Differential fault analysis (DFA) is an important technique for evaluating the implementation-level security of block ciphers. Many DFA attacks assume that the adversary can inject faults into a selected internal word, nibble, or branch. Such fixed-location assumptions are convenient for deriving key-recovery equations, but they may overestimate the adversary's spatial control and may obscure the branch-dependent leakage behavior of multi-branch structures. In this paper, we study the lightweight block cipher Lilliput under a fixed-timing full-branch random-location nibble fault model. The attacker is assumed to induce a nonzero nibble fault in round 27, while the affected branch is randomly distributed over all sixteen state branches and is unknown to the attacker. The main challenge is to convert faulty ciphertexts with unknown injection locations into usable key-recovery constraints. We analyze the fault propagation induced by the EGFN structure of Lilliput and derive ciphertext-difference conditions for identifying the injected branch. The proposed branch-identification approach has a DDT-based combinatorial estimate of at least 99.9909% and achieves 99.9983% accuracy in 2^{20} random fault simulations. Once the fault branch is determined, we classify the corresponding propagation patterns according to whether the injected fault value and the intermediate S-box output difference can be uniquely determined. For each case, we derive DDT-based constraints on the last-round and penultimate-round subkeys and combine multiple faulty ciphertexts by candidate-set intersection. Simulation experiments over 2^{15} trials show that the attack reaches key-recovery success rates of over 90%, 95%, and 99% with 32, 36, and 46 faulty ciphertexts, respectively. These results show that Lilliput exhibits exploitable branch-dependent leakage even when the attacker cannot control the exact fault location.

翻译：暂无翻译