The WhibOx contest (Edition 2019) is a white-box cryptography competition organized by CryptoExperts and Cybercrypt as the CHES 2019 CTF Challenge. The contest took place from March 18, 2019 to August 21, 2019. The results were announced at the CHES 2019 Rump Session (slides available at here).
Final strawberry scoreboard (developer category):
|cryptolux||Alex Biryukov, Aleksei Udovenko
(University of Luxembourg)
|Gordon F.|| Charles Bouillaguet
(University of Lille)
Final banana scoreboard (attacker category):
|cryptolux||Alex Biryukov, Aleksei Udovenko (University of Luxembourg)||728.22|
|Idefix||Security group of IDEMIA||640.48|
The competition comes in two flavors for competitors:
It is up to contestants to choose between remaining completely anonymous or using a recognizable identity. Coders are not expected to explain their designs, but only to provide a resulting C code. Attackers are not expected to explain their techniques, but only to recover embedded key(s) or decrypted plaintexts.
The motivation for initiating the WhibOx contest Edition 1 came from the growing interest of the industry towards white-box cryptography (most particularly for DRMs and mobile payments) and the obvious difficulty of designing secure solutions in a scientifically valid sense. The conjunction of these 2 realities has prompted some companies to develop home-made solutions (with a security relying on the secrecy of the underlying techniques) rather than to rely on academic designs.
The 2017 edition of the competition gave an opportunity for researchers and practitioners to confront their (secretly designed) white-box implementations to state-of-the-art attackers. It also provided a new training material to reverse-engineers and security evaluators.
Given the success of Edition 1, and the fact that no challenge implementation survived more than 28 days of continuous attacks, we thought useful and exciting to pick up the competition where we left off and give a new chance to designers to showcase their talents. Once again, we hope to give a boost to scientific research and elevate the worldwide industrial know-how in the field of white-box cryptography.
Similarly to Edition 1:
New in Edition 2:
This time around, new features and competition rules have been instated.
The complete and detailed rules of the competition are available in the "Competition Rules" tab on the dashboard.
As soon as a challenge implementation is submitted, it is made public on the server and can hence be freely downloaded and broken by contestants. Implementations can be submitted from March 18 to Aug 1, 2019. After the submission deadline, attackers still have 20 days to continue breaking challenge implementations (until 4 days before CHES 2019 starts).
Winners will be announced at the CHES 2019 rump session (CHES 2019 will take place from Aug 25 to 28 in Atlanta, USA).
Join the discussion forum on Slack and get your questions answered by the organizing committee. Invitation based - send us an invitation request at firstname.lastname@example.org. You may also be invited by people that are already members.
The organizing committee is composed of Yunsi Fei, Vincent J. Mooney III and Patrick Schaumont (General Chairs of CHES 2019), Andrey Bogdanov and Stefan Kölbl (CyberCrypt), Louis Goubin, Pascal Paillier, Matthieu Rivain and Junwei Wang (CryptoExperts).
Andrey Bogdanov and Stefan Kölbl have gracefully volunteered to host and manage the submission server at CyberCrypt.
The source code of the submission server has been developed by CryptoExperts. It is fully open source and available on GitHub. Credits go to Junwei Wang for re-developing significant parts of the server at the occasion of this second edition of the WhibOx Contest; the 2017 version was created by Thomas Baignères and Matthieu Finiasz. The new rules and features are due to the CryptoExperts team, with ideas suggested by Benoît Chevallier-Mames, Chris Brzuska and contestants from the 2017 edition.