, Compute (x, y, z) such that x = ae ? rf , y = bd ? r c and z = am a ? dmd ? r c r f ? cf

A. Eval,

. Then,

, Let d 2. Let I be the set as defined in Proposition 9

, Equivalent description of the encryption algorithm, p.148

. .. White-box-implementation, 151 3.2.3 Description of a system of multivariate polynomials, p.152

. .. Security-analysis,

. Our and . .. Dfa, , p.156

. .. , Submission to the WhibOx competition, p.159

, It is mainly composed of lookup tables which merge the key addition within the substitution layer and of systems of multivariate polynomials that are evaluated to obtain the result of the permutation layer. Our white-box implementation resists the first-order Differential Computation Analysis and the Differential Fault Analysis. This chapter is based on a joint work with CEA List that leads to a candidate to the WhibOx, 2019.

A. Amadori, W. Michiels, and P. Roelse, A DFA attack on white-box implementations of AES with external encodings, Selected Areas in Cryptography -SAC 2019 -26th International Conference, vol.11959, 2019.

E. Arikan, Channel polarization: A method for constructing capacity-achieving codes, IEEE International Symposium on Information Theory, pp.1173-1177, 2008.

F. Armknecht, R. Maes, A. Sadeghi, B. Sunar, and P. Tuyls, Memory leakage-resilient encryption based on physically unclonable functions, Advances in Cryptology -ASIACRYPT 2009, 15th International Conference on the Theory and Application of Cryptology and Information Security, vol.5912, pp.685-702, 2009.

F. Armknecht, D. Moriyama, A. Sadeghi, and M. Yung, Towards a unified security model for physically unclonable functions, Topics in Cryptology -CT-RSA 2016 -The Cryptographers' Track at the RSA Conference, vol.9610, pp.271-287, 2016.

. Chung-hun, J. H. Baek, H. Cheon, and . Hong, White-box aes implementation revisited, Journal of Communications and Networks, vol.18, issue.3, pp.273-287, 2016.

B. Barak, Y. Dodis, H. Krawczyk, O. Pereira, K. Pietrzak et al., Leftover hash lemma, revisited, Advances in Cryptology -CRYPTO 2011, 31st Annual Cryptology Conference, vol.6841, pp.1-20, 2011.

B. Barak, O. Goldreich, R. Impagliazzo, S. Rudich, A. Sahai et al., On the (im)possibility of obfuscating programs, Advances in Cryptology -CRYPTO 2001, 21st Annual International Cryptology Conference, vol.2139, pp.1-18, 2001.

G. Bertoni, L. Breveglieri, I. Koren, P. Maistri, and V. Piuri, Error analysis and detection procedures for a hardware implementation of the advanced encryption standard, IEEE Trans. Computers, vol.52, issue.4, pp.492-505, 2003.

E. Biham and A. Shamir, Differential cryptanalysis of des-like cryptosystems, J. Cryptology, vol.4, issue.1, pp.3-72, 1991.

E. Biham and A. Shamir, Differential fault analysis of secret key cryptosystems, Advances in Cryptology -CRYPTO '97, 17th Annual International Conference, vol.1294, pp.513-525, 1997.

O. Billet and H. Gilbert, A traceable block cipher, Advances in Cryptology -ASIACRYPT 2003, vol.2894, pp.331-346

. Springer, , 2003.

O. Billet, H. Gilbert, and C. Ech-chatbi, Cryptanalysis of a white box AES implementation, Selected Areas in Cryptography-SAC, vol.3357, pp.227-240, 2004.

O. Billet and . Duong-hieu-phan, Efficient traitor tracing from collusion secure codes, International Conference on Information Theoretic Security, pp.171-182, 2008.

A. Biryukov, C. Bouillaguet, and D. Khovratovich, Cryptographic schemes based on the ASASA structure: Black-box, white-box, and public-key

, Advances in Cryptology -ASIACRYPT 2014 -20th International Conference on the Theory and Application of Cryptology and Information Security, vol.8873, pp.63-84, 2014.

A. Biryukov, C. De-canniere, A. Braeken, and B. Preneel, A toolbox for cryptanalysis: linear and affine equivalence algorithms, International Conference on the Theory and Applications of Cryptographic Techniques, pp.33-50, 2003.

