What's the point of hiding the key in white box cryptography if the attacker already has full access to the encryption (or decryption) implementation?

Question

The attacker doesn't need the key in order to decrypt ciphertexts or encrypt plaintexts since he/she already has the full implementation.

• So what's the point of hiding the key?
• What advantage would the attacker even have by knowing the key?

Update: ddddavidee's answer below, in the second paragraph, raises an interesting point: a white-box implementation of a symmetric cipher that exhibits the "one-wayness" property - i.e. it is infeasible to derive the decryption circuit from the encryption circuit, or vice versa - can be used to create an assymetric cipher. That would indeed be useful. Note that key-extraction security - i.e. it is infeasible to derive the key from the encryption (or decryption) circuit - is a necessary but not sufficient condition for achieving one-wayness.

However, I'm still stumped by the tenor of the first paragraph of ddddavidee's answer, which is why I asked this question to begin with. The model for an attacker of a white-box implementation assumes that they have full access to the encryption (or decryption) circuit. In that case (aside from the scenario in the previous paragraph), what is the point of the notion of key-extraction security, or key-extraction itself, for that matter, since the attacker can accomplish any encryption without using the key? Either I am missing something or there is something missing or flawed in the definition of white-box cryptography itself.

Answer 1

The main goal is to, at least, oblige the attacker to use the software to consume the encrypted message and avoid to use it on a different platform. It is quite easy to understand this reason if one thinks to the DRM (Digital Right Management) model: one vendor sells hardware with the capability to show some media content. If an attacker can decrypt and use the content on her PC the vendor loses some market. In the mobile payment context one wants to avoid that a malware could steal payment keys and use them in a different platform against the legit user. A different use is to protect the Intellectual Property from the final user: some piece of firmware or software has to be given to the final user but the vendor wants to keep it protected. Other examples can be found thinking when, where and why hardware tokens are used. The white-box encryption can be seen as, with some other software security measures, as a cheap replacement for the hardware tokens (or smart cards).

Moreover you can see the white-box encryption as a way to transform a symmetric key algorithm into a asymmetric one. If it is infeasible to reverse the white-box encryption algorithm into a decryption one and it is infeasible to extract the key, only the encryption algorithm is available and the decryption remains infeasible. The same applies in the opposite direction: providing a white-box decryption makes impossible to encrypt something under the same key.

Some other security properties are discussed in this paper White-Box Security Notions for Symmetric Encryption Schemes

In particular the "incompressibility" property says that "should not be possible to output a program smaller than the challenge one doing the same crypto-operation". Some solutions have published achieving a provable incompressibility, the reason motivating such construction is that it is more difficult for a national agency to store (say) 1 terabyte of key per person to decrypt the targeted user data, while would be feasible to store the corresponding 128-bit key.