- Abstract
- Types of attacks on cryptographic keys
- Black-box attacks
- Gray-box attacks
- White-box attacks
- Solutions against white-box attacks
- Software solution: White-Box Cryptography
Modern cryptography is implemented on computers as two basic elements: a cryptographic algorithm and a cryptographic key.
Since the algorithms themselves are standardized, the security of a system ultimately rests on its key — the secret key of a symmetric algorithm or the private key of an asymmetric one.
Research in cryptography therefore covers not only the algorithms, but also techniques that protect keys and the attacks that try to obtain them.
Two approaches are used to keep keys safe: a hardware solution, the HSM (Hardware Security Module), and a software solution, White-Box Cryptography (WBC). HSMs have been proven in industry for decades, while WBC has been drawing attention more recently.
Attacks on cryptographic keys fall into three categories.
The attacker only sees inputs and outputs — plaintexts, ciphertexts and, for asymmetric algorithms, the public key — and cannot observe the algorithm while it runs, hence "black box".
Security depends on the algorithm and the key length. Such attacks need a great deal of computation, and rotating keys regularly is the usual countermeasure.
The attacker uses information leaked while the algorithm runs, such as timing, power consumption or electromagnetic emanation. These are also called side-channel attacks; the cold boot attack, which recovers keys from memory, is often counted among them.
Countermeasures prevent the leakage physically, or implement the algorithm so that leaked information does not reveal the key ("side-channel resistant" implementations). "Gray box" means a level between black box and white box.
The attacker has full access to the execution environment and can inspect memory and every step of the computation, for example with debuggers, emulators and reverse engineering. This is also called a total-access attack.
Because black-box attacks are so costly, attackers who want a key usually try gray-box or white-box attacks — for instance by getting malware onto a user's system or by stealing a device that holds the key.
The two answers to white-box attacks are the HSM (hardware) and WBC (software).
From an application developer's point of view, how keys are stored depends on whether the platform offers hardware support such as a TPM or a TEE. Without it, keys must at least be protected with password-based encryption or obfuscation so that they never appear in plaintext.
WBC is attractive because it is purely software and therefore hardware independent: the key is never supplied as an input, but is embedded in the cryptographic function itself.
White-box cryptography assumes that the algorithm runs on an open platform that anyone — including an attacker — can inspect, which is exactly the white-box attack model. Its goal is to keep the key (and related secrets such as salts) safe even if the device is lost or an attacker is present on it.
Compared with an HSM, WBC avoids hardware cost and integration effort, and it is easy to patch and upgrade.
WBC does not compete with standardized algorithms; it uses them and protects the key in software. The key is mixed into the implementation of the algorithm, a state called obfuscation: the algorithm and the key are combined into newly generated code, the "white-box cryptographic function", which performs the same encryption and decryption without ever exposing the key. The first proposals used lookup tables for this mapping; later designs achieve the same goal with code alone.
Open challenges for WBC are reducing the size of the implementations and improving their speed. New non-standard ciphers designed to provide stronger security in the white-box setting, known as white-box friendly ciphers, are also being developed.