Differential Power Analysis of HMAC SHA-2 in the Hamming Weight Model

• Main Authors: Belaïd, Sonia, Bettale, Luk, Dottax, Emmanuelle, Genelle, Laurie, Rondepierre, Franck
• Other Authors: Construction and Analysis of Systems for Confidentiality and Authenticity of Data and Entities (CASCADE), Département d'informatique de l'École normale supérieure (DI-ENS), École normale supérieure - Paris (ENS Paris), Université Paris sciences et lettres (PSL)-Université Paris sciences et lettres (PSL)-Institut National de Recherche en Informatique et en Automatique (Inria)-Centre National de la Recherche Scientifique (CNRS)-École normale supérieure - Paris (ENS Paris), Université Paris sciences et lettres (PSL)-Université Paris sciences et lettres (PSL)-Institut National de Recherche en Informatique et en Automatique (Inria)-Centre National de la Recherche Scientifique (CNRS)-Inria Paris-Rocquencourt, Institut National de Recherche en Informatique et en Automatique (Inria)-Centre National de la Recherche Scientifique (CNRS), Thales Communications Colombes, THALES, Université Paris sciences et lettres (PSL), Oberthur Technologies
• Format: Conference Object
• Language: English
• Published: HAL CCSD 2013
• Subjects: Side Channel Analysis; Differential Power Analysis; Hamming Weight; HMAC; SHA-2; [INFO.INFO-CR]Computer Science [cs]/Cryptography and Security [cs.CR]; Iceland
• Online Access: https://hal.inria.fr/hal-00872410; https://hal.inria.fr/hal-00872410/document; https://hal.inria.fr/hal-00872410/file/articleHMAC.pdf

International audience As any algorithm manipulating secret data, HMAC is potentially vulnerable to side channel attacks. In 2007, McEvoy et al. proposed a differential power analysis attack against HMAC instantiated with hash functions from the SHA-2 family. Their attack works in the Hamming distance leakage model and makes strong assumptions on the target implementation. In this paper, we present an attack on HMAC SHA-2 in the Hamming weight leakage model, which advantageously can be used when no information is available on the targeted implementation. Furthermore, our attack can be adapted to the Hamming distance model with weaker assumptions on the implementation. We show the feasibility of our attack on simulations, and we study its overall cost and success rate. We also provide an evaluation of the performance overhead induced by the countermeasures necessary to avoid the attack.