A Differential Fault Attack on Plantlet

Transcription

1 1 A Dfferental Fault Attack on Plantlet Subhamoy Matra, Akhlesh Sddhant Abstract Lghtweght stream cphers have receved serous attenton n the last few years. The present desgn paradgm consders very small state (less than twce the key sze) and use of the secret key bts durng pseudo-random stream generaton. One such effort, Sprout, had been proposed two years back and t was broken almost mmedately. After carefully studyng these attacks, a modfed verson named Plantlet has been desgned very recently. Whle the desgners of Plantlet do not provde any analyss on fault attack, we note that Plantlet s even weaker than Sprout n terms of Dfferental Fault Attack (DFA). Our nvestgaton, followng the smlar deas as n the analyss aganst Sprout, shows that we requre only around 4 faults to break Plantlet by DFA n a few hours tme. Whle fault attack s ndeed dffcult to mplement and our result does not provde any weakness of the cpher n normal mode, we beleve that these ntal results wll be useful for further understandng of Plantlet. Index Terms Cryptanalyss, Fault Attack, Plantlet, Stream Cpher. I. INTRODUCTION A new lght-weght stream cpher has been ntroduced by Mkhalev, Armknecht and Müller [22], whch clams to be bult upon by takng care of varous cryptographc weaknesses of Sprout [4]. Called Plantlet, t nvolves the secret key bts both n key-schedulng phase and n the pseudo-random bt generaton phase. Ths unque feature has been carred over from Sprout, and sets t apart from most of the common stream cphers. The desgners of such proposals clam that ths feature allows lower state szes aganst Tme-Memory-Data Trade-Off (TMDTO) attack and hence saves resources. Sprout, the predecessor of Plantlet, was heavly attacked n many papers and serous concerns were voced regardng ts desgn. A key-recovery based on dvde-and-conquer technque [14] and a TMDTO attack [13] are two mportant cryptanalytc results on the cpher. Addtonally, one may refer to [15], [2], [8], [27] for further cryptanalytc results. Although Sprout was attacked mmedately, t was an ntal attempt n realzaton of lghtweght stream cphers wth the secret key stored n non-volatle memory. Plantlet uses an 80-bt key, a 90-bt ntalzaton vector, two shft regsters, namely LFSR and NFSR, a counter and a Boolean functon. Lke other stream cphers, Plantlet has an ntal Key Loadng Algorthm, followed by a Key Schedulng Algorthm (nvolvng the secret key bts) and then fnally the Pseudo-Random Generaton Algorthm (agan nvolvng secret key bts) for provdng the key stream. S. Matra s wth Indan Statstcal Insttute, 203 B T Road, Kolkata , Inda. E-mal: subho@scal.ac.n A. Sddhant s wth BITS Plan KK Brla Goa Campus, Zuarnagar , Goa, Inda. E-mal: akhleshsddhant@gmal.com The desgners of Sprout [4] clamed the securty of the cpher aganst fault attacks, though t was dsproved mmedately [2]. However, for Plantlet [22] no specfc comment has been made n terms of fault attack. In ths paper, we present a Dfferental Fault Attack (DFA) aganst Plantlet n the same lne as aganst Sprout n [2]. The attack succeeds wth only 4 random faults n contrast wth around 120 faults n random locatons (20 faults, f the locatons are known) for Sprout [2]. For Plantlet we frst obtan the fault locatons from respectve sgnatures. Then we explot the dfferental key streams usng a SAT solver to obtan the entre states of LFSR and NFSR. Then one can mmedately dscover the secret key. Before proceedng any further, let us descrbe Plantlet n detal. A. Descrpton of Plantlet Plantlet s an mprovsaton over Sprout, whch adapts from the Gran famly of stream cphers, more