# Security Analysis of HMAC/NMAC by Using Fault Injection

Authors: Kitae Jeong; Yuseop Lee; Jaechul Sung; Seokhie Hong
Journal: Journal of Applied Mathematics
 (2013)

---

## Abstract

In Choukri and Tunstall (2005), the authors showed that if they decreased the number of rounds in AES by injecting faults, it is possible to recover the secret key. In this paper, we propose fault injection attacks on HMAC/NMAC by applying the main idea of their attack. These attacks are applicable to HMAC/NMAC based on the MD-family hash functions and can recover the secret key with the negligible computational complexity. Particularly, these results on HMAC/NMAC-SHA-2 are the first known key recovery attacks so far.


---

## Body

## 1. Introduction

HMAC and NMAC are hash-based message authentication codes proposed in [1]. The construction of HMAC/NMAC is based on a keyed hash function. Let H be an iterated Merkle-Damgård hash function, which defines a keyed hash function HK by replacing IV with the key K. Then, HMAC and NMAC can be defined as follows:(1)HMACK(M)=H(K-⊕opad∥H(K-⊕ipad∥M)),NMACK1,K2(M)=HK1(HK2(M)).
Here, M is a message and K and (K1,K2) are the secret keys of HMAC and NMAC, respectively; K- means K padded to a single block, and opad(=0x5c5c⋯) and ipad(=0x3636⋯) are two one-block length constants. Until now, many theoretical cryptanalytic results on HMAC/NMAC have been proposed [2–4]. For example, Wang et al. presented key recovery attacks on HMAC/NMAC-MD4 with 272 MAC queries and 277 MD4 computations [4]. On the other hand, McEvoy et al. introduced a differential power analysis on HMAC-SHA-256 in [5]. This attack does not allow the recovery of the secret key, but rather a secret intermediate hash value of SHA-256. It leads to forging the MACs for arbitrary messages. Correlation power analysis on HMAC based on six SHA-3 candidates was presented in [6]. This is also a forgery attack. To our knowledge, there is no key recovery attack on HMAC by using side channel analyss.Side channel analysis exploits the easily accessible information such as power consumption, running time, and input-output behavior under malfunctions. It is often much more powerful than the classical cryptanalysis such as differential cryptanalysis and linear cryptanalysis. Since Kocher had introduced timing attacks in [7], many side channel analyses such as differential fault analysis [8] and fault injection attack [9] have been proposed [10–12].Choukri and Tunstall proposed a fault injection attack on AES [13]. The fault injection method used a transient glitch on the power supplied to the smart card. In general, the implementation of a symmetric cryptographic algorithm in the PIC assembly language will have the following format:(2)movlwOAhmovwfRoudCounterRoudLabelCallRoudFunctiondecfzRoudCountergotoRoudLabel
The RAM variable (RoudCounter) is set to the number of rounds required (in the case of AES, OA in hexadecimal). The round function is executed, which has been represented by a call to the function RoudFunction. The RoudCounter variable is then decremented, and the round is repeated until RoudCounter is equal to zero, at which the loop point exits. It is this loop that we are trying to change so that it exits earlier than expected. The target of the fault is the decfz step, which consists of a decrement, a test, and a conditional jump. The conditional jump is presented as a jump of one instruction when the test is positive; otherwise, the next instruction is executed. The aim of the attack is to reduce the algorithm to one round. It is not possible to remove the first round entirely as the first conditional test is after the first round. Thus, the cryptanalysis of the resulting algorithm can be simple and only requires two plaintext/ciphertext pairs.In this paper, we propose fault injection attacks on HMAC/NMAC. Our fault assumption is based on that of   [13]. That is, it is assumed that we can decrease the number of steps in the target compression function by injecting some faults. Our attack can be applied to HMAC/NMAC based on the MD-family hash functions and recover the secret key with the negligible computational complexity. As concrete examples, we apply our attack to HMAC/NMAC based on MD4, MD5 and SHA-2. Our attack results are summarized in Table 1. In the case of HMAC-SHA-256, for any message, we can recover the n-word secret key with [n/3] fault injections and only a negligible computational complexity. Also, we need only 2·[n/3] fault injections to recover the 2n-word secret key of NMAC-SHA-256. Thus, when n is 4, that is, the 4(8)-word secret key, we require just two(four) fault injections to recover the secret key of HMAC-SHA-256 (NMAC-SHA-256), respectively. Note that the attack results on HMAC/NMAC-SHA-2 are the first known key recovery attacks on them.Table 1
Our attack results on HMAC/NMAC.
Algorithm
No. of injected faults
Algorithm
No. of injected faults
HMAC-MD4
[
n
/
3
]
NMAC-MD4
2
·
[
n
/
3
]
HMAC-MD5
[
n
/
3
]
NMAC-MD5
2
·
[
n
/
3
]
HMAC-SHA-224
[
n
/
3
]
NMAC-SHA-224
[
n
/
3
]
+
[
n
/
2
]
HMAC-SHA-256
[
n
/
3
]
NMAC-SHA-256
2
·
[
n
/
3
]
HMAC-SHA-384
[
n
/
3
]
NMAC-SHA-384
[
n
/
3
]
+
n
HMAC-SHA-512
[
n
/
3
]
NMAC-SHA-512
2
·
[
n
/
3
]This paper is organized as follows: in Section2, we briefly introduce the MD-family hash functions. Then, we describe the fault injection attacks on HMAC and NMAC in Sections 3 and 4, respectively. Finally, we give a conclusion in Section 5.


