Page 1
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Different Concepts for ProgramObfuscation
Yury Lifshits
Mathematics & Mechanics FacultySaint Petersburg State University
Spring 2005 – SETLab
Page 2
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Outline
1 ApplicationsClassical CryptographySoftware ProtectionMobile Agents TechnologyOther
Page 3
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Outline
1 ApplicationsClassical CryptographySoftware ProtectionMobile Agents TechnologyOther
2 Main ApproachesObfuscating TransformationsBlackbox SecurityMobile Cryptography
Page 4
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Outline
1 ApplicationsClassical CryptographySoftware ProtectionMobile Agents TechnologyOther
2 Main ApproachesObfuscating TransformationsBlackbox SecurityMobile Cryptography
3 Aspects of ModelProgram RepresentationAttacks and Environment
Page 5
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Applications for Obfuscation
Today: only short overview of applications
In details: Lecture 4 - “Applications for Obfuscation”
Page 6
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Classical Cryptography
What applications in cryptography can we imagine?
Page 7
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Classical Cryptography
What applications in cryptography can we imagine?
➯ Private key cryptosystem → Public key cryptosystemIt was mentioned even in famous Diffie-Hellman paper.
Page 8
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Classical Cryptography
What applications in cryptography can we imagine?
➯ Private key cryptosystem → Public key cryptosystemIt was mentioned even in famous Diffie-Hellman paper.
➯ Homomorphic encoding
Page 9
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Classical Cryptography
What applications in cryptography can we imagine?
➯ Private key cryptosystem → Public key cryptosystemIt was mentioned even in famous Diffie-Hellman paper.
➯ Homomorphic encoding
➯ Random oracles removing
Page 10
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Software Protection
Situation: we distribute (sell) software products.
Question: Threats and applications you see?
Page 11
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Software Protection
Situation: we distribute (sell) software products.
Question: Threats and applications you see?
➯ Competitors threat (reusing your code)
Page 12
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Software Protection
Situation: we distribute (sell) software products.
Question: Threats and applications you see?
➯ Competitors threat (reusing your code)
➯ Intelligent tampering (changing parameters)
Page 13
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Software Protection
Situation: we distribute (sell) software products.
Question: Threats and applications you see?
➯ Competitors threat (reusing your code)
➯ Intelligent tampering (changing parameters)
➯ Threat of functionality changes (protectiondemo-versions)
Page 14
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Software Protection
Situation: we distribute (sell) software products.
Question: Threats and applications you see?
➯ Competitors threat (reusing your code)
➯ Intelligent tampering (changing parameters)
➯ Threat of functionality changes (protectiondemo-versions)
➯ Watermarks protection
Page 15
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Mobile Agents Technology
Situation: we distribute programs for our needs.
Question: Threats and applications you see?
Page 16
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Mobile Agents Technology
Situation: we distribute programs for our needs.
Question: Threats and applications you see?
➯ Privacy: e.g. internet-distributed computation
Page 17
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Mobile Agents Technology
Situation: we distribute programs for our needs.
Question: Threats and applications you see?
➯ Privacy: e.g. internet-distributed computation
➯ Keys protection: buying agents.
Page 18
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Mobile Agents Technology
Situation: we distribute programs for our needs.
Question: Threats and applications you see?
➯ Privacy: e.g. internet-distributed computation
➯ Keys protection: buying agents.
➯ Intelligent tampering
Page 19
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Other applications
Question: More applications?
Page 20
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Other applications
Question: More applications?
Yes!
Page 21
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Other applications
Question: More applications?
Yes!
➯ Virus development
Page 22
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Other applications
Question: More applications?
Yes!
➯ Virus development
➯ Watermark attacks
Page 23
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
An Obfuscator
In details: Lecture 2 - “Obfuscating transformations”
Page 24
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
An Obfuscator
In details: Lecture 2 - “Obfuscating transformations”
➯ Functionality preserving
➯ Increase of code size, time & space requirements are restricted(usually by constant factor)
➯ Obfuscated program is not readable (not understandable)
Page 25
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Classification of obfuscatingtransformations
What can we obfuscate in the program?
Page 26
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Classification of obfuscatingtransformations
What can we obfuscate in the program?
➯ Layout transformationsChange formatting information
Page 27
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Classification of obfuscatingtransformations
What can we obfuscate in the program?
