Java Cryptography Uses in the Wild

[Background] Previous research has shown that developers commonly misuse cryptography APIs. [Aim] We have conducted an exploratory study to find out how crypto APIs are used in open-source Java projects, what types of misuses exist, and why developers make such mistakes. [Method] We used a static analysis tool to analyze hundreds of open-source Java projects that rely on Java Cryptography Architecture, and manually inspected half of the analysis results to assess the tool results. We also contacted the maintainers of these projects by creating an issue on the GitHub repository of each project, and discussed the misuses with developers. [Results] We learned that 85 misused, however, not every misuse has severe consequences. Developer feedback showed that security caveats in the documentation of crypto APIs are rare, developers may overlook misuses that originate in third-party code, and the context where a Crypto API is used should be taken into account. [Conclusion] We conclude that using Crypto APIs is still problematic for developers but blindly blaming them for such misuses may lead to erroneous conclusions.

READ FULL TEXT

page 1

page 2

page 3

page 4

research
08/05/2019

The Impact of Developer Experience in Using Java Cryptography

Previous research has shown that crypto APIs are hard for developers to ...
research
08/19/2022

Fixing Dockerfile Smells: An Empirical Study

Background. Containerization technologies are widely adopted in the DevO...
research
09/29/2021

Worrisome Patterns in Developers: A Survey in Cryptography

We surveyed 97 developers who had used cryptography in open-source proje...
research
10/11/2018

An Initial Step Towards Organ Transplantation Based on GitHub Repository

Organ transplantation, which is the utilization of codes directly relate...
research
01/03/2020

CryptoExplorer: An Interactive Web Platform Supporting Secure Use of Cryptography APIs

Research has shown that cryptographic APIs are hard to use. Consequently...
research
05/12/2022

Analyzing Impact of Dependency Injection on Software Maintainability

Dependency injection (DI) is generally known to improve maintainability ...
research
10/06/2021

Towards Heuristics for Supporting the Validation of Code Smells

The identification of code smells is largely recognized as a subjective ...

Please sign up or login with your details

Forgot password? Click here to reset