Towards Practical Whitebox Cryptography: Optimizing Efficiency and Space Hardness

Andrey Bogdanov, Takanori Isobe, Elmar Wolfgang Tischhauser

Research output: Chapter in Book/Report/Conference proceedingArticle in proceedingsResearchpeer-review


Whitebox cryptography aims to provide security for cryptographic algorithms in an untrusted environment where the adversary has full access to their implementation. Typical security goals for whitebox cryptography include key extraction security and decomposition security: Indeed, it should be infeasible to recover the secret key from the implementation and it should be hard to decompose the implementation by finding a more compact representation without recovering the secret key, which mitigates code lifting.Whereas all published whitebox implementations for standard cryptographic algorithms such as DES or AES are prone to practical key extraction attacks, there have been two dedicated design approaches for whitebox block ciphers: ASASA by Birykov et al. at ASIACRYPT'14 and SPACE by Bogdanov and Isobe at CCS'15. While ASASA suffers from decomposition attacks, SPACE reduces the security against key extraction and decomposition attacks in the white box to the security of a standard block cipher such as AES in the standard blackbox setting. However, due to the security-prioritized design strategy, SPACE imposes a sometimes prohibitive performance overhead in the real world as it needs many AES calls to encrypt a single block.In this paper, we address the issue by designing a family of dedicated whitebox block ciphers SPNbox and a family of underlying small block ciphers with software efficiency and constant-time execution in mind. While still relying on the standard blackbox block cipher security for the resistance against key extraction and decomposition, SPNbox attains speed-ups of up to 6.5 times in the black box and up to 18 times in the white box on Intel Skylake and ARMv8 CPUs, compared to SPACE. The designs allow for constant-time implementations in the blackbox setting and meet the practical requirements to whitebox cryptography in real-world applications such as DRM or mobile payments. Moreover, we formalize resistance towards decomposition in form of weak and strong space hardness at various security levels. We obtain bounds on space hardness in all those adversarial models.Thus, for the first time, SPNbox provides a practical whitebox block cipher that features well-understood key extraction security, rigorous analysis towards decomposition security, demonstrated real-world efficiency on various platforms and constant-time implementations. This paves the way to enhancing susceptible real-world applications with whitebox cryptography.
Original languageEnglish
Title of host publicationAdvances in Cryptology – ASIACRYPT 2016
Number of pages33
Publication date2016
ISBN (Print)978-3-662-53886-9
Publication statusPublished - 2016
Event22nd International Conference on the Theory and Application of Cryptology and Information Security (ASIACRYPT 2016) - Hanoi, Viet Nam
Duration: 4 Dec 20168 Dec 2016
Conference number: 22


Conference22nd International Conference on the Theory and Application of Cryptology and Information Security (ASIACRYPT 2016)
Country/TerritoryViet Nam
Internet address
SeriesLecture Notes in Computer Science


Dive into the research topics of 'Towards Practical Whitebox Cryptography: Optimizing Efficiency and Space Hardness'. Together they form a unique fingerprint.

Cite this