specfcally Gran128a [1]. Table 1 compares the varous stream cphers. Cpher Key sze IV sze State sze Intalzaton rounds Plantlet (61 LFSR + 40 NFSR) 320 Sprout (40 LFSR + 40 NFSR) 320 Gran 128a (128 LFSR NFSR) 256 Gran v (80 LFSR + 80 NFSR) 160 TABLE I COMPARISON OF PLANTLET WITH ITS PREDECESSORS IN TERMS OF LFSR AND NFSR SIZES. Lke the members of the Gran famly [1], [3], [16], [17] and Sprout [4], Plantlet has two regsters one LFSR and one NFSR, whch we denote by L t and N t respectvely (for some round t) wth LFSR beng 61 bts long and NFSR beng 40 bts n length. For a gven round t, we denote LFSR bts as l t, l t+1,..., l t+60 and NFSR bts as n t, n t+1,..., n t+39 respectvely. We also denote the secret key by k and ts correspondng bts by k 0, k 1,..., k 79. Plantlet ncorporates the secret key n the KSA and PRGA by XORng a specally selected key bt, k, wth the last bt of NFSR, n t+39. The selecton happens through a Round-Key functon, whch s cyclcally selected from the secret key: k = k (t mod 80) t 0 (1) Ths cpher uses a 9-bt counter dvded n two halves. The lower 7 bts are used for a modulo 80 counter, denoted by (c 6 t, c 5 t, c 4 t, c 3 t, c 2 t, c 1 t, c 0 t ) for a gven round t. The last two bts, namely c 7 t, c 8 t consttute a modulo 4 counter ncremented once after completon of one round of the modulo 80 counter. Ths s merely to keep track of the completon of 320 rounds of KSA, post whch the counter resets to zero. However, only the 5th LSB (c 4 t ) of ths counter s actually used n the evoluton of the states. Hence, t mght not be necessary to nclude the hgher counter bts n the mplementaton.

2 2 As dscussed before, the clockng of the cpher can be dvded nto three routnes: KLA (Key Loadng Algorthm), KSA (Key Schedulng Algorthm) and PRGA (Pseudo Random Generatng Algorthm). 1) The KLA Routne: The NFSR s ntalzed wth the frst 40 bts of IV. The rest 50 bts of the IV are used to ntalze the frst 50 bts of LFSR. The remanng 11 bts of LFSR are ntalzed wth a specfc paddng n the partcular sequence: (1, 1, 1, 1, 1, 1, 1, 1, 1, 0, 1) from l 50 to l 60. 2) The KSA Routne: The NFSR and LFSR regsters are clocked 320 tmes, wth one bt shfted n every clock pulse. The hghest bt of NFSR s updated as n t+39 = z t g(n t ) k t l t c 4 t, where g(n t ) s a polynomal n GF(2): g(n t ) = n t n t+13 n t+19 n t+35 n t+39 n t+2 n t+25 n t+3 n t+5 n t+7 n t+8 n t+14 n t+21 n t+16 n t+18 n t+22 n t+24 n t+26 n t+32 n t+33 n t+36 n t+37 n t+38 n t+10 n t+11 n t+12 n t+27 n t+30 n t+31 (2) and z t s the key stream bt computed as: z t = h(x) + l t+30 + j B n t+j. (3) Here h(x) s a non-lnear functon: h(x) = n t+4 l t+6 l t+8 l t+10 l t+17 l t+32 l t+19 l t+23 n t+4 l t+32 n t+38 (4) and B = {1, 6, 15, 17, 23, 28, 34}. We would also lke to present a clarfcaton regardng the feedback of output z to NFSR durng KSA. The specfcaton of Plantlet [22, Secton 4.3] mentons t whle the equatons do not agree wth the same. However, here we consder the more complex verson where the output s fed back to both LFSR and NFSR durng KSA. Note that faults are njected durng the rounds of PRGA only. Hence t makes no dfference n mplementaton of our fault attack. The hghest bt of LFSR, l t+60 s always ntalzed to 1 durng KSA. The second-hghest bt l t+59 s updated as: l t+59 = l t+54 l t+43 l t+34 l t+20 l t+14 l t z t (5) Note that n any clock cycle, the output s generated frst and only then the regsters are updated. It s XORed to l t+59 and n t+39 (used as feedback) nstead of producng any output durng KSA. 3) The PRGA Routne: The update functon for PRGA remans the same for NFSR except that the output s no longer XORed wth the