White-Box Cryptography Using Partitioned Boolean Circuits
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing cryptographic systems, including white-box implementations, are vulnerable to algebraic attacks that exploit knowledge of the underlying cryptosystem and the structure of lookup tables, making it difficult to resist key recovery attacks, especially in open devices with general-purpose processors.
Innovation Solution
The implementation of a white-box cryptographic system using a partitioned Boolean circuit construction with non-algebraic or obfuscated interconnections among logic elements, which replaces lookup tables and randomizes the connections to hide function boundaries, thereby preventing algebraic attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If lookup tables are used in white-box cryptographic implementations, then the implementation is simpler and more efficient, but the structure becomes vulnerable to algebraic attacks that can recover the secret key
Solution Approach 1:
The cryptographic implementation is divided into multiple separate Boolean circuits, each performing a specific operation (e.g., S-box substitution, permutation). This segmentation prevents attackers from analyzing the complete structure in a single lookup table, making algebraic attacks significantly more difficult while maintaining operational efficiency through specialized circuit designs for each function.
Solution Approach 2:
Random intermediate variables are introduced between the secret key and the input/output operations. These intermediary variables act as a barrier that decouples the observable inputs/outputs from the secret key, preventing direct algebraic relationships from being established. The intermediate variables are computationally inexpensive to process but provide strong security against key recovery attacks.
2Reliability
If the cryptographic implementation is made more secure against algebraic attacks, then resistance to key recovery improves, but the complexity of the implementation increases
Solution Approach 1:
Traditional lookup table-based cryptographic implementations are replaced with Boolean circuit constructions. This substitution eliminates the algebraic structure inherent in lookup tables while providing equivalent or superior security. The Boolean circuit approach uses fundamental logical operations (AND, OR, NOT, XOR) that are native to digital processors, avoiding the need for complex table management while enhancing security.
Solution Approach 2:
The implementation changes from fixed lookup tables to dynamically constructed Boolean circuits with random intermediate variables. This parameter change introduces non-algebraic relationships that break the structure exploited by algebraic attacks. The randomization of intermediate variables ensures that each implementation instance has unique security properties while maintaining the same cryptographic functionality.
3Reliability
If random intermediate variables are introduced to prevent algebraic attacks, then security against key recovery improves, but the computational overhead increases
Solution Approach 1:
Rather than completely transforming the cryptographic algorithm, the invention applies Boolean circuit constructions selectively to critical components (e.g., S-boxes, key mixing operations) while maintaining efficient lookup tables for less critical operations. This partial application provides sufficient security against algebraic attacks without incurring the full computational overhead of complete circuit reconstruction, achieving an optimal balance between security and efficiency.
Data Source
AI summary
A method is provided for generating an output from an input according to a secret using a white-box implementation of a cryptographic function having a first operation, a second operation, and a third operation. The method applies the input to a first operation to generate a first intermediate result, applies the first intermediate result to a second operation to generate a second intermediate result, and applies the second intermediate result to a third operation to generate the output, wherein at least two of the first operation, the second operation, and the third operation is implemented by a plurality of interconnected logic elements, the interconnection of the plurality of logic elements being comprised of one of a non-algebraic interconnection of logic elements and an algebraic interconnection of logic elements having obfuscated boundaries between the at least one of the first operation, the second operation and the third operation.