Securing Symmetric Encryption Based on Substitution-Permutation Network Against White-Box Attacks

Extensive research has been done on the security of symmetric encryption algorithms in the black-box attack contexts, where the execution platforms are supposed to be secure. Recent studies intend to secure encryption algorithms in a more challenging but widely adopted scenario, the white-attack context (WBAC), where the adversaries have full visibility of the implementations of cryptosystems and full control over execution platforms. Various of approaches for protecting symmetric encryption algorithms in the WBAC have been proposed. Unfortunately, most existing approaches have been broken. This paper proposes a novel approach for securing symmetric encryption algorithms based on substitution-permutation network (SPN). Our key idea is to incorporate additional secret components into lookup tables to expand and dramatically change the inner states of encryption. Unlike existing approaches, these components do not need to be annihilated in adjacent rounds, and the ciphertext remains essentially unchanged. To recover the plaintext, only simple operations and the standard decryption algorithm are required. Our approach can be applied to protect SPN-based symmetric encryption algorithms such as AES. Security analysis indicates that the approach is expected to be resistant to both existing and unknown attacks. Furthermore, experimental evaluation shows that our approach performs well on various platforms.