A fault attack on a hardware-based implementation of the secure hash algorithm SHA-512

Cryptographic hash functions are frequently used as basic components in cryptographic schemes such as message authentication codes, one-time signature schemes, and random number generators. In such applications the input to the hash function is a secret key or secret data. An investigation of the hash function against implementation attacks in such cases is indispensable. This paper presents a fault attack on the secure hash algorithm using the example of SHA-512. A fault model is proposed that relies on flipping two control bits to reduce the round number of the SHA-512 algorithm. By means of this attack the first data block can be extracted completely. The attack was applied to a keyed-hash message authentication code to reveal its secret key. A countermeasure is proposed to detect and prevent the attack. The attack and the countermeasure were evaluated for an FPGA implementation.