Towards a theory of white-box security

Amir Herzberg, Haya Shulman, Amitabh Saxena, Bruno Crispo

Research output: Chapter in Book/Report/Conference proceedingConference contributionpeer-review

8 Scopus citations


Program hardening for secure execution in remote untrusted environment is an important yet elusive goal of security, with numerous attempts and efforts of the research community to produce secure solutions. Obfuscation is the prevailing practical technique employed to tackle this issue. Unfortunately, no provably secure obfuscation techniques currently exist. Moreover, Barak et. al., showed that not all programs can be obfuscated. Theoretical research exhibits provably secure albeit inefficient constructions, e.g. using tools from encrypted domain. We present a rigorous approach to software execution in remote environment based on a new white box primitive, the White Box Remote Program Execution (WBRPE), whose security specifications include confidentiality and integrity of both the local and the remote hosts. WBRPE can be used for many applications, e.g. grid computing, digital rights management, mobile agents. We then present a construction of a specific program such that if there exists a secure WBRPE for that program, then there is a secure WBRPE for any program, reducing its security to the underlying WBRPE primitive. The security of WBRPE construction is established by reduction among two white box primitives and it introduces new techniques of programs manipulation.

Original languageEnglish
Title of host publicationEmerging Challenges for Security, Privacy and Trust - 24th IFIP TC 11 International Information Security Conference, SEC 2009, Proceedings
Number of pages11
StatePublished - 2009
Externally publishedYes
Event24th IFIP TC11 International Information Security Conference, SEC 2009 - Pafos, Cyprus
Duration: 18 May 200920 May 2009

Publication series

NameIFIP Advances in Information and Communication Technology
ISSN (Print)1868-4238


Conference24th IFIP TC11 International Information Security Conference, SEC 2009


Dive into the research topics of 'Towards a theory of white-box security'. Together they form a unique fingerprint.

Cite this