Several such protections have been proposed in the past and already cryptanalyzed thanks to a complete WBC scheme analysis. In this article, we study a particular pattern for local protection (which can be leveraged for robust WBC); we formalize it as DIBO (for Diffused-Input-Blocked-Output). This notion has been explored (albeit without having been nicknamed DIBO) in previous works. However, we notice that guidelines to adequately select the invertible diffusion $\phi$ and the blocked bijections $B$ were missing. Therefore, all choices for $\phi$ and $B$ were assumed as suitable. Actually, we show that most configurations can be attacked, and we even give mathematical proof for the attack. The cryptanalysis tool is the number of zeros in a Walsh-Hadamard spectrum. This ``spectral distinguisher'' improves on top of the previously known one (Sasdrich, Moradi, G{\"{u}}neysu, at FSE 2016). However, we show that such an attack does not work always (even if it works most of the time).
Therefore, on the defense side, we give a straightforward rationale for the WBC implementations to be secure against such spectral attacks: the random diffusion part $\phi$ shall be selected such that the rank of each restriction to bytes is full. In AES's case, this seldom happens if $\phi$ is selected at random as a linear bijection of $\F_2^{32}$. Thus, specific care shall be taken. Notice that the entropy of the resulting $\phi$ (suitable for WBC against spectral attacks) is still sufficient to design acceptable WBC schemes.
Category / Keywords: implementation / White-Box Cryptography, obfuscation, Diffused-Input-Blocked-Output (DIBO), spectral characteristics, number of zeros in Walsh spectrum, mathematical proof of attack, repaired DIBO. Original Publication (with minor differences): IACR-CHES-2021 Date: received 5 Aug 2021 Contact author: sylvain guilley at secure-ic com Available format(s): PDF | BibTeX Citation Version: 20210806:075645 (All versions of this report) Short URL: ia.cr/2021/1028