Most cryptographic attacks are passive: the attacker measures something the device produces (timing, power, EM, output) and uses statistical or mathematical analysis to recover the secret. Fault injection is different. The attacker actively perturbs the device, causing it to misbehave, and uses the resulting incorrect output to recover the secret. The technique was put on the cryptographic map in 1997 by Boneh, DeMillo, and Lipton, who showed that a single bit flip during an RSA-CRT signature could let an attacker factor the modulus and recover the private key.
Twenty-eight years later, fault injection is a mature discipline. Off-the-shelf equipment can deliver voltage glitches, clock glitches, electromagnetic pulses, and laser injection. Smart cards have hardened against fault attacks for decades, but the broader embedded ecosystem (IoT devices, automotive electronics, industrial control systems) often has not. And the post-quantum algorithms standardised by NIST have their own fault attack surfaces, with several published attacks demonstrating signature forgery and key recovery.
This article walks through the techniques, surveys the published attacks, explains the countermeasures, and discusses the implications for organisations deploying post-quantum cryptography.
The Boneh-DeMillo-Lipton Attack
The seminal paper, "On the Importance of Checking Cryptographic Protocols for Faults," EUROCRYPT 1997 (and the journal version "On the Importance of Eliminating Errors in Cryptographic Computations," Journal of Cryptology 2001), introduced fault attacks against RSA, DSA, and other schemes. The most famous result was the RSA-CRT attack:
RSA-CRT signatures use the Chinese Remainder Theorem to compute s = m^d mod n by computing s_p = m^d mod p and s_q = m^d mod q separately, then combining. If a fault occurs during one of the half-computations (say s_p is corrupted to s_p'), the resulting signature s' satisfies s' ≡ correct mod q but s' ≢ correct mod p. The attacker can compute gcd(s' - s, n), which equals q. The factorisation of n is recovered, and so is the private key.
The attack requires only one faulty signature plus one correct signature on the same message. The fault can be a single bit flip. The cost of a fault attack against unprotected RSA-CRT is, in principle, low.
This launched a research field. Attacks against AES, DES, ECDSA, and other schemes followed. Modern smart cards check the integrity of their cryptographic computations to defeat fault attacks; modern HSMs include fault detection circuits.
The Toolkit
Fault injection requires equipment that can deliver a precise perturbation at a precise moment. The main techniques:
Voltage glitching. The attacker briefly drops or raises the supply voltage, typically by a few hundred millivolts, for a few nanoseconds. The glitch can cause the CPU to skip an instruction, miscompute, or enter an undefined state. Voltage glitching equipment is cheap (a few hundred to few thousand dollars). The ChipWhisperer Pro and Lite Plus boards include voltage glitch capability.
Clock glitching. The attacker briefly accelerates or decelerates the clock, causing setup-time violations in flip-flops and resulting in latched garbage values. Clock glitching is most effective against devices with externally supplied clocks (smart cards). Internally clocked devices are more resistant.
Electromagnetic injection. The attacker places a coil near the chip and pulses a current, inducing a localised electromagnetic field that can cause bit flips. EM injection is non-contact, can be localised to specific chip regions, and is more powerful than voltage glitching against modern silicon. Equipment costs in the low five-figures.
Laser injection. The attacker focuses a pulsed laser onto a specific transistor through the back-side of the chip (after thinning the silicon). Laser injection is the most precise technique, capable of single-bit faults at specific times. Equipment is expensive (six figures) but the attack is most powerful.
Optical injection (UV light, white light). Older and less precise techniques that can still affect older silicon.
Temperature attacks. Operating the chip outside its specified temperature range can cause sporadic bit flips. Less precise but accessible.
Rowhammer. A software-only fault attack against DRAM, demonstrated to flip bits in adjacent rows by repeatedly accessing the same row. Used in exploits including key recovery from ECDSA implementations.
Fault Models
Different attack equipment produces different fault models. The literature uses standard models:
Bit flip. A single bit changes value (0 to 1 or 1 to 0).
Byte fault. An entire byte is randomly corrupted.
Instruction skip. The CPU executes a NOP instead of the actual instruction.
Branch fault. The CPU takes the opposite branch from what the code specified.
Random word fault. A 32-bit or 64-bit word is corrupted.
Stuck-at fault. A bit is stuck at 0 or 1 for the duration of the operation.
Different fault models support different attacks. Boneh-DeMillo-Lipton works with single bit flips. Some attacks against AES require precise byte faults. Instruction skip faults can defeat verification routines.
Fault Attacks on Post-Quantum Algorithms
The post-quantum schemes have their own fault attack surfaces.
