Further Improved Deep Differential Fault Analysis on Camellia

This paper presents a further improved deep differential fault analysis (DFA) on Camellia. The proposed method can extend the single byte based fault depth into the r-2^th round, recover full 8 bytes of the rth round equivalent key, 5-6 bytes of the r-1^th round equivalent key, and 1 byte of the r-2^th round equivalent key at one time. Experimental results show that: due to the Feistel structure and permutation function design, Camellia is vulnerable to deep DFA attack. 4 and 20 faulty ciphertexts can reduce the key space of Camellia-128 and Camellia-192/256 to 2^22.2 and 2^21.2 respectively.