Wikipedia

White-box cryptography

In cryptography, the white-box model refers to an extreme attack scenario, in which an adversary has full unrestricted access to a cryptographic implementation, most commonly of a block cipher such as the Advanced Encryption Standard (AES). A variety of security goals may be posed (see the section below), the most fundamental being "unbreakability", requiring that any (bounded) attacker should not be able to extract the secret key hardcoded in the implementation, while at the same time the implementation must be fully functional. In contrast, the black-box model only provides an oracle access to the analyzed cryptographic primitive (in the form of encryption and/or decryption queries). There is also a model in-between, the so-called gray-box model, which corresponds to additional information leakage from the implementation, more commonly referred to as side-channel leakage.

White-box cryptography is a practice and study of techniques for designing and attacking white-box implementations. It has many applications, including digital rights management (DRM), pay television, protection of cryptographic keys in the presence of malware,[1] mobile payments and cryptocurrency wallets. Examples of DRM systems employing white-box implementations include CSS, Widevine.

White-box cryptography is closely related to the more general notions of obfuscation, in particular, to Black-box obfuscation, proven to be impossible, and to Indistinguishability obfuscation, constructed recently under well-founded assumptions but so far being infeasible to implement in practice.[2]

As of January 2023, there are no publicly known unbroken white-box designs of standard symmetric encryption schemes. On the other hand, there exist many unbroken white-box implementations of dedicated block ciphers designed specifically to achieve incompressibility (see § Security goals).

Security goals

edit

Depending on the application, different security goals may be required from a white-box implementation. Specifically, for symmetric-key algorithms the following are distinguished:[3]

  • Unbreakability is the most fundamental goal requiring that a bounded attacker should not be able to recover the secret key embedded in the white-box implementation. Without this requirement, all other security goals are unreachable since a successful attacker can simply use a reference implementation of the encryption scheme together with the extracted key.
  • One-wayness requires that a white-box implementation of an encryption scheme can not be used by a bounded attacker to decrypt ciphertexts. This requirement essentially turns a symmetric encryption scheme into a public-key encryption scheme, where the white-box implementation plays the role of the public key associated to the embedded secret key. This idea was proposed already in the famous work of Diffie and Hellman in 1976[4] as a potential public-key encryption candidate.
  • Code lifting security is an informal requirement on the context, in which the white-box program is being executed. It demands that an attacker can not extract a functional copy of the program. This goal is particularly relevant in the DRM setting. Code obfuscation techniques are often used to achieve this goal.
A commonly used technique is to compose the white-box implementation with so-called external encodings.[1] These are lightweight secret encodings that modify the function computed by the white-box part of an application. It is required that their effect is canceled in other parts of the application in an obscure way, using code obfuscation techniques. Alternatively, the canceling counterparts can be applied on a remote server.
  • Incompressibility requires that an attacker can not significantly compress a given white-box implementation. This can be seen as a way to achieve code lifting security (see above), since exfiltrating a large program from a constrained device (for example, an embedded or a mobile device) can be time-consuming and may be easy to detect by a firewall.[5]
Examples of incompressible designs include SPACE cipher,[5] SPNbox,[6] WhiteKey and WhiteBlock.[7] These ciphers use large lookup tables that can be pseudorandomly generated from a secret master key. Although this makes the recovery of the master key hard, the lookup tables themselves play the role of an equivalent secret key. Thus, unbreakability is achieved only partially.
  • Traceability (Traitor tracing) requires that each distributed white-box implementation contains a digital watermark allowing identification of the guilty user in case the white-box program is being leaked and distributed publicly.

History

edit

The white-box model with initial attempts of white-box DES and AES implementations were first proposed by Chow, Eisen, Johnson and van Oorshot in 2003.[1][8] The designs were based on representing the cipher as a network of lookup tables and obfuscating the tables by composing them with small (4- or 8-bit) random encodings. Such protection satisfied a property that each single obfuscated table individually does not contain any information about the secret key. Therefore, a potential attacker has to combine several tables in their analysis.

The first two schemes were broken in 2004 by Billet, Gilbert, and Ech-Chatbi using structural cryptanalysis.[9] The attack was subsequently called "the BGE attack".

The numerous consequent design attempts (2005-2022)[10] were quickly broken by practical dedicated attacks.[11]

In 2016, Bos, Hubain, Michiels and Teuwen showed that an adaptation of standard side-channel power analysis attacks can be used to efficiently and fully automatically break most existing white-box designs.[12] This result created a new research direction about generic attacks (correlation-based, algebraic, fault injection) and protections against them.[13]

Competitions

edit

Four editions of the WhibOx contest were held in 2017, 2019, 2021 and 2024 respectively. These competitions invited white-box designers both from academia and industry to submit their implementation in the form of (possibly obfuscated) C code. At the same time, everyone could attempt to attack these programs and recover the embedded secret key. Each of these competitions lasted for about 4-5 months.

  • WhibOx 2017 / CHES 2017 Capture the Flag Challenge targeted the standard AES block cipher. Among 94 submitted implementations, all were broken during the competition, with the strongest one staying unbroken for 28 days.
  • WhibOx 2019 / CHES 2019 Capture the Flag Challenge again targeted the AES block cipher. Among 27 submitted implementations, 3 programs stayed unbroken throughout the competition, but were broken after 51 days since the publication.[14][15]
  • WhibOx 2021 / CHES 2021 Capture the Flag Challenge changed the target to ECDSA, a digital signature scheme based on elliptic curves. Among 97 submitted implementations, all were broken within at most 2 days.[16][17]
  • WhibOx 2024 / CHES 2024 Capture the Flag Challenge again targeted ECDSA. Among 47 submitted implementations, all were broken during the competition, with the strongest one staying unbroken for almost 5 days.

