SaTC: TTP: Medium: Collaborative: Deployment-quality and Accessible Solutions for Cryptography Code Development

在实际应用中，加密实现中的漏洞严重降低了算法的安全保障，并导致攻击。对易受攻击的代码问题的有效修复是自动代码检查。然而，现有的代码验证工具不能充分覆盖加密属性，这是由于准确性（就漏检和假警报而言）和可伸缩性（就复杂性和运行时间而言）的不足。这个向实践过渡项目中的技术是为了帮助保护加密实现，这是许多高级系统的基础。通过制定部署级的相关研究解决方案，这项工作可以大大改善加密编码实践，并使所有专业的软件开发人员受益。该项目的目标是将多个安全加密编码研究解决方案转化为实践，并使其方便和可访问地自动筛选程序，以防止各种加密实现漏洞或滥用。主要的技术推动者是基于称为CryptoGuard的专门程序分析技术的高精度和高吞吐量方法。当在复杂和大规模的Java程序中使用时，CryptoGuard可以以超低的误报率检测广泛的密码滥用。该项目利用多种流行的软件开发和软件安全平台，包括软件保证市场，使这些工具在生产环境中有效。系统的基准和测量工作旨在推进安全科学，大幅提高密码学筛选的标准和质量。该奖项反映了美国国家科学基金会的法定使命，并通过使用基金会的知识价值和更广泛的影响审查标准进行评估，被认为值得支持。

Vulnerabilities in cryptographic implementations seriously reduce the security guarantees of algorithms in practice and lead to attacks. An effective fix to the vulnerable code problem is automatic code checking. However, existing code verification tools cannot adequately cover cryptographic properties due to deficiencies in both accuracy, in terms of missed detection and false alarms, and scalability, in terms of complexity and runtime. The technology in this transition-to-practice project is to help secure cryptographic implementations, which are the foundation of many advanced systems. By making relevant research solutions deployment-grade, this effort can substantially improve the cryptographic coding practice and benefit software developers in all professions. The project's objective is to transition multiple secure cryptographic coding research solutions to practice and make it convenient and accessible to automatically screen programs against a wide range of cryptographic implementation vulnerabilities or misuses. The main technical enabler is a high precision and high throughput approach based on specialized program analysis techniques called CryptoGuard. CryptoGuard can detect a wide range of cryptographic misuses with ultra-low false alarm rates when used on complex and large-scale Java programs. The project leverages multiple popular software development and software security platforms, including the Software Assurance Marketplace, to make these tools effective in production environments. The systematic benchmark and measurement work is designed to advance the science of security and substantially raises the standard and quality of cryptographic code screening.This award reflects NSF's statutory mission and has been deemed worthy of support through evaluation using the Foundation's intellectual merit and broader impacts review criteria.