Carry-based Differential Power Analysis (CDPA) and its Application to Attacking HMAC-SHA-2

In this paper, we introduce Carry-based Differential Power Analysis (CDPA), a novel methodology that allows for attacking schemes that use arithmetical addition. We apply this methodology to attacking HMAC-SHA-2. We provide full mathematical analysis of the method and show that under certain assumptions and with a sufficient amount of traces any key can be revealed. In the experimental part of the paper, we demonstrate successful application of the attack both in software simulation and on an FPGA board using power consumption measurements. With as few as 30K traces measured on the FPGA board, we recover the secrets that allow for forging the HMAC-SHA-2 signature of any message in 3% of the cases — while with 275K traces the success rate reaches 100%. This means that any implementation of HMAC-SHA-2, even in pure parallel hardware, is vulnerable to side-channel attacks, unless it is adequately protected. To the best of our knowledge, this is the first published full-fledged attack on pure hardware implementations of HMAC-SHA-2, which does not require a profiling stage.