Fault Injection Attack on Salsa20 and ChaCha and a Lightweight Countermeasure

We propose a fault injection attack on Salsa20 and ChaCha stream ciphers. In these stream ciphers, the initial matrix X, which consists of constants, a key, a block counter, and a nonce, is added to the matrix X(20) process with a round function to generate a keystream. Our proposed fault injection attack skips the corresponding addition (add) instruction to obtain the matrix X or X(20) and extracts the key. General countermeasures against instruction skipping, including randomization, duplication, and parity checking, are not suitable for the software implementation of a stream cipher that requires high performance and lightweight computation. We thus demonstrate an algorithm-specific but extremely lightweight countermeasure with less than 0.5% execution time overhead based on a variable separation technique. Furthermore, we study the feasibility of the countermeasure in the IA-32, Intel 64, and ARM architectures.