PHOTON-Beetle is an authenticated encryption scheme, which was a finalist in the NIST’s call for standardization in the area of lightweight cryptography (LWC). There are certain difficulties while executing known fault attacks on PHOTON-Beetle in the real world. One of the attacks is in the random fault model, but it requires 237.15faults, which makes it difficult to implement in practice. Other attacks require fewer faults (29.32and 211.5) but rely on the bit-fault models, which necessitates expensive tools and detailed information about the implementation. In this paper, we bridge this gap by presenting an attack that is based on a realistic fault model that requires only 29. We employ a new fault attack technique called linked ineffective fault attack (LIFA). Our attack does not require knowing the plaintext or the corresponding ciphertext. Compared to conventional key-recovery techniques, we provide a highly efficient algebraic method for obtaining the secret key. Furthermore, we introduce linked effective fault analysis (LEFA) and show that, in a noisy environment, LEFA performs significantly better than LIFA in attacking the PHOTON-Beetle while maintaining the basic assumptions of LIFA. We verify our attack using several simulations, as well as conducting practical experiments in the ATmega328P against the publicly available PHOTON-Beetle implementation made available by the designers.

Numerous fault models with distinct characteristics and effects have been developed. The costs, repeatability, and practicability of these models should be assessed. Moreover, there must be effective ways to use the injected fault to retrieve the secret key, particularly if the implementation includes any countermeasures. In this paper, we introduce a new fault analysis called “linked fault analysis” (LFA), a more powerful technique than other well-known fault attacks against implementations of symmetric primitives, especially in software implementations. For known fault analysis, the basis for the fault model is either the bias over the faulty value or the relationship between the correct value and the faulty one. In the LFA, however, a single fault involves two intermediate values. The faulty target variable,$u'$, is linked to a second variable,$v$, such that a particular relation holds:$u'=l(v)$. LFA lets the attacker perform fault attacks without the input control, using far fewer data than previously introduced fault attacks in the same class. We show the utilization of LFA in the presence or absence of typical redundancy-based countermeasures by introducing “Linked Differential Fault Analysis” (LDFA) and “Linked Ineffective Fault Analysis” (LIFA). We also demonstrate that, under specific circumstances, LFA is still effective even when masking protections are in place. We have performed our attacks against the public implementation of AES and PRESENT in ATMEGA328p to show the feasibility of LFA in the real world. The practical results and simulations validate our theoretical models as well.