White-box cryptography explained

In cryptography, the white-box model refers to an extreme attack scenario, in which an adversary has full unrestricted access to a cryptographic implementation, most commonly of a block cipher such as the Advanced Encryption Standard (AES). A variety of security goals may be posed (see the section below), the most fundamental being "unbreakability", requiring that any (bounded) attacker should not be able to extract the secret key hardcoded in the implementation, while at the same time the implementation must be fully functional. In contrast, the black-box model only provides an oracle access to the analyzed cryptographic primitive (in the form of encryption and/or decryption queries). There is also a model in-between, the so-called gray-box model, which corresponds to additional information leakage from the implementation, more commonly referred to as side-channel leakage.

White-box cryptography is a practice and study of techniques for designing and attacking white-box implementations. It has many applications, including digital rights management (DRM), pay television, protection of cryptographic keys in the presence of malware, mobile payments and cryptocurrency wallets. Examples of DRM systems employing white-box implementations include CSS, Widevine.

White-box cryptography is closely related to the more general notions of obfuscation, in particular, to Black-box obfuscation, proven to be impossible, and to Indistinguishability obfuscation, constructed recently under well-founded assumptions but so far being infeasible to implement in practice.^[1]

As of January 2023, there are no publicly known unbroken white-box designs of standard symmetric encryption schemes. On the other hand, there exist many unbroken white-box implementations of dedicated block ciphers designed specifically to achieve incompressibility (see security goals).

Security goals

Depending on the application, different security goals may be required from a white-box implementation. Specifically, for symmetric-key algorithms the following are distinguished:^[2]

• Unbreakability is the most fundamental goal requiring that a bounded attacker should not be able to recover the secret key embedded in the white-box implementation. Without this requirement, all other security goals are unreachable since a successful attacker can simply use a reference implementation of the encryption scheme together with the extracted key.
• One-wayness requires that a white-box implementation of an encryption scheme can not be used by a bounded attacker to decrypt ciphertexts. This requirement essentially turns a symmetric encryption scheme into a public-key encryption scheme, where the white-box implementation plays the role of the public key associated to the embedded secret key. This idea was proposed already in the famous work of Diffie and Hellman in 1976^[3] as a potential public-key encryption candidate.
• Code lifting security is an informal requirement on the context, in which the white-box program is being executed. It demands that an attacker can not extract a functional copy of the program. This goal is particularly relevant in the DRM setting. Code obfuscation techniques are often used to achieve this goal.

A commonly used technique is to compose the white-box implementation with so-called external encodings. These are lightweight secret encodings that modify the function computed by the white-box part of an application. It is required that their effect is canceled in other parts of the application in an obscure way, using code obfuscation techniques. Alternatively, the canceling counterparts can be applied on a remote server.

• Incompressibility requires that an attacker can not significantly compress a given white-box implementation. This can be seen as a way to achieve code lifting security (see above), since exfiltrating a large program from a constrained device (for example, an embedded or a mobile device) can be time-consuming and may be easy to detect by a firewall.

Examples of incompressible designs include SPACE cipher,^[4] SPNbox,^[5] WhiteKey and WhiteBlock.^[6] These ciphers use large lookup tables that can be pseudorandomly generated from a secret master key. Although this makes the recovery of the master key hard, the lookup tables themselves play the role of an equivalent secret key. Thus, unbreakability is achieved only partially.

• Traceability (Traitor tracing) requires that each distributed white-box implementation contains a digital watermark allowing identification of the guilty user in case the white-box program is being leaked and distributed publicly.

History

The white-box model with initial attempts of white-box DES and AES implementations were first proposed by Chow, Eisen, Johnson and van Oorshot in 2003.^{[7] [8]} The designs were based on representing the cipher as a network of lookup tables and obfuscating the tables by composing them with small (4- or 8-bit) random encodings. Such protection satisfied a property that each single obfuscated table individually does not contain any information about the secret key. Therefore, a potential attacker has to combine several tables in their analysis.

The first two schemes were broken in 2004 by Billet, Gilbert, and Ech-Chatbi using structural cryptanalysis.^[9] The attack was subsequently called "the BGE attack".

