Earlier this month, Apple and Microsoft disclosed independent vulnerabilities in their digital signature infrastructure, affecting a huge range of operating systems.
In Apple's case, it was possible to create a fake signature and get macOS to trust it. (Details) This is like a fake ID that fools the bartender into selling alcohol to a teenager.
In Microsoft's case, it was possible to create fake signatures that looked like they were from a trusted entity. (Details) This is like being able to print your own ID cards, as if you were some authority.
Digital signatures are like driver's licenses (or other ID cards, around the world), but for software. They say, with authority, who the holder is. They are used to convey trust: if I know who you are, I know what you should be allowed to do, and I can have reasonable trust in how you'll behave.
So too with apps.
All modern apps come with digital signatures, like ID cards, saying who they are. But a digital signature, unlike an ID card, can instantly be checked to see if it's valid. It doesn't just have to look authentic - you can actually check that it really is authentic, and who the publisher really is - through standard cryptographic techniques based on “public key infrastructure (PKI)”.
This idea underpins most consumer apps used today. Apps in the iOS App Store have always required digital signatures. So too with Android. macOS and Windows have been ratcheting up digital signature requirements for more than a decade, and now signatures are effectively a requirement to deliver software to macOS, while on Windows they are required for a good user experience.
Digital signatures are also used by software publishers to establish their own trust systems. One common example is products that load content or have plugins, and need to verify that the content or plugins are authentic. Digital signatures are exactly the right tool for this job.
Both of these bugs have the same basic consequence: until they were fixed, digital signatures weren't really the strong guarantee of identity that we thought they were. Or in the Microsoft case, there might be fake digital signatures in the wild that can never be proven inauthentic.
Those apps you installed, from trusted publishers, might not have been from those publishers at all.
This highlights one of the problems with digital signatures: they're a single source of trust. If you base all your trust on one system, then when that system is broken, you have no trust left. As happened last week, with Apple and Microsoft.
But PACE customers are still protected, even now that these vulnerabilities are well known. Our licensing and content protection platforms use our own digital signature infrastructure - on top of the OS signature infrastructure - to verify the authenticity of plugins and content. We use a completely separate set of certificate authorities (but the same proven cryptography!) to provide a second layer of trust above and beyond the standard operating system signature checking.
Our signatures weren't broken by these vulnerabilities, and the software publishers who rely on PACE digital signatures can continue to trust the content and plugins they load into their products.
PACE customers also enjoy features that don't come with operating system digital signatures, like explicit identification of the product (not just the publisher), and connections between licensing and digital signatures that enable features like encrypting content that can only be decrypted by authorized products.
If you have a software product or content that would benefit from stronger authenticity guarantees, or from high-security licensing and distribution, we encourage you to contact us at to learn more about how PACE can help you protect your work.
Solid State Logic (SSL) is a world leading manufacturer of advanced audio production systems for studio, live sound and broadcast. With more than 3000 SSL-equipped facilities operational today, SSL consoles and recording studio hardware and software are universally recognised for their reliability and outstanding sound quality.
Founded in 1969, SSL has seen an interesting evolution in its product offering . The name “Solid State Logic” was originally derived from their first product - a switching system for pipe organs. 7 years later, the product line expanded to include the first A-series console in 1976, and a big breakthrough with the SL 4000 E Series in 1979. Variants of this console followed, transforming the way music was recorded, and creating an international gold standard in music engineering hardware.
1985 marked the beginning of an era of digital research and development, leading to the development of the 01 - an eight channel recorder/editor. Three decades of continuous innovation landed Solid State Logic not only as a leader in recording hardware, but also professional studio software - both analogue and digital.
Although SSL is most famous for its rich legacy in analogue studio hardware, the company also has extensive experience in digital audio and DSP development. As the industry grew beyond dedicated hardware-hosted DSP, the release of the ‘SSL Native’ plug-ins signaled SSL’s first steps into the Digital Audio Workstation software marketplace - including the legendary Bus Compressor and Channel Strip plug-ins, inspired by sought-after sound of the SL 4000 E-series analogue console.
