0
$\begingroup$

I can find several whitebox AES 128 implementations on Github, such as wbaes-1, wbaes-2, wbaes-3, etc. All of them are developed based on WB AES encryption. Ideally, most implementations include two parts:

(1). Table_Generator.c (or .cpp, .h ...). Input: 16-byte key; Output: a big lookup table (e.g., table.h), where the key information is already hidden in this lookup table

(2). AES_Encrypt.c. Input: plain text & table generated from (1); Output: cipher text

But I need decryption implementation as well.

First, let me confirm one basic question:

  • Encryption table & decryption table are generated separately, using one same key (e.g., 16 byte key for AES128)? Correct? which means there are two table generation algorithms (and hence two separate lookup tables) - one encryption, one for decryption.

Then, the main questions:

  • What are the important steps to modify an WB encryption project into a WB decryption project?
  • Is there any WB AES decryption implementation for me to read?
$\endgroup$
  • $\begingroup$ Why would you need this? $\endgroup$ – Squeamish Ossifrage Jun 19 at 15:32
  • $\begingroup$ @ squeamish: decrypt the information when called in the software. otherwise, how can we use the ciphertext $\endgroup$ – TJCLK Jun 20 at 2:07
  • $\begingroup$ Most modern use of AES—in AES-GCM—doesn't use the inverse permutation at all. But even if you used something like AES-CBC, why do you need both the forward and the reverse directions to be whitebox? What application needs a whitebox sender and a whitebox receiver? (Standard caveat: generic whitebox cryptography basically doesn't work; there's a reason we use specialized public-key algorithms instead of inventing them generically out of AES through whitebox systems.) $\endgroup$ – Squeamish Ossifrage Jun 20 at 2:18
  • 1
    $\begingroup$ you can also exchange "encryption" and "decryption", the server "decrypts" a plaintext and sends it to the app, the app "encrypts" is to get it in intelligible format and use it $\endgroup$ – ddddavidee Jun 20 at 6:49
  • 1
    $\begingroup$ They're only two permutations one the inverse the other. We just decided which one has to be called "enc" and which one "Dec" $\endgroup$ – ddddavidee Jun 20 at 10:10
1
$\begingroup$

Encryption table & decryption table are generated separately, using one same key (e.g., 16 byte key for AES128)? Correct? which means there are two table generation algorithms (and hence two separate lookup tables) - one encryption, one for decryption.

yes, this is correct. you need two different sets of tables to implement the encryption and the decryption algorithm. Both set are generated using, of course, the same secret AES key.

What are the important steps to modify an WB encryption project into a WB decryption project?

To implement the AES decryption, one should undo all operation one-by-one doing the inverse: you could, therefore, rewrite the table generator algorithm following this logic and then writing the corresponding decryption function where the round structure is inversed. Otherwise one can notice that decryption can be implemented using the same round structure as encryption but with a slightly modified key schedule (and the operations replaced by their inverses). I suggest using this second way to implement decryption, as you only need to change the key schedule function and the rest of the implementation stays the same.

EDIT: more details are available on the AES standard publication at Section 5.3.5 where the Equivalent Inverse Cipher is described.

Is there any WB AES decryption implementation for me to read?

if I remember correctly, the following implementation contains both encryption and decryption direction. You can also read the very good tutorial by James A. Muir (pdf)

$\endgroup$
  • $\begingroup$ It's worth noting that the most common secure mode of operation (GCM) doesn't use AES decryption, only encryption to generate the keystream. Don't implement useless functions, that can only lead to bugs. $\endgroup$ – SAI Peregrinus Jun 19 at 22:00
  • $\begingroup$ @SAI: without an opposite decryption, how can u use the ciphertext? $\endgroup$ – TJCLK Jun 20 at 2:08
  • $\begingroup$ while I agree that using a well-known Authenticated method is better, in the whitebox context using the same function for encryption and decryption is a weakness, as the same function can be called as an oracle to decrypt the ciphertext, making, almost completely, useless the encryption. $\endgroup$ – ddddavidee Jun 20 at 6:47
  • $\begingroup$ @Li Dong look up CTR mode: You use AES to encrypt a steadily increasing counter. you xor the resulting stream of data with your plaintext so encrypt, and can simply restart the counter and generate the same stream of data to xor with the ciphertext and thus decrypt. AES never gets used in the decryption direction since it's only generating a keystream. $\endgroup$ – SAI Peregrinus Jun 21 at 4:10
  • $\begingroup$ your remark on CTR is the same as in GCM as the encryption mode is the same. $\endgroup$ – ddddavidee Jun 21 at 7:12
-1
$\begingroup$

Encryption and decryption differ mostly in these two steps:

  1. The S-Box for the SubBytes-step is inverted, so if e.g. 0x00 is mapped to 0x63 in encryption, in decryption 0x63 is mapped to 0x00 (see https://en.wikipedia.org/wiki/Rijndael_S-box).
  2. The MixColumns-step. Here the values to mix the columns are different (inverted again, see https://en.wikipedia.org/wiki/Rijndael_MixColumns).

To get around this, you might simply use AES in counter-mode. This way, encryption and decryption become the exact same operation and you can simply use the encryption implementations you found for both.

Instead of encrypting the message itself, a random value is encrypted and then XORed with the respective plaintext block. After that, the counter is incremented (e.g. by 1) and encrypted again. The result is XORed with the next block of the message and so forth. This way, for encryption one has to simply repeat the same steps (encrypt the counter, XOR the result with the ciphertext, increment the counter and repeat).

Here's a link to a diagram of how it works: https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#CTR

If possible, use existing libraries. It's easy to get crypto running, but it's hard to get it secure.

$\endgroup$
  • $\begingroup$ This does not answer the question. Moreover having the same whitebox implementation for encryption and decryption can be seen as a weakness... The implementation can be used as an oracle. $\endgroup$ – ddddavidee Jun 19 at 19:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.