Exploiting Bitflip Detector for Non-invasive Probing and its Application to Ineffective Fault Analysis

Matsuda et al. proposed a countermeasure against laser fault injection that uses distributed on-chip sensors. The sensor raises an alarm by detecting an electrical phenomenon caused in conjunction with a bitflip. A cryptographic module can stop releasing a faulty ciphertext by using the alarm. In this paper, security and limitation of the countermeasure by Matsuda et al. is rigorously evaluated. We show that an attacker can get side-channel information by observing how the sensors react to laser fault injection. That enables the attacker to probe intermediate values in a chip non-invasively. On the one hand, under a chosen-plaintext setting, the laser-based probing enables to run the conventional probing attack on AES by Schmidt and Kim. On the other hand, under a ciphertextonly setting, the laser-based probing raises a new challenge: the attacker is given correct ciphertexts and corresponding singlebit probing results. We propose a new ineffective fault analysis against AES based on linear cryptanalysis that can be used in the above setting.