Along CHES 2017 was a Capture the Flag Challenge, aka The WhibOx Contest.

Participants submit C source code with interface

void AES_128_encrypt(unsigned char ciphertext[16], unsigned char plaintext[16]);

that performs AES-128 encryption with some key. Other participants attempt to find that key from the submission. A mechanical referee checks if a guess of the key is correct. A rating system awards points (strawberries and bananas) as a function of how much time one's submission remains unbroken, and for breaking a submission. Survival range has been from 1 minute to a record 28 days 13h 42'.

What where the techniques used by the leading participants, both for making whiteboxes, and attacking them? The only clear thing is that there was an inflation in size; the winner is 28MByte.

  • 1
    $\begingroup$ Their site states “Join the discussion forum on Slack and get your questions answered by the organizing committee…” which sounds like a potential option to get according answers. Did you already try that with any result whatsoever? $\endgroup$
    – e-sushi
    Oct 29 '17 at 14:56
  • $\begingroup$ there is no a complete answer. The contest did not require a submitter to give details of his/her design. $\endgroup$
    – ddddavidee
    Oct 30 '17 at 8:50
  • $\begingroup$ @ddddavidee: indeed, neither whiteboxing nor attack techniques where required to be public; but that does not prevent from asking! $\endgroup$
    – fgrieu
    Oct 30 '17 at 11:52
  • $\begingroup$ Not at all. I've asked on Twitter to the winner implementation. There's some slides about the attack to solve it, too. $\endgroup$
    – ddddavidee
    Oct 30 '17 at 12:09
  • 1
    $\begingroup$ @fgrieu: from here (ches.2017.rump.cr.yp.to) the last link (ches.2017.rump.cr.yp.to/a905c99d1845f2cf373aad564ac7b5e4.pdf). And here to refresh the question to the author: twitter.com/alexcryptan/status/908691476447744000 $\endgroup$
    – ddddavidee
    Oct 30 '17 at 13:14

Junwei Wang gave a talk on how the winning entry (#777 by cryptolux) was designed and how team cryptoexperts broke it. Slides, video.

The overvew of the design (slide 9) is:

  • Multi-layer protection
    • Inner: encoded Boolean circuit with error detection
    • Middle: bitslicing
    • Outer: virtualization, randomly naming, duplications, dummy operations
  • Code size: ~28 MB
  • Code lines: ∼2.3k
  • 12 global variables including:
    • computation state (2.1 MB)
    • program bytecode (15.3 MB)

And the overview of their approach to reversing it:

  1. Reverse engineering ⇒ a Boolean circuit
  2. Single static assignment (SSA) transformation
  3. Circuit minimization
  4. Data dependency analysis
  5. Key recovery with algebraic analysis
  • 2
    $\begingroup$ TLDR: They made a huge mess with mostly standard obfuscation techniques. $\endgroup$
    – Elias
    Jan 17 '18 at 20:37

I am from the winning attacking team: team_cryptoexperts. Recently, we released a white paper on our white-box attacking techniques 2018/098. As @Michael suggested, you can also find some expressive detail from my talk at RWC 2018 and the slides.

By the way, some of the protection techniques can be found from 2018/049.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.