3
$\begingroup$

I am familiar with white box cryptography, but somehow I still fail to see its potential applications? Which situations would necessitate using it? Maybe you can even give me an example or two?

I know it is used to protect keys, but one could say: “Hey, come-on, derive a scheme where you don't need secret key”. Or, we could simply use what we have: public key encryption. All that’s to it is to maybe generate session keys and then encrypt/decrypt things using those keys.

| improve this question | |
$\endgroup$
  • $\begingroup$ I bet you can come up with an application for DRM usage... $\endgroup$ – SEJPM♦ Jul 30 '16 at 17:26
  • $\begingroup$ @SEJPM something other than DRM please $\endgroup$ – user37229 Jul 30 '16 at 17:31
  • $\begingroup$ @EllaRose can you expand? $\endgroup$ – user37229 Jul 30 '16 at 17:31
  • $\begingroup$ Host Card Emulation (HCE), which is commonly used for mobile payments. See e.g. bellid.com/blog/what-is-white-box-cryptography for more detail. $\endgroup$ – user4982 Jul 30 '16 at 19:36
  • $\begingroup$ Please to all: instead of replying with one sentence, provide elaborated example how and where white box crypto would be necessary and useful and how. $\endgroup$ – user37229 Jul 30 '16 at 19:51
7
$\begingroup$

It could enable a key exchange based off of symmetric primitives alone. For example, suppose I can provide to you a program that will allow you to perform AES-256 encryption of a single plaintext block. I could send you this program, you could perform your encryption and send me the result, and due to the whitebox nature of the algorithm, only I can decrypt it (not even you can).

This basically creates a public key encryption scheme using only the white box symmetric primitive. This is valuable because the hardness assumptions that underlie traditional public key primitives versus that of symmetric primitives. There is no known way to scratch the surface of the security of a single AES encryption. This is contrary to ordinary public key crypto, which is based on problems that more or less have very clear solutions, and only work because there are no known algorithms that are efficient enough to handle the key sizes involved.

The key size for AES are significantly smaller then say an RSA keypair, and the operations are significantly more efficient. A white box implementation might be different then a traditional implementation in this respect, but we'll have to wait and see.

This is not possible with a traditional implementation of AES because anyone who knows the key can perform both the encryption and decryption operations. With a white box implementation, the key is embedded into the program in a manner that makes it (ideally) impossible to extract. Of course, this also implies the program is constructed to only posses the encryption capability, and not decryption.

| improve this answer | |
$\endgroup$
  • 1
    $\begingroup$ for completeness please add also why I would not be able to do same just using AES 256 (without white box) $\endgroup$ – user37229 Jul 31 '16 at 7:26
  • $\begingroup$ @user200300 Chances are that the following Q&A will help you to grasp that last bit… “What is a white-box implementation of a cryptographic algorithm?” $\endgroup$ – e-sushi Jul 31 '16 at 10:57
  • $\begingroup$ @e-sushi No that I've read that - that example mentions how white box crypto would help if I hard coded AES key in code. What if I don't hard code and neither use white box - can't I achieve same what Ella Rose suggests in this post??? $\endgroup$ – user37229 Jul 31 '16 at 18:12
  • 1
    $\begingroup$ @user200300 no, because "anyone who knows the key can perform both encryption and decryption" - a white box implementation lets you perform encryption using my key, without me giving you my key. $\endgroup$ – Ella Rose Jul 31 '16 at 18:23
  • $\begingroup$ @user200300 Exactly what Ella wrote! Besides, if you …don't hard code and neither use white box, we’re not talking white-box crypto anymore… which would render your question superfluous. ;) In the end, it’s all about definitions and scenarios. White box crypto can make a lot of sense in the correct scenarios (and when implemented correctly)… but you’re not all that wrong when you think that white box crypto can also break your neck if you try to use it in scenarios it wasn’t invented for. Let’s see if I can wrap up a small example as a final comment here. OK, maybe it helps if you… [1/2] $\endgroup$ – e-sushi Jul 31 '16 at 23:21
4
$\begingroup$

We can divide the applications into several categories according to the security notions related to white-box cryptography.

  1. Unbreakability: means protecting against key extraction in the worst case attacking model where an adversary fully controls the running environment. The mobile payment(e.g. HCE), digital contents distribution and soft-keyboard-typed password protection belong to this category.
  2. One-wayness: means it is difficult to reverse a white-box implementation. In this sense, we can turn a white-box implemented symmetric primitive into a public-key primitive, where the published implementation is the public key and the key of you symmetric primitive is hence the private key.
  3. Incompressibility: means you cannot easily compress the white-box implementation below some boundary. I do not know any practical application of this notion so far.
  4. Traceability: means it is possible to put an irremovable watermark into your implementation, which can be used to track the distribution of your software, or detecting illegal leakage of assets.
| improve this answer | |
$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy