Automated Cryptography Usage Analysis using Dynamic Taint Tracking = 동적 오염추적을 이용한 자동화된 암호 사용 분석

다국어 초록 (Multilingual Abstract)

Since sensitive data (e.g., user credentials, biometric data, personal data, and digital contents) are typically used in an application, protecting such data is essential to store and manage them in a secure manner. Therefore, misuse of cryptography is becoming one of the most common issues in secure software development. However, it is not straightforward to analyze how sensitive data is protected well in a device.
In this paper, we propose a novel approach to track the entire flow of all sensitive data including input data and cryptographically transformed data by only executing binary using dynamic taint analysis.
We have developed a prototype system called CRAY (Crypto-RAY) and demonstrated that CRAY can analyze entire cryptography usages in runtime and detect four types of cryptographic misuses (e.g., Weak algorithm and weak option, Hardcoded key and IV, Insufficient iteration in PBKDF, and Leak without encryption). We also propose a method called tag-merge trace to solve the multi-tag limitation of the existing taint analysis. The performance experiment shows that CRAY can use a large number of taint tags to track a plenty of input data (e.g. binary image, file, socket, and stdin) without any significant runtime overhead, while the state-of-the-art taint tracking tool can only use a small number of taint tags due to memory consumption and performance slowdown.

목차 (Table of Contents)

• 1. Introduction 1
• 2. Related work 4
• 2.1. Static analysis 4
• 2.2. Dynamic analysis 5
• 3. Background 8
• 3.1. Mistakes in cryptography usage 8
• 3.2. Limitations in previous approaches 10
• 4. Design 16
• 4.1. Architecture 17
• 4.2. Crypto API modeling 18
• 4.3. Data tracking in runtime 21
• 4.4. Multi-tag taint propagation 24
• 4.5. Data flow and cryptography usage analysis 27
• 5. Evaluation 31
• 5.1. Cryptographic misuse analysis 32
• 5.2. Performance 35
• 6. Conclusions 39
• 6.1. Limitations 39
• 6.2. Future work 40
• References 41
• Korean Abstract 44