key stream bt: n t+39 = g(n t ) k t l t 0 c 4 t. Further, the slghtly modfed update functon for LFSR durng PRGA phase s: l t+60 = l t+54 l t+43 l t+34 l t+20 l t+14 l t (6) The key stream bt z t s produced usng the output functon n (3). B. Descrpton of Dfferental Fault Attack Fault attacks were frst ntroduced n the works of [9], [11], and snce then such technques have ganed attenton n cryptanalytc lterature. In the doman of stream cphers, one of the frst fault attacks was ntroduced by Hoch and Shamr n [18]. Generally, faults are njected nto the state of a cpher to ntroduce a change n the key stream bts, whch can help deduce nformaton about the nternal state. The method of njectng faults can be laser shots, clock gltches, onzng radaton, unsupported voltage, etc. Faults can be both transent or permanent. Though the approach of the attack seems qute complcated to be mplemented n practcal scenaro, many mplementatons of well known cphers lke RSA, AES, DES etc. have been cryptanaylsed by ths technque. In fact, all the cphers n estream [12] hardware portfolo, namely Gran v1, Mckey 2.0 and Trvum, have been cryptanalyzed aganst DFA [5], [6], [7], [19], [20], [21], [23]. As mentoned before, even Sprout has been cryptanalyzed [2]. In all these cases, t was enough to recover the cpher state by DFA as the KSA and PRGA of such cphers are reversble, provdng the secret key once the state s known. The same s true for Plantlet. Let us now brefly explan the connecton between Dfferental Cryptanalyss and Dfferental Fault Attacks (DFA). In dfferental attack, we generally put a dfference n IV whle KLA. Thus, f one goes for a suffcent number of rounds durng KSA (namely 320 for Plantlet), the dfference mght not be exploted durng the PRGA. In DFA, the adversary s allowed to nject faults durng the rounds of PRGA as well. Here the dfference s reflected mmedately n the key stream and thus, the cpher becomes much weaker n ths model. Thus, here we show that Plantlet s even weaker than Sprout n ths very specfc lne of attack. One dfference between the cphers from the estream portfolo (Gran v1, Mckey 2.0 and Trvum) s that the secret key bts are not only nvolved n the KSA but also durng PRGA (smlar to Sprout). However, that does not resst DFA knd of cryptanalyss. We explot the probablty of matchng between each correspondng par of fault-free and faulty keystream bts to compute the sgnatures. Further we consder correlatons between the dfferental stream and the sgnatures to obtan the good matches and thereby dentfyng the fault locaton (Secton II). After fndng the locaton of the faults, we can use correspondng dfferental key streams to obtan a system of nonlnear equatons and those can be solved usng an effcent SAT Solver tool (Secton III). Once all the state varables are known for some round t, we can mmedately deduce the secret key. As wth every fault attack, we need to lay down the assumptons whle mountng the DFA. Naturally, ths s mportant as too many assumptons can make the attack mpractcal. Also, the number of faults njected should be low, as there s a chance of damagng the devce. We consder the followng assumptons whch are generally accepted throughout n cryptanalytc lterature on fault attacks. The adversary 1) can restart the cpher and re-key t wth the orgnal Key/IV multple tmes,

