I googled it, but got no result. There is a binary executable of a white-box implementation of DES (scroll down), but no source code is provided.

The same page also links various papers about white-box cryptography, but these don't contain the implementation.

I want to study such an implementation to learn about the techniques used there.

  • 1
    $\begingroup$ As I understand, providing the source would make the whole game of If you like, try to extract the secret key trivial. I think an open-source implementation would have to include the compiler (or other tools) used to hide the key in the binary. $\endgroup$ Jul 30, 2011 at 16:13
  • $\begingroup$ Thanks for your comment. Thing that is obvious, the binary executable file produced from a source code. My query is, how can i obtain that code or an example implementation of white-box AES or DES? $\endgroup$
    – ir01
    Jul 30, 2011 at 19:04
  • $\begingroup$ I suppose that as soon as the source code is available (to the attacker), the white-box security breaks down. But this is only my intuitation, I might be wrong here. (I only looked at the slides of the presentation, not the whole dissertation). (And no, I don't know anything. You could try to write an e-mail to the guy which created this thing.) $\endgroup$ Jul 30, 2011 at 19:14
  • 4
    $\begingroup$ I assume you already read the two papers linked on the page, from Chow et. al, White-Box Cryptography and an AES Implementation and A White-box DES Implementation for DRM Applications. These do not contain source code, but describe how to do this. (In effect, you are writing a program which generates the implementation, not the implementation itself.) The authors seem to create products from this. $\endgroup$ Jul 30, 2011 at 20:18
  • 1
    $\begingroup$ Try github.com/wbaes/wbaes $\endgroup$
    – user632
    Aug 26, 2011 at 18:51

6 Answers 6


I've seen two implementations in the wild:

  • $\begingroup$ I always wanted to learn Slovak, now I have an additional reason ... (I know the papers are in Czech, but the languages are quite similar.) At least the source code has some english comments there, compared to the only russian ones in the second one. $\endgroup$ Aug 19, 2011 at 20:29

I add my whitebox AES implementation on GitHub in:

C++ version implements both Chow's (mixing bijections, input/output encodings, external encodings) and Karroumi's (dual AES in each column) whitebox AES scheme plus Billet's key recovery attack on both schemes.

Java implements Chow's scheme only.

PS: Due to low reputation I post links to schemes to the comment below.

  • $\begingroup$ I read your C++ implementation on github. I am interested in Chow's implementation only. But all of them are mixed together. How to differentiate them? $\endgroup$
    – TJCLK
    Jun 18, 2019 at 7:11
  • $\begingroup$ @LiDong try setting useDualAESARelationsIdentity=true; useDualAESIdentity=true; in the generator $\endgroup$ Jun 18, 2019 at 8:34
  • $\begingroup$ i can see the generated /tmp/aes-table. there's only one table. why the encrypt & decrypt use the same table? they suppose to use one encrypt table & one inverse decrypt table? $\endgroup$
    – TJCLK
    Jun 18, 2019 at 10:51
  • $\begingroup$ you have to generate both tables separately $\endgroup$ Jun 19, 2019 at 9:53

Adding my 2 cents, I would like to point out that many published methods for white-box cryptography have been broken. This includes…

  • white-box AES
    “Cryptanalysis of White Box AES Implementation”
    by Olivier Billet, Henri Gilbert, and Charaf Ech-Chatbi

  • white-box DES
    “Cryptanalysis of White-Box DES Implementations with Arbitrary External Encodings“
    by Brecht Wyseur and Wil Michiels and Paul Gorissen and Bart Preneel

… which have been crypto-analyzed and are known to be insecure ever since.

On the other hand, as long as you just plan to study implementation to learn about the techniques and not plan to actually implement them in practice, you should be fine. So, let's mention one of the implementations that haven’t been mentioned here yet – https://github.com/wbaes/wbaes


94 White-box AES implementations can be found at WhibOx contest website.


Have fun!

  • $\begingroup$ And all of them are broken. :) $\endgroup$
    – Biv
    Feb 9, 2018 at 9:28

I have a x86 assembly version of the basic AES algorithm I wrote when we briefly tried to remediate some 20 year old POS registers for PCI compliance. Turned out we didn't need it, but it was a great experience to write some assembler again.

I would be happy to share it if you feel it would be valuable. Please keep in mind that it is just the encryption portion, i.e. you supply it the Key and Data block and it returns the encrypted block. So you aren't getting anything that initializes a key, performs any salting, or any sort of rolling block encryption. Give it a 256-bit key, 256-bit data and get out 256-bit encrypted data.

I also have a version of it in .net c# which I wrote to prove my ASM.

  • $\begingroup$ Thanks in advanced. Great implementation.but, i need a white-box implementation with embedded key, but your implementation get the key as an input parameter. $\endgroup$
    – ir01
    Aug 4, 2011 at 22:12
  • 5
    $\begingroup$ @Bill, it sounds like you have an AES implementation, but I think ir01 wanted an implementation of "white-box AES". "White-box AES" is a somewhat obscure scheme derived from AES -- and in particular, it is not the same as AES. So an AES implementation probably won't help ir01. $\endgroup$
    – D.W.
    Aug 5, 2011 at 1:39

I'm not sure I get your Q? but do these links help


Not the answer you're looking for? Browse other questions tagged or ask your own question.