Feistel Network White-Box Cryptography Fault Attack Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
In the context of digital rights management, existing cryptographic implementations are vulnerable to fault attacks and key extraction in white-box cryptography scenarios where attackers have complete control over the system, making it difficult to secure decryption keys and enforce content usage terms.
Innovation Solution
A method using a Feistel network with a plurality of rounds in a keyed cryptographic system, where the input message is mapped to an output message through a network of basic blocks, including lookup tables and obfuscated intermediate results, to prevent key extraction and enhance tamper resistance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If traditional cryptographic implementations are used in white-box scenarios, then decryption functionality is provided, but the system becomes vulnerable to fault attacks and key extraction
Solution Approach 1:
The cryptographic system is divided into multiple Feistel rounds, each processing a portion of the data with a round key derived from the master key. This segmentation allows the system to maintain security while distributing the cryptographic operations across multiple stages, making fault attacks less effective as they would need to compromise multiple rounds simultaneously.
Solution Approach 2:
The implementation embeds multiple layers of protection within the cryptographic system, including lookup tables that contain pre-computed values, obfuscated intermediate results, and redundant computation paths. These nested structures ensure that even if one layer is compromised by a fault attack, other layers remain intact to protect the key material.
2Difficulty of detecting and measuring
If lookup tables are used to obscure cryptographic functions, then reverse engineering is prevented, but the system becomes vulnerable to memory analysis attacks
Solution Approach 1:
Instead of directly storing cryptographic operations in lookup tables, the system inverts the approach by storing obfuscated intermediate results and using multiple lookup tables that must be combined through complex operations. This inversion makes it difficult for attackers to directly analyze memory contents to extract key information, as the meaningful data is dispersed and transformed across multiple tables.
Solution Approach 2:
The system introduces intermediary computation steps between the lookup tables and the final cryptographic output. These intermediaries include additional XOR operations, permutations, and key mixing steps that transform the lookup table outputs before they contribute to the final result, thereby preventing direct correlation between memory contents and key material.
3Ease of operation
If decryption keys are stored in memory for content playback, then content decryption is enabled, but the keys become accessible to attackers through memory monitoring
Solution Approach 1:
The system implements dynamic key management where the master key is never stored in static memory locations. Instead, round keys are generated on-the-fly through key derivation functions and are constantly transformed and mixed with intermediate results during the Feistel rounds. This dynamic approach ensures that even if memory is monitored, the key material is in constant flux and cannot be directly captured.
Solution Approach 2:
The cryptographic system continuously changes the parameters of key storage and processing. Round keys are derived from the master key through multiple transformation steps, and their usage patterns change with each Feistel round. This parameter changing approach ensures that the same key material is represented in different forms at different stages, preventing attackers from identifying and extracting the key through static memory analysis.
Data Source
Figure 1
Figure 2
Figure 3
AI summary
A method of implementing a method of mapping an input message to an output message by a keyed cryptographic operation, wherein the keyed cryptographic operation includes a plurality of rounds using a Feistel network, including: receiving an input having a first half and a second half; performing, by a basic block, a portion of a round function on the second half to produce a portion of an encoded output, and wherein the basic block provides a portion of the second half as a portion of an encoded first input to a next round; and XORing the portion of the encoded output and a portion the first half to produce a portion of an encoded second input to the next round.