arXiv 2603.197812026-03cs.CR

从精确到随机：轻量块密码Lilliput的系统性差分故障分析

Differential Fault Analysis of Lilliput under Random-Location Nibble Faults

School of Cyber Science and Technology, Hubei University（湖北大学网络空间安全学院）；Key Laboratory of Intelligent Sensing System and Security, Ministry of Education, Hubei University（湖北大学智能感知系统与信息安全教育部重点实验室）；Faculty of Mathematics and Statistics, Hubei Key Laboratory of Applied Mathematics, Hubei University（湖北大学数学与统计学院，湖北省应用数学重点实验室）

Peipei Xie, Siwei Chen, Zejun Xiang, Shasha Zhang, Xiangyong Zeng

备注：: 36 pages, 25 figures. Minor revisions and clarifications

阅读 PDF

arXiv 页面 ↗HTML 原文 ↗

AI总结：

本文首次系统性地对轻量块密码Lilliput进行了三种不同故障模型下的差分故障分析，揭示其在现实场景中对物理攻击的脆弱性，为安全实现提供关键见解。

摘要：

在SAC 2013上，Berger等人首次提出了扩展广义Feistel网络（EGFN）结构，用于设计具有高效扩散特性的块密码。后来，基于类型2 EGFN，他们实例化了一种新的轻量块密码Lilliput（发表于IEEE Transactions on Computers，第65卷，第7期，2016年）。根据已发表的密码分析结果，Lilliput在理论上对差分、线性、回旋和积分攻击等统计性质依赖的攻击具有足够的安全性。然而，关于其在现实场景中对物理攻击（如故障攻击）的抵抗力分析却存在不足。本文首次系统性地对Lilliput进行了三种以字节为导向的故障模型下的差分故障分析，以全面评估其故障容忍性。在模型I（多轮固定位置）中，精确的故障注入在特定轮次中可使用仅8次故障恢复主密钥，成功率为98%。模型II（单轮固定位置）放宽了多轮要求，证明8次故障集中在单一轮仍足以通过利用Lilliput的扩散特性和基于DDT的约束，实现99%的成功率。模型III（单轮随机位置）进一步放宽假设，允许故障在第27轮的八个最右边分支中随机发生。通过高概率地从密文差异中唯一识别故障位置，攻击仍具有高度可行性，使用33次故障可实现超过99%的成功率，使用36次故障可超过99.5%。我们的发现揭示了Lilliput在不同对手能力的现实场景中对实际故障攻击的显著脆弱性，为其实现安全提供了关键见解。

英文摘要：

Lilliput is a lightweight block cipher based on a Type-2 Extended Generalized Feistel Network (EGFN). Although it has been studied under conventional cryptanalytic techniques, its resistance to fault attacks remains largely unexplored. We present a theoretical differential fault analysis of Lilliput under a random-location nibble fault model. A nonzero nibble fault is injected at the input to round 27, with the injection location uniformly distributed among the 16 state branches and unknown to the adversary. We analyze fault propagation through the EGFN and derive ciphertext-difference conditions to identify the faulty branch. A DDT-weighted calculation yields an overall branch-identification accuracy of approximately 99.9980% under independent uniform sampling of plaintexts, nonzero fault values, and fault locations; simulations of 2^20 random faults give 99.9983%. After identifying the faulty branch, we classify propagation patterns using the injected difference and the intermediate S-box output difference. We then derive DDT-based constraints on last-round and penultimate-round subkeys and intersect candidate sets from multiple faulty ciphertexts. In 2^15 simulation trials, key-recovery success rates exceed 90%, 95%, and 99% with 32, 36, and 46 faulty ciphertexts, respectively. These simulation-based results are not claims of physical fault-injection performance but offer insight into practical fault analysis of Lilliput.

机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。