White-Box Standard Encryption With Pre/Post Transformations
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Current Whitebox encryption methods are susceptible to attacks such as side-channel analysis and fault injection, as attackers can observe and manipulate the AES encryption process, making it vulnerable to key extraction.
Innovation Solution
Implementing non-standard pre- and post-AES data transformations using randomized S-boxes and unique round keys to create a protective 'wrapper' around the AES encryption core, concealing input and output data, and introducing randomness to break the predictability of traditional AES structures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If standard AES encryption is used in Whitebox mode, then encryption functionality is provided, but the system is susceptible to side-channel analysis and fault injection attacks
Solution Approach 1:
The encryption system is divided into multiple independent components: pre-AES transformation layer, core AES encryption layer, and post-AES transformation layer. Each layer performs a specific function and can be independently secured, allowing the pre and post transformations to be protected separately from the core AES algorithm.
Solution Approach 2:
Pre-AES and post-AES transformations act as intermediary layers between the external environment and the core AES encryption. These intermediaries obfuscate the actual AES inputs and outputs, preventing attackers from directly observing or manipulating the core encryption process.
2Productivity
If standard AES structures are used, then predictable behavior enables efficient encryption, but this predictability allows attackers to mount statistical attacks
Solution Approach 1:
The patent modifies the standard AES parameters by using non-standard S-boxes (substitution boxes) and custom round key schedules in the pre and post transformations. These parameter changes maintain the efficiency of AES-like operations while eliminating the statistical patterns that attackers exploit.
Solution Approach 2:
Different parts of the encryption system use different transformation properties. The pre-AES transformation uses one set of S-boxes and key schedule, while the post-AES transformation uses another set, creating localized variations that prevent uniform statistical analysis across the entire encryption process.
3Reliability
If pre- and post-AES transformations are added, then attack resistance is improved, but the system complexity increases
Solution Approach 1:
The pre-AES and post-AES transformation modules perform multiple functions: they obfuscate data, provide additional diffusion and confusion, and protect the core AES algorithm. This multi-functionality reduces the need for separate security mechanisms, thereby limiting complexity growth.
Solution Approach 2:
The pre and post transformations are nested around the core AES encryption, creating a layered structure where each layer protects the inner layer. This nested architecture provides comprehensive security while reusing the same transformation framework at different levels.
Data Source
AI summary
A system and a method are disclosed for performing encryptions with pre- and post-standard data transformations. The system receives an input that includes cleartext data. The system may apply a pre-encryption to the input by performing one or more rounds of data transformations, and the pre-encryption transforms the cleartext data into non-cleartext data. The system applies a core encryption to the non-cleartext data. The core encryption includes a standard cipher algorithm that transforms the non-cleartext data into encrypted ciphertext. The system then applies a post-encryption to the encrypted ciphertext. The post-encryption includes one or more rounds of additional data transformations. The system generates an encryption of the input at a local client device based on an output from the post-encryption. In some embodiments, the pre-encryption, core encryption and post-encryption are under a White-box encryption to protect intermediate data.