1. Attacking an obfuscated cipher by injecting faults Matthias Jacob mjacob@cs.princeton.edu mjacob@cs.princeton.edu Dan Boneh dabo@cs.stanford.edu Edward Felten felton@cs.princeton.edu In the proceedings of the 2002 ACM Workshop on Digital Rights Management http://crypto.stanford.edu/DRM2002/drm1.pdf Oral report presented for COMPSCI 725 by Sidney MarkowitzSidney Markowitz

2. Attacking an obfuscated cipher by injecting faults Summary Fault injection to extract a DES key from decryption software protected using a particular commercial obfuscator Why hiding such a key is important How to mount the attack Claims that the technique can be used on any block cipher that uses rounds Possible defenses against this attack Oral report presented for COMPSCI 725 by Sidney MarkowitzSidney Markowitz

3. Appreciative comment: The topic is important: If we could let people run decryption software but hide the key from them, then copy protection, enforcement of software licensing, protecting trade secrets in software, etc., would be easy. Critical comments: 1. The technique requires so much access to the software being cracked that the attacker already has everything that can be gained by cracking it 2. The authors' claims of generality of the technique to other ciphers seem incorrect Oral report presented for COMPSCI 725 by Sidney MarkowitzSidney Markowitz

4. How the attack works Figure 2, from the paper Block diagram of one round of DES Provide inputs that produce small changes in the output Insert faults before last round, analyse changes in outputs Oral report presented for COMPSCI 725 by Sidney MarkowitzSidney Markowitz

5. Criticism #1: Assumes too much access "First, both encryption and decryption operations need to be available, and second, the attacker needs to be able to modify the ciphertext arbitrarily.“ If you can encrypt and decrypt at will what need is there for the key? Attacker must be able to see boundaries between rounds in the code Attacker must be able to change data being passed into a round computation. Oral report presented for COMPSCI 725 by Sidney MarkowitzSidney Markowitz

6. Criticism #2: Incorrect claims of generality Rn-1 -> (Ln or Rn) unchanged (Feistel network) -- Not true for non-Feistel round-based block ciphers such as AES Few bits left to brute force after round subkey is found -- Not true for other Feistel ciphers including Skipjack, Blowfish, 3DES Oral report presented for COMPSCI 725 by Sidney MarkowitzSidney Markowitz

7. Appreciative comment (redux): The topic is important: If we could let people run decryption software but hide the key from them, then copy protection, enforcement of software licensing, protecting trade secrets in software, etc., would be easy. Questions based on appreciative comment How far is it worth going to prevent people from having full access to the software that they buy? What ethical rights do people have to software that they buy? What ethical rights do the publishers have? Do your answers justify ever hiding a decryption key in software? Oral report presented for COMPSCI 725 by Sidney MarkowitzSidney Markowitz