ML-DSA (lattice-based signatures). The Fiat-Shamir-with-aborts structure includes a rejection check: after computing a candidate signature, the algorithm checks whether certain coefficients are within bounds and rejects the candidate if not. A fault that skips the rejection check, or always passes the rejection check, results in signatures that leak information about the secret key.
Bruinderink et al. and Ravi et al. have published fault attacks against Dilithium (the predecessor to ML-DSA). Specifically:
Ravi-Bhasin et al., "Exploiting Determinism in Lattice-based Signatures: Practical Fault Attacks on pqm4 Implementations of NIST Candidates," EUROCRYPT 2019. Demonstrated practical fault attacks.
Subsequent work has extended to ML-DSA implementations.
ML-KEM (lattice-based KEM). The Fujisaki-Okamoto transform requires a re-encryption check during decapsulation. A fault that skips this check, or that corrupts the comparison, can lead to security failures. Specifically, if the attacker can submit malformed ciphertexts and observe whether the implementation rejects them properly, fault attacks can recover the secret.
Pessl-Prokop, "Fault Attacks on CCA-Secure Lattice KEMs," TCHES 2021, demonstrated fault attacks against multiple lattice KEMs.
SLH-DSA (hash-based signatures). The hypertree structure of SLH-DSA includes many internal hash computations. Fault attacks targeting specific tree levels can cause signature forgery. Genet, Kannwischer, et al., "Practical Fault Injection Attacks on SPHINCS," IACR ePrint 2018/674, demonstrated fault attacks on SPHINCS (the predecessor to SLH-DSA).
The general lesson: fault attacks against PQ schemes are demonstrated, practical, and require explicit countermeasures.
Specific Attack Scenarios
Signature forgery. An attacker injects a fault to bypass a rejection check or to corrupt a tree-level computation, producing a signature that the legitimate verifier accepts as valid. This is the most direct attack with the highest impact.
Key recovery. An attacker injects faults during signing or decapsulation, observes the corrupt outputs, and uses the differential between correct and corrupt outputs to extract the secret.
DoS. An attacker injects faults to crash the device or to put it into an undefined state. While not a cryptographic compromise, this can be used to bypass security mechanisms (e.g., a fault that resets a counter, allowing replay attacks).
Bypass of authentication. An attacker injects a fault to skip a signature verification or to make a comparison succeed when it should fail. This is the secure-boot attack model.
Countermeasures
The countermeasure landscape is mature for classical algorithms and emerging for post-quantum.
Verification of cryptographic computations. After signing, recompute and verify. The Shamir countermeasure for RSA-CRT is the canonical example: after computing s_p and s_q, verify by checking that s mod p equals s_p and s mod q equals s_q. For lattice schemes, similar verification can be added.
Redundant computation. Compute the operation twice and compare. Higher cost but defeats single-fault attacks.
Sensor-based glitch detection. Hardware sensors that detect voltage anomalies, temperature anomalies, clock anomalies, or EM disturbances. The device aborts the operation if a glitch is detected.
Physical countermeasures. Active mesh (a metal grid that detects probing or laser injection), passive shielding, top-side and back-side metal layers.
Code-level countermeasures. Defensive programming patterns like double-call-and-compare for critical decisions, redundant flag checks, and integrity-protected control flow.
Fault-tolerant cryptographic protocols. Some schemes are designed to be fault-resistant by construction. For lattice schemes, careful structuring of the signing and decapsulation algorithms can reduce fault attack surface.
For post-quantum implementations, the practical countermeasures include:
- recompute-and-verify in ML-DSA signing;
- explicit re-encryption with mismatch detection in ML-KEM decapsulation;
- redundant tree path verification in SLH-DSA;
- consistency checks in NTT operations;
- sensor-based glitch detection in hardware deployments.
Common Criteria and FIPS 140-3
Fault injection resistance is part of high-assurance certification.
Common Criteria. The Common Criteria framework (ISO/IEC 15408) includes the AVA_VAN (vulnerability analysis) component. AVA_VAN.5 requires high-attack-potential vulnerability analysis, which includes fault attacks. Smart cards typically certify at EAL 4+ AVA_VAN.5 (also known as "high attack potential"), with detailed evaluation of fault injection resistance.
The SOG-IS Mutual Recognition Agreement (MRA) provides a framework for European Common Criteria certification, with detailed protection profiles for smart cards (PP-Smartcard) and HSMs.
FIPS 140-3. NIST's Cryptographic Module Validation Programme (CMVP) certifies cryptographic modules at four levels. Level 3 requires identity-based authentication, physical tamper detection, and secure key management. Level 4 adds environmental failure protection (EFP) and environmental failure testing (EFT), which include resistance to voltage and temperature attacks.
FIPS 140-3 Level 4 modules are the highest assurance level for cryptographic hardware. As of 2026, the first FIPS 140-3 Level 4 modules with PQ algorithms are emerging from major HSM vendors.