A. Biryukov and A. Shamir, Structural cryptanalysis of SASAS, Advances in Cryptology -EUROCRYPT 2001, International Conference on the Theory and Application of Cryptographic Techniques, vol.2045, pp.394-405, 2001.

J. Blömer and J. Seifert, Fault based cryptanalysis of the advanced encryption standard (AES), Financial Cryptography, 7th International Conference, vol.2742, pp.162-181, 2003.

C. Blondeau, A. Bogdanov, and G. Leander, Bounds in shallows and in miseries, Advances in Cryptology -CRYPTO 2013 -33rd Annual Cryptology Conference, vol.8042, pp.204-221, 2013.

A. Estuardo, C. Bock, W. Brzuska, A. Michiels, and . Treff, On the ineffectiveness of internal encodings -revisiting the DCA attack on white-box cryptography, Applied Cryptography and Network Security -16th International Conference ACNS 2018, vol.10892, pp.103-120, 2018.

A. Bogdanov and T. Isobe, White-box cryptography revisited: Space-hard ciphers, Proceedings of the 22nd ACM SIGSAC Conference on Computer and Communications Security, pp.1058-1069, 2015.

A. Bogdanov, T. Isobe, and E. Tischhauser, Towards practical whitebox cryptography: Optimizing efficiency and space hardness, Advances in Cryptology -ASI-ACRYPT 2016, 22nd INternational Conference on the Theory and Application of Cryptology and Information Security, vol.10031, pp.126-158, 2016.

D. Boneh and M. K. Franklin, An efficient public key traitor tracing scheme, Advances in Cryptology -CRYPTO '99, 19th Annual International Cryptology Conference, vol.1666, pp.338-353, 1999.

D. Boneh and M. Naor, Traitor tracing with constant size ciphertext, Proceedings of the 15th ACM conference on Computer and Communications Security, pp.501-510, 2008.

D. Boneh, A. Sahai, and B. Waters, Fully collusion resistant traitor tracing with short ciphertexts and private keys, 25th Annual International Conference on the Theory and Applications of Cryptographic Techniques, vol.4004, pp.573-592, 2006.

D. Boneh and B. Waters, A fully collusion resistant broadcast, trace, and revoke systems, Proceedings of the 13th ACM Conference on Computer and Communications Security, pp.211-220, 2006.

W. Joppe, C. Bos, W. Hubain, P. Michiels, and . Teuwen, Differential computation analysis: Hiding your white-box designs is not enough, Cryptographic Hardware and Embedded Systems -CHES 2016, vol.9813, pp.215-236, 2016.

W. Joppe, C. Bos, W. Hubain, P. Michiels, and . Teuwen, Differential computation analysis: Hiding your white-box designs is not enough, Cryptographic Hardware and Embedded Systems -CHES 2016, vol.9813, pp.215-236, 2016.

J. Bringer, H. Chabanne, and E. Dottax, Perturbing and protecting a traceable block cipher, IFIP International Conference on Communications and Multimedia Security, pp.109-119, 2006.

J. Bringer, H. Chabanne, and E. Dottax, White box cryptography: Another attempt, IACR Cryptology ePrint Archive, p.468, 2006.

D. Canright, A very compact s-box for AES, Cryptographic Hardware and Embedded Systems -CHES 2005, 7th International Workshop, vol.3659, pp.441-455, 2005.

H. Chabanne, D. Duong-hieu-phan, and . Pointcheval, Public traceability in traitor tracing schemes, Advances in Cryptology -EUROCRYPT 2005, 24th Annual International Conference on the Theory and Applications of Cryptographic Techniques, vol.3494, pp.542-558, 2005.

J. Cho, Y. Kyu, I. Choi, O. Dinur, N. Dunkelman et al., WEM: A new family of white-box block ciphers based on the evenmansour construction, Topics in Cryptology -CT-RSA 2017 -The Cryptographers' Track at the RSA Conference, vol.10159, pp.293-308, 2017.

