Is your crypto-detector any good?

Now you can check.

Introducing the tool
MASC
Mutation testing for crypto-detectors

Describe the API. Not the code.

Name a crypto API, a secure value and an insecure one — MASC writes the misuses.

Cipher.properties
scope = main
type = StringOperator
apiName = javax.crypto.Cipher
invocation = getInstance
secureParam = AES/GCM/NoPadding
insecureParam = AES
noise = ~

Run it. Get disguised misuses.

Compilable variants from 12 operators — 6 for restrictive APIs, 6 for flexible ones.

$ java -jar MASC.jar Cipher.properties
Cipher.getInstance("AES"); // base misuse
Cipher.getInstance("aes");
Cipher.getInstance("aes".toUpperCase());
Cipher.getInstance("A~ES".replace("~", ""));
String cryptoVariable = "AES"; Cipher.getInstance(cryptoVariable);

Then it grades the detector.

MASC runs the tool, reads its SARIF report, and lists every mutant it missed.

Mutated misuseseeded in a template app
Command handlerbuilds & runs the detector
Output wrappernormalizes results
SARIF handlercompares with the mutation log
Unkilled mutantsthe detector’s blind spots
"aes" CAUGHT
"A~ES".replace("~", "") MISSED
cryptoVariable MISSED

Bring your own operators.

Built for researchers, tool builders and users alike.

PLUG-IN ARCHITECTURE

Custom operators

Write an operator, plug it into the Main Scope — no need to touch MASC’s 11K+ lines.

class MyOperator implements … { … }
MASC WEB

A local web front-end

Upload apps, configure runs, profile detectors — and learn in MASC Lab.

localhost · MASC Web
MASC LabEnginePlug-insProfile
Main scopeSimilarity scope · from MDroid+Exhaustive scope · from µSE
Found with MASC in 9 major crypto-detectors
0
unique, undocumented flaws
12usage-based mutation operators
3mutation scopes
CLI + Webopen source, with docs and examples

MASC: A Tool for Mutation-based Evaluation of Static Crypto-API Misuse Detectors

Amit Seal Ami · Syed Yusuf Ahmed · Radowan Mahmud Redoy · Nathan Cooper · Kaushal Kafle · Kevin Moran · Denys Poshyvanyk · Adwait Nadkarni
ESEC/FSE 2023
Joint European Software Engineering Conference and Symposium on the Foundations of Software Engineering · Tool Demonstrations