Yaacov Belenky
FortifyIQ, Inc., 300 Washington Street, Suite 850, Newton, MA 02458 USA

Ira Dushar
FortifyIQ, Inc., 300 Washington Street, Suite 850, Newton, MA 02458 USA

Valery Teper
FortifyIQ, Inc., 300 Washington Street, Suite 850, Newton, MA 02458 USA

Vadim Bugaenko
FortifyIQ, Inc., 300 Washington Street, Suite 850, Newton, MA 02458 USA

Oleg Karavaev
FortifyIQ, Inc., 300 Washington Street, Suite 850, Newton, MA 02458 USA

Leonid Azriel
FortifyIQ, Inc., 300 Washington Street, Suite 850, Newton, MA 02458 USA

Yury Kreimer
FortifyIQ, Inc., 300 Washington Street, Suite 850, Newton, MA 02458 USA

Keywords: Side-channel analysis, DPA, HMAC, SHA-2, SHA-256

Abstract

In this paper, we introduce Carry-based Differential Power Analysis (CDPA), a novel methodology that allows for attacking schemes that use arithmetical addition. We apply this methodology to attacking HMAC-SHA-2. We provide full mathematical analysis of the method and show that under certain assumptions and with a sufficient amount of traces any key can be revealed. In the experimental part of the paper, we demonstrate successful application of the attack both in software simulation and on an FPGA board using power consumption measurements. With as few as 30K traces measured on the FPGA board, we recover the secrets that allow for forging the HMAC-SHA-2 signature of any message in 3% of the cases — while with 275K traces the success rate reaches 100%. This means that any implementation of HMAC-SHA-2, even in pure parallel hardware, is vulnerable to side-channel attacks, unless it is adequately protected. To the best of our knowledge, this is the first published full-fledged attack on pure hardware implementations of HMAC-SHA-2, which does not require a profiling stage.