White-Box Cryptography and an AES Implementation

Abstract

Abstract. Conventional software implementations of cryptographic algorithms are totally insecure where a hostile user may control the execution environment, or where co-located with malicious software. Yet current trends point to increasing usage in environments so threatened. We discuss encrypted-composed-function methods intended to provide a practical degree of protection against white-box (total access) attacks in untrusted execution environments. As an example, we show how aes can be implemented as a series of lookups in key-dependent tables. The intent is to hide the key by a combination of encoding its tables with random bijections representing compositions rather than individual steps, and extending the cryptographic boundary by pushing it out further into the containing application. We partially justify our aes implementation, and motivate its design, by showing how removal of parts of the recommended implementation allows specified attacks, including one utilizing a pattern in the aes SubBytes table.

Building Secure Block Ciphers on Generic Attacks Assumptions

“…It may even be possible to design a key expansion procedure relying itself on the Russian Dolls construction with PRFs rather than PRPs. Besides, we'd like to underline that the nonexistence of short keys may be turned into an advantage in some cases, particularly in a white-box context of operation [9]. We leave this as topics for further research.…”

Smart Card Research and Advanced Applications

“…Thomas The goal of white-box cryptography, as introduced in 2002 by Chow et al, is to protect a secret key used in a cryptographic software against an adversary that has full access to the underlying execution environment [CEJvO02,CEJv03]. The basic approach is to design an obfuscated cryptographic implementation embedding the key so that, even for such a powerful adversary, key recovery is made difficult.…”

System-Level Methods to Prevent Reverse-Engineering, Cloning, and Trojan Insertion

“…Concrete implementations of whitebox cryptography make of secret tables much smaller than the codebook [7]. This solution is attractive in hardware also, since EEPROM memories are much more difficult to read by invasive means than RAM or ROM.…”