Search

Since the seminal work of Boneh et al., the threat of fault attacks has been widely known and techniques for fault attacks and countermeasures have been studied extensively. The vast majority of the literature on fault attacks focuses on the ability of fault attacks to change an intermediate value to a faulty one, such as differential fault analysis (DFA), collision fault analysis, statistical fault attack (SFA), fault sensitivity analysis, or differential fault intensity analysis (DFIA). The other aspect of faults—that faults can be induced and do not change a value—has been researched far less. In case of symmetric ciphers, ineffective fault attacks (IFA) exploit this aspect. However, IFA relies on the ability of an attacker to reliably induce reproducible deterministic faults like stuck-at faults on parts of small values (e.g., one bit or byte), which is often considered to be impracticable. As a consequence, most countermeasures against fault attacks do not focus on such attacks, but on attacks exploiting changes of intermediate values and usually try to detect such a change (detection-based), or to destroy the exploitable information if a fault happens (infective countermeasures). Such countermeasures implicitly assume that the release of “fault-free” ciphertexts in the presence of a fault-inducing attacker does not reveal any exploitable information. In this work, we show that this assumption is not valid and we present novel fault attacks that work in the presence of detection-based and infective countermeasures. The attacks exploit the fact that intermediate values leading to “fault-free” ciphertexts show a non-uniform distribution, while they should be distributed uniformly. The presented attacks are entirely practical and are demonstrated to work for software implementations of AES and for a hardware co-processor. These practical attacks rely on fault induction by means of clock glitches and hence, are achieved using only low-cost equipment. This is feasible because our attack is very robust under noisy fault induction attempts and does not require the attacker to model or profile the exact fault effect. We target two types of countermeasures as examples: simple time redundancy with comparison and several infective countermeasures. However, our attacks can be applied to a wider range of countermeasures and are not restricted to these two countermeasures., IACR Transactions on Cryptographic Hardware and Embedded Systems, Volume 2018, Issue 3

SifA is a bi-functional Type III Secretion System (T3SS) effector protein that plays an important role in Salmonella virulence. The N-terminal domain of SifA binds SifA-Kinesin-Interacting-Protein (SKIP), and via an interaction with kinesin, forms tubular membrane extensions called Sif filaments (Sifs) that emanate from the Salmonella Containing Vacuole (SCV). The C-terminal domain of SifA harbors a WxxxE motif that functions to mimic active host cell GTPases. Taken together, SifA functions in inducing endosomal tubulation in order to maintain the integrity of the SCV and promote bacterial dissemination. Since SifA performs multiple, unrelated functions, the objective of this study was to determine how each functional domain of SifA becomes processed. Our work demonstrates that a linker region containing a caspase-3 cleavage motif separates the two functional domains of SifA. To test the hypothesis that processing of SifA by caspase-3 at this particular site is required for function and proper localization of the effector protein domains, we developed two tracking methods to analyze the intracellular localization of SifA. We first adapted a fluorescent tag called phiLOV that allowed for type-III secretion system (T3SS) mediated delivery of SifA and observation of its intracellular colocalization with caspase-3. Additionally, we created a dual-tagging strategy that permitted tracking of each of the SifA functional domains following caspase-3 cleavage to different subcellular locations. The results of this study reveal that caspase-3 cleavage of SifA is required for the proper localization of functional domains and bacterial dissemination. Considering the importance of these events in Salmonella pathogenesis, we conclude that caspase-3 cleavage of effector proteins is a more broadly applicable effector processing mechanism utilized by Salmonella to invade and persist during infection.