B. Chor, A. Fiat, and M. Naor, Tracing traitors, Annual International Cryptology Conference, pp.257-270, 1994.

B. Chor, A. Fiat, M. Naor, and B. Pinkas, Tracing traitors, IEEE Trans. Inf. Theory, vol.46, issue.3, pp.893-910, 2000.

S. Chow, P. A. Eisen, H. Johnson, and P. C. Van-oorschot, White-box cryptography and an AES implementation, Selected Areas in Cryptography -SAC 2002, vol.2595, pp.250-270, 2002.

S. Chow, P. A. Eisen, H. Johnson, and P. C. Van-oorschot, A white-box DES implementation for DRM applications, Security and Privacy in Digital Rights Management, ACM CCS-9 Workshop, DRM 2002, vol.2696, pp.1-15, 2002.

B. Cogliati, R. Lampe, and Y. Seurin, Tweaking even-mansour ciphers, Advances in Cryptology -CRYPTO 2015, vol.9215, pp.189-208, 2015.
URL : https://hal.archives-ouvertes.fr/hal-02163312

A. Jean-sébastien-coron, D. Mandal, M. Naccache, and . Tibouchi, Fully homomorphic encryption over the integers with shorter public keys, Advances in Cryptology -CRYPTO 2011 -31st Annual Cryptology Conference, vol.6841, pp.487-504, 2011.

N. Courtois and J. Pieprzyk, Cryptanalysis of block ciphers with overdefined systems of equations, Advances in Cryptology -ASIACRYPT 2002, 8th International Conference on the Theory and Application of Cryptology and Information Security, vol.2501, pp.267-287, 2002.

. Cryptolux and . Github,

J. Daemen and V. Rijmen, Aes proposal: Rijndael, 1999.

C. Delerablée, T. Lepoint, P. Paillier, and M. Rivain, White-box security notions for symmetric encryption schemes, Selected Areas in Cryptography -SAC 2013, vol.8282, pp.247-264, 2013.

P. Derbez, P. Fouque, B. Lambin, and B. Minaud, On recovering affine encodings in white-box implementations, IACR Trans. Cryptogr. Hardw. Embed. Syst, vol.2018, issue.3, pp.121-149, 2018.
URL : https://hal.archives-ouvertes.fr/hal-02162300

W. Diffie and M. E. Hellman, New directions in cryptography, IEEE Trans. Inf. Theory, vol.22, issue.6, pp.644-654, 1976.

J. Ding, A new variant of the matsumoto-imai cryptosystem through perturbation, International Workshop on Public Key Cryptography, pp.305-318, 2004.

I. Dinur, O. Dunkelman, T. Kranz, and G. Leander, Decomposing the ASASA block cipher construction, IACR Cryptology ePrint Archive, p.507, 2015.

H. Dobbertin, Uniformly representable permutation polynomials, Sequences and their Applications -Proceedings of SETA 2001, pp.1-22, 2001.

Y. Dodis, R. Ostrovsky, L. Reyzin, and A. D. Smith, Fuzzy extractors: How to generate strong keys from biometrics and other noisy data, SIAM J. Comput, vol.38, issue.1, pp.97-139, 2008.

P. Dusart, G. Letourneux, and O. Vivolo, Differential fault analysis on AES, Applied Cryptography and Network Security, First International Conference ACNS 2003, vol.2846, pp.293-306, 2003.

J. Morris and . Dworkin, Sha-3 standard: Permutation-based hash and extendable-output functions, Federal Information Processing Standards Publication 202, 2015.

S. Even and Y. Mansour, A construction of a cipher from s single pseudorandom permutation, J. Cryptology, vol.10, issue.3, pp.151-162, 1997.

J. , C. Faugere, and L. Perret, Polynomial equivalence problems: Algorithmic and theoretical aspects, Advances in Cryptology -EUROCRYPT, vol.4004, pp.30-47, 2006.
URL : https://hal.archives-ouvertes.fr/hal-01337038

N. Fazio, A. Nicolosi, and D. Phan, Traitor tracing with optimal transmission rate, International Conference on Information Security, pp.71-88, 2007.

A. Ronal, F. Fisher, and . Yates, Statistical tables for biological, agricultural and medical research. Statistical tables for biological, agricultural and medical research, 1963.