## 2. MD-Family Hash Function

Since MD4 [14] had been introduced in 1990, the MD-family hash functions such as MD5 [15] and SHA-2 [16], where the design rationale is based on that of MD4, have been proposed. To compute the hash value for a message M of any size, the MD-family hash functions divide M into message blocks (M0,…,Mt) of fixed length b and obtain the hash value by using a compression function f. A compression function f takes a b-bit message string Mi-1 and a s-bit chaining variable IHVi-1 as input values and outputs an updated s-bit chaining variable IHVi. IHVi is computed by iteratively using a step function. It consists of addition, Boolean function, and rotation operations. After operating a step function repeatedly, IHVi is updated by adding IHVi-1. Table 2 presents the parameters of MD4, MD5, and SHA-2.Table 2
Parameters of MD4, MD5 and SHA-2.
Hash function
Message block
Chaining value
Hash value
Step function
Word size
MD4
512 bits
128 bits
128 bits
48 steps
32 bits
MD5
512 bits
128 bits
128 bits
64 steps
32 bits
SHA-224
512 bits
256 bits
224 bits
64 steps
32 bits
SHA-256
512 bits
256 bits
256 bits
64 steps
32 bits
SHA-384
1024 bits
512 bits
384 bits
80 steps
64 bits
SHA-512
1024 bits
512 bits
512 bits
80 steps
64 bitsAs a concrete example, we briefly introduce SHA-2 (SHA-224, SHA-256, SHA-384, and SHA-512), one of the most important MD-family hash functions. In SHA-224/256, the word size is 32 bits. The message string is firstly padded to be a 512-bit multiple and is divided into 512-bit blocks. A compression functionf takes a 512-bit message string and a 256-bit chaining variable as input values and outputs an updated 256-bit chaining variable. It consists of a message expansion and a data processing. The message block is expanded by using the following message expansion function. Here, (m0,…,m15)=Mi, “+” denotes the wordwise addition, σ0(X)=(X⋙7)⊕(X⋙18)⊕(X≫3), and σ1(X)=(X⋙17)⊕(X⋙19)⊕(X≫10).Consider(3)Wj=mj,(0≤j<16),Wj=σ1(Wj-2)+Wj-7+σ0(Wj-15)+Wj-16,dddddddddddddddddddd(16≤j<80).The data processing computesIHVi as follows. Here, Vj denotes a 256-bit value consisting of eight words Aj, Bj, Cj, Dj, Ej, Fj, Gj, and Hj.Consider(4)V0=IHVi-1,Vj+1=Rj(Vj,Wj),(j=0,…,63),IHVi=IHVi-1+V64.
A step function Rj is defined as follows. Here, Kj is a constant number for each step; Ch(X,Y,Z)=(X∨Y)⊕(¬X∨Z), Maj(X,Y,Z)=(X∨Y)⊕(X∨Z)⊕(Y∨Z), Σ0(X)=(X⋙2)⊕(X⋙13)⊕(X⋙22), and Σ1(X)=(X⋙6)⊕(X⋙11)⊕(X⋙25).
(5)T1j=Hj+Σ1(Ej)+Ch(Ej,Fj,Gj)+Kj+Wj,T2j=Σ0(Aj)+Maj(Aj,Bj,Cj),Aj+1=T1j+T2j,Bj+1=Aj,Cj+1=Bj,Dj+1=Cj,Ej+1=Dj+T1j,Fj+1=Ej,Gj+1=Fj,Hj+1=Gj.
SHA-224 outputs the left most 224-bit value of IHVt+1 as the hash value, and SHA-256 outputs IHVt+1 as the hash value.The structures of SHA-384/512 are similar to those of SHA-224/256. In SHA-384/512, the word size is double that of SHA-224/256. Thus, a message block is 1024 bits, and the size of a chaining value is 512 bits. A compression function consists of 80 steps.


