Google Releases Test Set to Check Cryptographic Library Security
By Jaikumar Vijayan eweek.com Posted 2016-12-19
Google's new Project Wycheproof will let software engineers look for previously known flaws in their open source cryptographic libraries.
Google has released a set of tests that developers can use to check some open source cryptographic libraries for known security vulnerabilities.
The company has named the set of tests Project Wycheproof, after a mountain in Australia, which has the distinction of being the world's smallest registered mountain.
"The main motivation for the project is to have an achievable goal," Google security engineers Daniel Bleichenbacher and Thai Duong, explained in a blog announcing Project Wycheproof. "The smaller the mountain the easier it is to climb it!"
The engineers wrote that Project Wycheproof is designed to help developers catch subtle mistakes in open source cryptographic libraries that, if left unaddressed, can have catastrophic consequences. Such mistakes can be repeated too often and become prevalent wherever the encryption is implemented they noted.
The collection of unit tests that Project Wycheproof consists of allows developers to test whether certain cryptographic libraries, including those associated with popular algorithms such as RSA, authenticated encryption and elliptic curve cryptography are vulnerable to attack.
The tests include those for so-called invalid curve attacks, weaknesses in digital signature schemes and a variety of other exploits. In total, Project Wycheproof currently includes unit tests for 80 different types of attacks against cryptographic algorithms. To develop each unit test, Google's cryptographers surveyed available literature and implemented most of the known attacks against the algorithms.
The tests have already allowed Google to discover a total of 40 security flaws in cryptographic algorithms such as the Digital Signature Algorithm (DSA), Elliptic Curve Diffie-Hellman Cryptography (ECDHC). Some of the flaws that Google discovered via the Project Wycheproof tests were serious, including one that could be used to recover the private keys associated with ECDHC and DSA implementations.
Unit tests are currently available for several popular open source algorithms including DSA, ECDH, RSA, AES and Diffie-Hellman.
Google will continue to develop as many new attacks as possible to test open cryptographic libraries, but the company's effort is by no means comprehensive and developers should not assume their code is error free just because they pass Project Wycheproof, the two Google researchers said.
"Passing the tests does not imply that the library is secure, it just means that it is not vulnerable to the attacks that Project Wycheproof tests for," Bleichenbacher and Duong wrote.
Project Wycheproof is the second set of testing tools that Google has released recently. Earlier this month, the company released OSS-Fuzz, a continuous testing service for open source software. The service is designed to uncover security flaws by subjecting software to a continuous stream of attack data.
Google has said the goal is to help developers and researchers find critical issues like SQL injection errors and buffer overflows in some of the largest and most widely-used open source projects and components in the world.===============================================
Good Netiquette And A Green Internet To All!
=========================================================================================Tabula Rosa Systems - Tabula Rosa Systems (TRS) is dedicated to providing Best of Breed Technology and Best of Class Professional Services to our Clients. We have a portfolio of products which we have selected for their capabilities, viability and value. TRS provides product, design, implementation and support services on all products that we represent. Additionally, TRS provides expertise in Network Analysis, eBusiness Application Profiling, ePolicy and eBusiness Troubleshooting. We can be contacted at:
email@example.com or 609 818 1802.===============================================================
In addition to this blog, Netiquette IQ has a website with great assets which are being added to on a regular basis. I have authored the premiere book on Netiquette, “Netiquette IQ - A Comprehensive Guide to Improve, Enhance and Add Power to Your Email". My new book, “You’re Hired! Super Charge Your Email Skills in 60 Minutes. . . And Get That Job!” has just been published and will be followed by a trilogy of books on Netiquette for young people. You can view my profile, reviews of the book and content excerpts at:
Anyone who would like to review the book and have it posted on my blog or website, please contact me firstname.lastname@example.org.
In addition to this blog, I maintain a radio show on BlogtalkRadio online newsletter via paper.li.I have established Netiquette discussion groups with Linkedin and Yahooa member of the International Business Etiquette and Protocol Group and Minding Manners among others. I regularly consult for the Gerson Lehrman Group, a worldwide network of subject matter experts and I have been contributing to the blogs Everything Email and emailmonday . My work has appeared in numerous publications and I have presented to groups such as The Breakfast Club of NJ and PSG of Mercer County, NJ.
Additionally, I am the president of Tabula Rosa Systems, a “best of breed” reseller of products for communications, email, network management software, security products and professional services. Also, I am the president of Netiquette IQ. We are currently developing an email IQ rating system, Netiquette IQ, which promotes the fundamentals outlined in my book.
Over the past twenty-five years, I have enjoyed a dynamic and successful career and have attained an extensive background in IT and electronic communications by selling and marketing within the information technology marketplace.