A White-Box Cryptographic Implementation for Protecting against Power Analysis

Lee, Seungkwang

doi:10.1587/transinf.2017edl8186

Cited by 4 publications

(2 citation statements)

References 10 publications

(16 reference statements)

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This distinguisher has subsequently been reused in [Lee18,LJK20,Ras20]. This distinguisher considers absolute values (norm-1) and not squares (norm-2) of the Walsh spectrum, since according to the Parseval relation, the sum of squares is independent of the choice of…”

Section: Spectral Distinguisher Of Sasdrich Et Almentioning

confidence: 99%

Structural Attack (and Repair) of Diffused-Input-Blocked-Output White-Box Cryptography

Carlet

Guilley

Mesnager

2021

TCHES

View full text Add to dashboard Cite

In some practical enciphering frameworks, operational constraints may require that a secret key be embedded into the cryptographic algorithm. Such implementations are referred to as White-Box Cryptography (WBC). One technique consists of the algorithm’s tabulation specialized for its key, followed by obfuscating the resulting tables. The obfuscation consists of the application of invertible diffusion and confusion layers at the interface between tables so that the analysis of input/output does not provide exploitable information about the concealed key material.Several such protections have been proposed in the past and already cryptanalyzed thanks to a complete WBC scheme analysis. In this article, we study a particular pattern for local protection (which can be leveraged for robust WBC); we formalize it as DIBO (for Diffused-Input-Blocked-Output). This notion has been explored (albeit without having been nicknamed DIBO) in previous works. However, we notice that guidelines to adequately select the invertible diffusion ∅and the blocked bijections B were missing. Therefore, all choices for ∅ and B were assumed as suitable. Actually, we show that most configurations can be attacked, and we even give mathematical proof for the attack. The cryptanalysis tool is the number of zeros in a Walsh-Hadamard spectrum. This “spectral distinguisher” improves on top of the previously known one (Sasdrich, Moradi, Güneysu, at FSE 2016). However, we show that such an attack does not work always (even if it works most of the time).Therefore, on the defense side, we give a straightforward rationale for the WBC implementations to be secure against such spectral attacks: the random diffusion part ∅ shall be selected such that the rank of each restriction to bytes is full. In AES’s case, this seldom happens if ∅ is selected at random as a linear bijection of F322. Thus, specific care shall be taken. Notice that the entropy of the resulting ∅ (suitable for WBC against spectral attacks) is still sufficient to design acceptable WBC schemes.

show abstract

Section: Spectral Distinguisher Of Sasdrich Et Almentioning

confidence: 99%

Structural Attack (and Repair) of Diffused-Input-Blocked-Output White-Box Cryptography

Carlet

Guilley

Mesnager

2021

TCHES

View full text Add to dashboard Cite

show abstract

“…However, masking is vulnerable to higher-order DPA attacks, and this is also the case with masking applied to white-box cryptography [27]. Another method is to use an additional set of lookup tables that store bits completely inverted from a given table set [28]. However, this method is only effective if the given table set shows a high correlation, and thus the protection is not always guaranteed.…”

Section: Past Design Of Masked Wb-aesmentioning

confidence: 99%

Improvement on a Masked White-Box Cryptographic Implementation

Lee

Kim

2020

IEEE Access

Self Cite

View full text Add to dashboard Cite

White-box cryptography is a software technique to protect secret keys of cryptographic algorithms from attackers who have access to memory. By adapting techniques of differential power analysis to computation traces consisting of runtime information, Differential Computation Analysis (DCA) has recovered the secret keys from white-box cryptographic implementations. In order to thwart DCA, a masked white-box implementation was suggested. It was a customized masking technique that randomizes all the values in the lookup tables with different masks. However, the round output was only permuted by byte encodings, not protected by masking. This is the main reason behind the success of DCA variants on the masked white-box implementation. In this paper, we improve the masked white-box cryptography in such a way to protect against DCA variants by obfuscating the round output with random masks. Specifically, we introduce a white-box AES (WB-AES) implementation applying the masking technique to the key-dependent intermediate value and the several outer-round outputs computed by partial bits of the key. Our analysis and experimental results show that the proposed WB-AES can protect against DCA variants including DCA with a 2-byte key guess, collision, and bucketing attacks. This work requires approximately 3.7 times the table size and 0.7 times the number of lookups compared to the previous masked WB-AES.

show abstract