Differential Computation Analysis: Hiding Your White-Box Designs is Not Enough

  • Joppe W. Bos
  • Charles Hubain
  • Wil Michiels
  • Philippe Teuwen
Conference paper
Part of the Lecture Notes in Computer Science book series (LNCS, volume 9813)

Abstract

Although all current scientific white-box approaches of standardized cryptographic primitives are broken, there is still a large number of companies which sell “secure” white-box products. In this paper, we present a new approach to assess the security of white-box implementations which requires neither knowledge about the look-up tables used nor any reverse engineering effort. This differential computation analysis (DCA) attack is the software counterpart of the differential power analysis attack as applied by the cryptographic hardware community.

We developed plugins to widely available dynamic binary instrumentation frameworks to produce software execution traces which contain information about the memory addresses being accessed. To illustrate its effectiveness, we show how DCA can extract the secret key from numerous publicly (non-commercial) available white-box programs implementing standardized cryptography by analyzing these traces to identify secret-key dependent correlations. This approach allows one to extract the secret key material from white-box implementations significantly faster and without specific knowledge of the white-box design in an automated manner.

References

  1. 1.
    Amstadt, B., Johnson, M.K.: Wine. Linux J. 1994(4) (1994). http://dl.acm.org/citation.cfm?id=324681.324684, ISSN: 1075-3583
  2. 2.
    Barak, B., Garg, S., Kalai, Y.T., Paneth, O., Sahai, A.: Protecting obfuscation against algebraic attacks. In: Nguyen, P.Q., Oswald, E. (eds.) EUROCRYPT 2014. LNCS, vol. 8441, pp. 221–238. Springer, Heidelberg (2014)CrossRefGoogle Scholar
  3. 3.
    Barak, B., Goldreich, O., Impagliazzo, R., Rudich, S., Sahai, A., Vadhan, S.P., Yang, K.: On the (im)possibility of obfuscating programs. In: Kilian, J. (ed.) CRYPTO 2001. LNCS, vol. 2139, pp. 1–18. Springer, Heidelberg (2001)CrossRefGoogle Scholar
  4. 4.
    Bédrune, J.-B.: Hack.lu 2009 reverse challenge 1 (2009). http://2009.hack.lu/index.php/ReverseChallenge
  5. 5.
    Bhatkar, S., DuVarney, D.C., Sekar, R.: Address obfuscation: an efficient approach to combat a broad range of memory error exploits. In: Proceedings of the 12th USENIX Security Symposium. USENIX Association (2003)Google Scholar
  6. 6.
    Biham, E., Shamir, A.: Differential cryptanalysis of Snefru, Khafre, REDOC-II, LOKI and Lucifer. In: Feigenbaum, J. (ed.) CRYPTO 1991. LNCS, vol. 576, pp. 156–171. Springer, Heidelberg (1992)Google Scholar
  7. 7.
    Billet, O., Gilbert, H.: A traceable block cipher. In: Laih, C.-S. (ed.) ASIACRYPT 2003. LNCS, vol. 2894, pp. 331–346. Springer, Heidelberg (2003)CrossRefGoogle Scholar
  8. 8.
    Billet, O., Gilbert, H., Ech-Chatbi, C.: Cryptanalysis of a white box AES implementation. In: Handschuh, H., Hasan, M.A. (eds.) SAC 2004. LNCS, vol. 3357, pp. 227–240. Springer, Heidelberg (2004)CrossRefGoogle Scholar
  9. 9.
    Biryukov, A., Canniére, C., Braeken, A., Preneel, B.: A toolbox for cryptanalysis: linear and affine equivalence algorithms. In: Biham, E. (ed.) EUROCRYPT 2003. LNCS, vol. 2656, pp. 33–50. Springer, Heidelberg (2003)CrossRefGoogle Scholar
  10. 10.
    Brakerski, Z., Rothblum, G.N.: Virtual black-box obfuscation for all circuits via generic graded encoding. In: Lindell, Y. (ed.) TCC 2014. LNCS, vol. 8349, pp. 1–25. Springer, Heidelberg (2014)CrossRefGoogle Scholar
