White-box implementation

1. A method of enabling a device to compute an outcome of an exponentiation C x having a base C and an exponent x by means of a white-box implementation of the exponentiation, the method comprising

establishing, in a computer processor, the base C of the exponentiation and the exponent x of the exponentiation, comprising establishing the base C in dependence on a key of a cipher, wherein the key of the cipher is to be used by the device for performing a crytographic operation;

establishing, in the computer processor, a plurality of values λ i , for i=1, 2, . . . , r, wherein r is an integer and r≧2;

establishing, in the computer processor, a plurality of values ω i , for i=1, 2, . . . , r, satisfying ω i =C λ i ;

establishing, in the computer processor, a plurality of values φ i , for i=1, 2, . . . , r, satisfying

x

=

∑

i

=

1

r

⁢

λ

i

⁢

φ

i

;

providing the device with information indicative of the plurality of values ω i ;

providing the device with information indicative of the plurality of values φ i ; and

computing, in the device,

P

=

∏

i

=

1

r

⁢

ω

i

φ

i

,

thereby hiding the precise values of the base C and the exponent x from a white-box attack.

2. The method according to claim 1 ,

wherein the step of establishing a plurality of values λ i comprises establishing a set V of values to be used as the exponent x and establishing a plurality of sets of values W 1 , W 2 . . . , W r such that

V

⊆

{

∑

i

=

1

r

⁢

λ

i

·

w

i

|

(

w

1

,

w

2

,

…

⁢

,

w

r

)

∈

W

1

×

W

2

×

…

×

W

r

}

;

wherein the step of establishing the plurality of values φ i , comprises selecting the values φ i such that φ i εW i , for i=1, 2, . . . , r;

wherein the method comprises performing the steps of establishing the plurality of values φ i , providing the device with the information indicative of the plurality of values φ i , and computing by means of the device, in respect of a plurality of different values xεV.

3. The method according to claim 2 , wherein W i ={0,1}, for i=1, 2, . . . , r.

4. The method according to claim 1 , further comprising

establishing the key of the cipher.

5. The method according to claim 1 , further comprising

selecting different pluralities of values λ i and/or different values r to be used in respect of different devices;

performing in respect of the different devices, using the same values for the base C and the exponent x, and using the different pluralities of values λ i and/or the different values r, the steps of establishing the plurality of values ω i , establishing the plurality of values φ i , providing the device with information indicative of the plurality of values ω i , providing the device with information indicative of the plurality of values φ i , and computing, by means of the device,

P

=

∏

i

=

1

r

⁢

ω

i

φ

i

.

6. A device comprising a white-box implementation of an exponentiation for computing an outcome of an exponentiation C x having a base C and an exponent x, the device comprising

a memory for storing a plurality of values ω i wherein ω i =C λ i , wherein λ i is a plurality of values, for i=1, . . . , r, wherein r is an integer and r≧2,

an input for receiving information indicative of a plurality of values φ i wherein

x

=

∑

i

=

1

r

⁢

λ

i

⁢

φ

i

;

a computational unit for computing

P

=

∏

i

=

1

r

⁢

ω

i

φ

i

;

wherein the device is arranged for using P as the outcome of the exponentiation C x ;

wherein the precise values of the base C and the exponent x are hidden from a white-box attack,

the base C being established in dependence on a key of a cipher, wherein the key of the cipher is to be used by the device for performing a cryptographic operation.

7. The device according to claim 6 , wherein the input is arranged for further receiving information indicative of at least part of the plurality of values ω i .

8. The device according to claim 6 , further comprising means for determining at least part of the plurality of values ω i in dependence on at least one of: a hardware identifier of the device, a biometric measurement, and a password.

9. The device according to claim 6 , further comprising a cryptographic unit for performing a cryptographic operation according to an asymmetric cipher, wherein the cryptographic operation involves the exponentiation C x , wherein the means for performing the cryptographic operation is arranged for using P as the result of the exponentiation C x .

10. The device according to claim 6 , wherein the input is arranged for receiving encrypted information indicative of at least part of the plurality of values ω i and/or at least part of the plurality of values φ i , and wherein the device further comprises a cryptographic unit for decrypting the encrypted information to obtain, respectively, the at least part of the plurality of values ω i and/or the at least part of the plurality of values φ i .

11. The device according to claim 6 , wherein the device comprises a computer, a PDA, a personal video recorder, a set-top box, or a gaming console.

12. The device according to claim 9 , further comprising means for decrypting audio and/or video content using the cryptographic unit.

13. A system for enabling a device to compute an outcome of an exponentiation C x having a base C and an exponent x by means of a white-box implementation of the exponentiation, the system comprising

a first memory for temporarily storing the base C of the exponentiation and the exponent x of the exponentiation;

a second memory for storing a plurality of values λ i , for i=1, 2, . . . , r, wherein r is an integer and r≧2;

a computational unit for:

establishing the base C in dependence on a key of a cipher, wherein the key of the cipher is to be used by the device for performing a cryptographic operation;

establishing a plurality of values ω i , for i=1, 2, . . . , r, satisfying ω i =C λ i ;

establishing a plurality of values φ i , for i=1, 2, . . . , r, satisfying

x

=

∑

i

=

1

r

⁢

λ

i

⁢

φ

i

;

and

providing the device with information indicative of the plurality of values ω i and information indicative of the plurality of values φ i , the device computing

P

=

∏

i

=

1

r

⁢

ω

i

φ

i

,

thereby hiding the precise values of the base C and the exponent x from a white-box attack.

14. A computer program product stored on a non-transitory memory for enabling a device to compute an outcome of an exponentiation C x having a base C and an exponent x by means of a white-box implementation of the exponentiation, the computer program product comprising instructions for causing a machine to execute the steps of

establishing the base C of the exponentiation in dependence on a key of a cipher, wherein the key of the cipher is to be used by a device for performing a cryptographic operation;

establishing a plurality of values λ i , for i=1, . . . , r, wherein r is an integer and r≧2;

establishing a plurality of values ω i , for i=1, . . . , r, satisfying ω i =C λ i ;

establishing a plurality of values φ i , for i=1, . . . , r, satisfying

x

=

∑

i

=

1

r

⁢

λ

i

⁢

φ

i

;

providing information indicative of the plurality of values φ i and the plurality of values ω i to the device, the device computing

P

=

∏

i

=

1

r

⁢

ω

i

φ

i

,

thereby hiding the precise values of the base C and the exponent x from a white-box attack.

15. The computer program product according to claim 14 , comprising instructions for causing the machine to execute:

establishing the exponent x of the exponentiation.