An introduction to white-box cryptography
The post An introduction to white-box cryptography appeared first on Intertrust Technologies.
If you’re unfamiliar with white-box cryptography, you’re not alone. At Intertrust’s session on cryptographic key protection at the RSA Security Conference this year, an informal poll showed that less than 10 percent of the audience had even heard of it, let alone knew what it was and could do.
Cryptographic keys are essential for locking cyber defenses together: lose those and even the strongest encryption ciphers become useless. White-box cryptography is a software-based method to secure cryptographic keys that replaces or augments hardware-based key protection. It combines obfuscation, encryption, and mathematical transformation techniques to hide cryptographic keys and algorithms so that even if a program or device is compromised, cryptographic keys remain safe.
Before we dig into what that really means, let’s get a little background.
Why is white-box cryptography needed?
Almost every digital interaction requires encryption to function securely. For example, encryption is necessary to protect financial data in an online purchase, patient information transmitted from a medical device, or content streamed by an OTT video provider. Every software application that processes encrypted information uses cryptographic keys to decrypt incoming data and encrypt outgoing data. Unprotected keys can easily be lifted from an application through reverse engineering, memory analysis, side channel attacks, and other hacking techniques.
Traditionally, cryptographic functions have been secured by hardware components, such as hardware security modules (HSMs), trusted platform modules (TPM), Secure Enclaves (SE), and trusted execution environments (TEE). These are considered black-box models because their internal workings are well hidden from an observer. It is difficult and expensive for attackers to reverse engineer a hardware module and analyze or manipulate its internal data.
While hardware approaches provide good security, they tend to be costly as well as cumbersome. The push for design and material changes in connected devices, and the competition between different OS creators, means developers can’t always guarantee that there will be adequate hardware security support in place. Web applications running in a browser, for example, typically do not have access to built-in hardware.
Moreover it’s possible, and even likely, that the software being targeted will be installed and run in an environment that has been compromised, such as a jailbroken or rooted device. This is where white-box cryptography comes in. It assumes a worst case scenario, where a malicious actor has control over the execution environment and the internal workings of an algorithm are visible and modifiable. The question then becomes, how do you keep cryptographic keys safe in such an untrusted environment?
How does white-box cryptography work?
White-box cryptography provides the equivalent functionality of standard algorithms without revealing the intermediate values. It obscures and blends the internal data and execution flow of an algorithm so that it becomes extremely difficult to separate and identify cryptographic keys. In a “standard” cryptographic implementation, the keys and execution logic are clearly distinguishable and easy to tamper with. By contrast, in a well constructed white-box system, keys can’t be extracted and attempts to modify code end up breaking the entire executable. Here is a simplified illustration of how this process works:
What is the difference between white-box cryptography and code obfuscation?
While white-box cryptography uses obfuscation techniques in its implementation, it is not the same thing as code obfuscation. Put simply, code obfuscation transforms code to make it more difficult to analyze. White-box cryptography does more than that; it applies additional data transformation techniques specifically aimed at protecting software implementations of cryptographic algorithms. The result is that the secret cryptographic keys are secure and hidden at all times.
Where is white-box cryptography used?
Today’s applications hold more and more valuable sensitive data that make them attractive attack targets. At the same time, they are installed on endpoints that lie outside of security controls and must be presumed to be compromised. Developers need to equip programs with the means to protect their cryptographic operations and keys wherever they run. White-box cryptography has emerged as the gold standard to deliver this security without the necessity for hardware support.
Many types of software that store and process sensitive information benefit from white-box cryptography. In some industries, however, it is a critical piece of their security strategy. Here are a few specific use cases.
Mobile contactless payments
The newest mobile payment applications use near field communication (NFC) technology to convert standard, commercial off-the-shelf phones into contactless payment devices. These are a game-changer for businesses, especially smaller ones that do not have the resources to invest in specialized POS devices. Security, however, is a major concern. The Payment Card Industry (PCI) Security Standards Council, has determined white-box cryptography to be the best way to ensure flexible and robust security for cryptographic keys in these applications, no matter what devices they are on.
Conditional access markets
The boom in OTT video providers has created a similar headache for those charged with keeping video content safe from hackers while also ensuring ease of access and a smooth viewing experience for paying customers. White-box cryptography can be used both on the applications and the set-top boxes that OTT video providers use to transmit content.
Medical apps and devices
Data collected by medical devices is transmitted in encrypted form, typically using a lightweight cipher, such as Speck or Simon. The data may also be signed to ensure data integrity. Generally a key is safe within the boundaries of the medical device and once it is on the cloud servers. The weakest link is the companion or proxy application running on the mobile device or desktop computer. White-box cryptography protects decryption and signing keys to make sure medical data is not stolen or tampered with.
Leading white-box cryptography from Intertrust
With the increasingly mobile nature of applications and devices, hardware support can’t be guaranteed and isn’t always feasible. White-box cryptography, as a software-based security solution, has become a necessity. whiteCryption® Secure Key Box™ from Intertrust is a state-of-the-art white-box cryptography library that secures cryptographic keys at rest, at runtime, and in transit, even on compromised devices.
To find out more about how we use white-box cryptography to keep our customers safe, you can read more here.
For detailed information on compliance with PCI’s contactless payment security guidelines, check out this white paper.
*** This is a Security Bloggers Network syndicated blog from Intertrust Technologies - Security Blogs authored by Juris Olekss. Read the original post at: https://www.intertrust.com/blog/an-introduction-to-white-box-cryptography/
