# Can we use a hash-based stream cipher against DPA attacks?

There have been lots of DPA researches against block ciphers.

I was wondering if we use a cryptographically secure hash of an incremental counter as a stream cipher, will it withstand DPA attacks?

Ciphertext = Plaintext ⊕ HASH(counter)


My assumptions are:

1. The initial value of the counter is kept secret;
2. There seems to be not many effective DPA attacks against SHA (not HMAC).

There seems to be not many effective DPA attacks against SHA

How do you come to that conclusion? Is it because there aren't many published results of using DPA attacks against SHA? Well, that's mostly because SHA is most often used to hash publicly available data, and so there's less of a point using a DPA attack to recover that data.

Now, any side channel attack (such as DPA) is actually an attack against the implementation, not against the base crypto. Of course, if we consider DPA attacks against SHA implementations, we need to consider "how difficult is it to make a SHA implementation that is strong against DPA attacks?"

Well, there's nothing in the SHA architecture (either SHA-1, SHA-2 or SHA-3) that makes it specifically easy to provide such protection. Now, you could create such an implementation (using, say, thresholding to disguise the individual bits); however that's likely to be significantly slower than a standard implementation.

• What about Salsa20? May 5 '20 at 17:11
• Indeed, when there is a secret processed by a hash, DPA can at least attempt to extract it, and that has been stidied to a degree, like in this Differential Power Analysis of HMAC SHA-1 and HMAC SHA-2 in the Hamming Weight Model.
– fgrieu
May 5 '20 at 17:54
• I've seen more papers on attacking HMAC which is using the same key repeatedly with hashing, which can be subject to DPA. I was thinking that hashing an incremental counter should make it harder to find out the (initial) secret counter value. May 5 '20 at 21:22
• @adieux: actually, I believe that attacking a sequence of unknown values that vary in a predictable way (such as a counter) is actually easier from a DPA perspective (for example, if the lsbit of the sequence number was this ciphertext was $x$, then the lsbit for the next ciphertext is $\bar{x}$; the differences make the current delta stand out a bit more... May 5 '20 at 21:31