Presentation: Abstractions to Help Developers Write Good Crypto

Tozny is a cryptography company that builds software tools for computer programmers. Just as cryptography is difficult for end users, cryptography software tools for developers are quite challenging too. Our focus is to make those tools easier to use for developers.

We did some research to understand what mistakes people make in implementing cryptography. This came about because I asked a developer to implement something for me using a basic cipher, and the implementation they came back with was incorrect. To fix it, I tried to find an example of a correct implementation on Stack Overflow, but I could not actually find one that was correct! I had to do a significant amount of research myself in making sure that I was using the Java/Android libraries for cryptography correctly, and eventually we actually built an open source library that's very popular. It's used by Fortune 500 companies, and big or small open source projects. It does one thing and it does it well: it encrypts strings using the Android / Java cryptographic libraries correctly. So, the motivation for this talk is helping people understand what's hard and what's easy about cryptography, and the fact that solving problems in cryptography is not exactly the same as a lot of other areas. Googling for answers or finding them on Stack Overflow is not going to work well for cryptography problems.

First, I’ll set the context of the problem by reviewing some of the research that academics have done, that commercial industry has done, and a little bit of what we did to ourselves to validate the problem. There is good academic research out there showing that 80% of cryptography CVEs are misuse of libraries. That’s programmers using otherwise correct cryptographic libraries incorrectly. I’ll illustrate this with a few Java examples since the QCon audience is mostly very familiar with Java; these examples will resonate very well with them. These include some clear examples of what you would find if you tried to solve a simple problem, for example how to encrypt strings in Android. You can try to solve that problem using the typical approach of just Googling for the answer or finding code that seems to work. Then I will dive in some specific code problems. It's like 10 lines of code but there are five errors in it. I go into each of those errors and help people understand why it's a problem. What security property that you've now lost because you used this code. And then we'll take a deep dive in a couple of those to give people some intuition for the statistics of why key generation works in one way versus another way, and that would be fairly visual.

We'll use our library as an example of how to do things more correctly. It's open source, it is all free. We won't be marketing it, but we used the open source library to validate that this was a big problem, then we built a whole product that's cross-platform to address it in a more robust way. This is something anyone can try out for free of course.

In the end, we want everyone to come away with some new knowledge of common pitfalls and a few nice reasoning and technical tools they can apply to the problem of securing private information.