  11. 11.
    Brier, E., Clavier, C., Olivier, F.: Correlation power analysis with a leakage model. In: Joye, M., Quisquater, J.-J. (eds.) CHES 2004. LNCS, vol. 3156, pp. 16–29. Springer, Heidelberg (2004)CrossRefGoogle Scholar
  12. 12.
    Bringer, J., Chabanne, H., Dottax, E.: White box cryptography: another attempt. Cryptology ePrint Archive, Report 2006/468 (2006). http://eprint.iacr.org/2006/468
  13. 13.
  14. 14.
    Chari, S., Jutla, C.S., Rao, J.R., Rohatgi, P.: Towards sound approaches to counteract power-analysis attacks. In: Wiener, M. (ed.) CRYPTO 1999. LNCS, vol. 1666, pp. 398–412. Springer, Heidelberg (1999)Google Scholar
  15. 15.
    Chari, S., Rao, J.R., Rohatgi, P.: Template attack. In: Kaliski Jr., B.S., Koç, Ç.K., Paar, C. (eds.) CHES 2002. LNCS, vol. 2523, pp. 13–28. Springer, Heidelberg (2003)CrossRefGoogle Scholar
  16. 16.
    Chow, S., Eisen, P.A., Johnson, H., van Oorschot, P.C.: White-box cryptography and an AES implementation. In: Nyberg, K., Heys, H.M. (eds.) SAC 2002. LNCS, vol. 2595, pp. 250–270. Springer, Heidelberg (2003)CrossRefGoogle Scholar
  17. 17.
    Chow, S., Eisen, P., Johnson, H., van Oorschot, P.C.: A white-box DES implementation for DRM applications. In: Feigenbaum, J. (ed.) DRM 2002. LNCS, vol. 2696, pp. 1–15. Springer, Heidelberg (2003)CrossRefGoogle Scholar
  18. 18.
    de Mulder, Y.: White-box cryptography: analysis of white-box AES implementations. Ph.D. thesis, KU Leuven (2014)Google Scholar
  19. 19.
    Delerablée, C., Lepoint, T., Paillier, P., Rivain, M.: White-box security notions for symmetric encryption schemes. In: Lange, T., Lauter, K., Lisoněk, P. (eds.) SAC 2013. LNCS, vol. 8282, pp. 247–264. Springer, Heidelberg (2014)CrossRefGoogle Scholar
  20. 20.
  21. 21.
    Falco, F., Riva, N.: Dynamic binary instrumentation frameworks: I know you’re there spying on me. In: REcon (2012). http://recon.cx/2012/schedule/events/216.en.html
  22. 22.
    Garg, S., Gentry, C., Halevi, S., Raykova, M., Sahai, A., Waters, B.: Candidate indistinguishability obfuscation and functional encryption for all circuits. In: 54th Annual IEEE Symposium on Foundations of Computer Science, FOCS, pp. 40–49. IEEE Computer Society (2013)Google Scholar
  23. 23.
    Goubin, L., Masereel, J.-M., Quisquater, M.: Cryptanalysis of white box DES implementations. In: Adams, C., Miri, A., Wiener, M. (eds.) SAC 2007. LNCS, vol. 4876, pp. 278–295. Springer, Heidelberg (2007)CrossRefGoogle Scholar
  24. 24.
    Goubin, L., Patarin, J.: DES and differential power analysis. In: Koç, Ç.K., Paar, C. (eds.) CHES 1999. LNCS, vol. 1717, pp. 158–172. Springer, Heidelberg (1999)Google Scholar
  25. 25.
    Huang, Y., Ho, F.S., Tsai, H., Kao, H.M.: A control flow obfuscation method to discourage malicious tampering of software codes. In: Lin, F., Lee, D., Lin, B.P., Shieh, S., Jajodia, S. (eds.) Proceedings of the 2006 ACM Symposium on Information, Computer and Communications Security, ASIACCS 2006, p. 362. ACM (2006)Google Scholar
  26. 26.
    Jacob, M., Boneh, D., Felten, E.W.: Attacking an obfuscated cipher by injecting faults. In: Feigenbaum, J. (ed.) DRM 2002. LNCS, vol. 2696, pp. 16–31. Springer, Heidelberg (2003)CrossRefGoogle Scholar
  27. 27.
    Jakobsson, M., Reiter, M.K.: Discouraging software piracy using software aging. In: Sander, T. (ed.) DRM 2001. LNCS, vol. 2320, pp. 1–12. Springer, Heidelberg (2002)CrossRefGoogle Scholar
  28. 28.
