# Tag Info

18

This article is a nice introduction to the concept of white-box cryptography. It can be viewed as the devious cousin of code obfuscation. In simpler words: usually, security of a cryptographic algorithm is studied in the "black-box" model: e.g., for symmetric encryption, the attacker is given access to a "device" which runs the encryption algorithm with a ...

12

As you suspected, there's a very close relationship between white-box cryptography and obfuscation. (Good instincts!) White-box cryptography is basically all about obfuscating an encryption implementation. White-box cryptography is obfuscation of crypto code. Imagine that you took an AES implementation, picked a random AES key, and then hardcoded that AES ...

9

This requirement is a killer: The paper (or any medium other than the brain) must not at any time contain data that leaks information about the plaintext. Almost any security proof for a hash assumes an adversary only gets to see digests, not any mid-state. Mid-state has not had enough confusion and diffusion, so it leaks information. This means that ...

6

I still don't understand your desire for a hash, especially considering (as already stated at other places in this forum) that you don't gain any entropy by subjecting a PW to a deterministic function like a hash. So, when decrypting your ciphertext, you will be as secure with a H(key) as with (key), thus you might as well just memorize a good long ...

6

I've seen two implementations in the wild: WBACR AES A dubious Russian implementation

5

This question comes up often enough in the context of cryptography that it probably is relevant in a practical sense. I suspect we'll hear even more about it if homomorphic encryption raises interest in "computation in an adversarial setting". It's not just theoretically unsolvable. A great many software development organizations have tried to keep data ...

5

This is an excellent question. Unfortunately, I'm afraid I don't know of any really convincing answer. In principle, one possible application of white-box cryptography would be to build a public-key cipher out of a symmetric-key cipher. If you could build a white-box cryptographic implementation of AES encryption (say) where no one can recover the key nor ...

4

I add my whitebox AES implementation on GitHub in: C++ Java C++ version implements both Chow's (mixing bijections, input/output encodings, external encodings) and Karroumi's (dual AES in each column) whitebox AES scheme plus Billet's key recovery attack on both schemes. Java implements Chow's scheme only. PS: Due to low reputation I post links to ...

4

No, there aren't any cryptographic hash functions like this. I'm pretty confident you're not going to find one. I have yet to see a white-box secure hash function that remains secure against dedicated attack, let alone one that you can implement securely on pencil and paper. Since this is a practical problem, I suggest finding another solution -- like ...

4

The initial motivation was as follows. If you do not know the key, you are bind to a particular implementation even if you can invert the encryption. The implementation might have some sort of backdoor, which might reveal the attacker's identity. I do not know how relevant this thinking was, but it has been pursued in mid-00s.

3

"Invertibility of the cryptographic primitive" is just a fancy way of saying "you can decrypt things encrypted with that key." All the first sentence means is "if you can recover the key, you can decrypt anything encrypted with that key." As the second sentence points out, there are conceivably attacks where you can decrypt things encrypted with a key but ...

3

White-box cryptography is aimed at protecting secret keys from being disclosed in a software implementation. A cryptography algorithm gets the key and plaintext(encryption mode)/ciphertext(decryption mode) as input and outputs the ciphertext/plaintext. A white box implementation of the cryptography algorithm gets just plaintext/ciphertext as input and ...

3

I'm pretty sure it's impossible for software alone to do everything you suggested. Asymmetric encryption can solve part of the problem. I suspect that, even though asymmetric encryption can't do everything you suggested, it can get close enough to solve your real problem. Perhaps you can give a high-level explanation of what you're really trying to do, and ...

2

For a fixed key, a (block) cipher is a reversible transformation of a plaintext set to ciphertext set. Usually (and in the slide) these sets are identical, and consist of all the exactly $n$-bit strings. This set has $2^n$ elements, and is often noted $\{0,1\}^n$. Note: in this notation $\{0,1\}$ designates the set with the two elements $0$ and $1$, and as ...

2

You need your official builds to create a signature with some kind of key, without anyone being able to extract this key from the program, and without anyone being able to use that part of the program to sign anything else than what you intended it to sign. (Actually, private builds should be able to do the same thing, just with another key provided to ...

2

Adding my 2 cents, I would like to point out that many published methods for white-box cryptography have been broken. This includes… white-box AES white-box DES … which have been crypto-analyzed and are known to be insecure ever since. On the other hand, as long as you just plan to study implementation to learn about the techniques and not plan to ...

2

Check out Manuel Blum's human computable hash function. He calls it HCMU for Human Computable Machine Unbreakable. He claims you have to spend an hour memorizing the technique and then you can apply the has function in about 20 seconds without even using pencil and paper. The memorization required is to remember a random mapping of each letter of the ...

1

The current way of implementing a (symmetric) cryptographic algorithm as a white-box is to implement it as a network of encoded lookup tables (a good white-box will also have so called 'external encodings' applied, but I'll skip these for now). In this case however, a network of tables is not required (one table will do) and as a result encoding the tables ...

1

I hope you already found it, but a good starting point for research on this subject would be whiteboxcrypto.com It took me a while to understand exactly how white-box is used some sort of securely - not so much because the key can be recovered from the white box - but because one can isolate the white-box and use it's encrypt or decrypt functionality to do ...

1

I have a x86 assembly version of the basic AES algorithm I wrote when we briefly tried to remediate some 20 year old POS registers for PCI compliance. Turned out we didn't need it, but it was a great experience to write some assembler again. I would be happy to share it if you feel it would be valuable. Please keep in mind that it is just the encryption ...

Only top voted, non community-wiki answers of a minimum length are eligible