# US 2023/0412356 A1 · Hardware Countermeasures Against DFA Attacks on AES Operations

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2023/0412356 A1
- Document ID: US20230412356A1
- Status: Published application
- Kind: A1
- Application number: 17/844,817
- Filed: 2022-06-21
- Published: 2023-12-21
- Earliest claimed: 2022-06-21
- Assignees: Silicon Laboratories Inc.
- Applicants: Silicon Laboratories Inc.
- Inventors: Steven Cooreman
- Web page: https://patentgrep.com/patent/US20230412356A1

## CPC

- H04L 9/004: {for fault attacks}
- H04L 9/0631: {Substitution permutation network [SPN], i.e. cipher composed of a number of stages or rounds each involving linear and nonlinear transformations, e.g. AES algorithms}
- H04L 2209/12: Details relating to cryptographic hardware or logic circuitry
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)

## Abstract

A system and method of performing an AES encryption, while also determining whether a potentially successful DFA attack is underway is disclosed. When interim results are not visible, the DFA attack that is most likely to be succeed is initiated by introducing the fault between the MixColumns operation in the second to last round and the MixColumns operation in the next to last round. To detect this, the present system and method performs the next to last round and then repeats this next to last round. The results of the original round and repeated round are compared to identify a possible DFA attack. Importantly, the same hardware is used for the original round and the repeated round. In this way, the amount of additional hardware needed to detect a possibly successful DFA attack is minimized. Further, the impact on execution time may be 10% or less.

## Claims

### Claim 1

A method for detecting a Differential Fault Analysis (DFA) attack when executing an AES algorithm, wherein the AES algorithm requires execution of N rounds, each of a first (N-1) rounds comprising a SubBytes operation, a ShiftRows operation, a MixColumns operation and an adder operation, and wherein a last round comprises the SubBytes operation, the ShiftRows operation and the adder operation, the method comprising:
providing plaintext data to the AES algorithm;
performing a first (N-2) rounds;
saving interim data after completion of the MixColumns operation in the (N-2)nd round;
performing at least a portion of a (N-1)st round;
saving results after completion of the MixColumns operation in the (N-1)st round;
repeating a portion of the AES algorithm using the interim data, using a same circuit as was used to perform the at least a portion of the (N-1)st round, wherein the portion of the AES algorithm that is repeated comprises all operations starting after the interim data was saved and ending with an operation after which the results were stored;
comparing an output of the repeated portion of the AES algorithm with the saved results; and
flagging an error if the output of the repeated portion of the AES algorithm and the saved results do not match.

### Claim 2 (depends on 1)

The method of claim 1, wherein the interim data is saved after a last operation in which an injected fault would result in all bytes of the output being affected.

### Claim 3 (depends on 2)

The method of claim 2, wherein the interim data is saved after the MixColumns operation and before the adder operation of the (N-2)nd round.

### Claim 4 (depends on 2)

The method of claim 2, wherein the interim data is saved after the adder operation of the (N-2)nd round and before the SubBytes operation of the (N-1)st round.

### Claim 5 (depends on 1)

The method of claim 1, wherein the results saved after the MixColumns operation and before the adder operation of the (N-1)st round.

### Claim 6 (depends on 1)

The method of claim 1, wherein the results are saved after the adder operation of the (N-1)st round and before the SubBytes operation of the (N)th round.

### Claim 7 (depends on 1)

The method of claim 1, wherein a random delay is introduced during an execution of the AES algorithm to minimize a probability of a successful DFA attack.

### Claim 8 (depends on 7)

The method of claim 7, wherein the random delay is introduced after completion of the (N-1)st round and before repeating the (N-1)st round.

### Claim 9 (depends on 1)

The method of claim 1, wherein the SubBytes operation and the ShiftRows operation are executed in a different order during at least one of the rounds to minimize a probability of a successful DFA attack.

### Claim 10 (depends on 1)

The method of claim 1, wherein a dummy round is executed is introduced between completion of the (N-1)st round and completion of the repeated (N-1)st round to minimize a probability of a successful DFA attack.

### Claim 11

An integrated circuit for performing an AES encryption algorithm having N rounds and for detecting a DFA attack, comprising:
an integrated round circuit, wherein a round is defined as a time during which operations within the integrated round circuit are executed once, wherein the integrated round circuit comprises:
a SubBytes circuit, a ShiftRows circuit, a MixColumns circuit, an adder, an input multiplexer and an adder multiplexer; wherein the SubBytes circuit and the ShiftRows circuit are performed sequentially before the MixColumns circuit; the adder is performed after the MixColumns circuit; the input multiplexer is used to select with an output of the adder or plaintext data; and the adder multiplexer is used to bypass the MixColumns circuit during a last round;
at least one latch to hold interim data and results;
a recheck multiplexer, having an output of one of the at least one latch as an input;
a comparator to compare an output of one of the at least one latch to another value; and
a controller, wherein the controller configures the integrated circuit to:
perform a first (N-2) rounds;
save the interim data after completion of the MixColumns circuit in the (N-2)nd round in one of the at least one latch;
perform at least a portion of a (N-1)st round;
save the results after completion of the MixColumns circuit in the (N-1)st round in one of the at least one latch;
repeat a portion of the AES encryption algorithm using the interim data wherein the portion of the AES encryption algorithm that is repeated comprises all operations starting after the interim data was saved and ending with an operation after which the results were stored;
compare an output of the repeated portion of the AES encryption algorithm with the saved results; and
flag an error if the output of the repeated portion of the AES encryption algorithm (and the saved results do not match.

### Claim 12 (depends on 11)

The integrated of claim 11, wherein the interim data is saved after the MixColumns circuit and before the adder of the (N-2)nd round.

### Claim 13 (depends on 11)

The integrated circuit of claim 11, wherein the interim data is saved after the adder of the (N-2)nd round and before the (N-1)st round.

### Claim 14 (depends on 11)

The integrated circuit of claim 11, wherein the results saved after the MixColumns circuit and before the adder of the (N-1)st round.

### Claim 15 (depends on 11)

The integrated circuit of claim 11, wherein the results are saved after the adder of the (N-1)st round and before the (N)th round.

### Claim 16 (depends on 11)

The integrated circuit of claim 11, wherein a random delay is introduced by the controller during an execution of the AES encryption algorithm to minimize a probability of a successful DFA attack.

### Claim 17 (depends on 16)

The integrated circuit of claim 16, wherein the random delay is introduced after completion of the (N-1)st round and before repeating the (N-1)st round.

### Claim 18 (depends on 11)

The integrated circuit of claim 11, wherein the SubBytes circuit and the ShiftRows circuit are executed in a different order during at least one of the rounds to minimize a probability of a successful DFA attack.

### Claim 19 (depends on 11)

The integrated circuit of claim 11, wherein a dummy round is executed is introduced between completion of the (N-1)st round and completion of the repeated (N-1)st round to minimize a probability of a successful DFA attack.

### Claim 20 (depends on 11)

The integrated circuit of claim 11, wherein the at least one latch comprises two latches; a holding latch and a results latch, wherein interim data is stored in the holding latch and results are stored in the results latch.