White-Box PRF Input Domain Segmentation for DPA Resistance
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
White-box cryptographic implementations are vulnerable to attacks like Differential Power Analysis (DPA) and Correlation Power Analysis (CPA) due to attackers' ability to feed invalid inputs and collect sufficient traces, even when hardened methods are used, as they can exploit intermediate values and memory addresses.
Innovation Solution
Implementing a pseudo-random function (PRF) using a white-box construction that limits the domain of the block cipher to a subset of valid inputs, where incorrect outputs are produced for invalid inputs, and restricting white-box implementations to only specific iterations, merging with key scheduling algorithms to change keys, and using look-up tables with obfuscation techniques.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If white-box cryptographic implementations use standard block cipher operations with full input domain, then cryptographic functionality is complete, but vulnerability to DPA and CPA attacks increases due to attackers' ability to collect sufficient traces
Solution Approach 1:
The patent segments the input domain of the block cipher into valid and invalid input subsets. The white-box implementation is designed to correctly process only valid inputs while producing incorrect or unpredictable outputs for invalid inputs. This segmentation prevents attackers from using invalid inputs to gather useful traces for DPA and CPA attacks, thereby resolving the contradiction between maintaining cryptographic functionality and resisting attacks.
Solution Approach 2:
The patent applies local quality by making the white-box implementation's behavior dependent on the input's validity. For valid inputs within the restricted domain, the implementation maintains correct cryptographic behavior. For invalid inputs, the implementation produces incorrect outputs or enters undefined behavior. This localized differentiation in quality of operation prevents trace collection attacks while preserving cryptographic functionality for legitimate operations.
2Reliability
If white-box implementation is restricted to specific iterations and merged with key scheduling, then resistance to white-box attacks increases, but implementation complexity increases
Solution Approach 1:
The patent merges the white-box implementation with the key scheduling algorithm into a unified structure. The block cipher operations are integrated with key generation and update mechanisms, allowing the system to change keys dynamically while maintaining the restricted input domain property. This merging increases implementation complexity but provides the benefit of enhanced attack resistance through continuous key changes and obscured operational patterns.
Solution Approach 2:
The patent introduces dynamics by allowing the white-box implementation to operate in different iterations with changing keys. The system transitions between different operational states corresponding to different iterations, with each iteration using a different key derived through the merged key scheduling process. This dynamic behavior increases implementation complexity but enhances security by preventing static analysis and trace correlation attacks.
3Difficulty of detecting and measuring
If look-up tables with obfuscation techniques are used, then security against code inspection improves, but susceptibility to DCA-like attacks increases due to exposed intermediate values and memory addresses
Solution Approach 1:
The patent segments the look-up table operations by restricting which table entries can be accessed based on input validity. Only specific segments of the look-up tables corresponding to valid inputs are properly implemented; other segments produce incorrect outputs or undefined behavior. This segmentation obscures the true operational patterns from attackers while maintaining security against code inspection, as attackers cannot reliably trace through invalid input paths.
Data Source
Figure 1~2
Figure 3
Figure 4
AI summary
A method for implementing a pseudo-random function (PRF) using a white-box implementation of a cryptographic function in N rounds, including: receiving an input to the PRF; receiving a cryptographic key in a first round; encrypting, using the white-box implementation of the cryptographic function and the cryptographic key, an input message that is one of M possible input messages based upon a portion of the input to produce a first output; for each succeeding round: encrypting, using the white-box implementation of the cryptographic function and an ith cryptographic key, further input messages that are one of M possible input messages based upon a further portion of the input to produce an ith output, wherein the ith cryptographic key is the output from the preceding round, wherein the white-box implementation of the cryptographic function only produces a correct output for the M possible input messages and produces an incorrect output for input messages that are not one of the M possible input messages.