A Type of Differential Fault Attacks of the Stream Cipher SNOW-V Based on AES Structure

Abstract

SNOW-V is a member in the SNOW family of stream ciphers designed for the 5G mobile communication system. In order to have a high speed, both the linear feedback shift register (LFSR) and finite state machine (FSM) are updated to better align with vectorized implementations and the update function is based on the round function of AES. In this paper, we find the 512-bit LFSR can be approximately divided into four parts and each clock one 128-bit part updates the FSM, another 128-bit part masks the 128-bit keystream. Differences in different bytes of the LFSR have distinguishable propagations in the keystream, which all behaves not randomly. Under the assumption that the cipher can be reset several times with the same key and IV to permit the adversary to inject different one-byte faults in the higher 16 bytes of LFSR-B during the keystream-generating phase, the state of SNOW-V can be revealed. For the simplified version of SNOW-V that addition with carry is replaced by XOR, the 384-bit FSM state can be revealed from the faulty and fault-free keystreams of seven faults with evenly 2²³ computational complexity, and then the 512-bit LFSR state can be revealed with no more complexity. For the full version of SNOW-V, we can conduct another fault attack with 2⁴⁸ computational complexity and 64 faults on average.