White-Box Security Notions for Symmetric Encryption Schemes

Abstract

Abstract. White-box cryptography has attracted a growing interest from researchers in the last decade. Several white-box implementations of standard block-ciphers (DES, AES) have been proposed but they have all been broken. On the other hand, neither evidence of existence nor proofs of impossibility have been provided for this particular setting. This might be in part because it is still quite unclear what white-box cryptography really aims to achieve and which security properties are expected from white-box programs in applications. This paper builds a first step towards a practical answer to this question by translating folklore intuitions behind white-box cryptography into concrete security notions. Specifically, we introduce the notion of white-box compiler that turns a symmetric encryption scheme into randomized white-box programs, and we capture several desired security properties such as one-wayness, incompressibility and traceability for white-box programs. We also give concrete examples of white-box compilers that already achieve some of these notions. Overall, our results open new perspectives on the design of white-box programs that securely implement symmetric encryption.

Differential Computation Analysis: Hiding Your White-Box Designs is Not Enough

“…Formal security notions for symmetric white-box schemes are discussed and introduced in [59,22]. In [11] it is shown how one can use the ASASA construction with injective Sboxes (where ASA stands for the affine-substitution-affine [55] construction) to instantiate white-box cryptography.…”

“…This is equivalent to a setting where one has only black-box access to the implementation. As observed by [22] this means that such a white-box implementation should resist all existing and future side-channel attacks. In this paper we explore exactly this idea and check if we can deduce information about the secret embedded in a white-box implementation by correlating key guesses to intermediate results obtained from software traces.…”

“…Moreover, the authors of [35] built upon a 2012 result [65] which improves the most time-consuming phase of the BGE attack. This reduces the cost of the BGE attack to a time complexity of 2 22 . An independent attack, of the same time complexity, is presented in [35] as well.…”

Smart Card Research and Advanced Applications

“…This stresses the need for further security notions dedicated to white-box cryptography. We then review some previous works on the subject and in particular the notions of unbreakability, one-wayness, incompressibility and traceability as formalised in [DLPR14].…”

Efficient and Provable White-Box Primitives

“…A less ambitious goal, proposed in [DLPR13,BBK14] is that an adversary having access to the implementation of an encryption scheme may be able to encrypt (at least via code lifting), but should remain unable to decrypt. This notion is called strong white-box in [BBK14] and one-wayness in [DLPR13].…”