What actually happens in "low voltage fault attacks"

Question

I understand they are an attack on crypto algorithms as implemented on various processors, but how do they work? The online papers are too complex for me to understand.

Answer 1

"Fault attacks" are something you do on some hardware:

• that is in your physical hands,
• but is shielded against intrusion ("tamper resistant"),
• and does computations with values that you don't know but would like to ("cryptographic keys").

Example of such hardware are smart cards. A classic scenario would be: you have a smart card for a satellite-TV decoder; you got the card through a normal subscription to the broadcaster; you wish to make 3000 copies of that card so that you may resell them to people who want free/cheap TV. People do that.

A fault attack is when you induce the shielded hardware to get things wrong by changing its environment. For instance, you try to run the card in an oven, at a temperature which is beyond the nominal operating temperature of the card. The attacker's hope is that by analysing what the card returns when it failed, he may gain some insight on the secret values stored in the card (this is of course very specific to what the card computes and how things are implemented in that card). A low-voltage fault attack is a fault attack where the fault is induced by feeding the hardware with a lower-than-normal voltage (in the "smart card" model, the card has its own CPU, RAM and ROM, but the current and clock signals are provided externally, i.e. are under the control of the attacker). For instance, if the card expect 3.3V, you give it only 2V. The real trick here is that the attacker can lower the voltage for only very short durations, a few clock cycles, so as to induce a fault in a specific part of the algorithm execution.

Answer 2

This is a local attack and is an attack on the cryptographic algorithm itself. Basically, it is making use of the fact that at low voltage, it is hard to distinguish between a 0 and a 1 in order to fuzz the encryption algorithms in to leaking information about the key.

This is of limited use since it requires a system that is securely loading and running with encrypted storage while able to alter the power levels in the device, which is a very limited situation indeed. It would mainly be of use in a forensic type setup or with a stolen and logged in device where power can be maintained. The key for the attack to work is that the private key must be in use for decryption or encryption operations but not be accessible to the attacker by other means. By forcing the encryption and decryption software to fault in a controlled manner, information about the private key can be determined.

This works because controlling the point of failure will end up resulting in different changes of behavior based on if values are 1 or 0. Since a 0 is represented by the absence of voltage and a 1 is based on the presence, if you lower the amount of voltage, some 1s will start reading as 0s. This results in faults where a value is 1 for a condition, but not in places where a value is 0 for a condition.

The pattern of those faults can be used to gain some limited information about either the key being used for the cryptographic processes, or in this case, the original plain text being encrypted rather than the key itself and by re-running the encryption multiple times with faulting. They were experimentally able to recover the plaintext by preventing the encryption from occurring correctly in a way that allowed the plain text to be determined (which doesn't actually require the key or any key details to be leaked.) It took several minutes of constantly rerunning the encryption thousands of times to do so with reasonably high success, but they were able to perform the attack in a way that the device worked normally after they did the attack, so it could potentially be covert if there is unmonitored physical access to the device.