The numerous consequent design attempts (2005-2022)^{[10] [11] [12] [13] [14] [15]} were quickly broken by practical dedicated attacks.^{[16] [17] [18] [19] [20] [21] [22]}

In 2016, Bos, Hubain, Michiels and Teuwen showed that an adaptation of standard side-channel power analysis attacks can be used to efficiently and fully automatically break most existing white-box designs.^[23] This result created a new research direction about generic attacks (correlation-based, algebraic, fault injection) and protections against them.^{[24] [25] [26] [27] [28] [29]}

Competitions

Four editions of the WhibOx contest were held in 2017, 2019, 2021 and 2024 respectively. These competitions invited white-box designers both from academia and industry to submit their implementation in the form of (possibly obfuscated) C code. At the same time, everyone could attempt to attack these programs and recover the embedded secret key. Each of these competitions lasted for about 4-5 months.

• WhibOx 2017 / CHES 2017 Capture the Flag Challenge targeted the standard AES block cipher. Among 94 submitted implementations, all were broken during the competition, with the strongest one staying unbroken for 28 days.
• WhibOx 2019 / CHES 2019 Capture the Flag Challenge again targeted the AES block cipher. Among 27 submitted implementations, 3 programs stayed unbroken throughout the competition, but were broken after 51 days since the publication.^{[30] [31]}
• WhibOx 2021 / CHES 2021 Capture the Flag Challenge changed the target to ECDSA, a digital signature scheme based on elliptic curves. Among 97 submitted implementations, all were broken within at most 2 days.^{[32] [33]}
• WhibOx 2024 / CHES 2024 Capture the Flag Challenge again targeted ECDSA. Among 47 submitted implementations, all were broken during the competition, with the strongest one staying unbroken for almost 5 days.

See also

• Black-box obfuscation, a stronger form of obfuscation proven to be impossible
• Indistinguishability obfuscation, a more formal theoretic notion of obfuscation
• Obfuscation (software), non-cryptographic code obfuscation
• Digital rights management, a widely used application of white-box cryptography