P. Fouque, P. Karpman, P. Kirchner, and B. Minaud, Efficient and provable white-box primitives, Advances in Cryptology -ASIACRYPT 2016 -22nd International Conference on the Theory and Application of Cryptology and Information Security, vol.10031, pp.159-188, 2016.
URL : https://hal.archives-ouvertes.fr/hal-01427810

A. E. Gamal and H. Eltoukhy, Cmos image sensors, IEEE Circuits and Devices Magazine, vol.21, issue.3, pp.6-20, 2005.

B. Gassend, D. Clarke, M. Van-dijk, and S. Devadas, Silicon physical random functions, Proceedings of the 9th ACM conference on Computer and communications security, pp.148-160, 2002.

H. Gilbert, J. Plût, and J. Treger, Key-recovery attack on the ASASA cryptosystem with expanding s-boxes, Advances in Cryptology -CRYPTO 2015 -35th

. Annual-cryptology-conference, Lecture Notes in Computer Science, vol.9215, pp.475-490, 2015.

C. Giraud, DFA on AES, Advanced Encryption Standard -AES, 4th International Conference, vol.3373, pp.27-41, 2004.

L. Goubin, P. Paillier, M. Rivain, and J. Wang, How to reveal the secrets of an obscure white-box implementation, IACR Cryptology ePrint Archive, p.98, 2018.
URL : https://hal.archives-ouvertes.fr/hal-02171942

L. Goubin, J. Patarin, and B. Yang, Multivariate cryptography, Encyclopedia of Cryptography and Security, pp.824-828, 2011.
URL : https://hal.archives-ouvertes.fr/hal-00664733

X. Guo and R. Karri, Invariance-based concurrent error detection for advanced encryption standard, The 49th Annual Design Automation Conference 2012, DAC '12, pp.573-578, 2012.

Y. Guo and A. Tyagi, Voice-based user-device physical unclonable functions for mobile device authentication, Journal of Hardware and Systems Security, vol.1, issue.1, pp.18-37, 2017.

M. E. Hellman, A cryptanalytic time-memory trade-off, IEEE Trans. Inf. Theory, vol.26, issue.4, pp.401-406, 1980.

. Irdeto, Cloackware software protection

B. William, J. Johnson, and . Lindenstrauss, Extensions of lipschitz mappings into a hilbert space, Contemporary mathematics, vol.26, issue.1, pp.189-206, 1984.

R. Karri, G. Kuznetsov, and M. Gössel, Parity-based concurrent error detection of substitution-permutation network block ciphers, Cryptographic Hardware and Embedded Systems -CHES 2003, 5th International Workshop, vol.2779, pp.113-124, 2003.

M. Karroumi, Protecting white-box AES with dual ciphers, Information Security and Cryptology -ICISC 2010, vol.6829, pp.278-291, 2010.

T. Kerins and K. Kursawe, A cautionary note on weak implementations of block ciphers, 1st Benelux Workshop on Information and System Security, vol.12, 2006.

A. Kiayias and M. Yung, On crafty pirates and foxy tracers, Security and Privacy in Digital Rights Managements, ACM CCS-8 Workshop DRM, vol.2320, pp.22-39, 2001.

A. Kiayias and M. Yung, Breaking and repairing asymmetric public-key traitor tracing, Security and Privacy in Digital Rights Management, ACM CCS-9 Workshop, DRM 2002, vol.2696, pp.32-50, 2002.

A. Kiayias and M. Yung, Traitor tracing with constant transmission rate, International Conference on the Theory and Applications of Cryptographic Techniques, pp.450-465, 2002.

Y. Kim and Y. Lee, Campuf: physically unclonable function based on CMOS image sensor fixed pattern noise, Proceedings of the 55th Annual Design Automation Conference, DAC 2018, vol.66, pp.1-66, 2018.

C. Paul and . Kocher, Timing attacks on implementations of diffie-hellman, rsa, dss, and other systems, Advances in Cryptology -CRYPTO '96, 16th Annual International Cryptology Conference, vol.1109, pp.104-113, 1996.

C. Paul, J. Kocher, and B. Jaffe, Differential power analysis, Advances in Cryptology -CRYPTO '99, 19th Annual International Cryptology Conference, vol.1666, pp.388-397, 1999.