➯ Layout transformationsChange formatting information
➯ Control flow transformationsAlter control program and computation
Page 28
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Classification of obfuscatingtransformations
What can we obfuscate in the program?
➯ Layout transformationsChange formatting information
➯ Control flow transformationsAlter control program and computation
➯ Aggregation transformationRefactor program using aggregation methods
Page 29
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Classification of obfuscatingtransformations
What can we obfuscate in the program?
➯ Layout transformationsChange formatting information
➯ Control flow transformationsAlter control program and computation
➯ Aggregation transformationRefactor program using aggregation methods
➯ Data transformationsUse information encoding
Page 30
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Quality of Obfuscation
How good our obfuscation is?
Page 31
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Quality of Obfuscation
How good our obfuscation is?
Strength can be measured by:
➯ PotencyE(P′)E(P)
− 1
➯ ResilienceTrivial, weak, strong, full, one-way
➯ CostFree, cheap, costly, expensive
➯ Stealthy
Page 32
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Ideal case
What do we want to get?
Page 33
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Ideal case
What do we want to get?
Page 34
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Ideal case
What do we want to get?
Very limited information:
➯ input-output behavior
➯ running time
Page 35
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Ana and BAna
We are interested in 2 types of polynomial-time analyzers:
➯ Ana is a source-code analyzer that can read theprogram.
Ana(P)
➯ BAna is a black-box analyzer that only queries theprogram as an oracle.
BAnaP(time(P))
Page 36
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Ana and BAna
We are interested in 2 types of polynomial-time analyzers:
➯ Ana is a source-code analyzer that can read theprogram.
Ana(P)
➯ BAna is a black-box analyzer that only queries theprogram as an oracle.
BAnaP(time(P))
Black-Box security
Ana can’t get more information than BAna could
Page 37
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Property Hiding
How to formalize property hiding?
Page 38
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Property Hiding
How to formalize property hiding?
Instance: two families of programs Π1 and Π2
Adversary task: given a program P ∈ Π1 ∪ Π2 todecide whether P ∈ Π1 or P ∈ Π2.
Page 39
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Property Hiding
How to formalize property hiding?
Instance: two families of programs Π1 and Π2
Adversary task: given a program P ∈ Π1 ∪ Π2 todecide whether P ∈ Π1 or P ∈ Π2.
Desirable protection: make adversary task as difficult aswell-known computationally hard problem is.
Page 40
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Constant Hiding
How to formalize constant hiding?
Page 41
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Constant Hiding
How to formalize constant hiding?
Instance: family of programs
Π = {P|P computes f (s, x); s ∈ S}
Adversary task: given a program P ∈ Π to computeparameter s.
Page 42
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Constant Hiding
How to formalize constant hiding?
Instance: family of programs
Π = {P|P computes f (s, x); s ∈ S}
Adversary task: given a program P ∈ Π to computeparameter s.
Desirable protection: make adversary task as difficult aswell-known computationally hard problem is.
Page 43
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Encrypted Computation
More details: Lecture 5 - “Basic Complexity Results”
What is encrypted computation?
Basic task: keep F unknown to Bob.
Page 44
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Extendings of Encrypted Computation
Additional tasks of encrypted computation model:
➯ Move difficult computations to BobD is easier than F
➯ Reduce communication complexityIn the case sizeof ((F (x))� sizeof (x). Example: x is database
➯ Keep x secret from Alice
Page 45
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Currently studied representations
Obfuscating techniques development depends on usedprogram representation
So what sort of programs are we going to protect?
Page 46
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Currently studied representations
Obfuscating techniques development depends on usedprogram representation
So what sort of programs are we going to protect?
➯ Turing Machines / Circuits (function computing)
Page 47
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Currently studied representations
Obfuscating techniques development depends on usedprogram representation
So what sort of programs are we going to protect?
➯ Turing Machines / Circuits (function computing)
➯ C++/Java code
Page 48
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Currently studied representations
Obfuscating techniques development depends on usedprogram representation
So what sort of programs are we going to protect?
➯ Turing Machines / Circuits (function computing)
➯ C++/Java code
➯ Assembler code
Page 49
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Currently studied representations
Obfuscating techniques development depends on usedprogram representation
So what sort of programs are we going to protect?
➯ Turing Machines / Circuits (function computing)
➯ C++/Java code
➯ Assembler code
➯ Rational function / Matrix representation
Page 50
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Search for other representations
Is it enough?
