https://arxiv.org/abs/2107.04940

close this message

Donate to arXiv

Please join the Simons Foundation and our generous member
organizations in supporting arXiv during our giving campaign
September 23-27. 100% of your contribution will fund improvements and
new initiatives to benefit arXiv's global scientific community.

DONATE

[secure site, no need to create account]

Skip to main content
Cornell University
We gratefully acknowledge support from
the Simons Foundation and member institutions.
 
arXiv.org > cs > arXiv:2107.04940
[                    ]

Help | Advanced Search

[All fields        ]
Search
arXiv
Cornell University Logo
[                    ] GO
quick links

  * Login
  * Help Pages
  * About

Computer Science > Cryptography and Security

arXiv:2107.04940 (cs)
[Submitted on 11 Jul 2021]

Title:You Really Shouldn't Roll Your Own Crypto: An Empirical Study
of Vulnerabilities in Cryptographic Libraries

Authors:Jenny Blessing, Michael A. Specter, Daniel J. Weitzner
Download PDF

    Abstract: The security of the Internet rests on a small number of
    open-source cryptographic libraries: a vulnerability in any one
    of them threatens to compromise a significant percentage of web
    traffic. Despite this potential for security impact, the
    characteristics and causes of vulnerabilities in cryptographic
    software are not well understood. In this work, we conduct the
    first comprehensive analysis of cryptographic libraries and the
    vulnerabilities affecting them. We collect data from the National
    Vulnerability Database, individual project repositories and
    mailing lists, and other relevant sources for eight widely used
    cryptographic libraries.
    Among our most interesting findings is that only 27.2% of
    vulnerabilities in cryptographic libraries are cryptographic
    issues while 37.2% of vulnerabilities are memory safety issues,
    indicating that systems-level bugs are a greater security concern
    than the actual cryptographic procedures. In our investigation of
    the causes of these vulnerabilities, we find evidence of a strong
    correlation between the complexity of these libraries and their
    (in)security, empirically demonstrating the potential risks of
    bloated cryptographic codebases. We further compare our findings
    with non-cryptographic systems, observing that these systems are,
    indeed, more complex than similar counterparts, and that this
    excess complexity appears to produce significantly more
    vulnerabilities in cryptographic libraries than in
    non-cryptographic software.

Subjects: Cryptography and Security (cs.CR)
Cite as:  arXiv:2107.04940 [cs.CR]
          (or arXiv:2107.04940v1 [cs.CR] for this version)

Submission history

From: Jenny Blessing [view email]
[v1] Sun, 11 Jul 2021 02:09:52 UTC (1,736 KB)
Full-text links:

Download:

  * PDF
  * Other formats

[by-4]
Current browse context:
cs.CR
< prev   |   next >
new | recent | 2107
Change to browse by:
cs

References & Citations

  * NASA ADS
  * Google Scholar
  * Semantic Scholar

a export bibtex citation Loading...

Bibtex formatted citation

x
[loading...          ]
Data provided by:

Bookmark

BibSonomy logo Mendeley logo Reddit logo ScienceWISE logo
(*) Bibliographic Tools

Bibliographic and Citation Tools

[ ] Bibliographic Explorer Toggle
Bibliographic Explorer (What is the Explorer?)
[ ] Litmaps Toggle
Litmaps (What is Litmaps?)
( ) Code & Data

Code and Data Associated with this Article

[ ] arXiv Links to Code Toggle
arXiv Links to Code & Data (What is Links to Code & Data?)
( ) Related Papers

Recommenders and Search Tools

[ ] Connected Papers Toggle
Connected Papers (What is Connected Papers?)
[ ] Core recommender toggle
CORE Recommender (What is CORE?)
( ) About arXivLabs

arXivLabs: experimental projects with community collaborators

arXivLabs is a framework that allows collaborators to develop and
share new arXiv features directly on our website.

Both individuals and organizations that work with arXivLabs have
embraced and accepted our values of openness, community, excellence,
and user data privacy. arXiv is committed to these values and only
works with partners that adhere to them.

Have an idea for a project that will add value for arXiv's community?
Learn more about arXivLabs and how to get involved.

Which authors of this paper are endorsers? | Disable MathJax (What is
MathJax?)

  * About
  * Help

  * Click here to contact arXiv Contact
  * Click here to subscribe Subscribe

  * Copyright
  * Privacy Policy

  * Web Accessibility Assistance
  * arXiv Operational Status
    Get status notifications via email or slack