Hybrid Code Lifting on Space-Hard Block Ciphers
There is a high demand for whitebox cryptography from the practical use of encryption in untrusted environments. It has been actively discussed for two decades since Chow et al. presented the whitebox implementation of DES and AES. The goal is to resist the key extraction from the encryption progra...
| Main Authors: | , |
|---|---|
| Format: | Article |
| Language: | English |
| Published: |
Ruhr-Universität Bochum
2022-09-01
|
| Series: | IACR Transactions on Symmetric Cryptology |
| Subjects: | |
| Online Access: | https://tosc.iacr.org/index.php/ToSC/article/view/9861 |
| _version_ | 1828175584688078848 |
|---|---|
| author | Yosuke Todo Takanori Isobe |
| author_facet | Yosuke Todo Takanori Isobe |
| author_sort | Yosuke Todo |
| collection | DOAJ |
| description |
There is a high demand for whitebox cryptography from the practical use of encryption in untrusted environments. It has been actively discussed for two decades since Chow et al. presented the whitebox implementation of DES and AES. The goal is to resist the key extraction from the encryption program and mitigate the code lifting of the program. At CCS2015, Bogdanov and Isobe proposed space-hard block ciphers as a dedicated design of whitebox block ciphers. It ensures that the key extraction is as difficult as the key recovery in the standard blackbox model. Moreover, to mitigate code lifting, they introduce space hardness, a kind of leakage-resilient security with the incompressibility of a huge program. For space-hard ciphers, code lifting (a partial leakage of the entire program) is useless to copy the functionality.
In this paper, we consider a new attack model of space-hard block ciphers called hybrid code lifting. Space-hard block ciphers are intended to ensure security under a size-bounded leakage. However, they do not consider attackers (in the standard blackbox model) receiving the leakage by code lifting. If such attackers can recover the encryption program of a space-hard block cipher, such a cipher does not always satisfy the intention. We analyze Yoroi proposed in TCHES 2021. We introduce the canonical representation of Yoroi. Using the representation enables the recovery of the programs of Yoroi-16 and Yoroi-32 with 233 and 265.6 complexities, respectively, in spite of slight leakage. The canonical representation causes another attack against Yoroi. It breaks an authors’ security claim about the “longevity”. We additionally analyzed SPNbox proposed in Asiacrypt 2016. As a result, considering security on the hybrid code lifting, the original number of rounds is insufficient to achieve 128-bit security under quarter-size leakage.
|
| first_indexed | 2024-04-12T04:29:28Z |
| format | Article |
| id | doaj.art-d5005ed8c9d241629e86e30d120a6b69 |
| institution | Directory Open Access Journal |
| issn | 2519-173X |
| language | English |
| last_indexed | 2024-04-12T04:29:28Z |
| publishDate | 2022-09-01 |
| publisher | Ruhr-Universität Bochum |
| record_format | Article |
| series | IACR Transactions on Symmetric Cryptology |
| spelling | doaj.art-d5005ed8c9d241629e86e30d120a6b692022-12-22T03:47:59ZengRuhr-Universität BochumIACR Transactions on Symmetric Cryptology2519-173X2022-09-012022310.46586/tosc.v2022.i3.368-402Hybrid Code Lifting on Space-Hard Block CiphersYosuke Todo0Takanori Isobe1NTT Social Informatics Laboratories, Tokyo, JapanUniversity of Hyogo, Kobe, Japan There is a high demand for whitebox cryptography from the practical use of encryption in untrusted environments. It has been actively discussed for two decades since Chow et al. presented the whitebox implementation of DES and AES. The goal is to resist the key extraction from the encryption program and mitigate the code lifting of the program. At CCS2015, Bogdanov and Isobe proposed space-hard block ciphers as a dedicated design of whitebox block ciphers. It ensures that the key extraction is as difficult as the key recovery in the standard blackbox model. Moreover, to mitigate code lifting, they introduce space hardness, a kind of leakage-resilient security with the incompressibility of a huge program. For space-hard ciphers, code lifting (a partial leakage of the entire program) is useless to copy the functionality. In this paper, we consider a new attack model of space-hard block ciphers called hybrid code lifting. Space-hard block ciphers are intended to ensure security under a size-bounded leakage. However, they do not consider attackers (in the standard blackbox model) receiving the leakage by code lifting. If such attackers can recover the encryption program of a space-hard block cipher, such a cipher does not always satisfy the intention. We analyze Yoroi proposed in TCHES 2021. We introduce the canonical representation of Yoroi. Using the representation enables the recovery of the programs of Yoroi-16 and Yoroi-32 with 233 and 265.6 complexities, respectively, in spite of slight leakage. The canonical representation causes another attack against Yoroi. It breaks an authors’ security claim about the “longevity”. We additionally analyzed SPNbox proposed in Asiacrypt 2016. As a result, considering security on the hybrid code lifting, the original number of rounds is insufficient to achieve 128-bit security under quarter-size leakage. https://tosc.iacr.org/index.php/ToSC/article/view/9861Whitebox cryptographySpace-hard block cipherCode liftingBlackbox analysisTruncated differentialSecret S-box recovery |
| spellingShingle | Yosuke Todo Takanori Isobe Hybrid Code Lifting on Space-Hard Block Ciphers IACR Transactions on Symmetric Cryptology Whitebox cryptography Space-hard block cipher Code lifting Blackbox analysis Truncated differential Secret S-box recovery |
| title | Hybrid Code Lifting on Space-Hard Block Ciphers |
| title_full | Hybrid Code Lifting on Space-Hard Block Ciphers |
| title_fullStr | Hybrid Code Lifting on Space-Hard Block Ciphers |
| title_full_unstemmed | Hybrid Code Lifting on Space-Hard Block Ciphers |
| title_short | Hybrid Code Lifting on Space-Hard Block Ciphers |
| title_sort | hybrid code lifting on space hard block ciphers |
| topic | Whitebox cryptography Space-hard block cipher Code lifting Blackbox analysis Truncated differential Secret S-box recovery |
| url | https://tosc.iacr.org/index.php/ToSC/article/view/9861 |
| work_keys_str_mv | AT yosuketodo hybridcodeliftingonspacehardblockciphers AT takanoriisobe hybridcodeliftingonspacehardblockciphers |