6

There has been a lot of discussion about whitebox cryptography in recent years. However, I haven't found any signs of real world applications using it.

  • Are there any real world IT solutions depending on whitebox cryptography as of 2022?
  • Is any kind of whitebox cryptography considered secure by any authority (NIST etc.) and openly used in some really critical areas (banking, military, ...)?
vojta
  • 291
  • 1
  • 5

1 Answers1

5

Are there any real world IT solutions depending on whitebox cryptography as of 2022?

Yes, especially on mobile phones that don't contain a secure enclave or similar. There is a reason why e.g. Android tries to integrate more security by default though.

Is any kind of whitebox cryptography considered secure by any authority (NIST etc.) and openly used in some really critical areas (banking, military, ...)?

Yes, but that doesn't mean that it is easy to get whitebox cryptography accepted. Quite often the proprietary mechanisms are not secure enough, and the generic mechanisms from specialized parties are under big scrutiny by both white hat and black hat hackers. In that sense it is kind of a catch 22 situation: you're in dire straits if you go for either direction. You'll probably have to circumnavigate quite a bit to a relatively secure solution.

I'm not sure what NIST accepts or doesn't accept, but if they accept anything it won't be for banking, and I'd expect that what is acceptable to them will change in time. I see that they have certified a solution in the past, but that one has been marked as "historical" with a note that the solution should not be used by Federal Agencies. Not sure if they have certified anything lately.

Note that I'm not directly involved in white box cryptography at this time.

Maarten Bodewes
  • 92,551
  • 13
  • 161
  • 313