The entrance into the software marketplace marked the beginning of a relationship between Solid State Logic and PACE Anti-Piracy. In early 2011 SSL needed a licensing solution for their software and evaluated PACE’s early product InterLok. SSL needed a Machine Based Licensing solution, a solution which PACE was still developing, and ultimately SSL chose an alternative licensing platform.
It is important to note that license management platforms hold a variety of responsibility on many different levels. Not only does a platform have to securely distribute licenses to end users, the platform must also stay up to date with the latest operating system releases. "Customers are expecting things to work in their environment. In the audio industry, customers often need to avoid upgrading their computers for backcompatibility reasons between sessions. Supporting all of these environments ends up being maintenance and testing for the developer and you need a platform that can target all these things and is going to work. There are a lot of changes to keep up with. I don't think this would be possible were we doing all of this in house!” remarked Jon Sandman, Product Manager at SSL.
In 2013 an OS release caused a variety of issues with the SSL licensing system. The licensing vendor SSL had chosen was unable to maintain the software updates needed to continue uninterrupted service and a good user experience when a major release occurred. The issues caused the team at Solid State Logic to reach back out to PACE Anti-Piracy. “We needed a solution that was widely supported and from a supplier that made the integration process fast and straightforward. We had already used proprietary and less well known securitization solutions, and familiarity and market acceptance had been seen as barriers to success.”
By this time, PACE had developed and released Eden - a robust license management system with Machine-Based Licensing and security - exactly what SSL needed. James Motley, Head of Workstation Products at SSL at the time, was concerned about the cost to migrate license management platforms to PACE, and the effect it would have on business. PACE was able to work with the SSL and Audiotonix team to create flexible pricing and tiers.
When asked why SSL chose to go to PACE for their licensing needs, Jon Sandman said “We were aware of a number of successful companies using PACE security solutions in our industry. Many of our customers were already familiar with PACE, and so in looking for a securitization solution, PACE was an obvious choice.” When asked why SSL did not choose an alternative licensing solution, Jon continued “Market acceptance is important to us. Securitization and piracy prevention measures are a sensitive subject for our customers, and since PACE had already achieved acceptance with users and established themselves as a leader in our industry, a significant hurdle was overcome from the offset.”
“It is especially important to SSL that we also protect our IP. Emulations of SSL hardware, for example - if someone were to pick the software apart, then it would be a real shame for the dedicated plug-in development and DSP team that we have here at SSL.”
In addition to offering security and licensing services, the PACE Anti-Piracy brand also houses JUCE - an open-source cross-platform C++ application framework, used for the development of desktop and mobile applications. JUCE has been an integral part of the SSL software development framework. SSL has expanded software plug-in development - going from 10 plug-ins, to regularly releasing on average 2 plug-ins every quarter bringing the current total to 22.
“Not only our plug-ins, but our desktop application is in JUCE - the virtual mixer. We are reaping some of the benefits of the JUCE framework - including graphics improvements - in our SSL 360° desktop application and our new 4K B plug-in which used the latest JUCE release. The 4K B channel strip plug-in is an analogue model of the SL 4000 B-series console channel - an entirely new SSL channel strip for your productions - complete with 360° Plug-in Mixer (your virtual SSL console) and first-class integration with the SSL UC1 and UF8 for hands-on control.”
With PACE’s acquisition of JUCE also came the stewardship of the Audio Developer Conference (www.audio.dev). ADC will host its 7th annual conference in London and Online this year November 14 -16, 2022.
Solid State Logic supported the mission of the Audio Developer Conference with silver sponsorships in 2021.
The SSL team participated both online and in-person during the conference, presenting a talk How to Stand the Test of Time (Despite The Time it Takes to Test) by Jon Sandman. When asked why the Audio Developer Conference is important, Jon remarked “It is great to connect with the people that make the products you love.”
“I’ve always had an interest in accessibility and UX. It is a pretty broad subject, and going to ADC and actually connecting with experts in that field inspired me, and gave me a mental roadmap of what we can do and what our focus can be, which is important for me as a Product Manager.”
PACE Anti-Piracy brings a standard in professional audio software licensing that many companies rely on. We take great pride in working with organizations like Solid State Logic to ensure their software licensing needs are met. In addition, we are honored to expand our connection to SSL through our brands JUCE and the Audio Developer Conference. We look forward to a continued partnership on all levels!