K. J. Kulikowski, M. G. Karpovsky, and A. Taubin, Fault attack resistant cryptographic hardware with uniform error detection, Fault Diagnosis and Tolerance in Cryptography, Third International Workshop, vol.4236, pp.185-195, 2006.

K. Kurosawa and Y. Desmedt, Optimum traitor tracing and asymmetric schemes, International Conference on the Theory and Application, pp.145-157, 1998.

R. Lampe and Y. Seurin, Tweakable blockciphers with asymptotically optimal security, Fast Software Encryption -20th International Workshop, FSE 2013, vol.8424, pp.133-151, 2013.
URL : https://hal.archives-ouvertes.fr/hal-02176877

D. Jae-w-lee, B. Lim, E. Gassend, M. Suh, S. Van-dijk et al., A technique to build a secret key in integrated circuits for identification and authentication applications, Symposium on VLSI Circuits. Digest of Technical Papers, issue.04CH37525, pp.176-179, 2004.

S. Lee, T. Kim, and Y. Kang, A masked white-box cryptographic implementation for protecting against differential computation analysis, IEEE Trans. Information Forensics and Security, vol.13, issue.10, pp.2602-2615, 2018.

T. Lepoint, M. Rivain, Y. Mulder, P. Roelse, and B. Preneel, Two attacks on a white-box aes implementation, International Conference on Selected Areas in Cryptography, pp.265-285, 2013.
URL : https://hal.archives-ouvertes.fr/hal-00872844

M. D. Liskov, R. L. Rivest, and D. A. Wagner, Tweakable block ciphers, Advances in Cryptology -CRYPTO 2002, 22nd Annual International Cryptology Conference, vol.2442, pp.31-46, 2002.

J. Lukás, J. J. Fridrich, and M. Goljan, Determining digital image origin using sensor imperfections, Electronic Imaging: Image and Video Communications and Processing, vol.6, 2005.

R. Luo, X. Lai, and R. You, A new attempt of white-box AES implementation, Proceedings IEEE International Conference on Security, Pattern Analysis and Cybernetics, SPAC 2014, pp.423-429, 2014.

R. Maes, Physically Unclonable Functions: Constructions, Properties and Applications (Fysisch onkloonbare functies: constructies, eigenschappen en toepassingen), 2012.

M. Matsui, Linear cryptanalysis method for DES cipher, Advances in Cryptology -EUROCRYPT '93, Workshop on the Theory and Applications of Cryptographic Techniques, vol.765, pp.386-397, 1993.

W. Michiels and P. Gorissen, Mechanism for software tamper resistance: an application of white-box cryptography, Proceedings of the Seventh ACM Workshop on Digital Rights Management, pp.82-89, 2007.

W. Michiels, P. Gorissen, . Henk, and . Hollmann, Cryptanalysis of a generic class of white-box implementations, Selected Areas in Cryptography, 15th International Workshop, SAC, vol.5381, pp.414-428, 2008.

B. Minaud, P. Derbez, P. Fouque, and P. Karpman, Key-recovery attacks on ASASA, Advances in Cryptology -ASIACRYPT 2015, vol.9453, pp.3-27, 2015.
URL : https://hal.archives-ouvertes.fr/hal-02470995

Y. Mulder, White-Box Cryptography: Analysis of White-Box AES Implementation (White-Box Cryptografie: Analyse van White-Box AES implementaties), 2014.

Y. Mulder, P. Roelse, and B. Preneel, Cryptanalysis of the xiao -lai whitebox AES implementation, Selected Areas in Cryptography -SAC 2012, vol.7707, pp.34-49, 2012.

Y. Mulder, P. Roelse, and B. Preneel, Revisiting the BGE attack on a white-box AES implementation, IACR Cryptology ePrint Archive, p.450, 2013.

B. Yoni-de-mulder, B. Wyseur, and . Preneel, Cryptanalysis of a perturbated whitebox AES implementation, Progress in Cryptology -INDOCRYPT 2010, vol.6498, pp.292-310, 2010.

D. Naccache, A. Shamir, and J. P. Stern, How to copyright a function?, Public Key Cryptography, Second International Workshop on Practice and Theory in PUblic Key Cryptography, PKC '99, vol.1560, pp.188-196

. Springer, , 1999.

