Fault attacks on stream cipher scream

Abstract

In this paper we present a differential fault attack (DFA) on the stream cipher Scream which is designed by the IBM researchers Coppersmith, Halevi, and Jutla in 2002. The known linear distinguishing attack on Scream takes 2 120 output words and there is no key recovery attack on it, since the S-box used by Scream is key-dependent and complex. Under the assumption that we can inject random byte faults in the same location multiple number of times, the 128-bit key can be recovered with 2 94 computations and 2 72 bytes memory by injecting around 2000 faults. Then combined with the assumption of related key attacks, we can retrieve the key with 2 44 computations and 2 40 bytes memory. The result is verified by experiments. To the best of the our knowledge this is the first DFA and key recovery attack on Scream.