Why does cryptographic software fail?: a case study and open problems

No abstract is available for this paper.

• Publication year

  2014

• Venue

  Asia Pacific Workshop on Systems

• Publication date

  2014-06-25

• Fields of study

  Computer Science

• Identifiers
  DOI 10.1145/2637166.2637237
• External record

  Open on Semantic Scholar

• Source metadata

  Semantic Scholar

• No claims are published for this paper.

• No concepts are published for this paper.

• Timing Attack against Protected RSA-CRT Implementation Used in PolarSSL

  2013cited by this paper
• An empirical study of cryptographic misuse in android applications

  2013influential reference
• Undefined behavior: what happened to my code?

  2012cited by this paper
• From Computationally-proved Protocol Specifications to Implementations

  2012cited by this paper
• Why eve and mallory love android: an analysis of android SSL (in)security

  2012cited by this paper
• High-speed high-security signatures

  2011cited by this paper
• Cryptography Engineering - Design Principles and Practical Applications

  2010cited by this paper
• Structuring Protocol Implementations to Protect Sensitive Data

  2010influential reference
• Pragmatic equivalence and safety checking in Cryptol

  2009cited by this paper
• Improving application security with data flow assertions

  2009cited by this paper
• Refinement Types for Secure Implementations

  2008cited by this paper
• Cryptographically verified implementations for TLS

  2008cited by this paper
• Automatic Formal Verification of Block Cipher Implementations

  2008cited by this paper
• Protocol Composition Logic (PCL)

  2007influential reference
• Exposing private information by timing web applications

  2007cited by this paper
• Making information flow explicit in HiStar

  2006cited by this paper
• National Institute of Standards and Technologyにおける超伝導研究及び生活

  2001cited by this paper
• An efficient cryptographic protocol verifier based on prolog rules

  2001cited by this paper
• Automated analysis of cryptographic protocols using Mur/spl phi/

  1997cited by this paper
• Automated Analysis of Cryptographic Protocols Using Mur '

  1997influential reference
• Why cryptosystems fail

  1994cited by this paper

• KryptoPilot: An Open-World Knowledge-Augmented LLM Agent for Automated Cryptographic Exploitation

  2026cites this paper
• Many Tools, Few Exploitable Vulnerabilities: A Survey of 246 Static Code Analyzers for Security

  2026cites this paper
• SoK: Evolution of the Key Encapsulation Mechanism’s Role in Cryptographic Migrations for IoT Systems

  2026cites this paper
• A Review of Virtual Private Network Mobile Application Security

  2025cites this paper
• Beyond Rules: How Large Language Models Are Redefining Cryptographic Misuse Detection

  2025cites this paper
• “I’m Pretty Expert and I Still Screw It Up”: Qualitative Insights into Experiences and Challenges of Designing and Implementing Cryptographic Library APIs

  2025cites this paper
• Implementing and integrating security controls: A practitioners' perspective

  2025cites this paper
• Beyond the code: analyzing OSS developers security awareness and practices

  2025cites this paper
• Cryptoscope: Analyzing cryptographic usages in modern software

  2025cites this paper
• A taxonomy of functional security features and how they can be located

  2025cites this paper
• When Crypto Fails: Demystifying Cryptographic Defects in Ethereum Smart Contracts

  2025cites this paper
• DROIDCCT: Cryptographic Compliance Test via Trillion-Scale Measurement

  2025cites this paper
• Can generative AI detect and fix real-world cryptographic misuses?

