Ways to make white-box cryptography AES implementation more difficult to be broken

Question

Background: I want to use white-box cryptography to hide the keys stored in a client application.

I am looking for existing implementations of white-box cryptography, such as AES 128 or 256. But I found that almost all the existing implementations are breakable in some reasonable period of time. For example, see the CHES 2017 challenge and BGE attacks on the original Chow's scheme, etc. I haven't been able to find a mature/unbroken implementation so far.

My objective is to make WBC implementation very difficult to be broken. As we know,

1) WBC aims to protect cryptographic algorithms against key recovery

2) Code obfuscation aims to protect against the reverse engineering of a cryptographic algorithm.

Thus, I want to use a published WBC implementation (may be broken already), and then apply obfuscation on the code (e.g., C++).

1. Is the above way reasonable (if we cannot find a proper implementation)?

2. Please recommend any mature WBC implementations (not broken yet)

3. Any better ideas? (other than re-design & evaluate a new WBC algorithm)

Answer 1

Is the above way reasonable (if we cannot find a proper implementation)?

No, there are currently no such code-obfuscation algorithms that securely obfuscate code to a point where it's very hard to reverse engineer it.

Please recommend any mature WBC implementations (not broken yet)

I'm not aware of any WBC implementations for AES.

Note, that a successful implementation of a WB-AES algorithm would mean that the "one-wayness" (very hard to invert) would turn this algorithm into a public-key-cryptosystem without a need for asymmetric cryptography (you would just publish the WBC-AES-implementation and the key wouldn't leak). So I'm pretty sure that there are no unbroken implementations.

It could be that there are some unbroken WBC implementations out there, but I don't think that they would remain unbroken for long if they would attract a lot of attention from the cryptographic community.

Any other better idea? (other than re-design & evaluate a new WBC algorithm)

No. As Geoffroy Couteau and I commented, self-made code obfuscation is likely unsecure for many reasons, the main reason being that the security would rely on the fact that nobody ever would gain knowledge of your obfuscation algorithm.

Answer 2

Adding software obfuscation to the standard white-box designs is close to what it is already done in the industry. This solution is not strong enough, it can be somewhat useful to make reverse engineering harder and make the attacker spend a longer time to fully understand the underlying design but does not avoid the key extraction. Software obfuscation, indeed, makes harder to understand and potentially lift some portion of the code but does not avoid the execution of the encryption function. Few years ago, a new family of attack techniques, borrowed from the secure element world, has been successfully applied to the white-box context (see Differential Computational Analysis(video here), Differential Fault Analysis, shameless plug: Bucketing Attack). With those more recent techniques, even if the software is obfuscated the attacks are effective.

On the other hand, code obfuscation aims to hide the logic of the obfuscated algorithm, and usually, this is not the same security target of such situation you described, code obfuscation aims to hide that the obfuscated code is an AES implementation, but from a security point of view, the attacker already knows the encryption algorithm, only the secret key has to be protected. Code obfuscation in this context is used to hide how it is computed and in particular when/where the key is loaded in memory, data obfuscation is used to hide the link between some loaded data and the plain AES key.

If you are looking for white-box designs you can have a look here: Side-Channel Marvels (more specifically in Deadpool) or OpenWhiteBox.

Better ideas...

actually the scientific community and the industrial one are actively looking for a better idea and solution to the problem. The industrial world is looking for a secure enough solution staying secure for the life of the product (at least until next update). As today no know design is considered secure, and as a consequence the industry produces software security solutions including (but not limited) to white-box cryptography, anti-tampering and anti-reverse engineering techniques, but to keep an advantage over the attacker the details are not public. Some other (non published) designs are available at the WhibOx Contest - Edition 2

Answer 3

There are no unbroken and published designs. The strongest recently published design from CHES 2017 challenge withstood attack for slightly less than a month and the strongest design from WhibOx 2019 challenge withstood attacks for 51 days since publication.

If you can, choose an alternative to AES white-box:

• use hardware-backed operating system features to store and use the key (e.g. Android Keystore, iOS Secure Enclave)
• use trusted application in TEE (Trusted Execution Environment, such as ARM TrustZone, Intel SGX)
• change the design so that security of keys during use are not so critical
• use a custom white-box algorithm instead of AES (this will thwart typical white-box attacks but is a mine-field in itself)

Applying obfuscation may help depending on the type of the attack and the features of obfuscation but you will probably never know until you do a penetration test or discover a hack after you publish your application.

Also please note that in the CHES challenge, encryption of a single AES block could take up to a second and the code could be 20 MB big, which means that performance and size of a decent white-box will be a concern.

BTW, even if you had access to a perfect white-box implementation, you may still need to further protect it against code lifting (attackers simply using your code to encrypt and decrypt, instead of learning the key).

In short, white-box protection is extremely difficult and good free versions of AES white-box don't exist.

Disclaimer: I work for a company, selling white-box implementations.

Answer 4

To my knowledge, there is no white-box cryptographic algorithm that is "secure" in cryptographic sense, that means its security depends on a random key from a space of certain size.

In practice the "security" of white-box cryptography is achieved by hiding implementation and by employing automated updates to quickly replace the key with new implementation when the old one is broken.

Two sad conclusions follow: 1) The best white-box cryptographic algorithms will never be published and will be available only at very high price. 2) White-box cryptography in its current state is completely unsuitable for Open Source software.

Answer 5

I just wanted to add a reverse engineering perspective on this sort of thing, since I've broken some such systems before.

Attackers often don't care about unraveling the math to determine the original algorithm. You can just copy the obfuscated algorithm outright from the (for example) movie player. It doesn't matter whether the code is simplified.

The only way to get partial success is to obfuscate the whole program and intertwine the encryption with the rest of the program to make it hard to isolate. Also, this allows for tamper resistance and anti-debugging techniques.

But in the end, just remember that always it takes longer to make an obfuscation system than it takes an attacker to break it. Nobody has ever gotten around this; just ask Denuvo.