# US 2014/0153716 A1 · White-box implementation

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 2014/0153716 A1
- Document ID: US20140153716A1
- Status: Published application
- Kind: A1
- Application number: 14/176,938
- Filed: 2014-02-10
- Published: 2014-06-05
- Earliest claimed: 2008-03-05
- Assignees: Irdeto Corporate B.V.
- Applicants: Irdeto Corporate B.V.
- Inventors: Wilhelmus P.A.J. Michiels; Paulus M.H.M.A. Gorissen
- Web page: https://patentgrep.com/patent/US20140153716A1

## CPC

- H04L 9/16: the keys or algorithms being changed during operation
- G06F 7/723: {Modular exponentiation (G06F7/724, G06F7/727, G06F7/728 take precedence)}
- H04L 9/06: the encryption apparatus using shift registers or memories for block-wise {or stream} coding, e.g. DES systems {or RC4; Hash functions; Pseudorandom sequence generators}
- H04L 9/30: Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
- H04L 2209/16: Obfuscation or hiding, e.g. involving white box
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

A system for enabling a device to compute an outcome of an exponentiation Cx having a base C and/or an exponent x, the system comprising means for establishing a plurality of values λi; means for establishing a plurality of values ωi satisfying ωi=Cλi; means for establishing a plurality of values φi satisfying that the sum of the values λiφi equals x; and an output for providing the device with the plurality of values φi. A device computes an outcome of the exponentiation Cx. The device comprises means for computing a product of the values ωi to the power of φi. The device is arranged for using the product as a result of the exponentiation Cx.

## Claims

### Claim at position 1

1-16. (canceled)

### Claim 17

A method for computation of an outcome of an exponentiation Cx having a base C and an exponent x by means of a white-box implementation of the exponentiation, the method comprising:
receiving information indicative of at least a part of a plurality of values ωi and at least a part of information indicative of a plurality of values φi, the plurality of values ωi satisfying ωi=Cλi, the plurality of values φi, satisfying
x
=
∑
i
=
1
r

λ
i

ϕ
i
,
i=1, 2, . . . , r ; and
encrypting a message to obtain a ciphertext and/or decrypting the ciphertext to obtain the message, by using
P
=
∏
i
=
1
r

ω
i
ϕ
i
wherein P=Cx, thereby hiding at least one of the precise value of the base C and exponent x from a white-box attack.

### Claim 18 (depends on 17)

The method according to claim 17, wherein the base C is a ElGamal public key.

### Claim 19 (depends on 17)

The method according to claim 17, wherein encrypting a message m comprises:
generating a ciphertext including calculating αk2 by using P,
k2 corresponding to x, α being associated with the key.

### Claim 20 (depends on 19)

The method according to claim 19, wherein generating a ciphertext comprises:
generating the ciphertext given by (γ, δ) by using P,
γ=αk1, δ=m·(αa)k1·αk2
α being associated with a public key
g being a function,
α being associated with a private key,
1≦k1≦n−1,
k2=g(γ).

### Claim 21 (depends on 17)

The method according to claim 17, wherein decrypting a ciphertext comprises:
decrypting a ciphertext including calculating αk2 by using P, k2 corresponding to x, α being associated with the key.

### Claim 22 (depends on 21)

The method according to claim 21, wherein decrypting a ciphertext comprises:
decrypting the ciphertext given by (γ, δ) by using P to obtain the message m given by γ−a·α−k2·δ, γ=αk1, δ=m·(αa)k1·αk2,
a being associated with a public key,
g being a function,
α being associated with a private key,
1≦k1≦n−1,
k2=g(δ).

### Claim 23

A non-transitory computer readable storage storing a program comprising instructions, which when executed by a processor, causes the processor to perform computation of an outcome of an exponentiation Cx having a base C and an exponent x by means of a white-box implementation of the exponentiation, comprising:
receiving a device with information indicative of at least a part of a plurality of values ωi and at least a part of information indicative of a plurality of values φi,
the plurality of values ωi satisfying ωi=Cλi, the plurality of values φi satisfying
x
=
∑
i
=
1
r

λ
i

ϕ
i
,
i=1, 2, . . . , r; and
encrypting a message m to obtain a ciphertext and/or decrypting the ciphertext to obtain the message m, by using
P
=
∏
i
=
1
r

ω
i
ϕ
i
wherein P=Cx, thereby hiding at least one of the precise value of the base C and exponent x from a white-box attack.

