1. Attacking an obfuscated cipher by injecting faults
Matthias Jacob
Dan Boneh
Edward Felten
2002 ACM Workshop on Digital Rights Management
Presented by Mike Stay

2. Summary
This paper introduces the concept of tamper resistance as a new way to measure the strength of obfuscation algorithms and shows how tampering can be used to defeat a commercial obfuscator.

3. “To make so confused as to be difficult to understand”
Obfuscation
“To make so confused as to be difficult to understand”
Code is supposed to be so confusing that it’s hard to figure out:
Data: decryption key, for instance
How to manipulate it: get rid of nag screens, DRM, etc.
What it’s doing: algorithm is trade secret

4. Previous Taxonomy Collberg et al: Potency – confusing a human
Resilience – confusing a computer
Cost – time / space overhead
Stealth – if you can’t find it, you can’t attack it

5. Previous Taxonomy Collberg et al: Potency – confusing a human
Resilience – confusing a computer
Cost – time / space overhead
Stealth – if you can’t find it, you can’t attack it
This paper:
Tamper Resistance – how well it resists attempts to break the system by changing data or code

6. Improving Tamper Resistance
Local checking: check each intermediate result or instruction with a checksum
Global checking: interleave many copies of the same algorithm and take the median value.
Self-checking: obfuscate the checker and have it check itself as well.
Custom obfuscation: different for each user

7. Criticism Human-consumable content Countermeasures
If you just consider the problem of decrypting data while protecting a secret key, public key crypto solves it; but neither system is any good at preventing attacks that just sniff the soundboard.
Countermeasures
The suggested countermeasures for tamper resistance are ad hoc, with no security proof.
Custom obfuscation is very impractical: you can’t burn 1000 CDs with your product all at once

8. Good stuff Proof that finding a key is NP-complete:
Given a decryption circuit D(p, k) and an obfuscated decryption circuit O(p), simply let O(p) = 1 and find k such that D(k) = 1.
But that’s exactly SAT, the canonical NP-complete problem.
Building functions that are hard like that is what modern cryptography is all about. No one knows, for instance, a k for which SHA1(k) = 0.

9. What if we could obfuscate any size data?
Trapdoor block cipher: a block cipher that works like a public-key cipher, but much faster.
Secure Turing machine: data becomes a one-time pad for hiding the state of the computation using two-player protocols.

10. Question:
What other countermeasures can you think of to protect software against tampering?