Is there any open-source white-box implementation of AES or DES?

Question

I googled it, but got no result. There is a binary executable of a white-box implementation of DES (scroll down), but no source code is provided.

The same page also links various papers about white-box cryptography, but these don't contain the implementation.

I want to study such an implementation to learn about the techniques used there.

score 12 · Answer 1 · edited Jun 17 '20 at 08:17

12

I add my whitebox AES implementation on GitHub in:

C++
Java

C++ version implements both Chow's (mixing bijections, input/output encodings, external encodings) and Karroumi's (dual AES in each column) whitebox AES scheme plus Billet's key recovery attack on both schemes.

Java implements Chow's scheme only.

PS: Due to low reputation I post links to schemes to the comment below.

edited Jun 17 '20 at 08:17

Community

1

answered Apr 06 '15 at 11:18

Dusan Klinec

251
2
4

score 8 · Accepted Answer · edited Oct 09 '15 at 09:33

8

I've seen two implementations in the wild:

WBACR AES – SecureFW: Protection Framework
A dubious Russian implementation – White-box AES Implementation Generator

edited Oct 09 '15 at 09:33

Mike Edward Moras

18,161
12
87
240

answered Aug 19 '11 at 19:53

Samuel Neves

12,960
46
54

Mike Edward Moras · Answer 3 · 2015-10-09T09:32:30.400

Adding my 2 cents, I would like to point out that many published methods for white-box cryptography have been broken. This includes…

white-box AES
_{“Cryptanalysis of White Box AES Implementation”

by Olivier Billet, Henri Gilbert, and Charaf Ech-Chatbi}
white-box DES
_{“Cryptanalysis of White-Box DES Implementations with Arbitrary External Encodings“

by Brecht Wyseur and Wil Michiels and Paul Gorissen and Bart Preneel}

… which have been crypto-analyzed and are known to be insecure ever since.

On the other hand, as long as you just plan to study implementation to learn about the techniques and not plan to actually implement them in practice, you should be fine. So, let's mention one of the implementations that haven’t been mentioned here yet – https://github.com/wbaes/wbaes

Junwei WANG · Answer 4 · 2018-02-09T09:29:22.497

3

94 White-box AES implementations can be found at WhibOx contest website.

https://whibox-contest.github.io/

Have fun!

edited Feb 09 '18 at 09:29

answered Feb 09 '18 at 09:10

Junwei WANG

371
4
8

score 0 · Answer 5 · answered Aug 04 '11 at 16:30

I have a x86 assembly version of the basic AES algorithm I wrote when we briefly tried to remediate some 20 year old POS registers for PCI compliance. Turned out we didn't need it, but it was a great experience to write some assembler again.

I would be happy to share it if you feel it would be valuable. Please keep in mind that it is just the encryption portion, i.e. you supply it the Key and Data block and it returns the encrypted block. So you aren't getting anything that initializes a key, performs any salting, or any sort of rolling block encryption. Give it a 256-bit key, 256-bit data and get out 256-bit encrypted data.

I also have a version of it in .net c# which I wrote to prove my ASM.

score -1 · Answer 6 · edited Sep 30 '13 at 22:43

-1

I'm not sure I get your Q? but do these links help

edited Sep 30 '13 at 22:43

Mike Edward Moras

18,161
12
87
240

answered Aug 04 '11 at 13:10

jspeshu

17
1

Is there any open-source white-box implementation of AES or DES?

6 Answers6