1. Let's discussed based on published symmetric white-box crypto only, such as Chow's white-box AES.

  2. I only know basic concepts/objectives of homomorphic encryption, such as PHE and FHE. Bring ciphertext into calculation instead of decryption.

  3. Without proper implementation design for real applications, white-box crypto may reveal its own vulnerabilities, such as code lifting (call whole WB function instead of unboxing WB).


I am thinking (just brainstorm first) how to bring the homomorphic feature into white-box crypto design. For examples:

A1. Use encrypted plaintext P_IN as white-box crypto encryption input to generate encrypted ciphertext C_OUT.

A2. Use encrypted ciphertext C_IN as white-box crypto decryption input to generated encrypted plaintext P_OUT

A3. Treat white-box as an API module. Use encrypted input/output for further calculation steps.


B. Apply homomorphic features on the intermediate values of white-box crypto, in order to prevent cryptoanalysis.

Remark: PHE or FHE supports limited operations (e.g., addition, multiplications), which could be the potential challenges for white-box crypto.

  • 1
    $\begingroup$ I like the idea. I hope you will push this further. $\endgroup$
    – hola
    Commented May 14, 2021 at 3:03
  • $\begingroup$ Did you make any progress? $\endgroup$ Commented Mar 17, 2023 at 7:35
  • 2
    $\begingroup$ I see two issues with this general idea: the first is that, with HE, you need something with the private key to be able to decrypt; if that's within the whitebox, then how do you protect that? The other issue (or, something that HE doesn't automatically address) are fault attacks - the attacker can make minor modifications to the program (which would act like a 'fault') and see how the modified program acts. Now, that could possibly be addressed, however HE doesn't do that for you for free... $\endgroup$
    – poncho
    Commented Mar 17, 2023 at 18:05


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.