“You have to read 50 different RFCs that contradict each other”
An Interview Study on the Experiences of Implementing Cryptographic Standards

Studying the experiences and opinions on cryptographic standards. Meet us at USENIX'24!

Paper

Cite

Copy
@inproceedings{conf/usenix/huaman24,
 author = {Nicolas Huaman and
Jacques Suray and
Jan H. Klemmer and
Marcel Fourné and
Sabrina Amft and
Ivana Trummová and
Yasemin Acar and
Sascha Fahl},
 booktitle = {In 33rd USENIX Security Symposium, USENIX Security '24, Philadelphia, PA, USA, August 14-16, 2024},
 month = {Aug},
 publisher = {USENIX Association},
 title = {``You have to read 50 different RFCs that contradict each other'': An Interview Study on the Experiences of Implementing Cryptographic Standards},
 url = {https://www.usenix.org/conference/usenixsecurity24/presentation/huaman},
 year = {2024}
}

More Links

Follow-Up

Abstract

Cryptographic standards aim to support developers and engineers in implementing cryptographic primitives and protocols. However, past security incidents suggest that implementing cryptographic standards can be challenging and might jeopardize software and hardware security.

To shed light on the challenges and obstacles of implementing cryptographic standards, we conducted 20 semi-structured interviews with experienced cryptographers and cryptographic software engineers. We identify common practices when implementing standards, including the criticality of reference and third-party implementations, test vectors to verify implementations, and the open standard community as central support for questions and reviews of implementations. Based on our findings, we recommend transparent standardization processes, strong (ideally formal) verification, improved support for comparing implementations, and covering updates and error handling in the standardization process

Follow-Up

We are working on a follow-up paper regarding cryptographic competitions. If you want more information on that, feel free to visit our website for this project.

Interviews

We recruited 20 cryptographers using a collection of manually selected cryptographic implementations, as well as emails to the PQC-Forum and the IETF saag mailing list.

Using these sources, we recruited a varied sample of people implementing and working with cryptographic standards.

Demographics Table from the Paper
Our demographics

Findings

Our findings cover three research questions:

  1. Which are developers’ practices when implementing cryptographic standards?
    Implementing cryptographic standards is essential to deploy cryptography from research into products. We are interested in better understanding developers’ implementation practices and requirements for cryptographic standards.

  2. What are the challenges of implementing cryptographic standards?
    Cryptographic standards are complex and require a high level of expertise to understand and follow. We aim to understand the challenges of writing cryptographic software following standards.

  3. How can future cryptographic standards be improved to better support implementations?
    The correct and secure implementation of cryptographic standards is crucial for overall software security. We aim to understand better how future cryptographic standards can be improved to support cryptographic software developers and implementations.

Based on our findings, we derive recomenndations in 11 areas and measure their prevalence in existing standards in our paper.

Aknowledgements

We thank the cryptography community and our participants for their invaluable contributions to our work. We also thank the anonymous reviewers, especially our shepherd, for their constructive feedback and support in improving the paper. Finally, we thank our students, Daniel Kabuth and Thassilo Schiepanski, for their help with early text drafts, project scouting, and interview conception as part of our lecture. This research was funded by the VolkswagenStiftung Niedersächsisches Vorab – ZN3695 and the Deutsche Forschungsgemeinschaft (DFG, German Research Foundation) under Germany’s Excellence Strategy – EXC 2092 CaSa – 390781972. This work was also supported by the Grant Agency of the Czech Technical University in Prague, grant No.~SGS23/211/OHK3/3T/18 funded by the MEYS of the Czech Republic.

TeamUSEC

You can find more Projects on our Website.

Imprint Disclaimer