Cryptanalysis of ARX-based White-box Implementations


  • Alex Biryukov University of Luxembourg, Esch-sur-Alzette, Luxembourg
  • Baptiste Lambin University of Luxembourg, Esch-sur-Alzette, Luxembourg
  • Aleksei Udovenko University of Luxembourg, Esch-sur-Alzette, Luxembourg



White-box cryptography, Cryptanalysis, Algebraic attacks, Decomposition attacks


At CRYPTO’22, Ranea, Vandersmissen, and Preneel proposed a new way to design white-box implementations of ARX-based ciphers using so-called implicit functions and quadratic-affine encodings. They suggest the Speck block-cipher as an example target.
In this work, we describe practical attacks on the construction. For the implementation without one of the external encodings, we describe a simple algebraic key recovery attack. If both external encodings are used (the main scenario suggested by the authors), we propose optimization and inversion attacks, followed by our main result - a multiple-step round decomposition attack and a decomposition-based key recovery attack.
Our attacks only use the white-box round functions as oracles and do not rely on their description. We implemented and verified experimentally attacks on white-box instances of Speck-32/64 and Speck-64/128. We conclude that a single ARX-round is too weak to be used as a white-box round.




How to Cite

Biryukov, A., Lambin, B., & Udovenko, A. (2023). Cryptanalysis of ARX-based White-box Implementations. IACR Transactions on Cryptographic Hardware and Embedded Systems, 2023(3), 97–135.