For more information on the new SSL 4K B plug-in, please visit: https://www.solidstatelogic.com/products/ssl-4k-b
For more information on the Audio Developer Conference visit https://audio.dev
PACE Joins the MathWorks Connections Program, Allowing MATLAB Users to Monetize Their Projects
Silicon Valley, CA – PACE Anti-Piracy, creator of the iLok and PACE Licensing Platform, announced today that it has become a member of the MathWorks Connections Program. MathWorks is the world's leading developer of technical computing software for engineers and scientists.
MathWorks Connections Membership Gives MATLAB Compiler Users Full-Scale Support to Commercially Distribute their Application with a Licensing and Security Solution.
The MathWorks Connections Program is available to third-party organizations that develop complementary products that integrate and add to the existing feature set of MATLAB®, a programming and numeric computing platform used by millions of engineers and scientists to analyze data, develop algorithms, and create models. These partner offerings address technical needs across a wide range of applications and industries worldwide with software and hardware products that extend the usage of MATLAB and Simulink®. These solutions seamlessly integrate with MathWorks products and ensure ongoing compatibility with new platform releases.
PACE Anti-Piracy brings nearly four decades of application security and licensing experience to the MATLAB market. With over 140 million licenses secured, PACE is extending its platform support to include MATLAB Compiler projects. PACE Anti-Piracy’s licensing solution delivers support for:
PACE allows MATLAB users to have the peace of mind that their IP and software are protected and offers a platform to commercialize and monetize their compiled MATLAB Applications.
“Our MATLAB integrated solution extends PACE’s respected security and licensing platform that currently services industries such as Fintech, Medical, Industrial Software, and Media Entertainment,” said Patrick DiFerdinando, VP of Sales. “We were approached by MATLAB users seeking a bespoke licensing solution. As a result, PACE created a standardized solution to meet the needs of MATLAB users. We are pleased to join the MathWorks Connections Program and offer our security expertise to the scientists and engineers that wish to sell their software.”
PACE Anti-Piracy is a global leader in robust Application Protection and flexible Software Licensing Management Solutions. Since 1985, PACE has provided software developers and distributors with high value products, automated solutions for anti-piracy protection and secure software distribution. In response to market demands for stronger security products, PACE has expanded its product line to offer White-Box Cryptography (WBC) and Runtime Application Security Protection (RASP) solutions. PACE's products and services are trusted by thousands of software developers supporting millions of end users around the world.www.paceap.com
For further information on how to monetize your MATLAB, please contact: [email protected]
MathWorks is the leading developer of mathematical computing software. MATLAB, the language of engineers and scientists, is a programming environment for algorithm development, data analysis, visualization, and numeric computation. Simulink is a block diagram environment for simulation and Model-Based Design of multidomain and embedded engineering systems. Engineers and scientists worldwide rely on these products to accelerate the pace of discovery, innovation, and development in automotive, aerospace, communications, electronics, industrial automation, and other industries. MATLAB and Simulink are also fundamental teaching and research tools in the world’s universities and learning institutions. Founded in 1984, MathWorks employs more than 5000 people in 16 countries, with headquarters in Natick, Massachusetts, USA. For additional information, visit mathworks.com.
MATLAB and Simulink are registered trademarks of The MathWorks, Inc. See www.mathworks.com/trademarks for a list of additional trademarks.
Maybe you’ve been making audio software for decades, or perhaps you’ve just finished your first plug-in with JUCE, and now you want people to try it for a certain period of time. Let’s talk about some quick and easy ways to offer trial licenses for your PACE-protected software. By the end of this, you will know several of the ways in which you can provide trial licenses, and some of the methods for delivering those trial licenses.
As a software publisher using the PACE licensing system, you have a lot of control over who can gain access to your software, and how. Whether you want to offer a perpetual license with several activations, or a subscription license only allowed on an iLok USB, or just a timed trial so everyone can try your product before they buy it, you control the ways in which your customers interact with your software.
Let’s explore several ways of distributing trial licenses to customers (and how to implement them) so everyone can enjoy trying your products, including:
Auto-demo is one of the most widely used methods for depositing a trial license into your customer’s iLok account. Why? Because the PACE tools do the work for you.