    Karroumi, M.: Protecting white-box AES with dual ciphers. In: Rhee, K.-H., Nyang, D.H. (eds.) ICISC 2010. LNCS, vol. 6829, pp. 278–291. Springer, Heidelberg (2011)CrossRefGoogle Scholar
  29. 29.
    Kirsch, J.: Towards transparent dynamic binary instrumentation using virtual machine introspection. In: REcon (2015). https://recon.cx/2015/schedule/events/20.html
  30. 30.
    Klinec, D.: White-box attack resistant cryptography. Master’s thesis, Masaryk University, Brno, Czech Republic (2013). https://is.muni.cz/th/325219/fi_m/
  31. 31.
    Kocher, P., Jaffe, J., Jun, B., Rohatgi, P.: Introduction to differential power analysis. J. Cryptogr. Eng. 1(1), 5–27 (2011)CrossRefGoogle Scholar
  32. 32.
    Kocher, P.C., Jaffe, J., Jun, B.: Differential power analysis. In: Wiener, M. (ed.) CRYPTO 1999. LNCS, vol. 1666, pp. 388–397. Springer, Heidelberg (1999)CrossRefGoogle Scholar
  33. 33.
    Lepoint, T., Rivain, M., De Mulder, Y., Roelse, P., Preneel, B.: Two attacks on a white-box AES implementation. In: Lange, T., Lauter, K., Lisoněk, P. (eds.) SAC 2013. LNCS, vol. 8282, pp. 265–286. Springer, Heidelberg (2014)CrossRefGoogle Scholar
  34. 34.
    Li, X., Li, K.: Defeating the transparency features of dynamic binary instrumentation. In: BlackHat US (2014). https://www.blackhat.com/docs/us-14/materials/us-14-Li-Defeating-The-Transparency-Feature-Of-DBI.pdf
  35. 35.
    Link, H.E., Neumann, W.D.: Clarifying obfuscation: improving the security of white-box DES. In: International Symposium on Information Technology: Coding and Computing (ITCC 2005), pp. 679–684. IEEE Computer Society (2005)Google Scholar
  36. 36.
    Linn, C., Debray, S.K.: Obfuscation of executable code to improve resistance to static disassembly. In: Jajodia, S., Atluri, V., Jaeger, T. (eds.) Proceedings of the 10th ACM Conference on Computer and Communications Security, CCS 2003, pp. 290–299. ACM (2003)Google Scholar
  37. 37.
    Luk, C., Cohn, R.S., Muth, R., Patil, H., Klauser, A., Lowney, P.G., Wallace, S., Reddi, V.J., Hazelwood, K.M.: Pin: building customized program analysis tools with dynamic instrumentation. In: Sarkar, V., Hall, M.W. (eds.) Proceedings of the ACM SIGPLAN 2005 Conference on Programming Language Design and Implementation, pp. 190–200. ACM (2005)Google Scholar
  38. 38.
    Maillet, A.: Nosuchcon 2013 challenge - write up and methodology (2013). http://kutioo.blogspot.be/2013/05/nosuchcon-2013-challenge-write-up-and.html
  39. 39.
    Mangard, S., Oswald, E., Standaert, F.: One for all - all for one: unifying standard differential power analysis attacks. IET Inf. Secur. 5(2), 100–110 (2011)CrossRefGoogle Scholar
  40. 40.
    Marceau, F., Perigaud, F., Tillequin, A.: Challenge SSTIC 2012 (2012). http://communaute.sstic.org/ChallengeSSTIC2012
  41. 41.
    Messerges, T.S.: Using second-order power analysis to attack DPA resistant software. In: Paar, C., Koç, Ç.K. (eds.) CHES 2000. LNCS, vol. 1965, pp. 238–251. Springer, Heidelberg (2000)CrossRefGoogle Scholar
  42. 42.
    Michiels, W.: Opportunities in white-box cryptography. IEEE Secur. Priv. 8(1), 64–67 (2010)MathSciNetCrossRefGoogle Scholar
  43. 43.
    Mougey, C., Gabriel, F.: Désobfuscation de DRM par attaques auxiliaires. In: Symposium sur la sécurité des technologies de l’information et des communications (2014). http://www.sstic.org/2014/presentation/dsobfuscation_de_drm_par_attaques_auxiliaires
  44. 44.
    De Mulder, Y., Roelse, P., Preneel, B.: Cryptanalysis of the Xiao–Lai white-box AES implementation. In: Knudsen, L.R., Wu, H. (eds.) SAC 2012. LNCS, vol. 7707, pp. 34–49. Springer, Heidelberg (2013)CrossRefGoogle Scholar
