Presented at COSADE 2021 conference
Carry-based Differential Power Analysis (CDPA) and its Application to Attacking HMAC-SHA-2
In this paper, FortifyIQ introduces Carry-based Differential Power Analysis (CDPA), a novel methodology that allows for attacking schemes involving arithmetical addition. This methodology is applied to what is believed to be the first published full-fledged attack on HMAC-SHA-2 which does not require a profiling stage.
FortifyIQ provides full mathematical analysis of the method and shows that, under certain assumptions and with a sufficient amount of traces, any key can be revealed. In the experimental part of the paper, FortifyIQ demonstrates a successful application of the attack both in software simulation and on an FPGA board using power consumption measurements.
Results of FortifyIQ research, described in the paper, show that any implementation of HMAC-SHA-2, even in pure parallel hardware, is vulnerable to side-channel attacks, unless it is adequately
protected.