External links

• WhibOx Contests

Notes and References

1. Book: Jain . Aayush . Lin . Huijia . Huijia (Rachel) Lin. Sahai . Amit . Indistinguishability obfuscation from well-founded assumptions . Proceedings of the 53rd Annual ACM SIGACT Symposium on Theory of Computing . 15 June 2021 . 60–73 . 10.1145/3406325.3451093 . 2008.09317 . 978-1-4503-8053-9 .
2. Delerablée . Cécile . Lepoint . Tancrède . Paillier . Pascal . Rivain . Matthieu . White-Box Security Notions for Symmetric Encryption Schemes . SAC 2013: Selected Areas in Cryptography . Lecture Notes in Computer Science. 2014 . 8282 . 247–264 . 10.1007/978-3-662-43414-7_13. 978-3-662-43413-0 .
3. Diffie . Whitfield . Hellman . Martin . New directions in cryptography . IEEE Transactions on Information Theory . November 1976 . 22 . 6 . 644–654 . 10.1109/TIT.1976.1055638.
4. Book: Bogdanov . Andrey . Isobe . Takanori . White-Box Cryptography Revisited: Space-Hard Ciphers . Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security . 12 October 2015 . 1058–1069 . 10.1145/2810103.2813699. 978-1-4503-3832-5 .
5. Book: Bogdanov . Andrey . Isobe . Takanori . Tischhauser . Elmar . Towards Practical Whitebox Cryptography: Optimizing Efficiency and Space Hardness . Lecture Notes in Computer Science. Advances in Cryptology – ASIACRYPT 2016 . 2016 . 10031 . 126–158 . 10.1007/978-3-662-53887-6_5. 978-3-662-53886-9 .
6. Book: Fouque . Pierre-Alain . Karpman . Pierre . Kirchner . Paul . Minaud . Brice . Efficient and Provable White-Box Primitives . Lecture Notes in Computer Science. Advances in Cryptology – ASIACRYPT 2016 . 2016 . 10031 . 159–188 . 10.1007/978-3-662-53887-6_6. 978-3-662-53886-9 . https://hal.archives-ouvertes.fr/hal-01427810/file/h4.pdf .
7. Chow . Stanley . Eisen . Phil . Johnson . Harold . van Oorschot . Paul C. . A White-Box DES Implementation for DRM Applications . Digital Rights Management . Lecture Notes in Computer Science. 2003 . 2696 . 1–15 . 10.1007/978-3-540-44993-5_1. 978-3-540-40410-1 .
8. Book: Chow . Stanley . Eisen . Philip . Johnson . Harold . Van Oorschot . Paul C. . White-Box Cryptography and an AES Implementation . SAC 2002: Selected Areas in Cryptography . . 2003 . 2595 . 250–270 . 10.1007/3-540-36492-7_17. 978-3-540-00622-0 .
9. Book: Billet . Olivier . Gilbert . Henri . Ech-Chatbi . Charaf . Cryptanalysis of a White Box AES Implementation . Selected Areas in Cryptography . Lecture Notes in Computer Science . 2004 . 3357 . 227–240 . 10.1007/978-3-540-30564-4_16. 978-3-540-24327-4 .
10. Book: Link . Hamilton . Neumann . W.D. . Clarifying obfuscation: Improving the security of white-box DES . International Conference on Information Technology: Coding and Computing (ITCC'05) - Volume II . 2005 . II . 679-684 Vol. 1 . https://ieeexplore.ieee.org/document/1428542 . 10.1109/ITCC.2005.100. 0-7695-2315-3 .
11. Book: Bringer . Julien . Chabanne . Hervé . Dottax . Emmanuelle . Perturbing and Protecting a Traceable Block Cipher . Communications and Multimedia Security . Lecture Notes in Computer Science . 2006 . 4237 . 109–119 . 10.1007/11909033_10. 978-3-540-47820-1 .
12. Book: Xiao . Yaying . Lai . Xuejia . A Secure Implementation of White-Box AES . 2009 2nd International Conference on Computer Science and its Applications . 2010 . 1–6 . 10.1109/CSA.2009.5404239. 978-1-4244-4945-3 .
13. Book: Karroumi . Mohamed . Protecting White-Box AES with Dual Ciphers . Information Security and Cryptology - ICISC 2010 . Lecture Notes in Computer Science . 2011 . 6829 . 278–291 . 10.1007/978-3-642-24209-0_19. 978-3-642-24208-3 .
14. Vandersmissen . Joachim . Ranea . Adrián . Preneel . Bart . A White-Box Speck Implementation Using Self-equivalence Encodings . Applied Cryptography and Network Security . Lecture Notes in Computer Science . 2022 . 13269 . 771–791 . 10.1007/978-3-031-09234-3_38. 978-3-031-09233-6 .
15. Book: Ranea . Adrián . Vandersmissen . Joachim . Preneel . Bart . Implicit White-Box Implementations: White-Boxing ARX Ciphers . Lecture Notes in Computer Science . Advances in Cryptology – CRYPTO 2022 . 2022 . 13507 . 33–63 . 10.1007/978-3-031-15802-5_2. 978-3-031-15801-8 .
16. Book: Goubin . Louis . Masereel . Jean-Michel . Quisquater . Michaël . Cryptanalysis of White Box DES Implementations . Selected Areas in Cryptography . . 2007 . 4876 . 278–295 . 10.1007/978-3-540-77360-3_18. 978-3-540-77359-7 .