  45. 45.
    De Mulder, Y., Wyseur, B., Preneel, B.: Cryptanalysis of a perturbated white-box AES implementation. In: Gong, G., Gupta, K.C. (eds.) INDOCRYPT 2010. LNCS, vol. 6498, pp. 292–310. Springer, Heidelberg (2010)CrossRefGoogle Scholar
  46. 46.
    Nethercote, N., Seward, J.: Valgrind: a framework for heavyweight dynamic binary instrumentation. In: Ferrante, J., McKinley, K.S., (eds.) Proceedings of the ACM SIGPLAN 2007 Conference on Programming Language Design and Implementation, pp. 89–100. ACM (2007)Google Scholar
  47. 47.
    Nikova, S., Rechberger, C., Rijmen, V.: Threshold implementations against side-channel attacks and glitches. In: Ning, P., Qing, S., Li, N. (eds.) ICICS 2006. LNCS, vol. 4307, pp. 529–545. Springer, Heidelberg (2006)CrossRefGoogle Scholar
  48. 48.
    Polla, M.L., Martinelli, F., Sgandurra, D.: A survey on security for mobile devices. IEEE Commun. Surv. Tutor. 15(1), 446–471 (2013)CrossRefGoogle Scholar
  49. 49.
    Sanfelix, E., de Haas, J., Mune, C.: Unboxing the white-box: practical attacks against obfuscated ciphers. In: BlackHat Europe 2015 (2015). https://www.blackhat.com/eu-15/briefings.html
  50. 50.
    Sasdrich, P., Moradi, A., Güneysu, T.: White-box cryptography in the gray box - a hardware implementation and its side channels. In: FSE 2016, LNCS. Springer, Heidelberg (2016, to appear)Google Scholar
  51. 51.
    Schramm, K., Paar, C.: Higher order masking of the AES. In: Pointcheval, D. (ed.) CT-RSA 2006. LNCS, vol. 3860, pp. 208–225. Springer, Heidelberg (2006)CrossRefGoogle Scholar
  52. 52.
    Scrinzi, F.: Behavioral analysis of obfuscated code. Master’s thesis, University of Twente, Twente, Netherlands (2015). http://essay.utwente.nl/67522/1/Scrinzi_MA_SCS.pdf
  53. 53.
    Souchet, A.: AES whitebox unboxing: No such problem (2013). http://0vercl0k.tuxfamily.org/bl0g/?p=253
  54. 54.
    SysK: Practical cracking of white-box implementations. Phrack 68: 14. http://www.phrack.org/issues/68/8.html
  55. 55.
    Teuwen, P.: CHES2015 writeup (2015). http://wiki.yobi.be/wiki/CHES2015_Writeup#Challenge_4
  56. 56.
    Teuwen, P.: NSC writeups (2015). http://wiki.yobi.be/wiki/NSC_Writeups
  57. 57.
    Tolhuizen, L.: Improved cryptanalysis of an AES implementation. In: Proceedings of the 33rd WIC Symposium on Information Theory. Werkgemeenschap voor Inform.-en Communicatietheorie (2012)Google Scholar
  58. 58.
    Vanderbéken, E.: Hacklu reverse challenge write-up (2009). http://baboon.rce.free.fr/index.php?post/2009/11/20/HackLu-Reverse-Challenge
  59. 59.
    Wyseur, B., Michiels, W., Gorissen, P., Preneel, B.: Cryptanalysis of white-box DES implementations with arbitrary external encodings. In: Adams, C., Miri, A., Wiener, M. (eds.) SAC 2007. LNCS, vol. 4876, pp. 264–277. Springer, Heidelberg (2007)CrossRefGoogle Scholar
  60. 60.
    Xiao, Y., Lai, X.: A secure implementation of white-box AES. In: 2nd International Conference on Computer Science and its Applications 2009, CSA 2009, pp. 1–6 (2009)Google Scholar
  61. 61.
    Zhou, Y., Chow, S.: System and method of hiding cryptographic private keys. 15 December 2009. US Patent 7,634,091Google Scholar

Copyright information

© International Association for Cryptologic Research 2016

Authors and Affiliations

  • Joppe W. Bos
    • 1
  • Charles Hubain
    • 2
  • Wil Michiels
    • 1
    • 3
  • Philippe Teuwen
    • 2
  1. 1.NXP SemiconductorsLeuvenBelgium
  2. 2.QuarkslabParisFrance
  3. 3.Technische Universiteit EindhovenEindhovenThe Netherlands

Personalised recommendations