A Masked White-Box Cryptographic Implementation for Protecting Against Differential Computation Analysis

Lee, Seungkwang; Kim, Taesung; Kang, Young-Shik

doi:10.1109/tifs.2018.2825939

Cited by 24 publications

(15 citation statements)

References 21 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…This section provides a brief overview of the past design of masked WB-AES with a 128-bit key [20]. To do so, the principle of a customized masking technique on white-box cryptography is explained based on Chow's WB-AES [5].…”

Section: Past Design Of Masked Wb-aesmentioning

confidence: 99%

“…More importantly, these countermeasures require a run-time random source in order to generate masks uniformly at random and select one of the two lookup table sets, respectively. To prevent the key leakage by statistical analysis without using run-time random number generators, two techniques were incorporated into Chow's WB-AES [20]. First, each byte at the right-hand side of Equation (1) was concealed by masks randomly picked for each value of x i∈{0,1,2,3} .…”

Section: Past Design Of Masked Wb-aesmentioning

confidence: 99%

“…The customized implementation of masked WB-AES explained in the previous section was shown to be resistant to DCA attacks using one-byte key guess [20]. However, it was known to be vulnerable to DCA variants, including a 2-byte key guess and collision-based attacks.…”

Section: Vulnerability To Dca Variantsmentioning

confidence: 99%

“…One of the most well-known techniques protecting against statistical side-channel analysis like CPA is masking [16]- [19], which randomizes every intermediate values for each execution of encryption. In [20], a customized version of masking on a white-box AES (WB-AES) implementation (with a 128-bit key) was proposed to prevent DCA. Unlike the existing masking, it used different masks for each value of the intermediate variable and generated a set of masked lookup tables; thus, there is no need to mask the entire tables every time an encryption operation is performed.…”

Section: Introductionmentioning

confidence: 99%

See 3 more Smart Citations

Improvement on a Masked White-Box Cryptographic Implementation

Lee

Kim

2020

IEEE Access

Self Cite

View full text Add to dashboard Cite

White-box cryptography is a software technique to protect secret keys of cryptographic algorithms from attackers who have access to memory. By adapting techniques of differential power analysis to computation traces consisting of runtime information, Differential Computation Analysis (DCA) has recovered the secret keys from white-box cryptographic implementations. In order to thwart DCA, a masked white-box implementation was suggested. It was a customized masking technique that randomizes all the values in the lookup tables with different masks. However, the round output was only permuted by byte encodings, not protected by masking. This is the main reason behind the success of DCA variants on the masked white-box implementation. In this paper, we improve the masked white-box cryptography in such a way to protect against DCA variants by obfuscating the round output with random masks. Specifically, we introduce a white-box AES (WB-AES) implementation applying the masking technique to the key-dependent intermediate value and the several outer-round outputs computed by partial bits of the key. Our analysis and experimental results show that the proposed WB-AES can protect against DCA variants including DCA with a 2-byte key guess, collision, and bucketing attacks. This work requires approximately 3.7 times the table size and 0.7 times the number of lookups compared to the previous masked WB-AES.

show abstract

Section: Past Design Of Masked Wb-aesmentioning

confidence: 99%

Section: Past Design Of Masked Wb-aesmentioning

confidence: 99%

Section: Vulnerability To Dca Variantsmentioning

confidence: 99%

Section: Introductionmentioning

confidence: 99%

See 2 more Smart Citations

Improvement on a Masked White-Box Cryptographic Implementation

Lee

Kim

2020

IEEE Access

Self Cite

View full text Add to dashboard Cite

show abstract

“…Obfuscation techniques or the randomization of the location of the lookup tables can be used to enhance security of white-box algorithms [50], while [51] examines how these techniques are successful against both DCA and differential power attacks (DPA). The paper [52] exploits noncommutative groups to obfuscate operation that should be made on commutative ones and it is employed in the IoT framework.…”

Section: The White-box Approachmentioning

confidence: 99%

Measuring Performances of a White-Box Approach in the IoT Context

et al. 2019

View full text Add to dashboard Cite

The internet of things (IoT) refers to all the smart objects that are connected to other objects, devices or servers and that are able to collect and share data, in order to "learn" and improve their functionalities. Smart objects suffer from lack of memory and computational power, since they are usually lightweight. Moreover, their security is weakened by the fact that smart objects can be placed in unprotected environments, where adversaries are able to play with the symmetric-key algorithm used and the device on which the cryptographic operations are executed. In this paper, we focus on a family of white-box symmetric ciphers substitution-permutation network (SPN)box, extending and improving our previous paper on the topic presented at WIDECOM2019. We highlight the importance of white-box cryptography in the IoT context, but also the need to have a fast black-box implementation (server-side) of the cipher. We show that, modifying an internal layer of SPNbox, we are able to increase the key length and to improve the performance of the implementation. We measure these improvements (a) on 32/64-bit architectures and (b) in the IoT context by encrypting/decrypting 10,000 payloads of lightweight messaging protocol Message Queuing Telemetry Transport (MQTT).

show abstract