Deterministic Hard Fault Attack on Trivium

Abstract

So far, the major work in fault attack on Trivium has been confined to the soft fault attacks where the attacker injects some faults at random position and at random time in the cipher state and analyze a simplified version of the cipher. Besides this, there is also some result on hard fault attack [Hu et al., 2009] on Trivium where the attacker sets the value 0 at any random position of 288 bit state of the cipher permanently. In this approach the key of the cipher is determined with success probability not less than 0.2291. In this paper, we introduce another type of hard fault attack, called a deterministic hard fault attack on Trivium, by setting the value 1 at three particular positions of 288 bit state permanently. We call it deterministic because the internal state is revealed deterministically. More specifically, we show that if we observe 117 original keystream and 236 faulty keystream, we can retrieve the original state of the cipher in 2^23.85 time with success probability 1.