Page 51
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Search for other representations
Is it enough?
Not! New models should contain:
Page 52
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Search for other representations
Is it enough?
Not! New models should contain:
➯ Current state of the program.
Page 53
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Search for other representations
Is it enough?
Not! New models should contain:
➯ Current state of the program.
➯ Self-modifiable code
Page 54
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Search for other representations
Is it enough?
Not! New models should contain:
➯ Current state of the program.
➯ Self-modifiable code
➯ Notion of computation trace.
Page 55
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Search for other representations
Is it enough?
Not! New models should contain:
➯ Current state of the program.
➯ Self-modifiable code
➯ Notion of computation trace.
➯ Other formalizations for functionality preserving.
Page 56
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Adversary
What should we specify about adversary?
Page 57
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Adversary
What should we specify about adversary?
➯ Adversary knowledge about protected program
Page 58
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Adversary
What should we specify about adversary?
➯ Adversary knowledge about protected programMember of family
Page 59
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Adversary
What should we specify about adversary?
➯ Adversary knowledge about protected programMember of familyKnown function – unknown parameters (data) and state.
Page 60
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Adversary
What should we specify about adversary?
➯ Adversary knowledge about protected programMember of familyKnown function – unknown parameters (data) and state.
➯ Adversary task (attack)
Page 61
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Adversary
What should we specify about adversary?
➯ Adversary knowledge about protected programMember of familyKnown function – unknown parameters (data) and state.
➯ Adversary task (attack)Classification follows in Lecture 4.
Page 62
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Potential for Obfuscation
Is it possible to protect every program?
Page 63
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Potential for Obfuscation
Is it possible to protect every program?
➯ How to measure potential of obfuscation?Learnability: black-box learnable functions areimpossible to obfuscate.
➯ What couldn’t be protected?Input-Outbut behaviourTraces
Page 64
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Network model
What are interesting network extentions of the model?
Page 65
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Network model
What are interesting network extentions of the model?
➯ Many programs cooperate
➯ Programs are migrating
➯ Programs can be recharged
➯ Different sources for inputs (outside connections)
Page 66
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Summary
➯ Rough idea of applications: cryptosystem design,mobile agents technology, software protection.
Page 67
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Summary
➯ Rough idea of applications: cryptosystem design,mobile agents technology, software protection.
➯ Basic approaches: obfuscating transformations,black-box security, encrypted computation.
Page 68
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Summary
➯ Rough idea of applications: cryptosystem design,mobile agents technology, software protection.
➯ Basic approaches: obfuscating transformations,black-box security, encrypted computation.
➯ Further aspects of the model: program representation,state protection, adversary description, functionalitypreserving.
Page 69
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Summary
➯ Rough idea of applications: cryptosystem design,mobile agents technology, software protection.
➯ Basic approaches: obfuscating transformations,black-box security, encrypted computation.
➯ Further aspects of the model: program representation,state protection, adversary description, functionalitypreserving.
Page 70
Concepts ofObfuscation
Yury Lifshits
ApplicationsClassicalCryptography
Software Protection
Mobile AgentsTechnology
Other
MainApproachesObfuscatingTransformations
Blackbox Security
MobileCryptography
Aspects ofModelProgramRepresentation
Attacks andEnvironment
Summary
Summary
➯ Rough idea of applications: cryptosystem design,mobile agents technology, software protection.
➯ Basic approaches: obfuscating transformations,black-box security, encrypted computation.
➯ Further aspects of the model: program representation,state protection, adversary description, functionalitypreserving.
Question Time!
Page 71
Concepts ofObfuscation
Yury Lifshits
Back UpSlidesNot covered by thetalk
References
Not covered by the talk
Gray & white securityApproximate obfuscatorsOperations on obfuscated codeAdversary successNondeterministic natureModifying algorithm vs. modifying codeComplexity of deobfuscation: NP, NP-hard, undecidable,one-way...Obfuscation on specification levelWroblewsky model
Page 72
Concepts ofObfuscation
Yury Lifshits
Back UpSlidesNot covered by thetalk
References
For Further Reading
Yury LifshitsProgram Obfuscation. A Survey [in Russian]http://logic.pdmi.ras.ru/˜yura/of/survey1.pdf
Luis F.G. SarmentaProtecting Programs from Hostile Environmentshttp://bayanihancomputing.net/papers/ae/ae.ps