"You have to read 50 different RFCs that contradict each other": An Interview Study on the Experiences of Implementing Cryptographic Standards

Result code in IS VaVaI

<a href="https://www.isvavai.cz/riv?ss=detail&h=RIV%2F68407700%3A21240%2F24%3A00377308" target="_blank" >RIV/68407700:21240/24:00377308 - isvavai.cz</a>

Result on the web

<a href="https://www.usenix.org/system/files/usenixsecurity24-huaman.pdf" target="_blank" >https://www.usenix.org/system/files/usenixsecurity24-huaman.pdf</a>

DOI - Digital Object Identifier

—

Result language

angličtina

Original language name

"You have to read 50 different RFCs that contradict each other": An Interview Study on the Experiences of Implementing Cryptographic Standards

Original language description

Implementing cryptographic standards is a critical process for the cryptographic ecosystem. Cryptographic standards aim to support developers and engineers in implementing cryptographic primitives and protocols. However, past security incidents suggest that implementing cryptographic standards can be challenging and might jeopardize software and hardware security. We need to understand and mitigate the pain points of those implementing cryptographic standards to support them better. To shed light on the challenges and obstacles of implementing cryptographic standards, we conducted 20 semi-structured interviews with experienced cryptographers and cryptographic software engineers. We identify common practices when implementing standards, including the criticality of reference and third-party implementations, test vectors to verify implementations, and the open standard community as central support for questions and reviews of implementations. Based on our findings, we recommend transparent standardization processes, strong (ideally formal) verification, improved support for comparing implementations, and covering updates and error handling in the standardization process.

Czech name

—

Czech description

—

Type

D - Article in proceedings

CEP classification

—

OECD FORD branch

10201 - Computer sciences, information science, bioinformathics (hardware development to be 2.2, social aspect to be 5.8)

Project

—

Continuities

S - Specificky vyzkum na vysokych skolach

Publication year

2024

Confidentiality

S - Úplné a pravdivé údaje o projektu nepodléhají ochraně podle zvláštních právních předpisů

Article name in the collection

33rd USENIX Security Symposium

ISBN

978-1-939133-44-1

ISSN

—

e-ISSN

—

Number of pages

18

Pages from-to

7249-7266

Publisher name

The USENIX Association

Place of publication

—

Event location

Philadelphia

Event date

Aug 14, 2024

Type of event by nationality

WRD - Celosvětová akce

UT code for WoS article

001333860308032