0
$\begingroup$

There have been lots of DPA researches against block ciphers.

I was wondering if we use a cryptographically secure hash of an incremental counter as a stream cipher, will it withstand DPA attacks? 

Ciphertext = Plaintext ⊕ HASH(counter)

My assumptions are:

  1. The initial value of the counter is kept secret;
  2. There seems to be not many effective DPA attacks against SHA (not HMAC).
Improve this question
$\endgroup$

1 Answer 1

Reset to default
2
$\begingroup$

There seems to be not many effective DPA attacks against SHA

How do you come to that conclusion? Is it because there aren't many published results of using DPA attacks against SHA? Well, that's mostly because SHA is most often used to hash publicly available data, and so there's less of a point using a DPA attack to recover that data.

Now, any side channel attack (such as DPA) is actually an attack against the implementation, not against the base crypto. Of course, if we consider DPA attacks against SHA implementations, we need to consider "how difficult is it to make a SHA implementation that is strong against DPA attacks?"

Well, there's nothing in the SHA architecture (either SHA-1, SHA-2 or SHA-3) that makes it specifically easy to provide such protection. Now, you could create such an implementation (using, say, thresholding to disguise the individual bits); however that's likely to be significantly slower than a standard implementation.

Improve this answer
$\endgroup$
4
  • $\begingroup$ What about Salsa20? $\endgroup$
    – kelalaka
    Commented May 5, 2020 at 17:11
  • 1
    $\begingroup$ Indeed, when there is a secret processed by a hash, DPA can at least attempt to extract it, and that has been stidied to a degree, like in this Differential Power Analysis of HMAC SHA-1 and HMAC SHA-2 in the Hamming Weight Model. $\endgroup$
    – fgrieu ♦
    Commented May 5, 2020 at 17:54
  • $\begingroup$ I've seen more papers on attacking HMAC which is using the same key repeatedly with hashing, which can be subject to DPA. I was thinking that hashing an incremental counter should make it harder to find out the (initial) secret counter value. $\endgroup$
    – adieux
    Commented May 5, 2020 at 21:22
  • $\begingroup$ @adieux: actually, I believe that attacking a sequence of unknown values that vary in a predictable way (such as a counter) is actually easier from a DPA perspective (for example, if the lsbit of the sequence number was this ciphertext was $x$, then the lsbit for the next ciphertext is $\bar{x}$; the differences make the current delta stand out a bit more... $\endgroup$
    – poncho
    Commented May 5, 2020 at 21:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.