3 3 2) can nject the fault at the exact tmngs durng the executon, 3) has the equpment/requred technology for mplementng the fault, 4) does not need to know the exact locaton durng fault njecton. The paper s organzed as follows. In Secton II, we dscuss how to obtan the fault sgnatures. Then, n Secton III, we dscuss the recovery of the entre state of LFSR, NFSR and consequently the recovery of the secret key bts by solvng nonlnear equatons. Secton IV concludes the paper. II. FAULT SIGNATURES, AND HOW TO IDENTIFY THE FAULT LOCATIONS Suppose we ntroduce a change n the key stream bts by njectng a fault at some random locaton f. From now on, by njectng a fault at locaton f, we mean (for 0 f 60) njectng a fault at LFSR bt l f, and by njectng a fault at any locaton f, for (61 f 100) we mean njectng a fault n NFSR bt n (f 61). We obtan the respectve fault-free key stream z and faulty key stream z (f) for λ key stream bts. To form a unque pattern of the key stream sequence, we compute a sgnature vector Q (f) whch we defne as: where q (f) Q (f) = (q (f) 0, q(f) 1,..., q(f) λ 1 ) (7) = 1 2 P r(z z (f) ), [0, λ 1]. (8) We obtan ths probablty by suffcent number of experments beforehand. The sharpness of a sgnature s defned as follows: σ(q (f) ) = 1 λ λ 1 q (f). (9) =0 Fg. 1. Plot of Q (f) for all f n [0, 100] wth λ = 64. As we can see n Fgure 1, q f are close to zero for > 32, hence λ = 32 could have been suffcent. However, we choose λ = 64 nstead as evaluaton of correlatons and ranks (whch we wll dscuss soon) becomes more accurate wth hgher number of key stream bts. Now, we can use the sharpness of a locaton (we just defned) to compare the faults at dfferent locatons. For example, one may note the cases for f = 30 and f = 31 n Fgure 2. It s very clear that dentfyng the locaton f the fault s ndeed njected at 30 (blue) has much better chance than that of 31 (red). Wth λ = 64, we execute Fg. 2. Plot of Q (30) (blue) and Q (31) (red). Ths s a snapshot of Fgure 1 for f = 30, runs wth random key-iv pars to prepare the sgnatures Q (0), Q (1),..., Q (100). As mentoned earler, we pre-compute the sgnatures durng the offlne phase of the attack, and store t for comparsons wth dfferental key stream. Suppose we nject a fault n a random unknown locaton g (0 g 100) and obtan the fault-free and faulty key streams z and z (g) respectvely. Then we defne the followng: where η (g) ν (g) = 1 2 η(g) (10) = z z (g). Let us now contnue wth a few defntons and notatons. Defnton 1: The vector Γ (g) = (ν (g) 0, ν(g) 1,..., ν(g) λ 1 ) s called tral of the fault at the unknown locaton g. Note that there s no probablty term n ths scenaro, snce we are actually njectng a fault and checkng aganst our sgnatures. We compare Γ (g) for each of the Q (f) s, for f = 0,..., 100 to dentfy the exact fault locaton. Defnton 2: We call a relaton between the sgnature Q (f) = (q (f) 0, q(f) 1,..., q(f) λ 1 ) and a tral Γ(g) = (ν (g) 0, ν(g) 1,..., ν(g) λ 1, (0 λ 1) such that (q (f) (q (f) = 1 2, ν(g) ) a msmatch, f there exsts at least one = 1 2, ν(g) = 1 2 ) or = 1 2 ) hold true. However, t s qute natural that ths may not always happen, and thus we need to extend ths defnton. For ths purpose, we ncorporate the correlaton coeffcent between two sets of data. Defnton 3: We use correlaton coeffcent µ(q (f), Γ (g) ) between the sgnature Q (f) λ 1 ) and a tral Γ (g) = (ν (g) 0, ν(g) 1,..., ν(g) λ 1 ) for checkng a match. Naturally, 1 µ(q (f), Γ (g) ) 1. In case of a msmatch, (as per the Defnton 2), then µ(q (f), Γ (g) ) = 1. = (q (f) 0, q(f) 1,..., q(f) Then we experment how one can locate the faults. For each known fault g, we calculate the tral Γ (g) = (ν (g) 0, ν(g) 1,..., ν (g) λ 1 ). and hence the correspondng µ(q(f), Γ (g) ) for each of the faults f, (0 f < 100). We note: 1) max 100 f=0 µ(q(f), Γ (g) ), 2) µ(q (g), Γ (g) ), and

