What is a white-box implementation?
Does a white-box implementation have specific properties?
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.Sign up to join this community
This article is a nice introduction to the concept of white-box cryptography. It can be viewed as the devious cousin of code obfuscation.
In simpler words: usually, security of a cryptographic algorithm is studied in the "black-box" model: e.g., for symmetric encryption, the attacker is given access to a "device" which runs the encryption algorithm with a given key, and can submit plaintexts and ciphertexts, the goal of the attacker being to be able to decrypt a given block without submitting that exact block as ciphertext. In the "grey-box" model, the attacker also has access to some partial side-channel information; this is where power analysis fits. In the "white-box" model, the attacker has full access to the internal state. The white-box model is meant for: "the algorithm runs as software on the attacker's own computer".
White-box cryptography is less ambitious, and correspondingly a bit less impossible, than the Holy Grail of video game vendors, namely preventing any kind of reverse engineering; WBC aims at protecting "just" cryptographic keys. WBC studies techniques by which a white-box implementation could be made, and also what security characteristics could be achieved assuming that a white-box implementation exists.
The goal of white-box cryptography is to build a compiler for a specific cryptographic algorithm (i.e., AES) such that given a randomly chosen key, it outputs an implementation hard-coded the key and it is hard for an adversary to extract the key. The key extraction is the most basic security notion for white-box cryptography, and it has been formulated as unbreakability in the literature. Besides, the authors also put forward several interesting and related security notions, intuitively:
Recently, a large number of publications are discussing (indistinguishability) obfuscation, which seems to have a strong relationship with white-box crypto. Nevertheless, there is no clear link between these notions.