Unboxing The White-Box: Practical Attacks Against Obfuscated Ciphers
summary
Shows that hardware DFA and side‑channel methods port to white‑box ciphers: custom scripts using GDB, Unicorn, Pin and emulators inject flip‑bit fault injection into memory and collect memory‑access traces (reads/writes/low bytes) to run differential analysis. About 40–100 injected faults and a few minutes of automated processing recover round keys and full TDES/AES keys from multiple open‑source and commercial implementations. External input/output encodings block the attack; tools include a custom Inspector DFA module and public DFA examples.
AI-written summary · about
chapters (28)
- 0:00Intro
- 0:48What and why...
- 3:42Black-Box Security
- 4:39Gray-Box Security
- 5:32Sign of the times...
- 8:08White Box Cryptography
- 9:12Software in the White Box context
- 9:52Software Protection
- 11:45How does WBC work?
- 13:41WBC Construction: partial evaluation
- 15:35Example code
- 16:17External encoding
- 18:07WBC attack literature
- 19:56Differential Fault Analysis
- 21:04DFA computation for DES
- 22:49Divide and conquer
- 25:09DFA attack process
- 27:41Locating the injection point
- 28:39Fault injection
- 32:05STEP 3: Analysis
- 33:13Hypothesis testing
- 34:53Generalization of differential SCA attacks
- 36:23To our surprise....
- 36:57SCA attack process
- 37:47Capture measurement
- 41:51SCA Analysis
- 42:48What does it mean?
- 47:50How to make it stronger?
related talks
08mWhite-box Cryptography
09mWhite-box Cryptography
41mFault Attacks & Side Channels
42mBreak Crypto like a Pro!
59mBreaking AES with side channel analysis
45mKeynote: How to Build Hardware Trojans
33mSecuring the Unseen: Vulnerability Research in Confidential Computing
01h 02mCryptographic Side-Channels on Embedded Devices