.png){kind=icon}
返回
CLFuzz: Vulnerability Detection of Cryptographic Algorithm Implementation via Semantic-aware Fuzzing
.png){kind=icon}
OA
AI
DOI：10.1145/3628160.png)
.png){kind=icon}
原文求助.png){kind=icon}
分享.png){kind=icon}
收藏
摘要
En 中文
Cryptography is a core component of many security applications, and flaws hidden in its implementation will affect the functional integrity or, more severely, pose threats to data security. Hence, guaranteeing the correctness of the implementation is important. However, the semantic characteristics (e.g., diverse input data and complex functional transformation) challenge those traditional program validation techniques (e.g., static analysis and dynamic fuzzing). In this article, we propose CLFuzz, a semantic-aware fuzzer for the vulnerability detection of cryptographic algorithm implementation. CLFuzz first extracts the semantic information of targeted algorithms including their cryptographic-specific constraints and function signatures. Based on them, CLFuzz generates high-quality input data adaptively to trigger error-prone situations efficiently. Furthermore, CLFuzz applies innovative logical cross-check that strengthens the logical bug detection ability. We evaluate CLFuzz on the widely used implementations of 54 cryptographic algorithms. It outperforms state-of-the-art cryptographic fuzzing tools. For example, compared with Cryptofuzz, it achieves a coverage speedup of 3.4x and increases the final coverage by 14.4%. Furthermore, CLFuzz has detected 12 previously unknown implementation bugs in 8 cryptographic algorithms (e.g., CMAC in OpenSSL and Message Digest in SymCrypt), most of which are security-critical and have been successfully collected in the national vulnerability database (7 in NVD/CNVD) and is awarded by the Microsoft bounty program (2 for $1,000).
Keyword:
Cryptographic algorithm
fuzzing
implementation bug
期刊
A
IF:
6.2
论文数:
1.2K
被引数:
3.4K
机构
引用论文
Microscale forced combustion: Pyrolysis-combustion flow calorimetry (PCFC)微尺度强制燃烧: 热解-燃烧流量量热法 (PCFC)
PREAI
分享收藏
Metabolic crosstalk between membrane and storage lipids facilitates heat stress management in Schizosaccharomyces pombe.png)
PLOS ONEOAAI
PLOS ONEIF0
OAAI分享收藏分享收藏
查看更多内容