17. Book: Wyseur . Brecht . Michiels . Wil . Gorissen . Paul . Preneel . Bart . Cryptanalysis of White-Box DES Implementations with Arbitrary External Encodings . Selected Areas in Cryptography . . 2007 . 4876 . 264–277 . 10.1007/978-3-540-77360-3_17. 978-3-540-77359-7 .
18. Book: Michiels . Wil . Gorissen . Paul . Hollmann . Henk D. L. . Cryptanalysis of a Generic Class of White-Box Implementations . Selected Areas in Cryptography . . 2009 . 5381 . 414–428 . 10.1007/978-3-642-04159-4_27. 978-3-642-04158-7 .
19. Book: De Mulder . Yoni . Wyseur . Brecht . Preneel . Bart . Cryptanalysis of a Perturbated White-Box AES Implementation . Progress in Cryptology - INDOCRYPT 2010 . . 2010 . 6498 . 292–310 . 10.1007/978-3-642-17401-8_21. 978-3-642-17400-1 .
20. Book: De Mulder . Yoni . Roelse . Peter . Preneel . Bart . Cryptanalysis of the Xiao – Lai White-Box AES Implementation . Selected Areas in Cryptography . . 2013 . 7707 . 34–49 . 10.1007/978-3-642-35999-6_3. 978-3-642-35998-9 .
21. Book: Lepoint . Tancrède . Rivain . Matthieu . De Mulder . Yoni . Roelse . Peter . Preneel . Bart . Two Attacks on a White-Box AES Implementation . Selected Areas in Cryptography -- SAC 2013 . . 2014 . 8282 . 265–285 . 10.1007/978-3-662-43414-7_14. 978-3-662-43413-0 .
22. Biryukov . Alex . Lambin . Baptiste . Udovenko . Aleksei . Cryptanalysis of ARX-based White-box Implementations . IACR Transactions on Cryptographic Hardware and Embedded Systems . 9 June 2023 . 97–135 . 10.46586/tches.v2023.i3.97-135. free .
23. Book: Bos . Joppe W. . Hubain . Charles . Michiels . Wil . Teuwen . Philippe . Differential Computation Analysis: Hiding Your White-Box Designs is Not Enough . Cryptographic Hardware and Embedded Systems – CHES 2016 . . 2016 . 9813 . 215–236 . 10.1007/978-3-662-53140-2_11. 978-3-662-53139-6 .
24. Rivain . Matthieu . Wang . Junwei . Analysis and Improvement of Differential Computation Attacks against Internally-Encoded White-Box Implementations . IACR Transactions on Cryptographic Hardware and Embedded Systems . 28 February 2019 . 225–255 . 10.13154/tches.v2019.i2.225-255.
25. Goubin . Louis . Paillier . Pascal . Rivain . Matthieu . Wang . Junwei . How to reveal the secrets of an obscure white-box implementation . Journal of Cryptographic Engineering . April 2020 . 10 . 1 . 49–66 . 10.1007/s13389-019-00207-5.
26. Book: Biryukov . Alex . Udovenko . Aleksei . Attacks and Countermeasures for White-box Designs . . Advances in Cryptology – ASIACRYPT 2018 . 2018 . 11273 . 373–402 . 10.1007/978-3-030-03329-3_13. 978-3-030-03328-6 . https://orbilu.uni.lu/bitstream/10993/33912/1/WhiteBoxAttacksCountermeasures.pdf .
27. Ezepue . B.C. . Differential fault analysis of white-box cryptographic implementations . Master Thesis . 2017 . en.
28. Seker . Okan . Eisenbarth . Thomas . Liskiewicz . Maciej . A White-Box Masking Scheme Resisting Computational and Algebraic Attacks . IACR Transactions on Cryptographic Hardware and Embedded Systems . 2021 . 61–105 . 10.46586/tches.v2021.i2.61-105. free .
29. Book: Biryukov . Alex . Udovenko . Aleksei . Dummy Shuffling Against Algebraic Attacks in White-Box Implementations . . Advances in Cryptology – EUROCRYPT 2021 . 2021 . 12697 . 219–248 . 10.1007/978-3-030-77886-6_8. 978-3-030-77885-9 . https://orbilu.uni.lu/bitstream/10993/49462/1/2021-290.pdf .
30. Web site: CryptoLUX Research Group. Whitebox cryptography. WhibOx 2019 Competition . www.cryptolux.org . 28 February 2024 . en.
31. Goubin . Louis . Rivain . Matthieu . Wang . Junwei . Defeating State-of-the-Art White-Box Countermeasures with Advanced Gray-Box Attacks . IACR Transactions on Cryptographic Hardware and Embedded Systems . 19 June 2020 . 454–482 . 10.13154/tches.v2020.i3.454-482.
32. Barbu . Guillaume . Beullens . Ward . Dottax . Emmanuelle . Giraud . Christophe . Houzelot . Agathe . Li . Chaoyun . Mahzoun . Mohammad . Ranea . Adrián . Xie . Jianrui . ECDSA White-Box Implementations: Attacks and Designs from CHES 2021 Challenge . IACR Transactions on Cryptographic Hardware and Embedded Systems . 31 August 2022 . 527–552 . 10.46586/tches.v2022.i4.527-552.
33. Bauer . Sven . Drexler . Hermann . Gebhardt . Max . Klein . Dominik . Laus . Friederike . Mittmann . Johannes . Attacks Against White-Box ECDSA and Discussion of Countermeasures: A Report on the WhibOx Contest 2021 . IACR Transactions on Cryptographic Hardware and Embedded Systems . 31 August 2022 . 25–55 . 10.46586/tches.v2022.i4.25-55. free .