It starts with the Activation Experience, which is a tool included with PACE Level 1 protection. The Activation Experience is triggered when PACE-protected desktop software is launched, or when a PACE-protected plug-in is scanned by a DAW. If you install a PACE-protected pro audio plug-in and do not yet have a license for it, the Activation Experience will pop up and ask the customer to log into their iLok account. After a user logs in, it will search for any valid license for that product within that iLok account.
If a license is found, Activation Experience will ask the user where it should be activated (iLok USB/iLok Cloud/machine, for example) and continue through the activation process.
If a license is not found, Activation Experience will pop up a ‘Try’ button. When that Try button is clicked, it will automatically deposit a trial license (pre-selected by the publisher) into that iLok account, and then continue with the activation process.
Once you (the Publisher) have set up your trial license and chosen the Auto-demo in your Activation Experience setup, all you need to deliver to the customer is that PACE-protected binary for the customers to gain access to a trial license.
Benefits of Auto-demo:
Built into the PACE SDK is access to an online portal called PACE Central. Among many other tools within PACE Central, (including license creation, trial license time limit setup, iLok account search, etc.) there is the Code Factory. The Code Factory allows you to create and manage activation codes for various licenses, including trials and perpetual licenses. You can create activation codes yourself and distribute them right to your customers.
Once your customer has that code, it can be redeemed one of two ways:
Which one is better? Whichever one your customer prefers. There is a benefit when your customer uses iLok License Manager because it will allow them to see more exactly which location they have activated the license to.
Redeeming a code and activating with iLok License Manager
Redeeming a code and activating with Activation Experience
Once you’ve created a batch of codes, there is the question of how you will deliver those codes to your potential customers. See the Methods of Distribution below for some commonly used ways to get trial licenses to your customers.
Benefits of Activation Codes:
The online portal, PACE Central, allows software publishers to manually deposit licenses directly into any iLok account. Having the ability to quickly deposit a trial license for customer support reasons, or for beta testing and influencer management, can be quite helpful. However, manually depositing trial licenses one by one for your general customer base is not recommended, for the hopefully obvious reason that it will quickly become tedious and time-consuming.
Whether you decide to use Auto-demo or Activation Codes for your trial licenses, there are a few methods of distribution to consider. Once you have a PACE-protected binary, you could easily give out Activation Codes to anyone or, just provide a download link for your installer if you chose the Auto-demo. Why wouldn’t you do that? Because you will want to know who actually tries your software.
People who try your software are your target audience, which means you’ll want to get them to opt in to marketing and promotional emails from you. This will provide you with the ability to:
While the PACE tools provide valuable data on licenses deposited for support purposes, owning your own customer database and knowing each product they have tried and/or purchased will enable you to grow your business and stay connected from the very beginning. Knowing the lifetime value of your customers is crucial for successful planning of marketing and promotional plans.
This option would require someone to either provide an email address, or a full user registration (name, email, etc.) on your website, before you allow them access to the installer for your product. Once that registration is verified, a redirect URL can give access to the installer with the Auto-demo. If you choose Activation Codes, one can be emailed to the customer.
This involves setting up a $0 product in your webstore that requires customers to fill out information and allows you to place a checkbox to try for the opt-in of marketing emails. Once they have ‘purchased’ a trial for that product, the installer can be provided with either the Activation Code to be redeemed, or a link to the installer for your software with the Auto-demo included.
To sum it up, once you’ve decided to protect your desktop application or plug-in with PACE, there are several ways to create and deliver trial licenses to your customers.
As your business grows, there are more advanced options available to centralize the direct sales, dealer sales, and customer registration and installation processes. This would involve having your own code system for users and dealers in a central place with more automated and secure deposits to PACE. This could also include single sign-on and activation in your application. Having all of this data within your own CRM or database will allow for a more seamless customer experience and more upsell opportunities, and remove any potential data privacy issues. PACE clients that make this investment in their infrastructure tend to have great success in growing their business and increasing the lifetime value for each customer.