4 4 3) α(q (g) ) = n(µ(q (f), Γ (g) ) > µ(q (g), Γ (g) )). As we can see n Fgure 3, when µ(q (g), Γ (g) ) (drawn n blue) s close to max 100 f=0 µ(q(f), Γ (g) ) (drawn n red), α(q (g) ) s small, t s easer to locate these faults. However, f µ(q (g), Γ (g) ) s much smaller than max 100 f=0 µ(q(f), Γ (g) ) (red),.e., α(q (g) ) s large, that means t s harder to locate the fault. number of tmes we have to run the SAT solver. However, for Plantlet, we note that the sgnature of the faults are qute sharp and thus we need not try for specfc fault locatons durng the attack. Now let us consder the set W such that t contans the 4 faults wth maxmum possble α(q (g) ) values from the experments (average over 2 15 runs. Then we calculate that g W (1+α(Q(g) )) combnatons (for 4 faults). Ths s the worst case. That s, after njectng random faults, f these faults appear, then we may need to run the SAT solver these many tmes. However, the average case scenaro s much better than ths. For example, we may consder the set of four fault locatons S = {5, 26, 2, 12}. As we have mentoned earler, the values less than 61 belong to LFSR, and the other values belong to NFSR. The expected number of combnatons to check n ths case s g S (1 + α(q(g) )) Fg. 3. Plot of max 100 f=0 µ(q(f), Γ (g) ) (red) and µ(q (g), Γ (g) ) (blue). Gven α(q (g) ), for each g, we can estmate how many attempts we should requre to obtan the actual fault locaton. Our expermental results show that obtanng random fault locatons s easer n Plantlet as compared to Sprout. Further, the fault requrement s much lower here, makng a practcal fault attack sgnfcantly easer. As we wll descrbe n Secton III, obtanng the exact state s always possble (durng the experments) from the dfferental key stream correspondng to 4 correct fault locatons (detals are n Table II). Hence, we need to locate 4 correct fault locatons from a large number of random faults. In fact, we also provde examples for the complete attack wth only 4 faults. However, we sometmes fal to get LSB of NFSR n 0 n some cases durng the experments. The exact algorthm for mountng a fault s as follows. Consder that every fault s njected at the same round t of PRGA routne: Inject a fault at some random fault locaton. Obtan the dfferental tral (for some unknown g) Γ (g) = (ν (g) 0, ν(g) 1,..., ν(g) λ 1 ). For each f n [0, 100], calculate µ(q (f), Γ (g) ). For the fault, prepare a ranked table T g arrangng the possble fault locatons f wth more prorty accordng to µ(q (f), Γ (g) ). After creatng tables T g for the requred faults (say 4), compute usng SAT solvers as mentoned n Secton III for each of the combnatons. When the correct fault set wll be selected n the above algorthm, we wll be able to obtan the correct state, whch wll n turn provde the secret key bts. Then we can check and match wth the exstng fault free and faulty key streams at hand. To obtan the streams, we need to re-key the cpher a few tmes and nject those many faults (4 s enough as per our experments). Naturally, the DFA wll be more effcent when the faults are n the locatons where t s easer to dentfy them. That s a locaton g such that α(q (g) ) s small wll provde better result. To clarfy, lower the α(q (g) ), lesser s the number of possble combnatons of faults, and lesser the III. OBTAINING THE STATE FROM THE DIFFERENTIAL KEY-STREAMS Let us assume that a fault s njected n the LFSR locaton φ at PRGA round t. The same method wll work f the fault s njected n the NFSR. Snce we re-key the cpher wth the same (key, IV) par before njectng a fault, after fault njecton we get the state l t, l t+1,..., l t+φ 1, 1 l t+φ, l t+φ+1..., l t+60 and n t, n t+1,..., n t+39 at the t-th round of PRGA. Then correspondng to each faulty key-stream bt z φ t, we ntroduce two new varables L (φ) t, N (φ) t and obtan three more equatons (LFSR, NFSR and output functon). Thus we have addtonal 2l varables and 3l equatons for each faulty key-streams, when we nvolve l many bts of key stream. Here we have consdered l = 60 for solvng such equatons. Naturally, ths mples that we wll not nvolve all the secret key bts (as we need at least 80 key stream bts for nvolvement of each of the secret key bts). However, at ths stage we are not lookng for solvng the secret key bts. Instead we only try to obtan the LFSR and NFSR states. By tral and error we found l = 60 to be suffcent for that. Once we know the state (N t, L t ) for some round t, then we may use SAT solver to obtan the secret key bts as explaned n [22, Table 4]. In fact, knowledge of 95 (out of 101) state bts are enough to get the state bts very quckly. Expermental Results: We solve the equatons usng a SAT solver, Cryptomnsat-2.9.6, under SAGE 7.5.rc2 [26] on a laptop runnng wth Ubuntu The hardware confguraton s based on Intel(R) Core(TM) M 2.50GHz and 8 GB RAM. For each guessed set of faults, a system of equatons are formulated, and the equatons are then fed nto the SAT solver. These experments are made for 5 runs (for each row) consderng that the correct faults have been dentfed. Thus the tme gven n the table should be multpled by g S (1 + α(q (g) )) whle estmatng the effort for the complete fault attack. Note that we have expermented wth more number of faults too. The results show that havng more faults does not mean that the equatons can be solved n less tme. Ths s the reason, we get faster processng tme n case of 9 faults than 10 faults (see Table II). However, as we contnue towards

5 5 # Faults Soluton tme (seconds) Maxmum Mnmum Average TABLE II RESULTS OBSERVED WHILE OBTAINING STATE FROM FAULT ATTACK. very few faults (such as 4 to 6), the processng tme generally ncreases wth lesser number of faults. The followng are two examples wth 4 faults each. Example 1: Consder that we nject 4 faults at random and the the locatons turn out to be S = {17, 19, 60, 42}. In ths case, the expected number of combnatons so that we arrve at the rght set of fault locatons s We have to check for every such combnaton n SAT solver. For the correct fault locatons, the SAT solver takes seconds to compute the entre states of LFSR and NFSR. Example 2: Here s another example wth 4 random faults. Consder the set of locatons S = {13, 36, 28, 45}. Here, the expected number of possble combnatons to check for s Note that n ths case, the SAT solver s unable to compute the NFSR bt n 0. However, ths should not be a problem to solve the complete system and the key fnally. For the correct fault locatons, the SAT solver takes seconds to compute the states of LFSR and NFSR (wthout n 0 ). IV. CONCLUSION In ths paper, we have appled Dfferental Fault Attack (DFA) on Plantlet. Plantlet has evolved from Sprout after dscovery of many of ts cryptographc weaknesses. It s thus beleved that Plantlet wll be cryptographcally stronger than Sprout. However, we note that ths s not true n terms of DFA. By usng as lttle as 4 faults, we show that the LFSR and NFSR states can be obtaned n reasonable tme and ths n turn provdes the secret key mmedately. Our technque frst fnds the locatons of the random faults usng fault sgnatures and then t formulates equatons to be fed nto a SAT solver. Experments for the same have been performed on a software mplementaton of the cpher and the exact algorthm was descrbed. It mght happen that the larger state sze and smple nvolvement of the secret key bts durng the PRGA phase for Plantlet compared