Hazhirpasand, Mohammadreza; Nierstrasz, Oscar; Ghafari, Mohammad (December 2021). Dazed and Confused: What's Wrong with Crypto Libraries? In: 18th International Conference on Privacy, Security and Trust (PST). Auckland, New Zealand. December 13-15, 2021. 10.1109/PST52912.2021.9647786
|
Text
Hazh21b.pdf - Accepted Version Available under License Creative Commons: Attribution (CC-BY). Download (124kB) | Preview |
Recent studies have shown that developers have difficulties in using cryptographic APIs, which often led to security flaws. We are interested to tackle this matter by looking into what types of problems exist in various crypto libraries. We manually studied 500 posts on Stack Overflow associated with 20 popular crypto libraries. We realized there are 10 themes in the discussions. Interestingly, there were only two questions related to attacks against cryptography. There were 63 discussions in which developers had interoperability issues when working with more than a crypto library. The majority of posts (112) were about encryption/decryption problems and 111 were about installation/compilation issues of crypto libraries. Overall, we realize that the crypto libraries are frequently involved in more than five themes of discussions. We believe the current initial findings can help team leaders and experienced developers to correctly guide the team members in the domain of cryptography. Moreover, future research should investigate the similarity of problems at the API level among popular crypto libraries.
Item Type: |
Conference or Workshop Item (Paper) |
|---|---|
Division/Institute: |
08 Faculty of Science > Institute of Computer Science (INF) 08 Faculty of Science > Institute of Computer Science (INF) > Software Composition Group (SCG) [discontinued] |
UniBE Contributor: |
Hazhirpasand Barkadehi, Mohammadreza, Nierstrasz, Oscar, Ghafari, Mohammad |
Subjects: |
000 Computer science, knowledge & systems |
Language: |
English |
Submitter: |
Oscar Nierstrasz |
Date Deposited: |
24 Feb 2022 08:54 |
Last Modified: |
05 Dec 2022 16:07 |
Publisher DOI: |
10.1109/PST52912.2021.9647786 |
ArXiv ID: |
2111.01406v1 |
Uncontrolled Keywords: |
scg-pub security snf-asa3 scg21 jb22 |
BORIS DOI: |
10.48350/165145 |
URI: |
https://boris.unibe.ch/id/eprint/165145 |
Actions (login required)
 |
Edit item |