Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I googled it and give me no result. There is a binary executable of white-box implementation of DES (scroll down), but no source code provided.

The same page also links various papers about white-box cryptography, but these don't contain the implementation.

I want to study such an implementation to learn about the techniques used there.

share|improve this question
As I understand, providing the source would make the whole game of If you like, try to extract the secret key trivial. I think an open-source implementation would have to include the compiler (or other tools) used to hide the key in the binary. – Paŭlo Ebermann Jul 30 '11 at 16:13
Thanks for your comment. Thing that is obvious, the binary executable file produced from a source code. My query is, how can i obtain that code or an example implementation of white-box AES or DES? – ir01 Jul 30 '11 at 19:04
I suppose that as soon as the source code is available (to the attacker), the white-box security breaks down. But this is only my intuitation, I might be wrong here. (I only looked at the slides of the presentation, not the whole dissertation). (And no, I don't know anything. You could try to write an e-mail to the guy which created this thing.) – Paŭlo Ebermann Jul 30 '11 at 19:14
I assume you already read the two papers linked on the page, from Chow et. al, White-Box Cryptography and an AES Implementation and A White-box DES Implementation for DRM Applications. These do not contain source code, but describe how to do this. (In effect, you are writing a program which generates the implementation, not the implementation itself.) The authors seem to create products from this. – Paŭlo Ebermann Jul 30 '11 at 20:18
Try – user632 Aug 26 '11 at 18:51
up vote 6 down vote accepted

I've seen two implementations in the wild:

share|improve this answer
I always wanted to learn Slovak, now I have an additional reason ... (I know the papers are in Czech, but the languages are quite similar.) At least the source code has some english comments there, compared to the only russian ones in the second one. – Paŭlo Ebermann Aug 19 '11 at 20:29

I add my whitebox AES implementation on GitHub in:

C++ version implements both Chow's (mixing bijections, input/output encodings, external encodings) and Karroumi's (dual AES in each column) whitebox AES scheme plus Billet's key recovery attack on both schemes.

Java implements Chow's scheme only.

PS: Due to low reputation I post links to schemes to the comment below.

share|improve this answer

Adding my 2 cents, I would like to point out that many published methods for white-box cryptography have been broken. This includes…

  • white-box AES
    “Cryptanalysis of White Box AES Implementation”
    by Olivier Billet, Henri Gilbert, and Charaf Ech-Chatbi

  • white-box DES
    “Cryptanalysis of White-Box DES Implementations with Arbitrary External Encodings“
    by Brecht Wyseur and Wil Michiels and Paul Gorissen and Bart Preneel

… which have been crypto-analyzed and are known to be insecure ever since.

On the other hand, as long as you just plan to study implementation to learn about the techniques and not plan to actually implement them in practice, you should be fine. So, let's mention one of the implementations that haven’t been mentioned here yet –

share|improve this answer

I have a x86 assembly version of the basic AES algorithm I wrote when we briefly tried to remediate some 20 year old POS registers for PCI compliance. Turned out we didn't need it, but it was a great experience to write some assembler again.

I would be happy to share it if you feel it would be valuable. Please keep in mind that it is just the encryption portion, i.e. you supply it the Key and Data block and it returns the encrypted block. So you aren't getting anything that initializes a key, performs any salting, or any sort of rolling block encryption. Give it a 256-bit key, 256-bit data and get out 256-bit encrypted data.

I also have a version of it in .net c# which I wrote to prove my ASM.

share|improve this answer
Thanks in advanced. Great implementation.but, i need a white-box implementation with embedded key, but your implementation get the key as an input parameter. – ir01 Aug 4 '11 at 22:12
@Bill, it sounds like you have an AES implementation, but I think ir01 wanted an implementation of "white-box AES". "White-box AES" is a somewhat obscure scheme derived from AES -- and in particular, it is not the same as AES. So an AES implementation probably won't help ir01. – D.W. Aug 5 '11 at 1:39

I'm not sure I get your Q? but do these links help

share|improve this answer
Take a look at the beginning of the paper to get an idea what "white box implementation" means in cryptology. – j.p. Aug 4 '11 at 13:42
See this post… – ir01 Aug 4 '11 at 14:31
ok, I get it, that is dumb version of me, as always. – jspeshu Aug 5 '11 at 5:56

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.