  2025cites this paper
• "You have to read 50 different RFCs that contradict each other": An Interview Study on the Experiences of Implementing Cryptographic Standards

  2024cites this paper
• Towards cryptographic agility manifesto in end-to-end encryption systems: a position paper from the perspective of crypto-consumers

  2024cites this paper
• Enhanced Analysis of Cryptographic Library Usage Patterns and Trends in Android Applications

  2024cites this paper
• K-Hunt++: Improved Dynamic Cryptographic Key Extraction

  2024cites this paper
• Beyond Static Tools: Evaluating Large Language Models for Cryptographic Misuse Detection

  2024cites this paper
• A survey on Cryptoagility and Agile Practices in the light of quantum resistance

  2024cites this paper
• Demystifying and Detecting Cryptographic Defects in Ethereum Smart Contracts

  2024cites this paper
• Cryptography in the Wild: An Empirical Analysis of Vulnerabilities in Cryptographic Libraries

  2024cites this paper
• Time to Separate from StackOverflow and Match with ChatGPT for Encryption

  2024cites this paper
• A Comparative Study on Design and Usability of Cryptographic Libraries

  2023cites this paper
• Research on Cryptographic Misuse Detection for Android Applications Based on Dynamic and Static Combination

  2023cites this paper
• Empirical Analysis of Software Vulnerabilities Causing Timing Side Channels

  2023cites this paper
• Understanding Persistent-memory-related Issues in the Linux Kernel

  2023influential citation
• Enabling Lightweight Privilege Separation in Applications with MicroGuards

  2023cites this paper
• Tracing Cryptographic Agility in Android and iOS Apps

  2023cites this paper
• Implementing Post-quantum Cryptography for Developers

  2023influential citation
• FUM - A Framework for API Usage constraint and Misuse Classification

  2022cites this paper
• Edge Security: Challenges and Issues

  2022cites this paper
• Formal Verification of Saber's Public-Key Encryption Scheme in EasyCrypt

  2022cites this paper
• CamBench - Cryptographic API Misuse Detection Tool Benchmark Suite

  2022cites this paper
• Improving Software Quality in Cryptography Standardization Projects

  2022cites this paper
• A Case Study of Mobile Health Applications: The OWASP Risk of Insufficient Cryptography

  2022cites this paper
• On the Reproducibility of Bugs in File-System Aware Storage Applications

  2022cites this paper
• To Fix or Not to Fix: A Critical Study of Crypto-misuses in the Wild

  2022cites this paper
• Methods and Techniques for Recommender Systems in Secure Software Engineering: A Literature Review

  2022cites this paper
• From Theory to Code: Identifying Logical Flaws in Cryptographic Implementations in C/C++

  2022cites this paper
• Web Cryptography API: Prevalence and Possible Developer Mistakes

  2022cites this paper
• CryptoDetection: A Cryptography Misuse Detection Method Based on Bi-LSTM

  2022cites this paper
• FluentCrypto: Cryptography in Easy Mode

  2021cites this paper
• Quantum Computing and the Financial System: Spooky Action at a Distance?

  2021cites this paper
• BenchCouncil Transactions on Benchmarks, Standards and Evaluations

  2021cites this paper
• Applicability of Blockchain towards Mitigation of Distributed Denial of Service Attack in IoT

  2021cites this paper
• You Really Shouldn't Roll Your Own Crypto: An Empirical Study of Vulnerabilities in Cryptographic Libraries

  2021cites this paper
• Static and Dynamic Analysis in Cryptographic-API Misuse Detection of Mobile Application

  2021cites this paper
• Formal Verifcation of Post-Quantum Cryptography

  2021cites this paper
• A study of persistent memory bugs in the Linux kernel

  2021cites this paper
• CRYScanner: Finding cryptographic libraries misuse

  2021cites this paper
• Privacy in the Cloud: A Survey of Existing Solutions and Research Challenges

  2021cites this paper
• CryptoEval: Evaluating the Risk of Cryptographic Misuses in Android Apps with Data-Flow Analysis

  2021cites this paper
• Benchmarking for observability: The case of diagnosing storage failures

  2021cites this paper
• Cryptography Vulnerabilities on HackerOne

  2021cites this paper
• Origin Attribution of RSA Public Keys

  2021cites this paper
• Dazed and Confused: What’s Wrong with Crypto Libraries?

