Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I googled it and give me no result. There is a binary executable of white-box implementation of DES (scroll down), but no source code provided.

The same page also links various papers about white-box cryptography, but these don't contain the implementation.

I want to study such an implementation to learn about the techniques used there.

share|improve this question
1  
As I understand, providing the source would make the whole game of If you like, try to extract the secret key trivial. I think an open-source implementation would have to include the compiler (or other tools) used to hide the key in the binary. –  Paŭlo Ebermann Jul 30 '11 at 16:13
    
Thanks for your comment. Thing that is obvious, the binary executable file produced from a source code. My query is, how can i obtain that code or an example implementation of white-box AES or DES? –  ir01 Jul 30 '11 at 19:04
    
I suppose that as soon as the source code is available (to the attacker), the white-box security breaks down. But this is only my intuitation, I might be wrong here. (I only looked at the slides of the presentation, not the whole dissertation). (And no, I don't know anything. You could try to write an e-mail to the guy which created this thing.) –  Paŭlo Ebermann Jul 30 '11 at 19:14
4  
I assume you already read the two papers linked on the page, from Chow et. al, White-Box Cryptography and an AES Implementation and A White-box DES Implementation for DRM Applications. These do not contain source code, but describe how to do this. (In effect, you are writing a program which generates the implementation, not the implementation itself.) The authors seem to create products from this. –  Paŭlo Ebermann Jul 30 '11 at 20:18
    
Try github.com/wbaes/wbaes –  user632 Aug 26 '11 at 18:51
show 1 more comment

4 Answers

up vote 4 down vote accepted

I've seen two implementations in the wild:

share|improve this answer
    
I always wanted to learn Slovak, now I have an additional reason ... (I know the papers are in Czech, but the languages are quite similar.) At least the source code has some english comments there, compared to the only russian ones in the second one. –  Paŭlo Ebermann Aug 19 '11 at 20:29
add comment

I'm not sure I get your Q? but do these links help

share|improve this answer
4  
Take a look at the beginning of the paper joye.site88.net/papers/Joy08whitebox.pdf to get an idea what "white box implementation" means in cryptology. –  j.p. Aug 4 '11 at 13:42
    
See this post crypto.stackexchange.com/questions/241/… –  ir01 Aug 4 '11 at 14:31
    
ok, I get it, that is dumb version of me, as always. –  jspeshu Aug 5 '11 at 5:56
add comment

I have a x86 assembly version of the basic AES algorithm I wrote when we briefly tried to remediate some 20 year old POS registers for PCI compliance. Turned out we didn't need it, but it was a great experience to write some assembler again.

I would be happy to share it if you feel it would be valuable. Please keep in mind that it is just the encryption portion, i.e. you supply it the Key and Data block and it returns the encrypted block. So you aren't getting anything that initializes a key, performs any salting, or any sort of rolling block encryption. Give it a 256-bit key, 256-bit data and get out 256-bit encrypted data.

I also have a version of it in .net c# which I wrote to prove my ASM.

share|improve this answer
    
Thanks in advanced. Great implementation.but, i need a white-box implementation with embedded key, but your implementation get the key as an input parameter. –  ir01 Aug 4 '11 at 22:12
3  
@Bill, it sounds like you have an AES implementation, but I think ir01 wanted an implementation of "white-box AES". "White-box AES" is a somewhat obscure scheme derived from AES -- and in particular, it is not the same as AES. So an AES implementation probably won't help ir01. –  D.W. Aug 5 '11 at 1:39
add comment

Adding my 2 cents, I would like to point out that many published methods for white-box cryptography have been broken. This includes…

… which have been crypto-analyzed and are known to be insecure ever since.

On the other hand, as long as you just plan to study implementation to learn about the techniques and not plan to actually implement them in practice, you should be fine. ;)

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.