Our experience has shown that publishers increase sales when they offer prospective customers a trial of their plug-in. To that end, we at PACE have created a licensing platform that offers our publishers the ability to customize the trial and demo experience. By offering multiple ways of creating and delivering licenses, we give our publishers the autonomy to customize the experience that is best for their customers.
For more information on offering trial licenses or how PACE can benefit you and your customers, contact us now.
PACE Anti-Piracy was featured in a recent edition of Cyber Defense Magazine with an article titled “Are We Shifting Left Enough” written by Douglas Kinloch, VP of Business Development.
The term “shift left” is centered on the idea that Application Security efforts are now happening at earlier stages of the development lifecycle. Mr. Kinloch adds to the discussion by raising the questions “how far left does an organization need to shift?”
He writes: “Shift Left” is in danger of becoming a buzz-word, much as “End Point” did 20 years ago. In software development, it is clear that the idea of moving security awareness from traditionally the last thing considered before shipping, to something every developer understands, can implement, and can act accordingly has to be a good thing. “Zero Trust” is another buzzword that may travel hand-in-hand with Shift Left, but as many are beginning to point out there is no single Zero Trust silver bullet, it’s a process. As a process it needs to be the default setting of any designer of any system relying on IT networks, connectivity or software.”
At PACE we are users of software tools that ensure the Licensing products we supply to our customers and partners remains as secure as possible. It is a different approach to most License Management tools where there is an emphasis on process, revenue management and software monetization. It is our belief that if the License Manager can be compromised, then all the software monetization tools in the world can’t maximize revenue or protect developers’ IP.
In order to deliver such security the Developer team at PACE “shifted left” in the early 2000s and delivered iLok License Manager, secured by deep understanding of application code, and use of our Fusion Application Protection tools; Anti-Tamper and Obfuscation. To further secure customers’ IP and revenue streams, White Box Works ensures the security of the cryptographic keys within the entire system.
PACE is now offering the same capabilities to partners across a number of markets, supporting Software POS and High Value Software customers, protecting IP and vitally important business logic from outside interference.
The assumption that compiled app code will be accessed, and that attackers have the tools and skills changes the security calculus completely.
Zero Trust means that developers protecting their code understand that the actual end-point is not the device, or even the application within that device, but is the source code on the developers’ machine - before it’s even compiled. So when you decide to Shift Left, as we did, ask yourself, “how far?”
Find the full article in Cyber Defense Magazine.
For more information on how PACE tools can help your organization shift left, contact us.
Freehand Graphics is a global leader in software solutions for the screen-printing industry. Some of their software, notably Separation Studio NXT and AccuRIP Emerald, makes pre-press functions, like color separation, a simple and easy process for their customers.
As art students living in New York City, Charlie and Laura Facini were interested in making a career in the arts. Charlie was interested in printmaking and took a part-time job at a screen-printing shop to earn some extra money. Technology was quickly changing during this time, and screen printing was beginning to transition from a completely manual process to digitization. The industry was changing, and Charlie was at the forefront. While working daily to process orders, manually adjusting colors and specs, Charlie realized that parts of the screen-printing process were extremely time-consuming and error-prone. He decided to embrace the innovation that was happening around him with computers and technology and write a computer program to optimize the process.
Charlie wrote a program that would ultimately revolutionize screen-printing. What would normally take 3 labor-intensive days of work, Charlie’s program allowed to be done in less than an hour. Having discovered such a time-saving and efficient tool, Charlie’s screen-printing shop (which he now owned with his wife Laura) was able to process more orders and ultimately make more money. The next step – could he sell this program to other screen-printing shops?
In 1995, Freehand sought a way to distribute its software securely with a licensing system. PACE helped Freehand set up a secure licensing model that allowed customers to try the software, and later to buy it. The ability to ‘wrap’ their code with PACE’s unique architecture gave Freehand the security and flexibility it needed for trial extensions, ensuring prospects had enough time to evaluate the product and eventually buy.
In 2007, after joining forces with a new developer, Freehand decided to move toward a home-grown licensing model and no longer use PACE.
A shortfall of the home-grown licensing system was the lack of a robust license control center. With limited ability to help clients activate or deactivate software in response to local hardware issues, Freehand actively looked to improve the UX and to enhance customer service.