See also

edit
edit

References

edit
  1. ^ a b c Chow, Stanley; Eisen, Phil; Johnson, Harold; van Oorschot, Paul C. (2003). A White-Box DES Implementation for DRM Applications. Digital Rights Management. Lecture Notes in Computer Science. Vol. 2696. pp. 1–15. doi:10.1007/978-3-540-44993-5_1. ISBN 978-3-540-40410-1.
  2. ^ Jain, Aayush; Lin, Huijia; Sahai, Amit (15 June 2021). "Indistinguishability obfuscation from well-founded assumptions". Proceedings of the 53rd Annual ACM SIGACT Symposium on Theory of Computing. pp. 60–73. arXiv:2008.09317. doi:10.1145/3406325.3451093. ISBN 978-1-4503-8053-9.
  3. ^ Delerablée, Cécile; Lepoint, Tancrède; Paillier, Pascal; Rivain, Matthieu (2014). White-Box Security Notions for Symmetric Encryption Schemes. SAC 2013: Selected Areas in Cryptography. Lecture Notes in Computer Science. Vol. 8282. pp. 247–264. doi:10.1007/978-3-662-43414-7_13. ISBN 978-3-662-43413-0.
  4. ^ Diffie, Whitfield; Hellman, Martin (November 1976). "New directions in cryptography". IEEE Transactions on Information Theory. 22 (6): 644–654. doi:10.1109/TIT.1976.1055638.
  5. ^ a b Bogdanov, Andrey; Isobe, Takanori (12 October 2015). "White-Box Cryptography Revisited: Space-Hard Ciphers". Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security. pp. 1058–1069. doi:10.1145/2810103.2813699. ISBN 978-1-4503-3832-5.
  6. ^ Bogdanov, Andrey; Isobe, Takanori; Tischhauser, Elmar (2016). "Towards Practical Whitebox Cryptography: Optimizing Efficiency and Space Hardness". Advances in Cryptology – ASIACRYPT 2016. Lecture Notes in Computer Science. Vol. 10031. pp. 126–158. doi:10.1007/978-3-662-53887-6_5. ISBN 978-3-662-53886-9.
  7. ^ Fouque, Pierre-Alain; Karpman, Pierre; Kirchner, Paul; Minaud, Brice (2016). "Efficient and Provable White-Box Primitives" (PDF). Advances in Cryptology – ASIACRYPT 2016. Lecture Notes in Computer Science. Vol. 10031. pp. 159–188. doi:10.1007/978-3-662-53887-6_6. ISBN 978-3-662-53886-9.
  8. ^ Chow, Stanley; Eisen, Philip; Johnson, Harold; Van Oorschot, Paul C. (2003). "White-Box Cryptography and an AES Implementation". SAC 2002: Selected Areas in Cryptography. Lecture Notes in Computer Science. Vol. 2595. pp. 250–270. doi:10.1007/3-540-36492-7_17. ISBN 978-3-540-00622-0.
  9. ^ Billet, Olivier; Gilbert, Henri; Ech-Chatbi, Charaf (2004). "Cryptanalysis of a White Box AES Implementation". Selected Areas in Cryptography. Lecture Notes in Computer Science. Vol. 3357. pp. 227–240. doi:10.1007/978-3-540-30564-4_16. ISBN 978-3-540-24327-4.
  10. ^
  11. ^
  12. ^ Bos, Joppe W.; Hubain, Charles; Michiels, Wil; Teuwen, Philippe (2016). "Differential Computation Analysis: Hiding Your White-Box Designs is Not Enough". Cryptographic Hardware and Embedded Systems – CHES 2016. Lecture Notes in Computer Science. Vol. 9813. pp. 215–236. doi:10.1007/978-3-662-53140-2_11. ISBN 978-3-662-53139-6.
  13. ^
  14. ^ "CryptoLUX Research Group. Whitebox cryptography. WhibOx 2019 Competition". www.cryptolux.org. Retrieved 28 February 2024.
  15. ^ Goubin, Louis; Rivain, Matthieu; Wang, Junwei (19 June 2020). "Defeating State-of-the-Art White-Box Countermeasures with Advanced Gray-Box Attacks". IACR Transactions on Cryptographic Hardware and Embedded Systems: 454–482. doi:10.13154/tches.v2020.i3.454-482.
  16. ^ Barbu, Guillaume; Beullens, Ward; Dottax, Emmanuelle; Giraud, Christophe; Houzelot, Agathe; Li, Chaoyun; Mahzoun, Mohammad; Ranea, Adrián; Xie, Jianrui (31 August 2022). "ECDSA White-Box Implementations: Attacks and Designs from CHES 2021 Challenge". IACR Transactions on Cryptographic Hardware and Embedded Systems: 527–552. doi:10.46586/tches.v2022.i4.527-552.
  17. ^ Bauer, Sven; Drexler, Hermann; Gebhardt, Max; Klein, Dominik; Laus, Friederike; Mittmann, Johannes (31 August 2022). "Attacks Against White-Box ECDSA and Discussion of Countermeasures: A Report on the WhibOx Contest 2021". IACR Transactions on Cryptographic Hardware and Embedded Systems: 25–55. doi:10.46586/tches.v2022.i4.25-55.
Retrieved from "https://en.wiki.x.io/w/index.php?title=White-box_cryptography&oldid=1252456153"