### Cryptographic Schemes Versus Black-Box Implementations  
Most cryptographic schemes require some secret keys for protocol participants. These keys must be protected, as the sheer possibility of unauthorized use undermines the whole security concept. This philosophy leads to the strategy of encapsulating cryptographic operations and data in a secure environment and restricting access to this environment so that only the requests specified in the cryptographic scheme are processed. In particular, no direct read access to the memory of this secure environment should be granted. This is a sound strategy, as a seemingly innocent read operation might be an element of an unknown attack. Consequently, it is a good practice to use such black-box devices (implemented either in hardware or software) to run cryptographic procedures. The concept of a cryptographic black box is a double-edged sword. As long as an implementation follows the specification to the letter, the cryptographic security arguments apply. However, how do we know what is executed by a black-box device? It may only look like an honest and flawless implementation of the scheme. In reality, intentional and non-intentional deviations from the ideal implementation might invalidate the security and privacy arguments. A prominent example of this situation was the flaw in Estonian electronic personal identity cards, where a faulty RSA key-generation procedure resultedin citizens' public keys being compromised [11]. In an ideal situation, an auditor could conclude that the implementation is correct and secure by analyzing the device's behavior (output correctness on test data, execution time, power consumption, etc.). Unfortunately, this is almost never the case for cryptographic products. First, a lot of effort is put into ensuring that side-channel analysis does not provide any information about the operations performed. This protects the system from attacks but simultaneously limits the auditor's capabilities. Given this, the problem is that a protocol implementation may deviate from the specification and cryptography may provide an indistinguishability proof for it. In that case, unless a fundamental cryptographic assumption is broken, no distinguisher has a non-negligible advantage in distinguishing a genuine implementation from a modified one based solely on the device's input and output. Of course, this does not preclude detection during a destructive physical inspection in a specialized lab. An attacker might have various goals when manipulating a protocol implementation. The first goal might be to transmit data to a designated receiver covertly. Classic subliminal channels [12] fall into this category. Another purpose of modification might be to leak secret keys stored on the device (and possibly generated there) to the attacker (and to nobody else). Then, these modifications fall into the category of _kleptography_[13]. Recently, anamorphic channels received a lot of interest: their additional feature in comparison to subliminal channels is undetectability even if the protocol participants are forced to surrender all secret keys present in the protocol according to the original specification to a distinguisher [14]. Subliminal information channels can be used for evil (like kleptography) and good purposes. For example, a malicious implementation of the popular FIDO2 standard may be used to break the unlinkability properties against a designated party [15]. On the other hand, one can hide information (a watermark) in standard signatures created by legitimate devices so that signatures forged by a third party after breaking the public key can be recognized and nulled [16]. In the case of blind signatures, the malicious goal might be to break anonymity guarantees: a malicious device may enable the signer to link the unblinded signature to the device and thereby to its owner. An attack may also involve transmitting covert data in either direction (e.g., the device's private keys or description of some tasks to be carried out by the device).