Cryptographic Path Hardening: Hiding Vulnerabilities in Software through Cryptography

Details Cryptographic Path Hardening: Hiding Vulnerabilities in Software through Cryptography Cryptographic Path Hardening: Hiding Vulnerabilities in Software through Cryptography

2012-02-02

arxiv.org/abs/1202.0359v1

Computer Science

Software Engineering

Accepted as part of Off-the-beaten track at POPL 2012

Scientific paper

We propose a novel approach to improving software security called Cryptographic Path Hardening, which is aimed at hiding security vulnerabilities in software from attackers through the use of provably secure and obfuscated cryptographic devices to harden paths in programs. By "harden" we mean that certain error-checking if-conditionals in a given program P are replaced by equivalent" we mean that adversaries cannot use semi-automatic program analysis techniques to reason about the hardened program paths and thus cannot discover as-yet-unknown errors along those paths, except perhaps through black-box dictionary attacks or random testing (which we can never prevent). Other than these unpreventable attack methods, we can make program analysis aimed at error-finding "provably hard" for a resource-bounded attacker, in the same sense that cryptographic schemes are hard to break. Unlike security-through-obscurity, in Cryptographic Path Hardening we use provably-secure crypto devices to hide errors and our mathematical arguments of security are the same as the standard ones used in cryptography. One application of Cryptographic Path Hardening is that software patches or filters often reveal enough information to an attacker that they can be used to construct error-revealing inputs to exploit an unpatched version of the program. By "hardening" the patch we make it difficult for the attacker to analyze the patched program to construct error-revealing inputs, and thus prevent him from potentially constructing exploits.

Affiliated with

Also associated with

No associations

Rating

Cryptographic Path Hardening: Hiding Vulnerabilities in Software through Cryptography does not yet have a rating. At this time, there are no reviews or comments for this scientific paper.

If you have personal experience with Cryptographic Path Hardening: Hiding Vulnerabilities in Software through Cryptography, we encourage you to share that experience with our LandOfFree.com community. Your opinion is very important and Cryptographic Path Hardening: Hiding Vulnerabilities in Software through Cryptography will most certainly appreciate the feedback.

Rate now

Comments { 0 }

Profile ID: LFWR-SCP-O-186948