Work

Differential Fault Attacks on TFHE-Friendly Cipher FRAST

Year: 2026

Type: article

Abstract: Differential Fault Attacks (DFAs) have recently emerged as a significant threat against stream ciphers specifically designed for Hybrid Homomorphic Encryption (HHE). In this work, we propose DFAs on the$\textsf {FRAST}$cipher, which is a cipher specifically tailored for Torus-based Fully Homomorphic Encryption (TFHE). The round function of$\textsf {FRAST}$employs random S-boxes to minimize the number of rounds, and can be efficiently evaluated in TFHE. Targeting the unbalanced Feistel structure of$\textsf {FRAST}$, we design a specialized key recovery strategy and can mount the DFA with a few faults. Under the assumption of precise fault injection, our DFA can recover the key within one second using just 4 or 6 faults. When discarding the assumption and considering a more practical fault model, we can still achieve key recovery in a few minutes without increasing the number of faults. To the best of our knowledge, this is the first fault-type analysis of$\textsf {FRAST}$. We also explored countermeasures to protect$\textsf {FRAST}$. Our analysis revealed that negacyclic S-boxes, a key component of TFHE-friendly ciphers, are unsuitable for incorporating linear structures to resist DFA. Consequently, we recommend removing the negacyclic restriction in the penultimate round of FRAST and introducing non-zero linear structures into the S-boxes of the last two rounds. We believe that our work will provide valuable insights for the design of TFHE-friendly ciphers.

Source: IEEE Transactions on Information Forensics and Security

DOI: 10.1109/tifs.2026.3725560

Authors: Weizhe Wang, Deng Tang

Institution: Shanghai Jiao Tong University

Language: English

Topic: Cryptographic Implementations and Security

Subfield: Artificial Intelligence

Field: Computer Science

Domain: Physical Sciences

Open Access status: hybrid

Estimated APC paid: $2,645

Funder: National Natural Science Foundation of China