Last week, employees from atsec Germany and atsec Italy attended the 20th International Conference on Applied Cryptography and Network Security (ACNS) in Rome, Italy. As the name implies, ACNS highlights academic and industry research in the areas of applied cryptography and network security. Accepted papers are published in Springer’s Lecture Notes in Computer Science series, and the authors give a presentation during the conference itself. Additionally, ACNS includes a poster session and workshop tracks.
This year, the conference was held in hybrid mode, with the in-person event located at the National Research Council building and the Sapienza University of Rome (Museum Of Classical Art). During the main conference track, 9 areas were presented: Encryption, Attacks, Cryptographic Protocols, System Security, Cryptographic Primitives, Multi-Party Computation (MPC), Blockchain, Block Ciphers, and Post-Quantum Cryptography. Joachim Vandersmissen, IT Security Consultant at atsec Germany, contributed a paper and presentation on white-box cryptography for the Speck block cipher called “A White-Box Speck Implementation Using Self-Equivalence Encodings.”
In white-box cryptography, a cryptographic implementation is executed in an untrusted environment by an untrusted attacker. This is commonly the case in Digital Rights Management (DRM). For example, an online streaming platform might send a customer an encrypted version of the movie they want to watch as well as a cryptographic implementation to decrypt this movie. However, the streaming platform does not want the customer to use this implementation to decrypt other movies, or worse, extract the cryptographic key from the implementation. Other applications of white-box cryptography include mobile apps and smart cards.
Academic research in white-box cryptography started in 2002, so the area is relatively young. Chow et al. proposed the white-box model, which formalized the real-world environment from the previous paragraph. In their model, the attacker wants to recover the cryptographic key from a white-box implementation to bypass this original white-box implementation. Since 2002, many academic methods have been proposed, but so far there is no secure way to construct white-box implementations from existing block ciphers. Instead, many commercial solutions rely on the secrecy of the white-box design to provide some degree of security.
In “A White-Box Speck Implementation Using Self-Equivalence Encodings,” Joachim and co-authors propose a method to construct white-box implementations for the Speck block cipher. Speck is a block cipher proposed in 2013 by the NSA, with a focus on performance in software. This makes Speck especially suitable for embedded applications, such as IoT. Unfortunately, in the paper, they also introduced an attack to demonstrate the proposed method is not secure in the white-box model. Even though this is a negative result, it can still be used to guide future research directions in white-box cryptography. The paper also proposes some ways to extend this method, which might perhaps result in a secure white-box Speck implementation.
If you are interested in learning more about this topic, you can refer to the full paper, freely available on the IACR ePrint archive: https://ia.cr/2022/444. Implementation code is also available on GitHub: https://github.com/jvdsn/white-box-speck.
