Implicit White-Box Implementations: White-Boxing ARX Ciphers

Abstract

Since the first white-box implementation of AES published twenty years ago, no significant progress has been made in the design of secure implementations against an attacker with full control of the device. Designing white-box implementations of existing block ciphers is a challenging problem, as all proposals have been broken. Only two whitebox design strategies have been published this far: the CEJO framework, which can only be applied to ciphers with small S-boxes, and selfequivalence encodings, which were only applied to AES. In this work we propose implicit implementations, a new design of whitebox implementations based on implicit functions, and we show that current generic attacks that break CEJO or self-equivalence implementations are not successful against implicit implementations. The generation and the security of implicit implementations are related to the self-equivalences of the non-linear layer of the cipher, and we propose a new method to obtain self-equivalences based on the CCZ-equivalence. We implemented this method and many other functionalities in a new open-source tool BoolCrypt, which we used to obtain for the first time affine, linear, and even quadratic self-equivalences of the permuted modular addition. Using the implicit framework and these self-equivalences, we describe for the first time a practical white-box implementation of a generic Addition-Rotation-XOR (ARX) cipher, and we provide an opensource tool to easily generate implicit implementations of ARX ciphers.

Cryptanalysis of ARX-based White-box Implementations

“…a bijective modular addition (called "permuted addition" in [RVP22], which we find ambiguous). A white-box round oracle or its modification is denoted by O : F N 2 → F N 2 .…”

“…for two consecutive rounds. However, the authors of [RVP22] proposed a way to generate encoded round functions satisfying the cancellation rule over 3 rounds (and not over 2 rounds):…”

“…Furthermore, it is important to evaluate whether the new design contributes towards security against generic attacks such as the differential computation analysis (DCA) [BHMT16] or the algebraic attack (also known as Linear Decoding Analysis, LDA) [GPRW20,BU18], which are only applicable in the "pure" white-box setting without external encodings. In this setting, we show a practical degree-2 algebraic key-recovery attack on the white-box implementation of Speck proposed in [RVP22]. To the best of our knowledge, this is the first application of the algebraic attack to an ARX primitive.…”

“…However, all of these proposals to "white-box" AES Table 1: Summary of attacks proposed in this paper. The branch size is denoted by n. Complexity is computed assuming encodings from [RVP22]. Target depends on round encodings: A for affine encodings, Q for sparse quadratic-affine encodings.…”

“…Our attacks were implemented and verified in practice on white-box instances of Speck32-64 and Speck64-128 generated by the code provided by the authors of [RVP22].…”