Abstract:

Based on lightweight stream cipher Sprout,small state stream cipher such as Fruit v2,Fruit-80,Fruit-128 and Fruit-F have been proposed since 2016.The difference between Fruit and Sprout is that the round key that participates in the internal state update in Fruit does not involve the internal state of NFSR and LFSR,which makes it more difficult to recover the key of Fruit than Sprout.In this paper,based on Maitra's differential fault attack on Sprout and Banik's differential fault attack on Grain,we will describe a differential fault attack(DFA) on Fruit v2 and Fruit-80 under the most relaxed of assumption.We assume that the attacker can inject multiple,time-synchronized,single bit-flipping faults in the same albeit random register location.e first accurately identify the location of the fault injection,and then according to the affine property of the output function,we formulate a sufficient number of linear equations to recover the whole internal state of the cipher.The results show that the time complexity required to determine the internal state of Fruit v2 and Fruit-80 is 2^16.3 (LFSR) and 2^6.3 (NFSR).In the part of key recovery,with the help of cryptomanisat-2.9.5 SAT solver,all the equations can be solved in about 10 minutes.According to the statistics,the number of fault needed to attack is 2^7.3.The complexity of identifying the correct fault location is 2^6.3 (Fruit v2) and 2^7.3 (Fruit-80),respectively.

Key words: side-channel attack, fault analysis, differential fault attack, stream cipher, small-state stream cipher