What are some use cases for white-box digital signatures?

Question

There were 2 papers published in the last year, that describe 2 different white-box identity-based digital signature schemes:

1. White-Box Implementation of the Identity-Based Signature Scheme in the IEEE P1363 Standard for Public Key Cryptography. IACR ePrint
2. White-Box Implementation of Shamir's Identity-Based Signature Scheme. DOI, ResearchGate

I understand how the described algorithms work, but I don't know where white-box signatures could be useful.

In (1), they write:

While there are numerous identity-based signature schemes, they are generally not white-box attack resilience, and we are not aware of any white-box implementation for identity-based signature scheme. Hence, our research has filled the gap in white-box cryptography.

...

According to the performance evaluation, our proposed method showed that it is potentially useful in the industrial area and the real world applications.

So is it possible that there are no use cases for this yet, but the crypto schemes are implemented just in case someone came up with a use case in the future?

Or is this purely academic prototype showing that it's possible to implement white-box signatures, without necessarily having any real world usage?

P.S. Here is some discussion about asymmetric white-box: Any white-box cryptography for asymmetric-key? What is the latest status of white-box cryptography?

Answer 1

Good question. WhiteBox Cryptography helps to protect the key in an untrusted environment. To that extent, it is indeed possible to design a system where the complexity of the private key retrieval will be equivalent or higher than the complexity of breaking the cryptographic algorithm itself (e.g. discrete logarithm).

However, from a real world application perspective it's nearly useless, as the attacker doesn't really need the private key. The attacker needs to be able to sign arbitrary messages. WhiteBox Cryptography doesn't protect against it. In fact, it's quite the opposite, as the attack model for WhiteBox Cryptography (http://cryptowiki.net/index.php?title=White-box_cryptography_and_software_code_cryptographic_obfuscation#White-box_attack_context) explicitly assumes that the attacker may perform chosen-message attacks.

Shortly, WBC may hide the private key from the attacker, but it cannot prevent signature forgery, which is the real goal in practice. That's why it's not very helpful for the signature use case, but it does make sense for deploying symmetric cryptography in an untrusted environment.

Answer 2

Please see the paper at https://eprint.iacr.org/2021/968 (title and abstract below, I am a co-author) for a novel way of implementing signatures in a white-box setting.

White-Box Implementations for Hash-Based Signatures and One-Time Passwords

Abstract: White-box cryptography aims at providing protection against a powerful adversary which is in complete control of the execution environment of the cryptographic operation. Most existing white-box implementations focus on symmetric encryption. In particular, we are not aware of any previous work on general-purpose digital signature schemes secure against white-box attackers. We present white-box implementations for hash-based signatures so that the security against white-box attackers depends not on the availability of a white-box secure pseudorandom function (in addition to a general one-way function). We also present a hash tree-based solution for one-time passwords secure in a white-box attacker context.