S-box Selection in White-Box Cryptography

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

In whitebox cryptography, protecting inputs to the S-box layer of a symmetric cipher is challenging due to known attacks that target fixed encodings, and existing methods have weaknesses such as constant points that can be exploited by attackers.

Innovation Solution

The implementation of a cryptographic system using a substitution box with self-equivalent affine functions, where the minimum diversification number is maximized by constructing a set of self-equivalences to prevent fixed encodings and ensure that each input value can be mapped to multiple output values, thereby enhancing security against attacks.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of manufacture

If fixed encodings are used in the S-box layer, then the implementation is simpler, but security is weakened due to exploitable constant points

Engineering Contradiction:
Improveimplementation simplicityVSAvoidsecurity against attacks
Core Design Contradiction:
Ease of manufactureVSReliability

Solution Approach 1:

The patent applies dynamics by making the S-box encoding variable rather than fixed. The system dynamically selects from multiple self-equivalent affine encodings based on the input value, ensuring that the encoding changes with each input. This prevents attackers from exploiting constant points while maintaining implementation feasibility through pre-computed encoding tables.

Inventive Principle:
Principle #15Dynamics

Solution Approach 2:

The patent changes the parameter of encoding from fixed to variable by introducing self-equivalent affine transformations. Different affine encodings are applied depending on the input value, changing the mapping parameters dynamically. This ensures that no single encoding is repeatedly used, thereby eliminating constant points that attackers could exploit.

Inventive Principle:
Principle #35Parameter changes

2Reliability

If self-equivalent affine functions with high diversification number are used, then security is improved, but the complexity of selecting and implementing the appropriate S-box increases

Engineering Contradiction:
Improvesecurity against attacksVSAvoidS-box selection complexity
Core Design Contradiction:
ReliabilityVSDevice complexity

Solution Approach 1:

The patent applies preliminary action by pre-computing and storing multiple self-equivalent affine encodings in lookup tables before execution. The diversification analysis and S-box selection criteria are predetermined and stored. During actual cryptographic operations, the system simply retrieves the appropriate pre-computed encoding based on the input, avoiding complex real-time calculations while maintaining high security.

Inventive Principle:
Principle #10Preliminary action

3Object-affected harmful factors

If the minimum diversification number is maximized, then the number of exploitable constant points is reduced, but the computational overhead for determining and implementing the optimal S-box increases

Engineering Contradiction:
Improvevulnerability to attacksVSAvoidcomputation time for S-box selection
Core Design Contradiction:
Object-affected harmful factorsVSLoss of time

Solution Approach 1:

The patent performs diversification analysis and S-box optimization in advance, storing the results in pre-computed tables. The minimum diversification number for each possible S-box configuration is calculated beforehand, and the optimal configurations are stored for quick retrieval. This eliminates the need for time-consuming computations during actual cryptographic operations, reducing time loss while maintaining maximum security.

Inventive Principle:
Principle #10Preliminary action

Data Source

PatentEP3035585B1S-box selection in white-box cryptographic implementation
Publication Date: 2020.03.25 NXP BV
  • EP3035585B1 patent drawingFigure 1~2
  • EP3035585B1 patent drawingFigure 3
  • EP3035585B1 patent drawingFigure 4A~4D

AI summary

A method of implementing a cryptographic operation using a substitution box, comprising: specifying a set of self-equivalent functions for the substitution box; determining the minimum diversification number of the substitution box over the set of self-equivalent functions; comparing the minimum diversification number to a threshold value; including and implementing a cryptographic operation with selected substitution box when the minimum diversification number is greater or equal to a threshold value.