Free trials are at the core of many software sales strategies. For Freehand Graphics, nearly all sales are preceded by an 8-day trial. One drawback to the home-grown licensing system was that when a potential customer downloaded the trial, Freehand couldn't easily turn off access once the trial was over. People evaluating the software could, in some cases, still have access even though their trial period was over.
Freehand Graphics also offered a ‘chargeback guarantee’ – allowing customers who purchased their products to get their money back if they were not satisfied. Although a rare occurrence, when a customer did ask for a chargeback, there wasn’t an easy way to completely turn off access. A customer chargeback should have triggered the end of the license use, but the system in place did not offer that ability.
Finally, in 2019 Freehand decided to move from perpetual licenses to a subscription model. The need to make this change stemmed from a goal to create more features and a better user experience for customers. Charlie added “Perpetual is an ugly word when you are trying to create recurring revenue for a software product.” It was this decision that ultimately brought them back to PACE.
"With PACE, clients in good standing continue to benefit from using Freehand software, while those without an active license no longer have access. Freehand benefits from knowing that software activated means profits retained, while users enjoy the freedom and power of 24/7/365 web-based license controls."
The return to PACE Licensing not only helped Freehand’s new business model create recurring revenue and growth, but it also resulted in a better experience for their end-users. PACE iLok License Manager delivered a better UX for end-users, who are now more self-sufficient. This has resulted in a significant decrease in some support requests and eliminated other support issues altogether. This, in turn, has allowed Freehand to focus more on product and development.
When asked what role professional security and licensing have on Freehand Graphics, Charlie Facini responded
“Without question, our products would not exist in this form in a digital age. It is impossible. You can’t let someone trial software without security, you can’t sell without security. Without proper security, you have an open-ended sale. PACE Anti-Piracy gave us something we never had in the past... mental security.”
For more information on how PACE Anti-Piracy can help with your licensing needs, contact us!
PACE Anti-Piracy, Inc. is proud to announce that Vienna Symphonic Library is now offering iLok USB and iLok Cloud compatible licenses for their entire product line. In an announcement earlier today, VSL's press release stated "We’re excited to enter a new era of easy installation procedures, license management, and using our products with or without a physical USB key!"
Along with new iLok compatible licenses, VSL has created an application called Vienna Assistant, to aid in the download and installation process. As VSL states "we’ve streamlined the entire process from purchasing to playing so you can focus on what really matters, your music!" To celebrate the switch, VSL is offering store-wide discounts on all of their products!
Derek Heimlich, Director of Sales, Pro Audio, at PACE Anti-Piracy stated "We are proud to be working with Vienna Symphonic Library. They are known throughout the industry for their excellent products, and we are happy to help protect their products while enabling their customers to fulfill their artistic endeavors."
For videos, instructions, and more details on VSL's switch to iLok, read their full article here.
VSL is one of the leading developers of sample libraries and music production software for classical orchestral music. The Vienna Symphonic Library provides digital samples of solo voices and instruments as well as orchestral ensembles. The VSL software acts as an interface for the music composer to play the real instruments on a MIDI keyboard. Hans Zimmer, Danny Elfman, Lenny Kravitz, Beyoncé, and Justin Timberlake are all VSL users.
PACE Anti-Piracy Inc., is pleased to announce full Native Apple Silicon support. After significant development and rigorous testing, iLok copy protection tools are now fully Apple Silicon compatible. The latest license support software update now includes full M1 support, along with existing support for Intel-based Mac OS systems. This release enables plug-in makers and publishers to update their products that have native M1 support with full license protection.
“We knew our publishers were keen on taking advantage of M1 Pro and M1 Pro Max devices and its impact on the creative community and their workflows. This was a top priority for our engineering team - and it was a big job. We are really happy about this release.” said Allen Cronce, CEO PACE Anti-Piracy, regarding the announcement.
In addition, if you are using iLok License Manager version 5.5 or newer, you can now request a machine activation reset from within iLok License Manager. The publisher will still need to approve the request.
iLok is part of the PACE Anti-Piracy licensing platform which enables publishers to distribute their licenses securely via cloud, machine, or iLok hardware. Secure license distribution also requires different layers of protection, including a high security tamper-protection solution called Fusion. The work surrounding Fusion was very complex and required significant changes at the OS Level.
