1. Applying White-Box Cryptography SoBeNet user group meeting October 8, 2004 Brecht Wyseur

2. SoBeNet – Track 3 “Software Tamper Resistance” COSIC – Computer Security and Industrial Cryptography Members  Prof. Bart Preneel  Jan Cappaert  Brecht Wyseur Project Involvement  Obfuscation (Jan)  White-Box Cryptography (Brecht)

3. Overview Problem Description State-Of-The-Art White-Box Transformations Pro’s and Cons Future Research

4. Problem Description Quite easy to find stored or embedded keys  Shamir et al.: Playing hide and seek with stored keys  Algebraic attack on RSA key  Attack through entropy data Key information

5. White-Box Cryptography (chow et al. 2002) White-box attack context (WBAC) a.k.a. Malicious host attack context  Full-privileged attack software shares a host with cryptographic software, having complete access to the implementation of algorithms;  Dynamic execution (with instantiated cryptographic keys) can be observed;  Internal algorithm details are completely visible and alterable at will. The attacker's objective is to extract the cryptographic key, e.g. For use on a standard implementation of the same algorithm on a different platform.

6. Applications Software Agents  Embedded cryptographic keys for signing purposes Digital Rights Management (DRM) Smart Card Technology Asymmetric crypto system

7. State-Of-The-Art Sander et al.: Impossible situation to secure August 2002 – Chow et al.  A White-Box DES Implementation  A White-Box AES Implementation Link et al. – Security issues and improvements “Choice of implementation the sole remaining line of defense”

8. General idea (1) Expanding the cryptographic border External function encoding Attacker:  Analyse  Isolate random bijections  Analyse to find Goal: make isolation difficult Cryptographic algorithm Authentication code …

9. General Idea (2) Spreading embedded secret information Thus forcing an attacker to understand a greater part of the implementation KEY

10. How? White-Box Transformations Transform an algorithm into a series of key- dependant lookup tables

11. White-Box Transformations Partial Evaluation Combined Function Encoding By-Pass Encoding Split Path Encoding … Techniques apply on cryptographic algorithms build with XOR, substitution and permutation functions AES, DES, …

12. White-Box Transformations (2) Partial Evaluation 6 4 S Definition of a new key- dependant lookup table k

13. Internal Function Encoding A A B B A’ B’ Encoded version: f f g g Choose random bijection and White-Box Transformations (3)

14. Local Security Internal function encoding provides local security A’ is known. Because the bijection f is random, no information can be revealed of A (similar to one time path)

15. Global Security Currently no proof Can we guarantee white-box security? Trade-off between performance and level of security AES: Cryptanalysis by Billet et al. (2004)

16. Some Numbers DES  Chow et al.: 4,54 Mb  Improvement by Link et al.: 2,25 Mb AES  Normal implementation: 4.352 bytes  Chow et al.: 770.048 bytes 177 times bigger, 55 times slower 3104 lookups

17. Pro’s and Cons Pro’s  Expansion of cryptographic boundaries  Diversity by injection of random bijections Cons  Performance reduction  Implementation size  Lack of proof of security

18. Future Research Development of new techniques  Algebraic transformations  Dynamic key implementations Proof of security Development of an automated application tool Improve security with Obfuscation techniques