Hot answers tagged

29

This article is a nice introduction to the concept of white-box cryptography. It can be viewed as the devious cousin of code obfuscation. In simpler words: usually, security of a cryptographic algorithm is studied in the "black-box" model: e.g., for symmetric encryption, the attacker is given access to a "device" which runs the encryption algorithm with a ...


17

As you suspected, there's a very close relationship between white-box cryptography and obfuscation. (Good instincts!) White-box cryptography is basically all about obfuscating an encryption implementation. White-box cryptography is obfuscation of crypto code. Imagine that you took an AES implementation, picked a random AES key, and then hardcoded that AES ...


10

In whitebox cryptography the attacker is supposed to have access to every detail of the computation and the goal of this implementation is to protect the key, to -usually- avoid it is used on a classical no-whitebox implementation on a different platform. The goal is that an attacker having access to the whole computation and intermediate values cannot ...


9

This requirement is a killer: The paper (or any medium other than the brain) must not at any time contain data that leaks information about the plaintext. Almost any security proof for a hash assumes an adversary only gets to see digests, not any mid-state. Mid-state has not had enough confusion and diffusion, so it leaks information. This means that ...


7

I add my whitebox AES implementation on GitHub in: C++ Java C++ version implements both Chow's (mixing bijections, input/output encodings, external encodings) and Karroumi's (dual AES in each column) whitebox AES scheme plus Billet's key recovery attack on both schemes. Java implements Chow's scheme only. PS: Due to low reputation I post links to ...


7

This is an excellent question. Unfortunately, I'm afraid I don't know of any really convincing answer. In principle, one possible application of white-box cryptography would be to build a public-key cipher out of a symmetric-key cipher. If you could build a white-box cryptographic implementation of AES encryption (say) where no one can recover the key nor ...


7

If your software needs to decrypt the data and you want to prevent even those with physical access from decrypting without your software, you are basically out of luck. It is impossible to achieve purely in software, since even if a good white-box algorithm existed, an attacker could copy it into their software and be able to decrypt (without directly ...


6

What you are looking for is called white-box cryptography. In short white-box crypto aims to make an implementation of a cypher (for example AES) in such a way that it is impossible for an attacker to extract the key, even if the attacker (the user of the computer) has access to the source code and a debugger. Up till now all academic white-box ...


6

I still don't understand your desire for a hash, especially considering (as already stated at other places in this forum) that you don't gain any entropy by subjecting a PW to a deterministic function like a hash. So, when decrypting your ciphertext, you will be as secure with a H(key) as with (key), thus you might as well just memorize a good long ...


6

The initial motivation was as follows. If you do not know the key, you are bind to a particular implementation even if you can invert the encryption. The implementation might have some sort of backdoor, which might reveal the attacker's identity. I do not know how relevant this thinking was, but it has been pursued in mid-00s.


6

I've seen two implementations in the wild: WBACR AES – SecureFW: Protection Framework A dubious Russian implementation – White-box AES Implementation Generator


5

This question comes up often enough in the context of cryptography that it probably is relevant in a practical sense. I suspect we'll hear even more about it if homomorphic encryption raises interest in "computation in an adversarial setting". It's not just theoretically unsolvable. A great many software development organizations have tried to keep data ...


4

Check out Manuel Blum's human computable hash function. He calls it HCMU for Human Computable Machine Unbreakable. He claims you have to spend an hour memorizing the technique and then you can apply the has function in about 20 seconds without even using pencil and paper. The memorization required is to remember a random mapping of each letter of the ...


4

No, there aren't any cryptographic hash functions like this. I'm pretty confident you're not going to find one. I have yet to see a white-box secure hash function that remains secure against dedicated attack, let alone one that you can implement securely on pencil and paper. Since this is a practical problem, I suggest finding another solution -- like ...


3

"Invertibility of the cryptographic primitive" is just a fancy way of saying "you can decrypt things encrypted with that key." All the first sentence means is "if you can recover the key, you can decrypt anything encrypted with that key." As the second sentence points out, there are conceivably attacks where you can decrypt things encrypted with a key but ...


3

I'm pretty sure it's impossible for software alone to do everything you suggested. Asymmetric encryption can solve part of the problem. I suspect that, even though asymmetric encryption can't do everything you suggested, it can get close enough to solve your real problem. Perhaps you can give a high-level explanation of what you're really trying to do, and ...


3

White-box cryptography is aimed at protecting secret keys from being disclosed in a software implementation. A cryptography algorithm gets the key and plaintext(encryption mode)/ciphertext(decryption mode) as input and outputs the ciphertext/plaintext. A white box implementation of the cryptography algorithm gets just plaintext/ciphertext as input and ...


2

A good white-box implementation does not just implement AES. Rather, it implements $G(AES(F^-1(x)))$ for a plaintext $x$. These functions $F$ and $G$ are called external encodings and are baked in the white-box. Now, to use this cryptographic part, you need to undo / apply the encodings elsewhere in your code (usually that code is terribly obfuscated). ...


2

You need your official builds to create a signature with some kind of key, without anyone being able to extract this key from the program, and without anyone being able to use that part of the program to sign anything else than what you intended it to sign. (Actually, private builds should be able to do the same thing, just with another key provided to ...


2

Adding my 2 cents, I would like to point out that many published methods for white-box cryptography have been broken. This includes… white-box AES “Cryptanalysis of White Box AES Implementation” by Olivier Billet, Henri Gilbert, and Charaf Ech-Chatbi white-box DES “Cryptanalysis of White-Box DES Implementations with Arbitrary External Encodings“ by Brecht ...


2

For a fixed key, a (block) cipher is a reversible transformation of a plaintext set to ciphertext set. Usually (and in the slide) these sets are identical, and consist of all the exactly $n$-bit strings. This set has $2^n$ elements, and is often noted $\{0,1\}^n$. Note: in this notation $\{0,1\}$ designates the set with the two elements $0$ and $1$, and as ...


1

The current way of implementing a (symmetric) cryptographic algorithm as a white-box is to implement it as a network of encoded lookup tables (a good white-box will also have so called 'external encodings' applied, but I'll skip these for now). In this case however, a network of tables is not required (one table will do) and as a result encoding the tables ...


1

I hope you already found it, but a good starting point for research on this subject would be whiteboxcrypto.com It took me a while to understand exactly how white-box is used some sort of securely - not so much because the key can be recovered from the white box - but because one can isolate the white-box and use it's encrypt or decrypt functionality to do ...



Only top voted, non community-wiki answers of a minimum length are eligible