### Claim 24

A method for computation of an outcome of an exponentiation Cx having a base C and an exponent x by means of a white-box implementation of the exponentiation, the method comprising:
establishing a plurality of values λi, for i=1, 2, . . . , r,
establishing a plurality of values ωi for i=1, 2, . . . , r, satisfying ωi=Cλi, C being associated with a key of a cipher,
establishing a plurality of values φi, for i=1, 2, . . . , r, satisfying
x
=
∑
i
=
1
r

λ
i

ϕ
i
;
and
providing a device with information indicative of at least a part of the plurality of values ωi and at least a part of information indicative of the plurality of values φi to calculate
P
=
∏
i
=
1
r

ω
i
ϕ
i
wherein P=Cx, thereby hiding at least one of the precise values of the base C and exponent x from a white-box attack.

### Claim 25 (depends on 24)

The method according to claim 24, wherein the base C is a ElGamal public key.

### Claim 26 (depends on 24)

The method according to claim 24, wherein encrypting a message m comprises:
generating a ciphertext including calculating αk2 by using P, k2 corresponding to x, α being associated with the key.

### Claim 27 (depends on 26)

The method according to claim 26, wherein generating a ciphertext comprises:
generating the ciphertext given by (γ, δ) by using P,
γ=αk1, δ=m·(αa)k1·αk2,
α being associated with a public key
g being a function,
α being associated with a private key,
1≦k1≦n−1,
k2=g(γ).

### Claim 28 (depends on 24)

The method according to claim 24, wherein decrypting a ciphertext comprises:
decrypting a ciphertext including calculating α−k2 by using P,
k2 corresponding to x, α being associated with the key.

### Claim 29 (depends on 28)

The method according to claim 28, wherein decrypting a ciphertext comprises:
decrypting the ciphertext given by (γ, δ) by using P to obtain the message m given by γ−a·α−k2·δ, γ=αk1, δ=m·(αa)k1·αk2,
α being associated with a public key,
g being a function,
α being associated with a private key,
1≦k1≦n−1,
k2=g(γ).

### Claim 30 (depends on 17)

The method according to claim 17, wherein the exponent x is variable, and wherein establishing a plurality of values λi comprises:
establishing a set V of values to be used as the exponent x, and a plurality of sets of values W1, W2 . . . , Wr such that
V
⊆
{
∑
i
=
1
r

λ
i
·
w
i

(
w
1
,
w
2
,
…

,
w
r
)
∈
W
1
×
W
2
×
…
×
W
r
}
.

### Claim 31 (depends on 30)

The method according to claim 30, wherein establishing the plurality of values φi comprises:
selecting the values φi such that φi∈Wi, for i 1, 2, . . . , r.

### Claim 32 (depends on 24)

The method according to claim 24, wherein Wi={0,1}, for i=1, 2, . . . , r.

### Claim 33 (depends on 24)

The method according to claim 24, wherein C is of order q, q being a positive integer such that Cx=1.

### Claim 34 (depends on 17)

The method according to claim 17, comprising at least one of:
selecting different pluralities of values λi with respect to the base C and the exponent x, to be used in respect of different devices; and
selecting different values r with respect to the base C and the exponent x, in respect of different devices.

### Claim 35 (depends on 17)

The method according to claim 17, comprising at least one of:
selecting wherein r is an integer and r≧2;
generating the key;
encrypting and/or decrypting information indicative of the plurality of values ωi and information indicative of the plurality of values φi.

### Claim 36

A non-transitory computer readable storage storing a program comprising instructions, which when executed by a processor, causes the processor to perform computation of an outcome of an exponentiation Cx having a base C and an exponent x by means of a white-box implementation of the exponentiation, comprising:
establishing a plurality of values λi, for i=1, 2, . . . , r,
establishing a plurality of values ωi for i=1, 2, . . . , r, satisfying ωi=Cλi, C being associated with a key of a cipher,
establishing a plurality of values ωi, for i1, 2, . . . , r, satisfying
x
=
∑
i
=
1
r

λ
i

ϕ
i
;
and
providing a device with information indicative of at least a part of the plurality of values ωi and at least a part of information indicative of the plurality of values φi to calculate
P
=
∏
i
=
1
r

ω
i
ϕ
i
wherein P=Cx, thereby hiding at least one of the precise values of the base C and exponent x from a white-box attack.