How to generate whitebox AES decryption algorithm and code, with existing WB-AES encryption code?

Question

I can find several whitebox AES 128 implementations on Github, such as wbaes-1, wbaes-2, wbaes-3, etc. All of them are developed based on WB AES encryption. Ideally, most implementations include two parts:

(1). Table_Generator.c (or .cpp, .h ...). Input: 16-byte key; Output: a big lookup table (e.g., table.h), where the key information is already hidden in this lookup table

(2). AES_Encrypt.c. Input: plain text & table generated from (1); Output: cipher text

But I need decryption implementation as well.

First, let me confirm one basic question:

• Encryption table & decryption table are generated separately, using one same key (e.g., 16 byte key for AES128)? Correct? which means there are two table generation algorithms (and hence two separate lookup tables) - one encryption, one for decryption.

Then, the main questions:

• What are the important steps to modify an WB encryption project into a WB decryption project?
• Is there any WB AES decryption implementation for me to read?

Answer 1

Encryption table & decryption table are generated separately, using one same key (e.g., 16 byte key for AES128)? Correct? which means there are two table generation algorithms (and hence two separate lookup tables) - one encryption, one for decryption.

yes, this is correct. you need two different sets of tables to implement the encryption and the decryption algorithm. Both set are generated using, of course, the same secret AES key.

What are the important steps to modify an WB encryption project into a WB decryption project?

To implement the AES decryption, one should undo all operation one-by-one doing the inverse: you could, therefore, rewrite the table generator algorithm following this logic and then writing the corresponding decryption function where the round structure is inversed. Otherwise one can notice that decryption can be implemented using the same round structure as encryption but with a slightly modified key schedule (and the operations replaced by their inverses). I suggest using this second way to implement decryption, as you only need to change the key schedule function and the rest of the implementation stays the same.

EDIT: more details are available on the AES standard publication at Section 5.3.5 where the Equivalent Inverse Cipher is described.

Is there any WB AES decryption implementation for me to read?

if I remember correctly, the following implementation contains both encryption and decryption direction. You can also read the very good tutorial by James A. Muir (pdf)

Answer 2

Encryption and decryption differ mostly in these two steps:

1. The S-Box for the SubBytes-step is inverted, so if e.g. 0x00 is mapped to 0x63 in encryption, in decryption 0x63 is mapped to 0x00 (see https://en.wikipedia.org/wiki/Rijndael_S-box).
2. The MixColumns-step. Here the values to mix the columns are different (inverted again, see https://en.wikipedia.org/wiki/Rijndael_MixColumns).

To get around this, you might simply use AES in counter-mode. This way, encryption and decryption become the exact same operation and you can simply use the encryption implementations you found for both.

Instead of encrypting the message itself, a random value is encrypted and then XORed with the respective plaintext block. After that, the counter is incremented (e.g. by 1) and encrypted again. The result is XORed with the next block of the message and so forth. This way, for encryption one has to simply repeat the same steps (encrypt the counter, XOR the result with the ciphertext, increment the counter and repeat).

Here's a link to a diagram of how it works: https://en.wikipedia.org/wiki/Block_cipher_mode_of_operation#CTR

If possible, use existing libraries. It's easy to get crypto running, but it's hard to get it secure.