Why does cryptographic software fail? A case study and open problems

Mistakes in cryptographic software implementations of-ten undermine the strong security guarantees offered by cryptography. This paper presents a systematic study of cryptographic vulnerabilities in practice, an examination of state-of-the-art techniques to prevent such vulnerabil-ities, and a discussion of open problems and possible future research directions. Our study covers 269 cryp-tographic vulnerabilities reported in the CVE database from January 2011 to May 2014. The results show that just 17 % of the bugs are in cryptographic libraries (which often have devastating consequences), and the remaining 83 % are misuses of cryptographic libraries by individual applications. We observe that preventing bugs in different parts of a system requires different techniques, and that no effective techniques exist to deal with certain classes of mistakes, such as weak key generation.