Software publishers often attempt to restrict access to portions of compiled software executables to thwart would-be reverse engineering while still allowing the executables to function properly. Reverse engineering is the practice of dissecting and/or analyzing software to understand how it works. On certain systems, reverse engineering can retrieve information stored within software such as information related to cryptographic keys or copy protection schemes. Reverse engineers can even tamper with the software itself.
Would-be attackers typically have access to the executable code for software and can try to reverse engineer it at their leisure. Those of skill in the art are aware of many approaches to harden a piece of software to such reverse engineering attempts. However, problems with these approaches include rapid growth of source code and increased computational requirements. Such source code can be very difficult to maintain. Further, if an attacker compromises the hardening scheme, the software is difficult to rewrite.
Suppose a software publisher includes proprietary keys, algorithms, and copy protection related information in software for sale or for free. Reverse engineers can quickly obtain legitimate or illegitimate copies of the software and commence testing the software for weaknesses and thereby extract proprietary keys and algorithms.
In modern cryptography, a common methodology is the use of mathematical problems that are believed to be difficult to solve, in order to give bricks to design strong systems. Amongst these problems, one may find the factorization or the discrete logarithm problem. This methodology has been shown to be very efficient, and was one of the key elements to transform the art of cryptography into a real science.
The most important success of basing cryptography on hard problems is the arrival of proven security: with some mathematical proof and rigorous analysis. It is possible to prove certain security features of a scheme, supposing only that these problems resist to algorithms in practice. White box cryptography in general lacks sufficient security compared to regular black box cryptography, where huge improvements were made to support such security in the standard model. It is indeed hard to prove something in the white box cryptography case because attackers have access to internal states or values.