Multiplicative Key Splitting for White Box Cipher Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptographic implementations, such as AES, are insecure in the White Box threat model where an attacker has full access to the system, allowing them to extract the secret key by observing operations acting on it, especially when the key is derived through a process unknown at code compilation time or when storing numerous lengthy keys is impractical.
Innovation Solution
The method employs algebraic properties of the AES S-box operation to compute the Add Round Key (ARK) cipher operation using operations before and after the S-box, avoiding direct S-box usage and storing the key in a novel masked form using an inversion function and affine operation, applicable to block ciphers with inversion functions.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If the key is stored in conventional form in memory, then the encryption operation can be performed efficiently, but the attacker can easily extract the secret key by observing operations acting on the key in White Box environments
Solution Approach 1:
The secret key is segmented into multiple components through multiplicative splitting. The key is divided into several key components that are stored separately in memory, preventing the attacker from recovering the complete key by observing single memory locations. This segmentation approach maintains security while enabling efficient encryption operations.
Solution Approach 2:
An intermediary computation process is introduced between key storage and encryption operation. Instead of directly using stored key components, the system performs multiplicative splitting and combination operations that transform the key components into usable form only during computation, preventing direct observation of the secret key.
2Reliability
If extensive table lookups are used to protect the key, then security against key extraction is improved, but the encryption operation becomes slower and more complex
Solution Approach 1:
The patent replaces the mechanical table lookup approach with an algebraic computation approach. Instead of using extensive pre-computed tables to obscure key operations, the system uses multiplicative splitting combined with field inversion operations, reducing the need for large lookup tables while maintaining security and improving computational efficiency.
Solution Approach 2:
The patent changes the mathematical parameters and operations used in key protection. By transitioning from additive masking to multiplicative splitting in finite fields, the system achieves better security properties with fewer lookup tables, thereby improving encryption speed while maintaining protection against key extraction.
3Adaptability or versatility
If the key is derived through a process unknown at code compilation time, then adaptability to different keys is improved, but the attacker can still extract the key by observing operations in White Box environments
Solution Approach 1:
The patent introduces dynamic key component generation through multiplicative splitting. The key components are not fixed at compilation time but are dynamically computed during runtime based on the secret key and public parameters. This dynamic approach maintains adaptability to different keys while preventing extraction attacks through the use of field inversion operations.
Data Source
AI summary
In the field of computer enabled cryptography, such as a keyed block cipher having a plurality of rounds, the cipher is hardened against an attack by a protection process which obscures the round keys using the properties of group field automorphisms and applying masks to the states of the cipher, for encryption or decryption. This is especially advantageous in a “White Box” environment where an attacker has full access to the cipher algorithm, including the algorithm's internal state during its execution. This method and the associated computing apparatus are useful for protection against known attacks on “White Box” ciphers, by eliminating S-box operations, together with improved masking techniques and increasing the cipher's complexity against reverse engineering and key storage attacks.