Differential Fault Analysis of Full LBlock

$\textsf{LBlock}$

is a 64-bit lightweight block cipher which can be implemented in both hardware environments and software platforms. It was designed by Wu and Zhang, and published at ACNS2011. In this paper, we explore the strength of

$\textsf{LBlock}$

against the differential fault analysis (

$\textsf{DFA}$

). As far as we know, this is the first time the

$\textsf{DFA}$

attack is used to analyze

$\textsf{LBlock}$

. Our

$\textsf{DFA}$

attack adopts the random bit fault model. When the fault is injected at the end of the round from the 25

th

round to the 31

st

round, the

$\textsf{DFA}$

attack is used to reveal the last three round subkeys (i.e.,

K

32

,

K

31

and

K

30

) by analyzing the

$\textit{active S-box}$

of which the input and output differences can be obtained from the right and faulty ciphertexts (

C

,

$\widetilde{C}$

). Then, the master key can be recovered based on the analysis of the key scheduling. Specially, for the condition that the fault is injected at the end of the 25

th

and 26

th

round, we show that the active S-box can be distinguished from the

$\textit{false active S-box}$

by analyzing the nonzero differences from the pair of ciphertexts (

C

,

$\widetilde{C}$

). The false active S-box which we define implies that the nonzero input difference does not correspond to the right output difference. Moreover, as the

$\textsf{LBlock}$

can achieve the best diffusion in eight rounds, there can exist the countermeasures that protect the first and last eight rounds. This countermeasure raises a question whether provoking a fault at the former round of

$\textsf{LBlock}$

can reveal the round subkey. Our current work also gives an answer to the question that the

$\textsf{DFA}$

attack can be used to reveal the round subkey when the fault is injected into the 24

th

round. If the fault model used in this analysis is a

$\textit{semi-random bit model}$

, the round subkey can be revealed directly. Specially, the semi-random bit model corresponds to an adversary who could know the corrupted 4 bits at the chosen round but not know the exact bit in these 4 bits. Finally, the data complexity analysis and simulations show the number of necessary faults for revealing the master key.