## 3. Key Recovery Attack on HMAC

Our attack can be applied to HMAC based on the MD-family hash functions. As a concrete example, we introduce a key recovery attack on HMAC-SHA-2. Other cases can be explained similarly. For the detailed attack results, see Table1.


### 3.1. Fault Assumption

Recall that the authors reduced the number of rounds in AES to one in [13]. We apply this fault assumption to HMAC. That is, by using several fault injections, we can reduce the number of steps in the last two compression functions (see Figure 1). Similarly to AES, the MD-family hash functions compute the hash value by iteratively using a step function. Moreover, there are some results based on similar fault models [17, 18]. Thus, our fault assumption is reasonable.Figure 1
Our fault model on HMAC.For the simplicity, we denote these two compression functions byf0* and f1*. Thus, we reduce the number of steps in (f0*,f1*) to some values by using fault injections, respectively, and then recover the secret key K of HMAC-SHA-2. When we reduced the number of steps in fi* to j, we denoted this event by fi,j* in this paper.


### 3.2. Key Recovery Attack on HMAC-SHA-256/512

As mentioned in the previous section, the structure of SHA-512 is similar to that of SHA-256 excluding parameters such as the word size. Thus, we only propose a key recovery attack on HMAC-SHA-256 in this subsection.Since the word size of SHA-256 is 32 bits, we assume that the length ofK(=K0∥K1∥⋯∥Kn-1) is 32·n bits. Our attack on HMAC-SHA-256 conducts the procedure recovering 96-bit (K3i,K3i+1,K3i+2) iteratively [n/3] times (i=0,…,[(n-1)/3]). We can recover (K0,K1,K2) as follows. From an event (f0,3*,f1,1*), we compute HMAC(=HMAC0∥HMAC1∥⋯∥HMAC7). Then, we can construct the following six equations (see Figure 2). Here, (A,…,H)=(IHV0,0,…,IHV0,7);
(6)(Y+Z)+(A+B)=HMAC1,(X+Y)+(B+C)=HMAC2,X+(A+B+D)=HMAC3,(β+γ)+(E+F)=HMAC5,(α+β)+(F+G)=HMAC6,α+(E+G+H)=HMAC7.
Since (A,…,H) are known values in (6), we can obtain (X,Y,Z,α,β,γ). With these values, we can compute (K0,K1,K2) by using the following equations:
(7)K0⊕0x5c=X-(H+Σ1(E)+Ch(E,F,G)+C0ddddddddddddddd+Σ0(A)+Maj(A,B,C)),K1⊕0x5c=Y-(G+Σ1(α)+Ch(α,E,F)+C1ddddddddddddddd+Σ0(X)+Maj(X,A,B)),K2⊕0x5c=Z-(F+Σ1(β)+Ch(β,α,E)+C2ddddddddddddddd+Σ0(Y)+Maj(Y,X,A)).Figure 2
An event(f0,3*,f1,1*).By repeating the previous procedure, we can recoverK by using [n/3] fault injections. Since this consists of only solving simple equations, the computational complexity is negligible.


