Timeline for What's the point of hiding the key in white box cryptography if the attacker already has full access to the encryption (or decryption) implementation?
Current License: CC BY-SA 4.0
14 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Oct 14, 2019 at 20:17 | comment | added | Giuliano Sider | @Conrado, why can't the attacker simply create and sell counterfeit devices by copying the code (a.k.a "code-lifting"), since they have full access to the implementation of the cipher? Copying software (as opposed to copying hardware) is very cheap. | |
| Oct 14, 2019 at 12:38 | history | edited | ddddavidee | CC BY-SA 4.0 |
added 172 characters in body
|
| Oct 14, 2019 at 12:30 | history | edited | ddddavidee | CC BY-SA 4.0 |
added 172 characters in body
|
| Oct 14, 2019 at 11:30 | comment | added | Conrado | One example is cable TV - it doesn't matter that the attacker can use the device to decrypt content, what matters is that they can't extract the key to in order to create and sell counterfeit devices that can decrypt TV content. | |
| Oct 13, 2019 at 20:37 | comment | added | Giuliano Sider | @EllaRose, In summary, you seem to be saying that the only goal of white-box schemes is one-wayness, i.e. building assymetric crypto from a symmetric cipher. | |
| Oct 12, 2019 at 10:56 | comment | added | ddddavidee | I put the sentence in a hypothetical way, with an "if" because even if as today we do not have any provably secure white-box construction for the AES algorithm there is no proof of its impossibility. And the discussion was about a "secure white-box implementation". Code lifting attack is a real threat in the real use case of white-box encryption, but WBC has, IMHO, to be considered only as a brick to build a security solution and that can be paired with other software security soliution (anti-tampering, anti-debug, binding, ...) | |
| Oct 11, 2019 at 17:16 | comment | added | Giuliano Sider | @Ella Rose, the white-box implementations I have seen proposed in the literature do not ensure one-wayness (i.e. they allow the attacker to obtain the decryption function from the encryption implementation, or vice versa). Are you saying that white-box implementations without this one-wayness are inherently broken or useless? The authors of those papers (Chow AES, SPACE, SPN-Box, etc) were not aiming for one-wayness; I believe the main goal was key-extraction security, whose usefulness I am calling into question here. | |
| Oct 11, 2019 at 17:00 | comment | added | Ella Rose | @GiulianoSider Care to ensure one-wayness and prevent reverse engineering is exactly the definition and goal of a white-box implementation. A broken white-box scheme is arguably not a white-box scheme in that it doesn't actually fulfill the goal of a white-box scheme. | |
| Oct 11, 2019 at 16:48 | comment | added | Giuliano Sider | @Ella Rose, to prevent attackers from deriving the "encrypt" function based on the "decrypt" implementation, you would have to engineer your implementation very carefully to exhibit this "one-wayness." It is by no means automatic. The attacker may be able to reverse the algorithm by reversing each round of the algorithm, for example. This can be done in published algorithms like Chow's white-box AES, SPACE, SPN-Box, etc. | |
| Oct 11, 2019 at 16:33 | comment | added | Ella Rose | @GiulianoSider Generally the whitebox implementation of an "encrypt" function would not be distributed with an implementation of a "decrypt" function - the key holder would generate both circuits and distribute the "encrypt" circuit publicly but keep the "decrypt" circuit secret. The decrypt circuit exists, but is not made public. There are plenty of things that can be achieved by doing so. | |
| Oct 11, 2019 at 16:08 | comment | added | Giuliano Sider | What I don't understand is the part where you said "If an attacker can decrypt and use the content on her PC." That "if" is not hypothetical. It is a consequence of the white-box attacker having full access to the implementation. With this access, the attacker can copy the implementation as he/she sees fit, and use it anytime, anywhere. What's the point of hiding the key then? I believe the literature calls this a "code-lifting" attack. I guess my point is that I don't see how white-box cryptography can be useful in this context (DRM, etc), in light of code-lifting attacks. | |
| Oct 11, 2019 at 16:04 | comment | added | Giuliano Sider | I see your point about the use of white-box {en,de}cryption to obtain an assymetric cipher from a symmetric one. I believe some papers called this a "one-wayness" property of the white-box symmetric cipher implementation, although I haven't actually seen any implementations that exhibit this property. | |
| Oct 11, 2019 at 15:59 | history | edited | ddddavidee | CC BY-SA 4.0 |
added 234 characters in body
|
| Oct 11, 2019 at 15:51 | history | answered | ddddavidee | CC BY-SA 4.0 |