SaTC: TTP: Medium: Collaborative: Deployment-quality and Accessible Solutions for Cryptography Code Development

密码实现中的漏洞严重降低了算法在实践中的安全保证，并导致攻击。对易受攻击的代码问题的有效修复是自动代码检查。然而，现有的代码验证工具不能充分覆盖密码属性，这是由于在漏检和误报警方面的准确性方面以及在复杂性和运行时间方面的可扩展性方面的不足。这个过渡到实践项目中的技术是帮助确保加密实现的安全，这是许多高级系统的基础。通过将相关研究解决方案部署到部署级，这一努力可以大幅改善密码编码实践，并使所有专业的软件开发人员受益。该项目的目标是将多个安全密码编码研究解决方案转化为实践，并使其方便和可访问，以自动筛选程序，防止广泛的密码实现漏洞或误用。主要的技术推动因素是一种基于称为CryptoGuard的专门程序分析技术的高精度和高吞吐量方法。当用于复杂和大规模的Java程序时，CryptoGuard可以以超低的误警率检测到广泛的加密误用。该项目利用多个流行的软件开发和软件安全平台，包括软件保障市场，以使这些工具在生产环境中有效。系统的基准和测量工作旨在推进安全科学，并大幅提高加密代码筛选的标准和质量。该奖项反映了NSF的法定使命，并通过使用基金会的智力优势和更广泛的影响审查标准进行评估，被认为值得支持。

Vulnerabilities in cryptographic implementations seriously reduce the security guarantees of algorithms in practice and lead to attacks. An effective fix to the vulnerable code problem is automatic code checking. However, existing code verification tools cannot adequately cover cryptographic properties due to deficiencies in both accuracy, in terms of missed detection and false alarms, and scalability, in terms of complexity and runtime. The technology in this transition-to-practice project is to help secure cryptographic implementations, which are the foundation of many advanced systems. By making relevant research solutions deployment-grade, this effort can substantially improve the cryptographic coding practice and benefit software developers in all professions. The project's objective is to transition multiple secure cryptographic coding research solutions to practice and make it convenient and accessible to automatically screen programs against a wide range of cryptographic implementation vulnerabilities or misuses. The main technical enabler is a high precision and high throughput approach based on specialized program analysis techniques called CryptoGuard. CryptoGuard can detect a wide range of cryptographic misuses with ultra-low false alarm rates when used on complex and large-scale Java programs. The project leverages multiple popular software development and software security platforms, including the Software Assurance Marketplace, to make these tools effective in production environments. The systematic benchmark and measurement work is designed to advance the science of security and substantially raises the standard and quality of cryptographic code screening.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.