Journal
IEEE TRANSACTIONS ON SOFTWARE ENGINEERING
Volume 49, Issue 1, Pages 288-303Publisher
IEEE COMPUTER SOC
DOI: 10.1109/TSE.2022.3150302
Keywords
Cryptography; Java; Security; Codes; Software; Encoding; Ciphers; Detection of cryptographic API misuses; developers' feedback; empirical
Ask authors/readers for more resources
This study investigates the misuse of cryptographic APIs on the Java platform and finds that developers face challenges in correctly using these APIs, leading to vulnerabilities in their software. Tools have been created to detect and fix these API misuses, but their design, effectiveness, and usefulness to developers are still unknown. The empirical study conducted in this research reveals that there is a significant gap between the current tools and developers' expectations.
The Java platform provides various cryptographic APIs to facilitate secure coding. However, correctly using these APIs is challenging for developers who lack cybersecurity training. Prior work shows that many developers misused APIs and consequently introduced vulnerabilities into their software. To eliminate such vulnerabilities, people created tools to detect and/or fix cryptographic API misuses. However, it is still unknown (1) how current tools are designed to detect cryptographic API misuses, (2) how effectively the tools work to locate API misuses, and (3) how developers perceive the usefulness of tools ' outputs. For this paper, we conducted an empirical study to investigate the research questions mentioned above. Specifically, we first conducted a literature survey on existing tools and compared their approach design from different angles. Then we applied six of the tools to three popularly used benchmarks to measure tools ' effectiveness of API-misuse detection. Next, we applied the tools to 200 Apache projects and sent 57 vulnerability reports to developers for their feedback. Our study revealed interesting phenomena. For instance, none of the six tools was found universally better than the others; however, CogniCrypt, CogniGuard, and Xanitizer outperformed SonarQube. More developers rejected tools ' reports than those who accepted reports (30 versus 9) due to their concerns on tools ' capabilities, the correctness of suggested fixes, and the exploitability of reported issues. This study reveals a significant gap between the state-of-the-art tools and developers ' expectations; it sheds light on future research in vulnerability detection.
Authors
I am an author on this paper
Click your name to claim this paper and add it to your profile.
Reviews
Recommended
No Data Available