Yet another attack on whitebox AES implementation Patrick Derbez 1 , Pierre-Alain Fouque 1 , Baptiste Lambin 1 , Brice Minaud 2 1 Univ Rennes, CNRS, IRISA 2 Royal Holloway University of London Patrick Derbez Yet another attack on whitebox AES implementation 1 / 31
Introduction 1 The Baek, Cheon and Hong proposal 2 Dedicated Attack 3 Generic attack 4 Patrick Derbez Yet another attack on whitebox AES implementation 2 / 31
Introduction Introduction 1 The Baek, Cheon and Hong proposal 2 3 Dedicated Attack Generic attack 4 Patrick Derbez Yet another attack on whitebox AES implementation 3 / 31
Introduction Black box vs. White box Black box model in AES K out Patrick Derbez Yet another attack on whitebox AES implementation 4 / 31
Introduction Black box vs. White box Black box model White box model in in key = 0x1337. . . key schedule(key) AES K out = in for i in 0. . .10 round i(out,key) return out out out Patrick Derbez Yet another attack on whitebox AES implementation 4 / 31
Introduction White box implementation Attacker: • extracting key information from the implementation in • computing decryption scheme from encryption scheme key = 0x1337. . . key schedule(key) Designer: out = in • provide sound and secure imple- for i in 0. . .10 mentation round i(out,key) return out Main application: • Digital Rights Management out • Fast (post-quantum ) public-key encryption scheme Patrick Derbez Yet another attack on whitebox AES implementation 5 / 31
Introduction Two main design strategies Table lookup First proposal by Chow et al. in 2002: broken Xiao and Lai in 2009: broken Karroumi et al. in 2011: broken Baek et al. in 2016: our target WhiteBlock from Fouque et al. : secure (but weird model) ASASA-like designs SASAS construction: broken in 2001 by Biryukov et al. ASASA proposals (Biryukov et al. , 2014): broken Recent proposals at ToSC’17 by Biryukov et al. to use more layers, leading to SA. . . SAS Patrick Derbez Yet another attack on whitebox AES implementation 6 / 31
Introduction CEJO Framework Derived from Chow et al. first white-box candidate constructions. Block cipher decomposed into R round functions. Round functions obfuscated using encodings. Obfuscated round functions implemented and evaluated using several tables (of reasonable size) · · · ◦ f ( r +1) − 1 ◦ E ( r ) ◦ f ( r ) ◦ f ( r ) − 1 ◦ E ( r − 1) ◦ f ( r − 1) ◦ . . . � �� � � �� � table table Increase security with external encodings Patrick Derbez Yet another attack on whitebox AES implementation 7 / 31
Introduction Baek et al. ’s toolbox Proposed by Baek, Cheon and Hong in 2016. Toolbox dedicated to SPN under CEJO framework Generic method to recover non-linear part of encodings Generic algorithm to recover the linear component of encodings Finding non-linear part not higher than recovering linear part New AES white-box construction Based on CEJO framework Parallel AES Resisting their toolbox (110 bits of security) Our target Patrick Derbez Yet another attack on whitebox AES implementation 8 / 31
The Baek, Cheon and Hong proposal Introduction 1 The Baek, Cheon and Hong proposal 2 3 Dedicated Attack Generic attack 4 Patrick Derbez Yet another attack on whitebox AES implementation 9 / 31
The Baek, Cheon and Hong proposal The Baek, Cheon and Hong proposal Round function of AES : AES ( r ) = MC ◦ SR ◦ SB ◦ ARK 256-bit 256-bit A ( r ) A ( r ) K ( r ) K ( r ) ⇒ AES ( r ) AES ( r ) S . . . S S . . . S table � A ( r +1) � − 1 MC ◦ SR MC ◦ SR M ( r ) � A ( r +1) � − 1 256-bit 256-bit Patrick Derbez Yet another attack on whitebox AES implementation 10 / 31
The Baek, Cheon and Hong proposal Sparse input encoding A 0 , 0 A 0 , 1 x 0 a 0 x 1 a 1 A 1 , 1 A 1 , 2 ⊕ A ( x ) = . . ... ... . . . . x 31 a 31 A 31 , 0 A 31 , 31 M = A − 1 ◦ MC ◦ SR 1 Split M in columns blocks of size 8 s.t. M = ( M 0 | . . . | M 31 ) � 31 2 M . x = M i . x i i =0 3 16-bit to 256-bit mappings: F i = M i ◦ S ◦ ⊕ ( k i ⊕ a i ) ◦ ( A i , i , A i , i +1 ) 4 Round function: 31 � F ( r ) ( x 0 , . . . , x 31 ) = F i ( x i , x i +1 ) i =0 Patrick Derbez Yet another attack on whitebox AES implementation 11 / 31
The Baek, Cheon and Hong proposal Complexity Time complexity R AES rounds: 32 R table lookups + 31 R xor of 256-bits words. For R = 10: 320 table lookups + 310 xor of 256-bit words. Very fast Memory requirement R AES rounds: 32 R 16-bit to 256-bit mappings. For R = 10: 320 16-bit to 256-bit mappings ≈ 160MB Patrick Derbez Yet another attack on whitebox AES implementation 12 / 31
