Advancing DFA on Ascon: A Practical Key-Recovery Attack Using Bit-Flip Faults

With the rapid expansion of the Internet of Things (IoT), ensuring robust security for resource-constrained devices has become essential. Many IoT devices operate in environments with significant security threats, necessitating lightweight yet effective cryptographic solutions. To address this need, the National Institute of Standards and Technology has selected Ascon as the standard for lightweight cryptography due to its efficient round-based processing. Since its introduction, extensive cryptanalysis and security evaluations have been conducted, including assessments of resistance to side-channel and fault attacks. Differential Fault Analysis has been applied to Ascon, with previous research introducing a two-step fault model that combines bit-flip and bit-set faults for key recovery. The previous study introduced a two-step fault model: the attacker first retrieves the lower 64 bits of the secret key with bit-flip faults and then uses bit-set/bit-reset faults to obtain the upper 64 bits of the key. However, in practice, we would not choose the bit-set or bit-reset fault depending on the target devices with a low precision in controlling the fault. In this regard, fault analysis based on bit-flip faults is preferable because it enables key-recovery attacks regardless of the bit-set or bit-reset fault. This paper proposes a new key-recovery fault attack that relies solely on bit-flip faults, eliminating the bit-set/reset fault assumptions. Additionally, we evaluate the theoretical relationship between the number of random bit-flips injected and the reduced keyspace using a probabilistic model based on the coupon collector problem. Through this approach, we assess the feasibility and complexity of our proposed attack, demonstrating its effectiveness against Ascon in a realistic adversarial setting.