### 3.3. Key Recovery Attack on HMAC-SHA-224/384

Recall that SHA-224/384 outputs the left most 224/384 bits of the resulting 256/512-bit hash value as the hash value, respectively. For example, HMAC-SHA-224 outputs onlyHMAC0∥⋯∥HMAC6 as the hash value. Thus, we can not compute (α,β) in (6) (see Figure 2). However, we can obtain (X,Y,Z) in (6) and compute K0 in (7). And then, we can obtain α by using K0. By repeating this procedure, we can recover (K1,K2) sequentially. Hence, we can recover K of HMAC-SHA-224/384 with [n/3] fault injections and the negligible computational complexity.


## 3.1. Fault Assumption

Recall that the authors reduced the number of rounds in AES to one in [13]. We apply this fault assumption to HMAC. That is, by using several fault injections, we can reduce the number of steps in the last two compression functions (see Figure 1). Similarly to AES, the MD-family hash functions compute the hash value by iteratively using a step function. Moreover, there are some results based on similar fault models [17, 18]. Thus, our fault assumption is reasonable.Figure 1
Our fault model on HMAC.For the simplicity, we denote these two compression functions byf0* and f1*. Thus, we reduce the number of steps in (f0*,f1*) to some values by using fault injections, respectively, and then recover the secret key K of HMAC-SHA-2. When we reduced the number of steps in fi* to j, we denoted this event by fi,j* in this paper.


## 3.2. Key Recovery Attack on HMAC-SHA-256/512

As mentioned in the previous section, the structure of SHA-512 is similar to that of SHA-256 excluding parameters such as the word size. Thus, we only propose a key recovery attack on HMAC-SHA-256 in this subsection.Since the word size of SHA-256 is 32 bits, we assume that the length ofK(=K0∥K1∥⋯∥Kn-1) is 32·n bits. Our attack on HMAC-SHA-256 conducts the procedure recovering 96-bit (K3i,K3i+1,K3i+2) iteratively [n/3] times (i=0,…,[(n-1)/3]). We can recover (K0,K1,K2) as follows. From an event (f0,3*,f1,1*), we compute HMAC(=HMAC0∥HMAC1∥⋯∥HMAC7). Then, we can construct the following six equations (see Figure 2). Here, (A,…,H)=(IHV0,0,…,IHV0,7);
(6)(Y+Z)+(A+B)=HMAC1,(X+Y)+(B+C)=HMAC2,X+(A+B+D)=HMAC3,(β+γ)+(E+F)=HMAC5,(α+β)+(F+G)=HMAC6,α+(E+G+H)=HMAC7.
Since (A,…,H) are known values in (6), we can obtain (X,Y,Z,α,β,γ). With these values, we can compute (K0,K1,K2) by using the following equations:
(7)K0⊕0x5c=X-(H+Σ1(E)+Ch(E,F,G)+C0ddddddddddddddd+Σ0(A)+Maj(A,B,C)),K1⊕0x5c=Y-(G+Σ1(α)+Ch(α,E,F)+C1ddddddddddddddd+Σ0(X)+Maj(X,A,B)),K2⊕0x5c=Z-(F+Σ1(β)+Ch(β,α,E)+C2ddddddddddddddd+Σ0(Y)+Maj(Y,X,A)).Figure 2
An event(f0,3*,f1,1*).By repeating the previous procedure, we can recoverK by using [n/3] fault injections. Since this consists of only solving simple equations, the computational complexity is negligible.