to Sprout make the DFA more effcent on Plantlet than ts prevous nstantaton. Ths ndeed requres further attenton. Whle fault attacks can be mplemented n very restrcted scenaros, we beleve our observatons can help n understandng Plantlet better. REFERENCES [1] M. Ågren, M. Hell, T. Johansson and W. Meer. A New Verson of Gran- 128 wth Authentcaton. Symmetrc Key Encrypton Workshop 2011, DTU, Denmark. [2] S. Matra and S. Sarkar and A. Baks and P. Dey. Key Recovery from State Informaton of Sprout: Applcaton to Cryptanalyss and Fault Attack. [3] M. Ågren, M. Hell, T. Johansson and W. Meer. Gran-128a: a new verson of Gran-128 wth optonal authentcaton. IJWMC, 5(1): 48 59, Ths s the journal verson of [1]. [4] F. Armknecht and V. Mkhalev. On Lghtweght Stream Cphers wth Shorter Internal States. FSE [5] S. Bank, S. Matra and S. Sarkar. A Dfferental Fault Attack on the Gran Famly of Stream Cphers. In CHES 2012, LNCS, Vol. 7428, pp [6] S. Bank and S. Matra. A Dfferental Fault Attack on MICKEY 2.0. CHES 2013, LNCS, Vol. 8086, pp , [7] S. Bank, S. Matra and S. Sarkar. Improved dfferental fault attack on MICKEY 2.0. Journal of Cryptographc Engneerng, 5(1):13 29, [8] S. Bank. Some results on Sprout. INDOCRYPT 2015, LNCS, Vol. 9462, pp , [9] E. Bham and A. Shamr. Dfferental Fault Analyss of Secret Key Cryptosystems. In CRYPTO 1997, LNCS, Vol. 1294, pp [10] E. Bham and O. Dunkelman. Dfferental Cryptanalyss n Stream Cphers. Cryptology eprnt Archve, Report 2007/218, org/2007/218 [11] D. Boneh, R. A. DeMllo and R. J. Lpton. On the Importance of Checkng Cryptographc Protocols for Faults. In EUROCRYPT 1997, LNCS, Vol. 1233, pp [12] The ECRYPT Stream Cpher Project. estream Portfolo of Stream Cphers. SAC 2015, Canada. [13] M. F. Esgn and O. Kara. Practcal Cryptanalyss of Full Sprout wth TMD Tradeoff Attacks. [14] V. Lallemand and M. Naya-Plasenca. Cryptanalyss of Full Sprout. In Crypto 2015, LNCS. In CRYPTO 2015, LNCS, Vol. 9215, pp [15] Y. Hao. A Related-Key Chosen-IV Dstngushng Attack on Full Sprout Stream Cpher. [16] M. Hell, T. Johansson and W. Meer. Gran - A Stream Cpher for Constraned Envronments. ECRYPT Stream Cpher Project Report 2005/001, Avalable at [17] M. Hell, T. Johansson, A.Maxmov and W. Meer. A Stream Cpher Proposal: Gran-128. In IEEE Internatonal Symposum on Informaton Theory (ISIT 2006). [18] J. J. Hoch and A. Shamr. Fault Analyss of Stream Cphers. In CHES 2004, LNCS, Vol. 3156, pp [19] M. Hojsík and B. Rudolf. Dfferental Fault Analyss of Trvum. In FSE 2008, LNCS, Vol. 5086, pp [20] M. Hojsík and B. Rudolf. Floatng Fault Analyss of Trvum. In INDOCRYPT 2008, LNCS, Vol. 5365, pp [21] Y. Hu, J. Gao, Q. Lu and Y. Zhang. Fault analyss of Trvum. Desgns, Codes and Cryptography, 62(3): , [22] V. Mkhalev, F. Armknecht and C. Müller. On cphers that contnuously access the non-volatle key. FSE TOSC, Volume 2016, Issue 2, pp , [23] S. Sarkar, S. Bank and S. Matra. Dfferental Fault Attack aganst Gran famly wth very few faults and mnmal assumptons. IEEE Transactons on Computers, 64(6): , [24] S. P. Skorobogatov and R. J. Anderson. Optcal Fault Inducton Attacks. In CHES 2002, LNCS, Vol. 2523, pp [25] S. P. Skorobogatov. Optcally Enhanced Poston-Locked Power Analyss. In CHES 2006, LNCS, Vol. 4249, pp [26] W. Sten. Sage Mathematcs Software. Free Software Foundaton, Inc., Avalable at (Open source project ntated by W. Sten and contrbuted by many). [27] B. Zhang and X. Gong. Another Tradeoff Attack on Sprout-Lke Stream Cphers. In Asacrypt 2015, LNCS, Vol. 9453, pp Acknowledgments: The authors lke to thank Dr. Santanu Sarkar of IIT Madras for detaled techncal dscusson and mplementaton ssues n SAGE.