Discouraging Software Piracy Using Software Aging

Jakobsson, Markus; Reiter, Michael K.

doi:10.1007/3-540-47870-1_1

Cited by 20 publications

(14 citation statements)

References 2 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Among other available approaches, wbac-resistant cryptographic components can also (and are often recommended to) employ a strategy of regular software updates or replacements (cf. Jakobsson and Reiter [17]). When appropriate, such a design requires that protection need only withstand attacks for a limited period of time -thus counterbalancing the extreme threats faced, and the resulting limits on the level of protection possible.…”

Section: Black-box Gray-box and White-box Attack Contextsmentioning

confidence: 98%

White-Box Cryptography and an AES Implementation

Chow

Eisen

Johnson

et al. 2003

Lecture Notes in Computer Science

254

283

View full text Add to dashboard Cite

Abstract. Conventional software implementations of cryptographic algorithms are totally insecure where a hostile user may control the execution environment, or where co-located with malicious software. Yet current trends point to increasing usage in environments so threatened. We discuss encrypted-composed-function methods intended to provide a practical degree of protection against white-box (total access) attacks in untrusted execution environments. As an example, we show how aes can be implemented as a series of lookups in key-dependent tables. The intent is to hide the key by a combination of encoding its tables with random bijections representing compositions rather than individual steps, and extending the cryptographic boundary by pushing it out further into the containing application. We partially justify our aes implementation, and motivate its design, by showing how removal of parts of the recommended implementation allows specified attacks, including one utilizing a pattern in the aes SubBytes table.

show abstract

Section: Black-box Gray-box and White-box Attack Contextsmentioning

confidence: 98%

White-Box Cryptography and an AES Implementation

Chow

Eisen

Johnson

et al. 2003

Lecture Notes in Computer Science

254

283

View full text Add to dashboard Cite

show abstract

“…The idea is to use the concept of the software aging technique [29]: this forces, at a regular interval, updates to the white-box implementation. It is hoped that when this interval is small enough, this gives insufficient computational time to the adversary to extract the secret key from the white-box implementation.…”

Section: Scientific White-box Cryptography Techniques: An Overviewmentioning

confidence: 99%

Differential Computation Analysis: Hiding Your White-Box Designs is Not Enough

Bos

Hubain²,

Michiels

et al. 2016

Lecture Notes in Computer Science

View full text Add to dashboard Cite

Abstract. Although all current scientific white-box approaches of standardized cryptographic primitives are broken, there is still a large number of companies which sell "secure" white-box products. In this paper a new approach to assess the security of white-box implementations is presented which requires neither knowledge about the look-up tables used nor any reverse engineering effort. This differential computation analysis (DCA) attack is the software counterpart of the differential power analysis attack as applied by the cryptographic hardware community. We developed plugins to widely available dynamic binary instrumentation frameworks to produce software execution traces which contain information about the memory addresses being accessed. We show how DCA can extract the secret key from all publicly (non-commercial) available whitebox programs implementing standardized cryptography by analyzing these traces to identify secret-key dependent correlations.

show abstract

“…Another proposal [19] is cycling software (e.g. through some forced obsolescence) at a rate faster than an opponent can break it; this expects the model of forced software renewal (Jakobsson and Reiter [20]), who suggested hopeless pirates via forced updates and software aging). This technique is suitable where protection from attacks for a restricted time period suffices.…”

Section: Literature Surveymentioning

confidence: 99%