This paper presents an extension of the byte-fault attack on signature schemes presented by Giraud et al. Our work extends their attack in a number of ways, but the main focus is an alternative fault model motivated by existing fault injection results. Instead of assuming faults are uniformly distributed (i.e., a given bit is flipped with probability 1/2), we consider the case where faults are biased (i.e., the probability differs from 1/2). Our results show that injecting biased faults allows an attacker to reveal security-critical data with significantly fewer faults and/or a significantly faster search through the remaining candidates.

We provide an extensive study of the differential properties of the functionsx→x2t-1 over \BBF2n, for 1tn. We notably show that the differential spectra of these functions are determined by the number of roots of the linear polynomialsx2t+bx2+(b+1)xwherebvaries in \BBF2n. We prove a strong relationship between the differential spectra ofx→x2t-1 andx→x2s-1 fors=n-t+1. As a direct consequence, this result enlightens a connection between the differential properties of the cube function and of the inverse function. We also determine the complete differential spectra ofx→x7by means of the value of some Kloosterman sums, and ofx→x2t-1 fort∈ {[n/2], [n/2]+1,n-2}.

Some properties of the differential spectra of power functions, i.e., monomials mappings on F2n, are investigated. We focus in particular on functions with a small differential uniformity and on some infinite families of power functions.