Cryptographic Key Masking via Table Lookups in White Box Environments
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptographic implementations in the White Box model, such as AES, are insecure when an attacker has complete control over the execution process, as they can easily extract the secret key from memory by observing operations, especially when keys are unknown at code compilation time or when dealing with distributed users or large numbers of keys.
Innovation Solution
A method that masks and hides cryptographic keys using complex digital masks and permutations, storing them in a 'blob' memory array, with dynamic and static table look-ups to protect against key extraction, allowing for secure key usage even when keys are unknown at compilation time or when memory size is limited.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If conventional AES software implementation is used in White Box model, then encryption can be performed, but the secret key can be easily extracted from memory by observing operations
Solution Approach 1:
The patent introduces table lookup operations as an intermediary between the key and the encryption operations. The tables are pre-computed with masked key values, so that during encryption, the attacker observes only the table lookup operations rather than the actual key values. This intermediary structure prevents direct observation of the key while still enabling correct encryption functionality.
Solution Approach 2:
The patent performs preliminary action by pre-computing and storing masked table lookup tables during system initialization. These tables are generated in advance with the secret key incorporated into their structure, so that when encryption operations execute, the key is already embedded in the tables rather than being explicitly present in memory during operation. This advance preparation eliminates the need for the key to be visible during the critical encryption phase.
2Productivity
If keys are stored in memory for encryption operations, then encryption can be performed, but attackers can observe key operations and extract keys
Solution Approach 1:
The table lookup tables serve as an intermediary that allows encryption operations to proceed efficiently without exposing the key. The tables are structured to incorporate key material in a masked form, enabling fast lookup operations that are computationally efficient while preventing key information from being directly observable in memory during encryption execution.
Solution Approach 2:
The patent changes the parameter representation of the key from its standard form (explicit key values in memory) to a transformed form (masked key values embedded in table lookup tables). This parameter transformation allows the key to be functional for encryption while changing its memory representation to be unrecognizable to attackers performing memory observation or operation analysis.
3Reliability
If table lookup tables are used to mask keys, then key security is improved, but more memory is required to store the tables
Solution Approach 1:
The patent segments the key protection into separate table lookup tables, where each table corresponds to a specific encryption operation or key material segment. This segmentation allows the tables to be generated and stored in a modular fashion, reducing overall memory requirements compared to storing complete key schedules or multiple key variants simultaneously. Each table is optimized for its specific function and can be loaded into memory only when needed.
Data Source
AI summary
In the field of cryptography, such as for a computer enabled block cipher, a cipher or other cryptographic process is hardened against an attack by protecting the cipher key or subkeys by using a masking process for these keys. The subkeys are thereby protected by applying to them a mask or set of masks to hide their contents. This is especially advantageous in a “White Box” computing environment where an attacker has full access to the cipher algorithm, including the algorithm's internal state during execution. Further, this method and the associated apparatus are useful where the key is derived through a process and so is unknown when the software code embodying the cipher is compiled. This is typically the case where there are many users of the cipher and each has his own key or where each user session has its own key.