PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Differential Fault Analysis on White-box AES Implementations

blog.quarkslab.com | research | #fault-injection | #cryptanalysis | #aes | #quarkslab | #white-box-cryptography | #dfa
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Applying differential fault analysis to white-box AES: faults are cheap and non-destructive in this model, so the classic 2002 DFA attack can be implemented and results filtered to recover keys.
Published
Collected

Related coverage

tool · blog.quarkslab.com
Dark Phoenix: a new White-box Cryptanalysis Open Source Tool
Dark Phoenix, a new open-source white-box cryptanalysis tool from Quarkslab that defeats AES white-box implementations with external encodings — cases where regular DCA/DFA attacks fail.
research · blog.quarkslab.com
State of Post-Quantum Cryptography implementations
In this blogpost, we first review the landscape of Post-Quantum Cryptography implementations across some of the most popular cryptographic libraries. Following that, we present the results of a differential fuzzing campaign on few of the presented implementations.
research · blog.quarkslab.com
Defeating AI-Assisted Reverse Engineering (or at Least Trying To)
This coverage gives security teams current context for monitoring, validation, and remediation.
research · blog.quarkslab.com
Bypassing Android Hardware Attestation from the Analyst's Chair
Hardware key attestation lets an Android app prove to its backend that a key lives in secure hardware on a locked, verified device. It is also the wall that stops a security analyst working on a rooted phone. This article opens the mechanism from the analyst's chair, from the certificate chain and the attestation extension down to the root of trust, then shows a simple bypass that never touches the secure hardware. We relay the attestation to a clean device and splice a genuine chain back into the target app with a Frida hook. A companion repository ships the validation backend, the demo apps and the instrumentation, so the whole setup can be run and inspected rather than taken on faith.
research · blog.quarkslab.com
Bypassing debug password protection on the RH850 family using fault injection
Quarkslab bypasses the 16-byte IDCODE debug password on several Renesas RH850 automotive microcontroller variants using voltage fault injection, enabling firmware extraction in black-box audits.
research · blog.quarkslab.com
BGE Attack on AES White-Boxes: Extending Blue Galaxy Energy for Decryption and Shuffled States
Quarkslab releases v2.0 of Blue Galaxy Energy, its open-source BGE attack tool for AES white-boxes, adding support for shuffled intermediate states and for decryption white-box implementations.
Back