Differential Fault Analysis Using Symbolic Execution

Differential fault analysis (DFA) is a cryptanalytic attack that uses corrupted cipher executions to extract secret/private keys. Traditionally applied in hardware-based systems, it is now being actively used in extracting keys from (whiteboxed) software cipher implementations. Extensive research is published which aims at increasing the efficiency of DFA on symmetric ciphers using fewer number of faulty cipher texts. However, such DFA attacks require manual analysis as a pre-processing step, a fixed guess at the fault model, and can be non-trivial to implement. Algebraic Fault Analysis (AFA) is a class of DFA which overcomes these difficulties by using a combination of algebraic cryptanalysis and DFA to retrieve the secret key. In this paper, we present a methodology which decreases the complexity of performing AFA, by using a symbolic execution engine on a software implementation of the cipher to create constraints which are then fed into a SAT solver. We test our proposed methodology against the AES and DES ciphers using different fault models, and show that under a given fault model, the keys can be extracted with as little as ~2 and ~5 faults respectively.