This paper presents the first instance of a successful differential fault attack (DFA) on the nonce-based authentication scheme PHOTON-BEETLE, which was a finalist but not the winner of the NIST LwC competition. Furthermore, the paper also reveals the first differential fault attacks on several other NIST LwC schemes, including ORANGE, SIV-TEM-PHOTON, and ESTATE, which are based on sponge and SIV techniques. In general, it is a challenging task to perform DFA for any nonce-based sponge/SIV-based AE because of a unique nonce in the encryption query. However, the decryption procedure (with a fixed nonce) is still susceptible to DFA. We propose different fault attack models, and also give theoretical estimates of the number of faulty queries to get multiple forgeries. Our simulated values corroborate closely the theoretical estimates. Finally, we devise an algorithm to recover the state based on the collected forgeries. Under the random fault attack model, to retrieve the secret key, we need approximately \(2^{37.15}\) number of faulty queries. Also, the offline time and memory complexities of this attack are respectively \(2^{16}\) and \(2^{10}\) nibbles. Whereas, under the random bit fault attack model, around \(2^{11.5}\) number of faulty queries are required to retrieve the key for PHOTON-based schemes and \(2^{13.1}\) for AES-based scheme ESTATE. In the known fault attack model, we need around \(2^{11.05}\) number of faulty queries to retrieve the secret key for PHOTON-based schemes and \(2^{13.01}\) for AES-based scheme ESTATE. The time and memory complexities of the state recovery attack (for PHOTON-based schemes) are respectively \(2^{11}\) and \(2^{9}\) nibbles. Further, we have reduced the number of faulty queries to \(2^{9.32}\) under the precise bit-flip fault model.
