Trafford Publishing, 2008. On White-Box Cryptography

Abstract. White-box cryptography techniques are aimed at protecting software implementations of cryptographic algorithms against key recov-ery. They are primarily used in DRM-like applications as a cost-effective alternative to token-based protections. This paper discusses the relevance of white-box implementations in such contexts as a series of questions and answers. Q1: What is white-box cryptography? A major issue when dealing with security programs is the protection of “sen-sitive ” (secret, confidential or private) data embedded in the code. The usual solution consists in encrypting the data but the legitimate user needs to get ac-cess to the decryption key, which also needs to be protected. This is even more challenging in a software-only solution, running on a non-trusted host. White-box cryptography is aimed at protecting secret keys from being dis-closed in a software implementation. In such a context, it is assumed that the attacker (usually a “legitimate ” user or malicious software) may also control th