Towards Security Notions for White-Box Cryptography

Abstract

Abstract. While code obfuscation attempts to hide certain characteristics of a program independently of an application, white-box cryptography (WBC) specifically focuses on software implementations of cryptographic primitives in an application. The aim of WBC is to resist attacks from an adversary having access to some 'executable' code with an embedded secret key. WBC, if possible, would have several applications. However, unlike obfuscation, it lacks a theoretical foundation. We present a first step towards a theoretical model of WBC via white-box security notions. We also present some positive and negative results on WBC and obfuscation. In particular, we show that for most interesting programs (such as an encryption algorithm), there are security notions that cannot be satisfied when the adversary has white-box access, while they are satisfied when it has black-box access. On the positive side, we show that there exists an obfuscator for a symmetric encryption scheme in the context of a useful security-notion (such as IND-CPA).

Differential Computation Analysis: Hiding Your White-Box Designs is Not Enough

“…Formal security notions for symmetric white-box schemes are discussed and introduced in [59,22]. In [11] it is shown how one can use the ASASA construction with injective Sboxes (where ASA stands for the affine-substitution-affine [55] construction) to instantiate white-box cryptography.…”

White-Box Security Notions for Symmetric Encryption Schemes

“…A first step towards a theoretical model was proposed by Saxena, Wyseur and Preneel [28], and subsequently extended by Wyseur in his PhD thesis [30]. These results show how to translate any security notion in the black-box model into a security notion in the white-box model.…”

“…As a matter of fact, some of our security notions are not black-box notions that one would wish to preserve in the whitebox setting, but arise from new features potentially introduced by the white-box compilation. Note that although we use a different formalism and pursue different goals, our work and those in [28,30] are not in contradiction but rather co-exist in a wider framework.…”

A framework for analyzing RFID distance bounding protocols

“…This is not always relevant in RFID, where one may clearly distinguish the Human prover from the prover's device. We model these concepts by introducing the black-box [8,60] and white-box [15,52] models in our framework. This allows to refine the success probabilities of an adversary and point out that some published works underestimate the success probabilities when the prover has a full control on the execution of the algorithm.…”