Review of White-box Implementations of AES Block Cipher and Known Attacks

Abstract

Conventional encryption algorithms are designed to be secure in the “black-box” context, i.e. the attacker has access to the input and output of the algorithm, but cannot observe the intermediate values generated during the software execution. Yet in some cases, the encryption algorithm runs in a hostile environment, where the attacker can see not only the input and output values but also has full access to all the internal values and can change the execution at will. White-box cryptography algorithms are designed to be executed in such untrusted environments and are said to operate in the white-box attack context. A white-box implementation of AES cipher was first presented by Chow, Eisen, Johnson and van Oorschot in 2002 [1], which was shown to be insecure against the BGE attack presented by Billet, Gilbert and Ech-Chatbi in 2004 [2]. In 2010, another white-box AES implementation was presented by Karroumi, which was supposed to withstand the BGE attack [3]. In 2013, De Mulder, Roelse, and Preneel showed, that Karroumis and Chows implementations are equivalent, i.e. the BGE attack can be successfully applied to both [4]. They also presented several optimizations, which reduce the work factor of the attack to 222 work steps. In this paper we will review both AES implementations and the BGE attacks.