There were 2 papers published in the last year, that describe 2 different white-box identity-based digital signature schemes:

  1. White-Box Implementation of the Identity-Based Signature Scheme in the IEEE P1363 Standard for Public Key Cryptography. IACR ePrint
  2. White-Box Implementation of Shamir's Identity-Based Signature Scheme. DOI, ResearchGate

I understand how the described algorithms work, but I don't know where white-box signatures could be useful.

In (1), they write:

While there are numerous identity-based signature schemes, they are generally not white-box attack resilience, and we are not aware of any white-box implementation for identity-based signature scheme. Hence, our research has filled the gap in white-box cryptography.


According to the performance evaluation, our proposed method showed that it is potentially useful in the industrial area and the real world applications.

So is it possible that there are no use cases for this yet, but the crypto schemes are implemented just in case someone came up with a use case in the future?

Or is this purely academic prototype showing that it's possible to implement white-box signatures, without necessarily having any real world usage?

P.S. Here is some discussion about asymmetric white-box: Any white-box cryptography for asymmetric-key? What is the latest status of white-box cryptography?


Good question. WhiteBox Cryptography helps to protect the key in an untrusted environment. To that extent, it is indeed possible to design a system where the complexity of the private key retrieval will be equivalent or higher than the complexity of breaking the cryptographic algorithm itself (e.g. discrete logarithm).

However, from a real world application perspective it's nearly useless, as the attacker doesn't really need the private key. The attacker needs to be able to sign arbitrary messages. WhiteBox Cryptography doesn't protect against it. In fact, it's quite the opposite, as the attack model for WhiteBox Cryptography (http://cryptowiki.net/index.php?title=White-box_cryptography_and_software_code_cryptographic_obfuscation#White-box_attack_context) explicitly assumes that the attacker may perform chosen-message attacks.

Shortly, WBC may hide the private key from the attacker, but it cannot prevent signature forgery, which is the real goal in practice. That's why it's not very helpful for the signature use case, but it does make sense for deploying symmetric cryptography in an untrusted environment.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.