| Keccak is the hash function selected by NIST as the SHA-3 (Secure Hash Algorithm) standard. Keccak is built on a new structure - sponge construction. The new algorithm and construction have raised questions regarding the side-channel security of SHA-3 and its MAC mode, MAC-Keccak.;Over the past decade, side-channel attack has shown to be a real and effective threat to many crypto systems, where inadvertent side-channel leakages can be exploited to retrieve secret information of the target system. Side-channel power (EM) analysis and fault injection attacks have been widely used to break various crypto algorithms, while the side-channel vulnerability and resilience of SHA-3 systems have not been addressed much. This dissertation investigates both side-channel security analysis and protection of SHA-3 systems. I propose novel power analysis and fault analysis methods, and also effective countermeasures against these attacks.;For side-channel power analysis, I examine hardware implementations and propose effective attack methods using power leakages from the first round output and the first round theta operation. To protect SHA-3 systems against side-channel power analysis, I adopt the operation shuffling method as the countermeasure. I propose algorithms to identify and explore the shuffling space automatically and then add shuffling into SHA-3 implementations. Recently Threshold Implementation (TI) has been a prevalent countermeasure against power analysis attacks with provable security. I adopt the method and implement it within the compilation process to automatically generate secure SHA-3 code.;For fault injection attacks on SHA-3, we implement differential fault analysis attacks targeting all four SHA-3 modes under much more relaxed fault models. I then introduce algebraic techniques into the attacks, to significantly improve the power of fault analysis attacks on SHA-3 systems. Finally, I make use of the clear algebraic properties of SHA-3 to protect it using error detection codes efficiently with minimal area and time overhead. |
