Either based on voltage, LASER or electro-magnetic disturbances, fault attacks represent an ever growing threat to cryptographic implementations, all the more when multiple-fault scenarios are considered. The state-of-the-art of fault countermeasures is essentially divided into two paradigms: Detection-based and infection-based countermeasures. The simple concept of detection-based countermeasures has been proven efficient to counteract fault attacks and easily extendable to handle high-order fault models. On the other hand, the design of infective countermeasures is much more challenging since most proposals have been broken in a single-fault setting. In this paper we present a new infective countermeasure framework fit for any symmetric cryptosystem. This framework takes into account the fatal flaws of previous infective proposals. Our framework can be instantiated in various flavours depending on the context of use and the available software or hardware components. In addition, we describe how our framework can be set-up to handle high-order fault attacks. As far as we know, this is the first time an infective countermeasure proposes such a feature.

Differential Fault Analysis (DFA) attacks are well known to cryptanalyse embedded cryptographic algorithms. However, efficient countermeasures exist and most devices are now secured against this kind of attacks. In the same way, Safe Error attacks avoid most of DFA countermeasures but they can not break a masked implementation. In this paper, we introduce a new fault attack which takes advantage of both kinds of attack and which is efficient with all countermeasures detecting the fault. We illustrate this attack on the DES Sboxes, even if it applies on all non-injective Sboxes. First, we provide a short reminder of DES, we introduce previous attacks performed on it and we present some existing mechanisms to defend it against these threats. Then, we introduce our attack which consists in injecting faults that nullify after passing in the SBoxes of the first round and allows retrieving the key of a secure DES implementation. We continue by presenting the simulated results of our attack. Finally, we detail the results of our attack realised on a DES implemented on a smart card thus confirming its practical feasibility.