Single-Trace Side-Channel Analysis on Polynomial-Based MAC Schemes

Abstract

This paper presents the first side-channel analysis (SCA) on polynomial-based message authentication code (MAC) schemes which is applicable to Poly1305. Typical SCAs (e.g., simple power analysis (SPA) and differential power analysis (DPA)) and conventional attacks on GCM/GMAC that focus on the first multiplication result in the universal hashing (i.e., polynomial evaluation) cannot be applied to Poly1305 owing to one-time keys and the structure of prime-field multiplication. On the other hand, the proposed attack retrieves the hash key from a single side-channel trace (e.g., a power/EM trace given by one execution) with a non-negligible probability and is applicable to polynomial-based MAC schemes implemented on an 8-bit micro-controller. The proposed attack allows the attacker to forge the authentication tag even if the hash key is a one-time key. The basic idea of the proposed attack is to exploit the addition in polynomial-based MAC schemes. Since the output or one input of the addition in these MAC schemes is known, we can efficiently estimate the unknown operands of addition, and then retrieve the hash key by the polynomial factorizations with the estimated candidates. This study also shows a cost-effective countermeasure for ChaCha20-Poly1305 using a combination of a lightweight masked Poly1305 and first-order mask conversion from Boolean to arithmetic.

Appendix: Side-Channel Analysis on Intermediate Addition

We then describe the attack focusing on the i-th intermediate addition of $X_{i-1}$ and $A_{i}$ (i.e., $W_i = (2^{128} + A_i) + X_{i-1}$). In contrast to final addition, while the output of i-th addition (i.e., $W_i$) is a secret value, the attacker knows $A_{i}$. Therefore, similarly to Algorithm 3, we can make a list of candidates for $X_{i-1}$ by calculating $HW(w_{i, j})$ from $a_{i,j}$ and guessed $x_{i-1, j}$ and comparing the hypothetical $HW(w_{i,j})$ with the estimated one from side-channel information. Algorithm 7 calculates a list of candidates for $X_{i-1}$. Algorithm 7 is basically derived by inverting the sign of g and $2^8$ in Algorithm 3 since Algorithm 7 is considered as a variant of Algorithm 3 where $W_i - X_{i-1} = A_i$ corresponds $S + U = T$. In addition, the special case $a_{i,j} = 0$ is removed because $a'_{i,j}$ at Line 7, which is a value representing that carry-in value is one, is calculated by adding one, but not by subtracting one. At Lines 29–38, we perform the loop for 17th byte. The 17th loop should be simplified because the 17th bytes of $X_{i}$ and $W_{i}$ should have limited value represented by only two bits and there should be no carry-propagation/generation to the 18th byte. At Line 39, we combine byte-wise candidates for $X_{i-1}$ by “CombineByteWiseCandidatesEval,” which basically performs Algorithm 4, but the output is given by $\varOmega _0 \; \cup \; \varOmega _1$ and Lines 10–16 are skipped because the addition is performed upto the 17th byte. Note that the main loop in Algorithm 7 and CombineByteWiseCandidatesEval is performed until $j=17$, but the computational cost of Algorithm 7 is almost equal to Algorithm 3.

Major concern about attacking the i-th addition is that the addition is performed over $GF(2^{130}-5)$, namely, reduction by $2^{130}-5$ may be applied to the result of addition and we cannot correctly estimate $W_i$. However, our attack can be still applied to many practical implementation where a reduction is applied only to the multiplication result, but not to the addition result. (Actually, the reduction is not always applied to the result of addition in many practical implementation.)

In addition, some implementation employs an efficient reduction exploiting the property of Mersenne-like prime after multiplication, which indicates that multiplication result is reduced in a kind of lazy manner and $X_{i-1}$ is given by more-than 130 bits. Let us consider the open-source implementation in [HS19] as well as Section 3.5. The implementation employs a lazy reduction and 133- and 134-bit representation for intermediate values. More precisely, the multiplication result is not fully reduced by $2^{130}-5$, $X_{i-1}$ is not given as a 130-bit value as described in Sect. 3.5, but is 133-bit (and $W_i$ is 134-bit). Our algorithms are still applied to this implementation by modifying the upper bound of d at Line 33 to $2^5$, because Algorithm 7 only assumes that $X_{i-1}$ and $W_i$ are 17-byte values and there should be no carry-propagation/generation to 18-th byte. Due to the redundancy, the number of candidates for $X_{i-1}$ after applying Algorithm 7 may be greater than the evaluation in Sect. 3.4 (i.e., Fig. 2 and Table 1). However, we confirmed that the number of candidates is only about $2^2$–$2^3$ times greater than that given in Sect. 3.4 in average case by a simulation. Thus, our attack can be still practical and can be performed with a non-negligible complexity according to Eq. (7) (and Table 3).