Improved Differential Fault Analysis On Camellia-128

In this paper we propose improved Differential Fault Analysis (DFA) on the block cipher Camellia with a 128-bit key. Existing DFAs on Camellia-128 require several faults induced at multiple rounds, at least two of which must be induced at or after the 16-th round. On the other hand, by utilizing longer fault propagation paths than the existing DFAs, the proposed attacks require random byte faults to targeted byte positions induced only at the 14-th round. The simulation results confirm the feasibility of the proposed attacks. Our attacks indicate that the last 5 rounds of Camellia-128, two more rounds compared with the existing DFAs, must be protected against DFAs.