Differential Fault Attacks on Privacy Protocols Friendly Symmetric-Key Primitives: RAIN and HERA

Abstract

As the practical applications of fully homomorphic encryption (FHE), secure multi-party computation (MPC) and zero-knowledge (ZK) proof continue to increase, so does the need to design and analyze new symmetric-key primitives that can adapt to these privacy-preserving protocols. These designs typically have low multiplicative complexity and depth with the parameter domain adapted to their application protocols, aiming to minimize the cost associated with the number of nonlinear operations or the multiplicative depth of their representation as circuits. In this paper, we propose two differential fault attacks against a one-way function RAIN used for Rainier (CCS 2022), a signature scheme based on the MPC-in-the-head approach and an FHE-friendly cipher HERA used for the RtF framework (Eurocrypt 2022), respectively. We show that our attacks can recover the keys for both ciphers by only injecting a fault into the internal state and requiring only one normal and one faulty ciphertext blocks. Thus, we can use only the practical complexity of 226.6/228.8/230.4 bit operations to break the full-round RAIN with 128/192/256-bit keys. For full-round HERA with 80/128-bit key, our attack is practical with complexity the complexity of 220 encryptions with about 216 memory.