Watermarking input and output of a white-box implementation

A non-transitory machine-readable storage medium encoded with instructions for mapping an input message to an output message by a keyed cryptographic decryption operation, wherein the keyed cryptographic decryption operation includes a last round and a state, comprising:

• instructions for performing a watermarking function on a first portion of the state prior to input to the last round, wherein the watermarking function produces a first output when the first portion has a specific predetermined value;
• instructions for performing a substitution function in the last round on the first output to produce a watermark output, wherein the substitution function incorporates a portion of a cryptographic key,
• wherein the watermark output uniquely identifies the keyed cryptographic encryption operation.

A method of mapping an input message to an output message by a keyed cryptographic decryption operation, wherein the keyed cryptographic decryption operation includes a last round and a state, comprising:

• performing a watermarking function on a first portion of the state prior to input to the last round, wherein the watermarking function produces a first output when the first portion has a specific predetermined value;
• performing a substitution function in the last round on the first output to produce a watermark output, wherein the substitution function incorporates a portion of a cryptographic key,
• wherein the watermark output uniquely identifies the keyed cryptographic encryption operation.