D. Naor, M. Naor, and J. Lotspiech, Revocation and tracing schemes for stateless receivers, Advances in Cryptology -CRYPTO 2001, 21st Annual International Cryptology Conference, vol.2139, pp.41-62, 2001.

S. Nikova, V. Nikov, and V. Rijmen, Decomposition of permutations in a finite field, Cryptography and Communications, vol.11, issue.3, pp.379-384, 2019.

J. Patarin, Generic attacks for the xor of k random permutations, Applied Cryptography and Network Security -11th International Conference ACNS 2013, vol.7954, pp.154-169, 2013.
URL : https://hal.archives-ouvertes.fr/hal-02177221

R. Duong-hieu-phan, D. Safavi--naini, and . Tonien, Generic construction of hybrid public key traitor tracing with full-public-traceability, Automata, Languages and Programming, 33rd International Colloquium ICALP, vol.4052, pp.264-275, 2006.

G. Piret and J. Quisquater, A differential fault attack technique against spn structures, with application to the aes and khazad, International Workshop on Cryptographic Hardware and Embedded Systems, pp.77-88, 2003.

. Nist-fips-pub, Federal information processing standards publication, vol.197, 2001.

S. Rasoamiaramanana, G. Macario-rat, and M. Minier, White-box traitor tracing from probabilistic tardos codes, Innovative Security Solutions for Information Technology and Communications, 12th International Conference, vol.12001, 2019.
URL : https://hal.archives-ouvertes.fr/hal-02944663

A. D. Chester-rebeiro, A. S. Selvakumar, and . Devi, Bitslice implementation of AES, Cryptology and Network Security, 5th International Conference, vol.4301, pp.203-212, 2006.

M. Rivain and J. Wang, Analysis and improvement of differential computation attacks against internally-encoded white-box implementations, IACR Trans. Cryptogr. Hardw. Embed. Syst, vol.2019, issue.2, pp.225-255, 2019.

M. Denise, . Rousseau, B. Sim, R. S. Sitkin, C. Burt et al., Not so different after all: A cross-discipline view of trust, Academy of management review, vol.23, issue.3, pp.393-404, 1998.

E. Sanfelix, C. Mune, and J. De-haas, Unboxing the white-box, Black Hat EU 2015, 2015.

P. Sasdrich, A. Moradi, and T. Güneysu, White-box cryptography in the gray box --A hardware implementation and its side channels, Fast Software Encryption -FSE 2016, vol.9783, pp.185-203, 2016.

A. Saxena, B. Wyseur, and B. Preneel, Towards security notions for white-box cryptography, Information Security, 12th International Conference, vol.5735, pp.49-58, 2009.

A. Shamir and . Nicko-van-someren, Playing "hide and seek" with stored keys, Financial Cryptography, Third International Conference, FC '99, vol.1648, pp.118-124, 1999.

B. Skoric, S. Katzenbeisser, and M. Celik, Symmetric tardos fingerprinting codes for arbitrary alphabet sizes, Des. Codes Cryptogr, vol.46, issue.2, pp.137-166, 2008.

G. Tardos, Optimal probabilistic fingerprint codes, Journal of the ACM, vol.55, issue.2, p.10, 2008.

G. Tardos, Optimal probabilistic fingerprint codes, Proceedings of the 35th Annual ACM Symposium on Theory of Computing, pp.116-125, 2003.

A. Nikolaevich and U. , Design and Cryptanalysis of Symmetric-Key Algorithms in Black and White-box Models. phdthesis, 2019.

D. Valsesia, G. Coluccia, T. Bianchi, and E. Magli, User authentication via prnu-based physical unclonable functions, IEEE Transactions on Information Forensics and Security, vol.12, issue.8, pp.1941-1956, 2017.

O. Willers, C. Huth, J. Guajardo, and H. Seidel, Mems gyroscopes as physical unclonable functions, Proceedings of the 2016 ACM SIGSAC Conference on Computer and Communications Security, pp.591-602, 2016.

Y. Xiao and X. Lai, A secure implementation of white-box aes, Computer Science and its Applications, 2009. CSA'09. 2nd International Conference on, pp.1-6, 2009.