Collision-correlation attack against a first-order masking scheme for MAC based on SHA-3

Abstract

In 2012, Keccak has been selected as the SHA-3 competition winner, and NIST recently announced the standardization of a keyed version for message authentication codes. In this paper, we consider an implementation of this keyed function, protected against first-order side-channel analysis with an efficient masking scheme proposed by the designers. We show that this masking scheme is vulnerable to a non-linear collision-correlation attack. Our attack advantageously needs no assumption on device-depending parameters, and hence constitutes an interesting alternative to second-order differential analysis. © 2014 Springer International Publishing Switzerland.