Due to the coupling between the two lines, a fault on one pole will induce relatively high electromagnetic transients of voltage and current in the healthy line.
If we can induce a fault on one bit of several nibbles of S 31 for each fault experiment, we can reduce the required number of faulty cipher texts to obtain S 31 and K 32.
In this section, to retrieve the whole master key, we extend the previous attack such that the adversary can inject a fault on one nibble rather than a bit.
The first attack is a basic attack which induces a fault on only one bit of intermediate states, and we can obtain the last subkey of the block cipher, given 48 faulty cipher texts on average.
Now, following the above argument, we assume that a fault on only one nibble of intermediate states at the beginning of the 29th round's S-box layer has occurred.
In this section, we introduce a basic DFA attack against PRESENT-80 which is based on the injection of a fault on only one bit of intermediate states at the beginning of the last round's S-box layer.
Inducing a fault on only one nibble of intermediate states at the beginning of the i th round's S-box layer, S i, leads to fault occurrences on one bit of some S-boxes of the next round, S i+1, where on average the inputs of two S-boxes would be corrupted at the beginning of S i+1.
Following the above criteria, we state that: Inducing a fault on only one nibble of intermediate states at the beginning of the i th round's S-box layer, S i, leads to fault occurrence on one bit of some S-boxes of the next round, where on average, the inputs of two S-boxes would be corrupted at the beginning of S i+1.
This investigation is conducted on one of the southern Iranian oil fields, which experiences a fault on its gas cap.
