Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I googled it and give me no result. There is a binary executable of white-box implementation of DES (scroll down), but no source code provided.

The same page also links various papers about white-box cryptography, but these don't contain the implementation.

I want to study such an implementation to learn about the techniques used there.


locked by e-sushi Jul 19 at 20:26

This question exists because it has historical significance, but it is not considered a good, on-topic question for this site, so please do not use it as evidence that you can ask similar questions here. This question and its answers are frozen and cannot be changed. More info: help center.

put on hold as off-topic by e-sushi Jul 19 at 20:24

This question appears to be off-topic. The users who voted to close gave this specific reason:

If this question can be reworded to fit the rules in the help center, please edit the question.

As I understand, providing the source would make the whole game of If you like, try to extract the secret key trivial. I think an open-source implementation would have to include the compiler (or other tools) used to hide the key in the binary. – Paŭlo Ebermann Jul 30 '11 at 16:13
Thanks for your comment. Thing that is obvious, the binary executable file produced from a source code. My query is, how can i obtain that code or an example implementation of white-box AES or DES? – ir01 Jul 30 '11 at 19:04
I suppose that as soon as the source code is available (to the attacker), the white-box security breaks down. But this is only my intuitation, I might be wrong here. (I only looked at the slides of the presentation, not the whole dissertation). (And no, I don't know anything. You could try to write an e-mail to the guy which created this thing.) – Paŭlo Ebermann Jul 30 '11 at 19:14
I assume you already read the two papers linked on the page, from Chow et. al, White-Box Cryptography and an AES Implementation and A White-box DES Implementation for DRM Applications. These do not contain source code, but describe how to do this. (In effect, you are writing a program which generates the implementation, not the implementation itself.) The authors seem to create products from this. – Paŭlo Ebermann Jul 30 '11 at 20:18
Try – user632 Aug 26 '11 at 18:51
up vote 6 down vote accepted

I've seen two implementations in the wild:

I always wanted to learn Slovak, now I have an additional reason ... (I know the papers are in Czech, but the languages are quite similar.) At least the source code has some english comments there, compared to the only russian ones in the second one. – Paŭlo Ebermann Aug 19 '11 at 20:29

I add my whitebox AES implementation on GitHub in:

C++ version implements both Chow's (mixing bijections, input/output encodings, external encodings) and Karroumi's (dual AES in each column) whitebox AES scheme plus Billet's key recovery attack on both schemes.

Java implements Chow's scheme only.

PS: Due to low reputation I post links to schemes to the comment below.


Adding my 2 cents, I would like to point out that many published methods for white-box cryptography have been broken. This includes…

  • white-box AES
    “Cryptanalysis of White Box AES Implementation”
    by Olivier Billet, Henri Gilbert, and Charaf Ech-Chatbi

  • white-box DES
    “Cryptanalysis of White-Box DES Implementations with Arbitrary External Encodings“
    by Brecht Wyseur and Wil Michiels and Paul Gorissen and Bart Preneel

… which have been crypto-analyzed and are known to be insecure ever since.

On the other hand, as long as you just plan to study implementation to learn about the techniques and not plan to actually implement them in practice, you should be fine. So, let's mention one of the implementations that haven’t been mentioned here yet –


I have a x86 assembly version of the basic AES algorithm I wrote when we briefly tried to remediate some 20 year old POS registers for PCI compliance. Turned out we didn't need it, but it was a great experience to write some assembler again.

I would be happy to share it if you feel it would be valuable. Please keep in mind that it is just the encryption portion, i.e. you supply it the Key and Data block and it returns the encrypted block. So you aren't getting anything that initializes a key, performs any salting, or any sort of rolling block encryption. Give it a 256-bit key, 256-bit data and get out 256-bit encrypted data.

I also have a version of it in .net c# which I wrote to prove my ASM.

Thanks in advanced. Great implementation.but, i need a white-box implementation with embedded key, but your implementation get the key as an input parameter. – ir01 Aug 4 '11 at 22:12
@Bill, it sounds like you have an AES implementation, but I think ir01 wanted an implementation of "white-box AES". "White-box AES" is a somewhat obscure scheme derived from AES -- and in particular, it is not the same as AES. So an AES implementation probably won't help ir01. – D.W. Aug 5 '11 at 1:39

I'm not sure I get your Q? but do these links help

Take a look at the beginning of the paper to get an idea what "white box implementation" means in cryptology. – j.p. Aug 4 '11 at 13:42
See this post… – ir01 Aug 4 '11 at 14:31
ok, I get it, that is dumb version of me, as always. – jspeshu Aug 5 '11 at 5:56

Not the answer you're looking for? Browse other questions tagged or ask your own question.