MIFA: An MILP-based Framework for Improving Differential Fault Attacks

2026-08-07

AI Summary

This work addresses the inefficiency of differential fault analysis (DFA) by proposing the first DFA framework based on mixed-integer linear programming (MILP). For the first time, MILP is employed to systematically search for differential trails with a unique solution, combined with bit-level single-bit flip fault modeling to optimize both the location and number of injected faults. The approach enables attacks on deeper-round implementations and allows theoretical computation of the minimal number of faults required to recover the secret key. When applied to the DEFAULT block cipher, the method uniquely recovers the full key with only three faults in the sixth-to-last round and two faults each in the seventh- and eighth-to-last rounds, significantly outperforming existing DFA results and effectively breaking the cipher’s claimed DFA resistance.

Abstract

At ASIACRYPT 2021, Baksi et al. introduced DEFAULT, a block cipher designed to algorithmically resist Differential Fault Attack (DFA), claiming 64-bit DFA security regardless of the number of injected faults. At EUROCRYPT 2022, Nageler et al. demonstrated that DEFAULT's claimed DFA resistance can be broken by applying an information-combining technique. More recently, at ASIACRYPT 2024, Jana et al. improved DFA by searching for differential trails with a single solution. They showed that, for DEFAULT with a simple key schedule, injecting five faults at the fifth-to-last round reduces the key space to one, and for BAKSHEESH, injecting twelve faults at the third-to-last round achieves the same result. In this paper, we propose a new DFA framework that utilizes a Mixed-Integer Linear Programming (MILP) solver. This framework makes it possible to attack deeper rounds than previously achieved, reducing the number of fault injections required for key recovery. Furthermore, we present a method to determine the most efficient fault injection bit positions by systematically analyzing the input differences from all possible single bit-flip faults, thereby further reducing the required number of faults. This systematic analysis has the significant advantage of allowing us to theoretically calculate the required number of faults. Applying our framework, for DEFAULT, injecting three faults at the sixth-to-last round and two faults at the seventh- and eighth-to-last rounds reduces the key space to one.

Problem

• Differential Fault Attack
• DEFAULT
• fault injection
• key recovery
• MILP

Innovation

• MILP
• Differential Fault Attack
• fault injection optimization
• block cipher cryptanalysis
• DEFAULT