Saturday, March 30, 2013

Dissecting the Whitebox Key returned by the TiVo Stream

We were able to successfully have the TiVo stream return a whiteboxkey, but what data IS the white box key?

White-box key output

It is important to note that the white-box key changes every X minutes, it is NOT a constant.

Here is the contents of the file:


Well, this is certainly not an AES-128 key.  It is some convoluted key that is probably consumed by a white-box cryptography object.

The header "SKBW" is quite interesting, upon googling "SKB" I found a company called "white cryption" (now cryptanium) that offers a "Secure Key Box" white box solution.  They offer a library for iOS, I imagine this is what TiVo used.  

Product Overview

SKB is a C/C++ library that provides an extensive set of high-level classes and methods for working with the most popular cryptographic algorithms. The library’s unique white-box implementation is specifically designed to hide and protect cryptographic keys at all times. In SKB, keys are always encrypted and cryptographic algorithms operate directly with encrypted keys.
  • Cryptographic keys are always encrypted
  • Diversified code and data
  • Robust white-box cryptography implementation
  • Watermarked program code
  • Security is inseparable from the program code
  • Safe storage of cryptographic keys

It is interesting to note that the parent company of "white cryption" is "intertrust", who has been in the news for suing numerous large companies recently (including HTC, Apple).  They also have a patent application for "Obfuscation techniques for enhacing software security": http://www.google.com/patents/US6668325

I have to accept the reality, I do not have the time or resources to decrypt this white-box cryptography engine.  But do I even have to? What is the white box key even used to decrypt?


No comments:

Post a Comment