The Baek, Cheon and Hong proposal Issue 16-bit to 256-bit mappings: F i = M i ◦ S ◦ ⊕ ( k i ⊕ a i ) ◦ ( A i , i , A i , i +1 ) Remark F i ( x , 0) = M i ◦ S ◦ ⊕ ( k i ⊕ a i ) ◦ A i , i ( x ) is a 8-bit to 256-bit mapping. Composing with right projection ⇒ affine equivalent to AES Sbox. Patrick Derbez Yet another attack on whitebox AES implementation 13 / 31
The Baek, Cheon and Hong proposal Issue 16-bit to 256-bit mappings: F i = M i ◦ S ◦ ⊕ ( k i ⊕ a i ) ◦ ( A i , i , A i , i +1 ) Remark F i ( x , 0) = M i ◦ S ◦ ⊕ ( k i ⊕ a i ) ◦ A i , i ( x ) is a 8-bit to 256-bit mapping. Composing with right projection ⇒ affine equivalent to AES Sbox. � 2 25 � Possible to recover affine mappings in O using the affine equivalence algorithm from Biryukov et al. . Patrick Derbez Yet another attack on whitebox AES implementation 13 / 31
The Baek, Cheon and Hong proposal Affine Equivalence Algorithm In 2003, Biryukov, De Canni` ere, Braeken and Preneel proposed an algorithm to solve the following problem: Given two bijections S 1 and S 2 on n bits, find affine mappings A and B such that S 2 = B ◦ S 1 ◦ A , if they exist. Ascertain whether such mappings exist Enumerate all solutions � n 3 2 2 n � Time complexity in O Patrick Derbez Yet another attack on whitebox AES implementation 14 / 31
The Baek, Cheon and Hong proposal Affine Equivalence Algorithm In 2003, Biryukov, De Canni` ere, Braeken and Preneel proposed an algorithm to solve the following problem: Given two bijections S 1 and S 2 on n bits, find affine mappings A and B such that S 2 = B ◦ S 1 ◦ A , if they exist. Ascertain whether such mappings exist Enumerate all solutions � n 3 2 2 n � Time complexity in O � n 3 2 n � Time complexity for linear version in O Patrick Derbez Yet another attack on whitebox AES implementation 14 / 31
The Baek, Cheon and Hong proposal Baek et al. Proposal To avoid this weakness, take 32 random 8-bit to 256-bit mappings h i . The 16-bit to 256-bit tables are defined as T i ( x , y ) = F i ( x , y ) ⊕ h i ( x ) ⊕ h i +1 ( y ) And we can evaluate the encoded round function with 31 31 � � F i ( x i , x i +1 ) = F ( r ) ( x 0 , . . . , x 31 ) T i ( x i , x i +1 ) = i =0 i =0 Security claim : 110-bit Patrick Derbez Yet another attack on whitebox AES implementation 15 / 31
Dedicated Attack Introduction 1 The Baek, Cheon and Hong proposal 2 3 Dedicated Attack Generic attack 4 Patrick Derbez Yet another attack on whitebox AES implementation 16 / 31
Dedicated Attack Overview of the attack � ∗ ∗ � ∗ ∗ ... From encoded round functions F ≃ M ◦ S ◦ A with A ≃ ∗ ∗ 1 Reduce the problem to block diagonal encodings : ⇒ � F = M ◦ S ◦ B with B block diagonal. 2 Compute candidates for each block: Using a projection, P ◦ M ◦ S ◦ B i is affine equivalent to S . 1 Use the affine equivalence algorithm from [BCBP03] to get some 2 candidates for B i . 3 Identify the correct blocks : Use a MITM technique to filter the wrong candidates Patrick Derbez Yet another attack on whitebox AES implementation 17 / 31
Dedicated Attack Reducing the problem to block diagonal encodings Decompose A in A = B ◦ � A with: B block diagonal affine mapping built from B i ’s (unknown) � A with same structure as A , built from blocks (0 8 Id 8 ) ◦ E − 1 (known) i Patrick Derbez Yet another attack on whitebox AES implementation 18 / 31
Dedicated Attack Reducing the problem to block diagonal encodings Decompose A in A = B ◦ � A with: B block diagonal affine mapping built from B i ’s (unknown) � A with same structure as A , built from blocks (0 8 Id 8 ) ◦ E − 1 (known) i For all 0 ≤ i ≤ 31 : 1 compute Ker L i with L i = ( A i , i A i , i +1 ) (8 × 16 matrix) 2 get a basis ( e 1 , . . . , e 8 ) of Ker L i 3 complete this basis ⇒ E i = ( e 1 . . . e 16 ) 4 ∃ B i 8x8 invertible matrix s.t. L i = B i ◦ (0 8 Id 8 ) ◦ E − 1 i Patrick Derbez Yet another attack on whitebox AES implementation 18 / 31
Dedicated Attack Find Ker L i with L i = ( A i , i A i , i +1 ) For any ( a , b ) ∈ F 8 2 × F 8 2 : 1 x ∈ Ker A i , i ⇒ y �→ T i ( a ⊕ x , b ⊕ y ) ⊕ T i ( a , b ⊕ y ) is constant 2 y ∈ Ker A i , i +1 ⇒ x �→ T i ( a ⊕ x , b ⊕ y ) ⊕ T i ( a ⊕ x , y ) is constant ( x , y ) ∈ Ker L i ⇒ T i ( a , b ) ⊕ T i ( a ⊕ x , b ) ⊕ T i ( a , b ⊕ y ) ⊕ T i ( a ⊕ x , b ⊕ y ) = 0 3 If x ∈ Ker A i , i then : Patrick Derbez Yet another attack on whitebox AES implementation 19 / 31
Recommend
More recommend
