Java密码学在野外的应用
Java Cryptography Uses in the Wild
摘要：
[背景]先前的研究表明，开发人员通常会滥用加密API。[Aim]我们已经进行了一项探索性研究，以了解如何在开源Java项目中使用加密API，存在哪些类型的误用，以及为什么开发人员会犯这样的错误。[方法]使用静态分析工具对数百个依赖Java密码体系结构的开源Java项目进行分析，并对其中一半的分析结果进行人工检查，以评估工具的结果。我们还通过在每个项目的GitHub存储库上创建一个问题来联系这些项目的维护人员，并与开发人员讨论了误用问题。[结果]我们了解到85%的密码学API被滥用，然而，并不是每一次滥用都有严重的后果。开发人员的反馈显示，加密API文档中的安全警告很少，开发人员可能会忽略源自第三方代码的误用，并且应该考虑使用加密API的上下文。[结论]我们得出结论，使用Crypto API对开发人员来说仍然存在问题，但盲目地指责他们滥用可能会导致错误的结论。
英文摘要：
[Background] Previous research has shown that developers commonly misuse cryptography APIs. [Aim] We have conducted an exploratory study to find out how crypto APIs are used in open-source Java projects, what types of misuses exist, and why developers make such mistakes. [Method] We used a static analysis tool to analyze hundreds of open-source Java projects that rely on Java Cryptography Architecture, and manually inspected half of the analysis results to assess the tool results. We also contacted the maintainers of these projects by creating an issue on the GitHub repository of each project, and discussed the misuses with developers. [Results] We learned that 85% of Cryptography APIs are misused, however, not every misuse has severe consequences. Developer feedback showed that security caveats in the documentation of crypto APIs are rare, developers may overlook misuses that originate in third-party code, and the context where a Crypto API is used should be taken into account. [Conclusion] We conclude that using Crypto APIs is still problematic for developers but blindly blaming them for such misuses may lead to erroneous conclusions.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
