What do we need white box crypto for?

Question

I am familiar with white box cryptography, but somehow I still fail to see its potential applications? Which situations would necessitate using it? Maybe you can even give me an example or two?

I know it is used to protect keys, but one could say: “Hey, come-on, derive a scheme where you don't need secret key”. Or, we could simply use what we have: public key encryption. All that’s to it is to maybe generate session keys and then encrypt/decrypt things using those keys.

Answer 1

It could enable a key exchange based off of symmetric primitives alone. For example, suppose I can provide to you a program that will allow you to perform AES-256 encryption of a single plaintext block. I could send you this program, you could perform your encryption and send me the result, and due to the whitebox nature of the algorithm, only I can decrypt it (not even you can).

This basically creates a public key encryption scheme using only the white box symmetric primitive. This is valuable because the hardness assumptions that underlie traditional public key primitives versus that of symmetric primitives. There is no known way to scratch the surface of the security of a single AES encryption. This is contrary to ordinary public key crypto, which is based on problems that more or less have very clear solutions, and only work because there are no known algorithms that are efficient enough to handle the key sizes involved.

The key size for AES are significantly smaller then say an RSA keypair, and the operations are significantly more efficient. A white box implementation might be different then a traditional implementation in this respect, but we'll have to wait and see.

This is not possible with a traditional implementation of AES because anyone who knows the key can perform both the encryption and decryption operations. With a white box implementation, the key is embedded into the program in a manner that makes it (ideally) impossible to extract. Of course, this also implies the program is constructed to only posses the encryption capability, and not decryption.

Answer 2

We can divide the applications into several categories according to the security notions related to white-box cryptography.

1. Unbreakability: means protecting against key extraction in the worst case attacking model where an adversary fully controls the running environment. The mobile payment(e.g. HCE), digital contents distribution and soft-keyboard-typed password protection belong to this category.
2. One-wayness: means it is difficult to reverse a white-box implementation. In this sense, we can turn a white-box implemented symmetric primitive into a public-key primitive, where the published implementation is the public key and the key of you symmetric primitive is hence the private key.
3. Incompressibility: means you cannot easily compress the white-box implementation below some boundary. I do not know any practical application of this notion so far.
4. Traceability: means it is possible to put an irremovable watermark into your implementation, which can be used to track the distribution of your software, or detecting illegal leakage of assets.