## 3.3. Key Recovery Attack on HMAC-SHA-224/384

Recall that SHA-224/384 outputs the left most 224/384 bits of the resulting 256/512-bit hash value as the hash value, respectively. For example, HMAC-SHA-224 outputs onlyHMAC0∥⋯∥HMAC6 as the hash value. Thus, we can not compute (α,β) in (6) (see Figure 2). However, we can obtain (X,Y,Z) in (6) and compute K0 in (7). And then, we can obtain α by using K0. By repeating this procedure, we can recover (K1,K2) sequentially. Hence, we can recover K of HMAC-SHA-224/384 with [n/3] fault injections and the negligible computational complexity.


## 4. Key Recovery Attack on NMAC

A key recovery attack on NMAC is similar to that on HMAC. This is also applicable to NMAC based on the MD-family hash functions. As a concrete example, we present a key recovery attack on NMAC-SHA-2. In the case of other MD-family hash functions, we can attack in a similar fashion. Table1 gives the detailed results.


### 4.1. Fault Assumption

Differently from HMAC, NMAC uses twon-word secret keys (K1,K2) (see Figure 3). Thus, our attack on NMAC consists of the following two steps. Firstly, we recover K2 by using a key recovery attack on HMAC-SHA-2 (Fault1 in Figure 3). Secondly, to compute K1, we inject faults to (f2*,f3*,f1*) (Fault2 in Figure 3). Note that we assume that a message M is only a single block.Figure 3
Our fault model on NMAC.


### 4.2. Key Recovery Attack on NMAC-SHA-256/512

Since the structure of SHA-512 is similar to that of SHA-256, we only introduce a key recovery attack on NMAC-SHA-256 in this subsection. We assume that the length of(K1(=K1,0∥⋯∥K1,n-1),K2(=K2,0∥⋯∥K2,n-1)) is 32·n bits, respectively. By using a key recovery attack on HMAC-SHA-256, we firstly recover K2 with [n/3] fault injections and the negligible computational complexity. And then, we compute K1 from an event (f2,i*,f3,j*,f1,k*).Table3 shows the results of an event (f2,3*,f3,1*,f1,4*). From Table 3, we can compute (K1,0,K1,1,K1,2) as follows. Since we know HMAC and can compute IHV1(=A∥B∥⋯∥H) by using K2, we can compute (α1,α2,α3,α4,β1,β2,β3,β4) by using the following equations:(8)α1=HMAC3-D,β1=HMAC7-H,α2=HMAC2-C,β2=HMAC6-G,α3=HMAC1-B,β3=HMAC5-F,α4=HMAC0-A,β4=HMAC4-E.
By using (α1,α2,α3,α4,β1,β2,β3,β4), we can compute the messages of f1*(W+Z+a,Y+Z+a+b,X+Y+b+c,X+a+c+d) easily. Since we know IHV0(=a∥b∥⋯∥h), we can obtain (X,Y,Z). Thus, we can recover (K1,0,K1,1,K1,2) similarly to a key recovery attack on HMAC-SHA-256.Table 3
Recovery of(K1,0,K1,1,K1,2).
Chaining value
Message
f
2,3
*
(
a
,
b
,
c
,
d
,
e
,
f
,
g
,
h
)
K
1,0
(
X
,
a
,
b
,
c
,
?
,
e
,
f
,
g
)
K
1,1
(
Y
,
X
,
a
,
b
,
?
,
?
,
e
,
f
)
K
1,2
(
Z
,
Y
,
X
,
a
,
?
,
?
,
?
,
e
)
—
(
Z
+
a
,
Y
+
b
,
X
+
c
,
a
+
d
,
?
,
?
,
?
,
e
+
h
)
feed-forward
f
3,1
*
(
Z
+
a
,
Y
+
b
,
X
+
c
,
a
+
d
,
?
,
?
,
?
,
e
+
h
)
M
(
W
,
Z
+
a
,
Y
+
b
,
X
+
c
,
?
,
?
,
?
,
?
)
—
(
W
+
Z
+
a
,
Y
+
Z
+
a
+
b
,
X
+
Y
+
b
+
c
,
X
+
a
+
c
+
d
,
?
,
?
,
?
,
?
)
feed-forward
f
1,4
*
(
A
,
B
,
C
,
D
,
E
,
F
,
G
,
H
)
W
+
Z
+
a
(
α
1
,
A
,
B
,
C
,
β
1
,
E
,
F
,
G
)
Y
+
Z
+
a
+
b
(
α
2
,
α
1
,
A
,
B
,
β
2
,
β
1
,
E
,
F
)
X
+
Y
+
b
+
c
(
α
3
,
α
2
,
α
1
,
A
,
β
3
,
β
2
,
β
1
,
E
)
X
+
a
+
c
+
d
(
α
4
,
α
3
,
α
2
,
α
1
,
β
4
,
β
3
,
β
2
,
β
1
)
—
(
α
4
+
A
,
α
3
+
B
,
α
2
+
C
,
α
1
+
D
,
β
4
+
E
,
β
3
+
F
,
β
2
+
G
,
β
1
+
H
)
feed-forwardBy repeating the previous procedure, we can recover(K1,K2) by using 2·[n/3] fault injections. Its computational complexity is also negligible.


### 4.3. Key Recovery Attack on NMAC-SHA-224/384

Since SHA-224/384 outputs the left most 224/384 bits of the resulting 256/512-bit hash value as the hash value, respectively, we do not know(β1,β2) (see Table 3). In this case, we can not compute K1. Thus, we consider different events on these algorithms. To recover (K1,0,K1,1) of NMAC-SHA-224, we use an event (f2,2*,f3,1*,f1,3*). This attack needs [n/3]+[n/2] fault injections and the negligible computational complexity. In the case of NMAC-SHA-384, we consider an event (f2,1*,f3,1*,f1,2*) to recover K1,0. This attack requires [n/3]+n fault injections with a negligible computational complexity.


## 4.1. Fault Assumption

Differently from HMAC, NMAC uses twon-word secret keys (K1,K2) (see Figure 3). Thus, our attack on NMAC consists of the following two steps. Firstly, we recover K2 by using a key recovery attack on HMAC-SHA-2 (Fault1 in Figure 3). Secondly, to compute K1, we inject faults to (f2*,f3*,f1*) (Fault2 in Figure 3). Note that we assume that a message M is only a single block.Figure 3
Our fault model on NMAC.


## 4.2. Key Recovery Attack on NMAC-SHA-256/512

Since the structure of SHA-512 is similar to that of SHA-256, we only introduce a key recovery attack on NMAC-SHA-256 in this subsection. We assume that the length of(K1(=K1,0∥⋯∥K1,n-1),K2(=K2,0∥⋯∥K2,n-1)) is 32·n bits, respectively. By using a key recovery attack on HMAC-SHA-256, we firstly recover K2 with [n/3] fault injections and the negligible computational complexity. And then, we compute K1 from an event (f2,i*,f3,j*,f1,k*).Table3 shows the results of an event (f2,3*,f3,1*,f1,4*). From Table 3, we can compute (K1,0,K1,1,K1,2) as follows. Since we know HMAC and can compute IHV1(=A∥B∥⋯∥H) by using K2, we can compute (α1,α2,α3,α4,β1,β2,β3,β4) by using the following equations:(8)α1=HMAC3-D,β1=HMAC7-H,α2=HMAC2-C,β2=HMAC6-G,α3=HMAC1-B,β3=HMAC5-F,α4=HMAC0-A,β4=HMAC4-E.
By using (α1,α2,α3,α4,β1,β2,β3,β4), we can compute the messages of f1*(W+Z+a,Y+Z+a+b,X+Y+b+c,X+a+c+d) easily. Since we know IHV0(=a∥b∥⋯∥h), we can obtain (X,Y,Z). Thus, we can recover (K1,0,K1,1,K1,2) similarly to a key recovery attack on HMAC-SHA-256.Table 3
