Fault attacks

Introduction to Fault Attacks

https://www.youtube.com/watch?v=4cGXYxSd_s4

DEFEATING ED25519 AND EDDSA USING A FAULT ATTACK

Fault attack agaisnt EdDSA demonstrated on an Arduino Nano board, allowing for partial key recovery and fake signatures.

We demonstrated it on an Arduino Nano, using the Arduino Libs' Crypto Ed25519 implementation and simple voltage glitches. We were able to cause single byte random errors at the end of the computation of H(R,A,M), allowing us to efficiently brute-force the error location and value, thus recovering half of the secret key. This allowed us to generate seemingly valid signatures for any message, thanks to randomly generated rr values, in a way that is indistinguishable from the real signer to the verifier, since the value rr has to be kept secret by the signer.

How to defeat Ed25519 and EdDSA using faults

Practical fault attack against the Ed25519 and EdDSA signature schemes

Fault Attacks on Nonce-based Authenticated Encryption: Application to Keyak and Ketje

Introduction to side-channel attacks and fault attacks