论文标题
Java密码学在野外使用
Java Cryptography Uses in the Wild
论文作者
论文摘要
[背景]先前的研究表明，开发人员通常滥用密码学API。 [AIM]我们进行了一项探索性研究，以了解如何在开源Java项目中使用加密API，存在哪些类型的滥用以及为什么开发人员犯此类错误。 [方法]我们使用静态分析工具来分析数百个依赖Java加密体系结构的开源Java项目，并手动检查了一半的分析结果来评估工具结果。我们还通过在每个项目的GitHub存储库上创建一个问题，并与开发人员讨论了滥用情况，与这些项目的维护者联系。 [结果]我们了解到，有85％的加密API被滥用，但是并非所有滥用都会产生严重的后果。开发人员的反馈表明，Crypto API的文档中的安全警告很少见，开发人员可能会忽略起源于第三方代码的滥用，并且应考虑使用加密API的上下文。 [结论]我们得出结论，对于开发人员而言，使用加密API仍然是有问题的，但是盲目地责怪它们可能会导致错误的结论。
[Background] Previous research has shown that developers commonly misuse cryptography APIs. [Aim] We have conducted an exploratory study to find out how crypto APIs are used in open-source Java projects, what types of misuses exist, and why developers make such mistakes. [Method] We used a static analysis tool to analyze hundreds of open-source Java projects that rely on Java Cryptography Architecture, and manually inspected half of the analysis results to assess the tool results. We also contacted the maintainers of these projects by creating an issue on the GitHub repository of each project, and discussed the misuses with developers. [Results] We learned that 85% of Cryptography APIs are misused, however, not every misuse has severe consequences. Developer feedback showed that security caveats in the documentation of crypto APIs are rare, developers may overlook misuses that originate in third-party code, and the context where a Crypto API is used should be taken into account. [Conclusion] We conclude that using Crypto APIs is still problematic for developers but blindly blaming them for such misuses may lead to erroneous conclusions.
