Industrial Experience of Finding Cryptographic Vulnerabilities in Large-scale Codebases

Enterprise environment often screens large-scale (millions of lines code) codebases with static analysis tools to find bugs and vulnerabilities. Parfait is a code tool used in Oracle security vulnerabilities industrial codebases. Recently, many studies show that there are complicated cryptographic caused by misusing APIs Java TM 1 In this paper, we describe how realize precise scalable detection these based on framework. The key challenge the high false alarm rate pseudo-influences. Pseudo-influences happen if security-irrelevant constants constructing security-critical values. Static usually unable distinguish them from hard-coded expose sensitive information. We tackle problem specializing backward dataflow refinement insights, an idea CryptoGuard [ 20 ]. evaluate our analyzer comprehensive vulnerability benchmark eleven large real-world applications. results Parfait-based detector can true-positive rates low runtime cost.