Recovery of(K1,0,K1,1,K1,2).
Chaining value
Message
f
2,3
*
(
a
,
b
,
c
,
d
,
e
,
f
,
g
,
h
)
K
1,0
(
X
,
a
,
b
,
c
,
?
,
e
,
f
,
g
)
K
1,1
(
Y
,
X
,
a
,
b
,
?
,
?
,
e
,
f
)
K
1,2
(
Z
,
Y
,
X
,
a
,
?
,
?
,
?
,
e
)
—
(
Z
+
a
,
Y
+
b
,
X
+
c
,
a
+
d
,
?
,
?
,
?
,
e
+
h
)
feed-forward
f
3,1
*
(
Z
+
a
,
Y
+
b
,
X
+
c
,
a
+
d
,
?
,
?
,
?
,
e
+
h
)
M
(
W
,
Z
+
a
,
Y
+
b
,
X
+
c
,
?
,
?
,
?
,
?
)
—
(
W
+
Z
+
a
,
Y
+
Z
+
a
+
b
,
X
+
Y
+
b
+
c
,
X
+
a
+
c
+
d
,
?
,
?
,
?
,
?
)
feed-forward
f
1,4
*
(
A
,
B
,
C
,
D
,
E
,
F
,
G
,
H
)
W
+
Z
+
a
(
α
1
,
A
,
B
,
C
,
β
1
,
E
,
F
,
G
)
Y
+
Z
+
a
+
b
(
α
2
,
α
1
,
A
,
B
,
β
2
,
β
1
,
E
,
F
)
X
+
Y
+
b
+
c
(
α
3
,
α
2
,
α
1
,
A
,
β
3
,
β
2
,
β
1
,
E
)
X
+
a
+
c
+
d
(
α
4
,
α
3
,
α
2
,
α
1
,
β
4
,
β
3
,
β
2
,
β
1
)
—
(
α
4
+
A
,
α
3
+
B
,
α
2
+
C
,
α
1
+
D
,
β
4
+
E
,
β
3
+
F
,
β
2
+
G
,
β
1
+
H
)
feed-forwardBy repeating the previous procedure, we can recover(K1,K2) by using 2·[n/3] fault injections. Its computational complexity is also negligible.


## 4.3. Key Recovery Attack on NMAC-SHA-224/384

Since SHA-224/384 outputs the left most 224/384 bits of the resulting 256/512-bit hash value as the hash value, respectively, we do not know(β1,β2) (see Table 3). In this case, we can not compute K1. Thus, we consider different events on these algorithms. To recover (K1,0,K1,1) of NMAC-SHA-224, we use an event (f2,2*,f3,1*,f1,3*). This attack needs [n/3]+[n/2] fault injections and the negligible computational complexity. In the case of NMAC-SHA-384, we consider an event (f2,1*,f3,1*,f1,2*) to recover K1,0. This attack requires [n/3]+n fault injections with a negligible computational complexity.


## 5. Conclusion

In this paper, we proposed key recovery attacks on HMAC/NAC by using a fault injection attack. Our attack can be applied to HMAC/NMAC based on the MD-family hash functions and requires a small number of fault injections with a negligible computational complexity. As concrete examples, we applied our attack to HMAC/NMAC based on MD4, MD5, and SHA-2. The results on HMAC/NMAC-SHA-2 are the first known key recovery attacks on them.



---

*Source: 101907-2013-09-25.xml*