Abstract:Extensive research has been conducted to explore cryptographic API misuse in Java. However, despite the tremendous popularity of the Python language, uncovering similar issues has not been fully explored. The current static code analysis tools for Python are unable to scan the increasing complexity of the source code. This limitation decreases the analysis depth, resulting in more undetected cryptographic misuses. In this research, we propose Cryptolation, a Static Code Analysis (SCA) tool that provides security guarantees for complex Python cryptographic code. Most existing analysis tools for Python solely focus on specific Frameworks such as Django or Flask. However, using a SCA approach, Cryptolation focuses on the language and not any framework. Cryptolation performs an inter-procedural data-flow analysis to handle many Python language features through variable inference (statically predicting what the variable value is) and SCA. Cryptolation covers 59 Python cryptographic modules and can identify 18 potential cryptographic misuses that involve complex language features. In this paper, we also provide a comprehensive analysis and a state-of-the-art benchmark for understanding the Python cryptographic Application Program Interface (API) misuses and their detection. Our state-of-the-art benchmark PyCryptoBench includes 1,836 Python cryptographic test cases that covers both 18 cryptographic rules and five language features. PyCryptoBench also provides a framework for evaluating and comparing different cryptographic scanners for Python. To evaluate the performance of our proposed cryptographic Python scanner, we evaluated Cryptolation against three other state-of-the-art tools: Bandit, Semgrep, and Dlint. We evaluated these four tools using our benchmark PyCryptoBench and manual evaluation of (four Top-Ranked and 939 Un-Ranked) real-world projects. Our results reveal that, overall, Cryptolation achieved the highest precision throughout our testing; and the highest accuracy on our benchmark. Cryptolation had 100% precision on PyCryptoBench, and the highest precision on the real-world projects.

Detection And Analysis Of Cryptographic Data Inside Software

Research on Cryptographic Algorithm Recognition Based on Behavior Analysis

Where's Crypto?: Automated Identification and Classification of Proprietary Cryptographic Primitives in Binary Code

Automatic Detection And Analysis Of Encrypted Messages In Malware

Detecting Encryption Functions Via Process Emulation and IL-based Program Analysis

Why Crypto-detectors Fail: A Systematic Evaluation of Cryptographic Misuse Detection Techniques

iCryptoTracer: Dynamic Analysis on Misuse of Cryptography Functions in iOS Applications.

Automatic Detection of Java Cryptographic API Misuses: Are We There Yet?

GENDA: A Graph Embedded Network Based Detection Approach on encryption algorithm of binary program

Establishment and Application of Cryptographic Library Model

APPROACH FOR DETECTING ANTI-ANALYSIS MALWARE

A Software Birthmark Based on System Call and Program Data Dependence

Cryptographic Core Design Security Verification and Vulnerability Detection Based on Information Flow Analysis

Automated Ransomware Behavior Analysis: Pattern Extraction and Early Detection

CRYLOGGER: Detecting Crypto Misuses Dynamically

Towards Automated Detection of Single-Trace Side-Channel Vulnerabilities in Constant-Time Cryptographic Code

Methods and Benchmark for Detecting Cryptographic API Misuses in Python

K-Hunt: Pinpointing Insecure Cryptographic Keys from Execution Traces.

Automatic Cryptographic Protocol Analysis

Analysis of cryptographic authentication and manipulation detection methods for big data

Evaluation of Static Vulnerability Detection Tools with Java Cryptographic API Benchmarks