Realizing authorization via incorrect functional behavior of a white-box implementation

A method of creating a cryptographic implementation of a cryptographic operation mapping an input message to an output message, wherein the cryptographic implementation provides separate authorization for a plurality of different input message groups using a single cryptographic key, comprising:

• producing a cryptographic implementation of the keyed cryptographic operation;
• receiving information identifying the authorization settings to be applied by the cryptographic implementation, wherein each identified authorization setting has an associated input message group, wherein each input message group is associated with a set of input messages, and wherein the sets of input messages do not overlap;
• modifying the cryptographic implementation based upon the received information identifying the authorization settings so that:
• when a received input message is associated with one of the authorized input message groups, the cryptographic implementation outputs a correct output message associated with the received input message;
• and
• when a received input message is not associated with one of the authorized input message groups, the cryptographic implementation outputs an incorrect output message associated with the received input message or terminates the operation of the keyed cryptographic operation.

A method of authorization in a cryptographic system that provides separate authorization for a plurality of different input message groups using a single cryptographic key, comprising:

• receiving, by the cryptographic system, a first input message from a first input message group;
• performing, by the cryptographic system, a keyed cryptographic operation mapping the first input message into a first output message,
• wherein the keyed cryptographic operation produces a correct output message when the cryptographic system is authorized for the first input message group,
• wherein the keyed cryptographic operation does not produce a correct output when the cryptographic system is not authorized for the first input message group, and
• wherein each of the plurality of input message groups has an associated set of input messages wherein the sets of input messages do not overlap.