Real-World Fault Attack Cases
Smart card fraud. In the early 2000s, criminal fraud rings targeted satellite TV smart cards using fault injection. Devices like the Smartmouse and various clones were used to extract subscription keys.
Game console hacking. Microsoft Xbox 360, Nintendo Wii, Sony PlayStation 3, and various other consoles have been compromised through fault injection attacks. The attacker injects faults during signature verification of the boot loader, allowing custom code to run.
ATM and payment terminals. Several attacks against ATMs and POS terminals have used fault injection to bypass cryptographic checks. The European Cybercrime Centre at Europol has documented multiple such cases.
Automotive ECUs. Modern cars contain dozens of electronic control units (ECUs) running cryptographic protocols. Researchers have demonstrated fault attacks against immobilisers, key fobs, and EV charging protocols.
IoT devices. The general consumer IoT market has been a fault attack playground. Many devices lack basic countermeasures.
For the IoT context, see PQC IoT Smart Home Devices.
What Organisations Should Require
For high-assurance deployments of post-quantum cryptography:
Common Criteria EAL 4+ AVA_VAN.5 or FIPS 140-3 Level 3+ certification of HSMs and smart cards, with PQ algorithms in the certified module.
Public information about countermeasures: which fault attack countermeasures are implemented, in what form, with what assurance level.
Recompute-and-verify in signing operations.
Sensor-based glitch detection in hardware.
Independent third-party fault injection testing for high-value deployments. The same labs that conduct CC certification can perform standalone fault attack assessments.
Update path. As fault attack research evolves, implementations should be updatable to incorporate new countermeasures.
For more on PQ deployment and threats, see Side-Channel Attacks on PQC. For implementations and audits, see Open Source PQC Libraries Review.
FAQ
Are fault attacks practical against software running on a server? Direct fault attacks (voltage glitching, clock glitching) require physical access. Rowhammer is a software-only fault attack but requires specific DRAM behaviour. Microarchitectural attacks (Spectre, Meltdown) are arguably fault-adjacent. For server-side deployment, the threat is lower than for embedded devices but not zero.
How much does fault injection equipment cost? Voltage glitching: ChipWhisperer Lite/Pro at a few hundred to few thousand dollars. EM injection: low five-figures. Laser injection: six figures including chip preparation equipment. The hobbyist threshold is voltage and EM glitching.
Are PQ algorithms more vulnerable to fault attacks than RSA/ECDSA? The published research suggests roughly comparable vulnerability. Lattice schemes have rejection checks and FO transforms that are fault-sensitive; RSA-CRT had its specific attack surface. Hash-based schemes (SLH-DSA) have a unique fault attack surface in tree traversal. Mature countermeasures exist for classical schemes; PQ countermeasures are catching up.
What's the difference between fault injection and side-channel analysis? Side-channel analysis is passive: the attacker observes signals (power, timing, EM) without perturbing the device. Fault injection is active: the attacker perturbs the device and uses the resulting incorrect computation. Both can be combined.
Can fault attacks be mitigated entirely in software? Software countermeasures (recompute-and-verify, redundancy, defensive programming) reduce attack surface but cannot fully defeat hardware-level glitches. A determined attacker with hardware can usually find a way. Hardware countermeasures (sensors, shielding) are required for high-assurance.
Sources
- Boneh, DeMillo, Lipton, "On the Importance of Checking Cryptographic Protocols for Faults," EUROCRYPT 1997, https://crypto.stanford.edu/~dabo/papers/faults.ps.gz
- Boneh, DeMillo, Lipton, "On the Importance of Eliminating Errors in Cryptographic Computations," Journal of Cryptology 2001, https://link.springer.com/article/10.1007/s001450010016
- Ravi, Bhasin et al., "Exploiting Determinism in Lattice-based Signatures," EUROCRYPT 2019, https://eprint.iacr.org/2019/769
- Genet, Kannwischer et al., "Practical Fault Injection Attacks on SPHINCS," IACR ePrint 2018/674, https://eprint.iacr.org/2018/674
- Pessl, Prokop, "Fault Attacks on CCA-Secure Lattice KEMs," TCHES 2021(2), https://tches.iacr.org/index.php/TCHES/article/view/8801
- ISO/IEC 15408 Common Criteria, https://www.iso.org/standard/72891.html
Related Articles
- Side-Channel Attacks on PQC
- Power Analysis Attacks
- Timing Attacks on Lattice
- ML-DSA vs SLH-DSA
- PQC IoT Smart Home Devices
Protect Your Data Before Q-Day Arrives
QNSQY's NIST-standardized post-quantum encryption protects files against both current and quantum-era threats.