White-box approaches target difficult environments where applications use keys locally. Evaluate claims against your application and threat model.
Evaluation approach
Measure key extraction and unauthorized key use separately. Ask about updates, performance and platform dependence.
Application example
Limit offline decryption scope without allowing operations requiring server authority to run locally without bounds.
Limits and considerations
Do not accept absolute non-extractability claims without independent evidence.
What should a proof of concept measure?
Recovering raw keys and invoking protected key functions without authority are separate objectives. Report both to explain business-risk effects.
Checks and decisions
- Ask for the threat model
- Measure use restrictions
- Plan updates
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.