White-Box Tweakable Block Cipher and Hardware-Binding Scheme Under Tweak-Unique Mode

Abstract

White-box cryptography protects secret keys in untrusted execution environments but remains vulnerable to code lifting attacks. Hardware-binding offers a practical countermeasure by coupling cryptographic implementations with specific devices, yet a unified theoretical foundation is lacking. This paper establishes such a foundation by formalizing the white-box tweakable block cipher and introducing the tweak-binding property, which guarantees decryption failure upon tweak mismatch and underpins hardware-binding security. We prove that strong tweakable pseudo-random permutation security implies tweak-binding. A concrete construction is realized by embedding the WARX white-box block cipher into the CLRW14 framework, with provable security against key extraction. We further propose the tweak-unique mode as a mandatory operational paradigm, requiring a unique non-repeating tweak per encryption. Leveraging this mode with physical unclonable functions (PUFs), we design a hardware-binding scheme that stores only a single challenge-response pair per device, enabling deployment with commodity static random-access memory (SRAM) PUFs. Security proofs demonstrate provable resilience against code lifting. Performance evaluations on Intel server, Raspberry Pi 5, and Xilinx Zynq-7010 platforms show linear scaling with message size and minimal overhead, confirming suitability for both server-grade and resource-constrained internet of things (IoT) or mobile environments.

The authors' abstract, as published at the source. Information, 2026 · DOI ↗