack against block ciphers such as AES and DES and is a standard item in hardware security evaluations.
Mechanism
A single-byte fault is injected into the second-to-last round; collecting the correct ciphertext C and the faulty ciphertext C′, the differential constraints on C XOR C′ derived from the AES round structure solve for the last round key.
Use cases
- AES hardware security assessment
- DFA attacks on DES
- HSM fault-resistance testing