  2021cites this paper
• Hotfixing misuses of crypto APIs in Java programs

  2021cites this paper
• Python Crypto Misuses in the Wild

  2021cites this paper
• Industrial Experience of Finding Cryptographic Vulnerabilities in Large-scale Codebases

  2020cites this paper
• Understanding security mistakes developers make: Qualitative analysis from Build It, Break It, Fix It

  2020cites this paper
• A Performant, Misuse-Resistant API for Primality Testing

  2020cites this paper
• CogniCryptGEN: generating code for the secure usage of crypto APIs

  2020cites this paper
• On the DSA Key Recovery Attack with Variable Partial Nonces Known

  2020cites this paper
• Vulnerabilities in Public Key Cryptography

  2020cites this paper
• AntiPatterns regarding the application of cryptographic primitives by the example of ransomware

  2020cites this paper
• Continuous Compliance

  2020influential citation
• Information Security Education. Information Security in Action: 13th IFIP WG 11.8 World Conference, WISE 13, Maribor, Slovenia, September 21–23, 2020, Proceedings

  2020cites this paper
• Learning and Grading Cryptology via Automated Test Driven Software Development

  2020cites this paper
• From Theory to Practice: Deployment-grade Tools and Methodologies for Software Security

  2020cites this paper
• CogniCrypt - the secure integration of cryptographic software

  2020cites this paper
• Using Graph Embeddings and Machine Learning to Detect Cryptography Misuse in Source Code

  2020cites this paper
• Analysis of Inappropriate Usage of Cryptographic Primitives in Indian Mobile Financial Applications

  2020cites this paper
• A machine learning approach to detect misuse of cryptographic APIs in source code

  2020cites this paper
• A Qualitative Investigation of Insecure Code Propagation from Online Forums

  2019cites this paper
• Integration of the Static Analysis Results Interchange Format in CogniCrypt

  2019cites this paper
• Systematic Testing of Post-Quantum Cryptographic Implementations Using Metamorphic Testing

  2019cites this paper
• CryptoREX: Large-scale Analysis of Cryptographic Misuse in IoT Devices

  2019cites this paper
• Understanding How to Use Static Analysis Tools for Detecting Cryptography Misuse in Software

  2019influential citation
• Socio-Technical Aspects in Security and Trust: 9th International Workshop, STAST 2019, Luxembourg City, Luxembourg, September 26, 2019, Revised Selected Papers

  2019cites this paper
• Mitigating Cryptographic Mistakes by Design

  2019influential citation
• A Formal Model for Checking Cryptographic API Usage in JavaScript

  2019cites this paper
• How Reliable is the Crowdsourced Knowledge of Security Implementation?

  2019cites this paper
• A Comparative Study of Misapplied Crypto in Android and iOS Applications

  2019cites this paper
• API Usability of Stateful Signature Schemes

  2019cites this paper
• The Impact of Developer Experience in Using Java Cryptography

  2019cites this paper
• A Dataset of Parametric Cryptographic Misuses

  2019cites this paper
• FireBugs: Finding and Repairing Bugs with Security Patterns

  2019cites this paper
• A Homotopical Approach to Cryptography

  2018cites this paper
• Finding Bugs in Cryptographic Hash Function Implementations

  2018cites this paper
• RIGORITYJ: Deployment-quality Detection of Java Cryptographic Vulnerabilities

  2018cites this paper
• HoTT-Crypt : A Study in Homotopy Type Theory based on Cryptography

  2018cites this paper
• Complementary test selection criteria for model-based testing of security components

  2018cites this paper
• CryptoGuard: High Precision Detection of Cryptographic Vulnerabilities in Massive-sized Java Projects

  2018cites this paper
• Source Attribution of Cryptographic API Misuse in Android Applications

  2018cites this paper
• A Type-based Formal Specification for Cryptographic Protocols

  2018cites this paper
• K-Hunt: Pinpointing Insecure Cryptographic Keys from Execution Traces

  2018cites this paper
• High-Level Cryptographic Abstractions

  2018cites this paper
• Deception Task Design in Developer Password Studies: Exploring a Student Sample

  2018cites this paper
• A Systematic Approach to Benchmark and Improve Automated Static Detection of Java-API Misuses

  2018cites this paper
• CrySL: An Extensible Approach to Validating the Correct Usage of Cryptographic APIs

  2018cites this paper