On Recovering Affine Encodings in White-Box Implementations

Abstract

Ever since the first candidate white-box implementations by Chow et al. in 2002, producing a secure white-box implementation of AES has remained an enduring challenge. Following the footsteps of the original proposal by Chow et al., other constructions were later built around the same framework. In this framework, the round function of the cipher is “encoded” by composing it with non-linear and affine layers known as encodings. However, all such attempts were broken by a series of increasingly efficient attacks that are able to peel off these encodings, eventually uncovering the underlying round function, and with it the secret key.These attacks, however, were generally ad-hoc and did not enjoy a wide applicability. As our main contribution, we propose a generic and efficient algorithm to recover affine encodings, for any Substitution-Permutation-Network (SPN) cipher, such as AES, and any form of affine encoding. For AES parameters, namely 128-bit blocks split into 16 parallel 8-bit S-boxes, affine encodings are recovered with a time complexity estimated at 232 basic operations, independently of how the encodings are built. This algorithm is directly applicable to a large class of schemes. We illustrate this on a recent proposal due to Baek, Cheon and Hong, which was not previously analyzed. While Baek et al. evaluate the security of their scheme to 110 bits, a direct application of our generic algorithm is able to break the scheme with an estimated time complexity of only 235 basic operations.As a second contribution, we show a different approach to cryptanalyzing the Baek et al. scheme, which reduces the analysis to a standalone combinatorial problem, ultimately achieving key recovery in time complexity 231. We also provide an implementation of the attack, which is able to recover the secret key in about 12 seconds on a standard desktop computer.

Implicit White-Box Implementations: White-Boxing ARX Ciphers

“…(3) in polynomial time [19]; or (3) if S is composed of small m s -bit S-boxes, the algorithm by Derbez et al can solve Eqn. (4) in about O(2 2ms ) [17].…”

“…The first generic attack that we will consider is the reduction subroutine that transforms the encodings of a CEJO implementation to selfequivalence encodings. This subroutine was proposed in [34] and combines the three generic CEJO attacks proposed in [3,17,29]; showing that the reduction subroutine does not succeed implies that neither the three generic CEJO attacks do.…”

“…Several CEJO implementations [3,14,23,26,27,37,43] have been proposed, but all of them have been broken. These attacks exploit some properties of the underlying cipher (AES in most cases), but efficient generic attacks have also been proposed to the CEJO framework [3,17,29], which can break CEJO implementations of a wide class of ciphers.…”

Cryptanalysis of ARX-based White-box Implementations

“…We will now use the method from [DFLM18] to partially recover the outer affine maps on the left branch. The idea is to query a fixed random input difference on the left branch and no difference on the right branch (possible due to the previous step), and to compute the dimension of the space of the observed output differences.…”

WARX: efficient white-box block cipher based on ARX primitives and random MDS matrix

“…However, the existing white-box schemes cannot meet these requirements. Since 2002, a number of white-box implementations of Data Encryption Standard (DES) and Advanced Encryption Standard (AES) have been proposed [1][2][3][4][5], but their security was penetrated [6][7][8][9][10][11][12]. At present, there are no recognized secure white-box implementations of DES/AES.…”