4

Let's say we have a program that only accepts numerical inputs and the output is simply an increment by one of the input.

Example with input "a" and output "b":

$$Input: a = 7$$

$$Output: b= a+1 = 8$$

So it would be easy to know what the program is doing.

Is it possible to obfuscate the program code in such a way that we can never be sure how it's done?

For example our program could take the input:

$$7$$

double it:

$$14$$

subtract input - 1

$$14 - (7 - 1) = 8$$

Is it possible to obfuscate the exact functionality, so that it can't be reverse-engineered? If not: Could such an obfuscation scheme exist one day or is there something fundamental that prevents it?

AleksanderCH
  • 6,435
  • 10
  • 29
  • 62
  • What you're describing is called indistinguishability obfuscation. There are candidate constructions for it, but the assumptions they are based on are still rather shaky. (Also they are completely impractical for any real world use.) – Maeher Jul 10 '18 at 16:24

1 Answers1

4

I think what you are asking for here is the so-called notion of black box obfuscation where the behavior of the obfuscated code and a literal blackbox oracle can't be distinguished.

Sadly this has been proven impossible in "On the (Im)possibility of Obfuscating Programs" by Barak, Goldreich, Impagliazzo, Rudich, Sahai, Vadhan and Yang with a nice blog post by Green also touching and more informally explaining the topic.

To be more precise about "this" being used above: "this" means here the existence of a general "compiler" taking any program and returning a black-box obfuscated version. Special programs, e.g. functions which only evaluate to true at exactly one point or conjunctions (PDF; thanks Weiken Chen) can be black-box obfuscated.

What is possible though is so-called indistinguishability obfuscation (iO) which allows you to take two programs implementing the same functionality and run them through an obfuscator and now nobody can efficiently tell with which obfuscation they are presented.

SEJPM
  • 45,967
  • 7
  • 99
  • 205
  • I don't think they're asking for black box obfuscation. They're explicitly stating that the function is known and just the implementation needs to be hidden. Modulo some minor details ( circuit size etc.) that's the exact definition of iO. – Maeher Jul 10 '18 at 16:51
  • @ Maeher my reading of the question was that "you may know what the function does, ie it's I/O behavior but not how it does it", which sounds like blackbox obfuscation to me. But then hopefully Aleksander will clarify and I can edit / delete / whatever. – SEJPM Jul 10 '18 at 16:54
  • I guess it hinges on the interpretation of "So it would be easy to know what the program is doing." If this is too mean that you can observe the behavior by querying, then you're right. If it means you have a complete description of the I/O behavior, then it would be iO. – Maeher Jul 10 '18 at 17:06
  • I actually meant blackbox obfuscation with my question, but I see how it could be misinterpreted now. Thanks for the clarification, because I remember once reading this Wired article and I was rather confused afterwards. Pretty sad that nowadays even informative articles are clickbaiting people as it seems. – AleksanderCH Jul 11 '18 at 07:06