About PACE Anti-Piracy
PACE Anti-Piracy Inc., is an industry leader in providing robust software copy protection and flexible license management services, is a privately held company based in Silicon Valley, California. Since 1985, PACE has provided software publishers and distributors with easy-to-use high-quality solutions for anti-piracy protection and secure software distribution. PACE's products and services are used by an ever-growing number of world-class software publishers around the world.
Next-gen ‘White-Box Works’ code generator launches complete with EMVCo Software-Based Mobile Payment security evaluation certificate
1st March 2022 - San Jose, California - Banks, payment service providers (PSPs), schemes, and other financial institutions can now benefit from a uniquely high level of sensitive data protection and application attack resistance, following today’s launch of White-Box Works, a next-generation EMVCo-evaluated White-Box code generator, from PACE Anti-Piracy.
Unlike traditional solutions, White-Box Works gives the customer complete, independent control over their protected code, ensuring their encryption keys and proprietary algorithms never leave the customer’s premises. White-Box Works can transform any C-code into a protected white-box variant in a single step, offering unparalleled flexibility, security, and efficiency.
This level of in-house control also promises to increase operational efficiency for the customer, since they are no longer beholden to a white-box library vendor’s build schedule and can develop their application in accordance with their internal schedules. It also enables the customer to use, replace and update their deployed encryption keys and algorithms at will, with no need to re-engage PACE Anti-Piracy, or any other third-party vendor, to do so.
White-Box Works has been designed to defeat a variety of sophisticated attacks, including those involving reverse engineering, fault injection, and advanced statistical analysis (such as Differential Computation Analysis).
White-Box Works outputs code that has been designed to defeat a range of attacks to which many encryption-dependent financial apps remain vulnerable, including, for example, those supporting mobile payments, digital identity, self-service retail, and softPOS use-cases.
White-Box Works has also achieved an EMVCo Software-Based Mobile Payment (SBMP) security evaluation certificate, following a successful EMVCo SBMP Evaluation conducted by global security lab, Riscure.
“Statistical Analysis attacks are the bane of all white-box encryption protection solutions,” comments Allen Cronce, CEO of PACE Anti-Piracy, Inc. “We are very proud to be equipping the financial services industry with a solution capable of addressing these and other vulnerabilities. White-Box Works represents a significant step forward in the encryption protection space, and will give banks, PSPs, schemes, and other financial sector users greater confidence in the security of their sensitive data. We’re also delighted to accompany the launch with news of White-Box Works’ EMVCo SBMP evaluation certificate and are grateful to Riscure’s talented penetration testers. The entire Riscure team has been a pleasure to work with throughout the rigorous EMVCo evaluation process.”
“Riscure is proud to have assisted PACE Anti-Piracy in achieving an EMVCo SBMP evaluation certificate for White-Box Works,” adds Maarten Bron, Managing Director of Riscure North America. “This innovative technology provides a unique security capability for solution developers as it supports the creation of white-box instances for any algorithm, allowing for optimal flexibility and developer freedom when the protection of cryptographic keys is vital. This makes White-Box Works not only useful in payments, but also in other fields such as digital rights management, eHealth, IoT, automotive and more.”
“It's also noteworthy that White-Box Works was evaluated as a stand-alone technology and did not require the additional protection of binary hardening and tamper-proofing technology to receive an EMVCo security evaluation certificate,” adds Allen Cronce. “I believe this is another industry first for White-Box Works. It’s an unmatched achievement we are immensely proud to highlight.”
About PACE Anti-Piracy, Inc.
PACE Anti-Piracy, Inc. is a privately held company based in San Jose, California. Since 1985, PACE has provided software publishers and distributors with high-quality solutions for secure software distribution. PACE products are used by a growing number of world-class software publishers around the world.
Founded in 2001, Riscure is a leading global advisor on the security of connected and IoT devices, as well as a recognized vendor of advanced security testing tools and security training. Riscure helps customers around the world to build robust hardware and software solutions and to speed up the process of secure development and certification. Riscure is the thought leader in Mobile Security and has been the front runner on security analysis of White-box Cryptographic implementations since 2012.