Differential Fault Attack on Dasta and Fasta

Abstract

We present a Differential Fault Attack (DFA) targeting Dasta and Fasta, two stream cipher constructions proposed for efficient Fully Homomorphic Encryption (FHE) schemes. Both designs are inspired by Rasta but modified with an affine layer. Dasta replaces the per-round pseudorandom matrices with a single fixed public matrix combined with a permutation, while Fasta partitions the state into five parallel Rasta-like branches whose outputs are cross-mixed through an additional diffusion layer. For Dasta, we demonstrate that a single bit-flip fault introduced into the internal state during keystream generation is sufficient to recover the full secret key. Targeting the full 6-round, 219-bit instance, our attack requires only one 219-bit block each of normal and faulty keystream to build a solvable system of equations. For Fasta, the parallel-branch structure requires a slightly stronger fault model. Injecting two single-bit faults into the internal state allows us to first reconstruct the intermediate branch states and subsequently recover the secret key. Our experiments use a 1645 bit keystream block of normal output together with one faulty block per injected fault to generate the difference equations. In both cases, our results show that departing from Rasta’s fully pseudorandom affine layer offers no inherent resistance to differential fault attacks.