Cipher.getInstance(
"DES""des");
⚠ Insecure cipher: DES✓ No issues found
Same misuse. Lowercase.
Not flagged.
CryptoGuard, a state-of-the-art crypto-detector, missed it.
We trust crypto-detectors.
They guard code in IDEs, in corporate test suites, and in CI pipelines.
CogniCrypt · Eclipse IDE
CryptoGuard · Oracle’s testing suite
GitHub code scanning
Who checks them?
Hand-made benchmarks.
The OWASP Benchmark treated AES in ECB mode as secure until March 2020.
Introducing
MASC
Mutation-based evaluation of crypto-detectors
Pronounced “mask” — because every misuse can wear a disguise.
01 · Map every known misuse
0 misuse cases. Nine clusters.
Mined from 40 papers, tools and guides spanning 20 years — 35 academic, 5 industry.
02 · Disguise it
One misuse. Many masks.
12 usage-based operators write valid, compilable variants — still just as insecure.
Cipher.getInstance("DES");
ATYPICAL CASE"des"
VALUE IN A VARIABLEString v = "DES"; getInstance(v)
CASE TRANSFORM"des".toUpperCase(…)
NOISE, THEN REPLACE"DE$S".replace("$", "")
METHOD CHAININGobj.A().B().getValue()
FLEXIBLE API · ALWAYS TRUEboolean verify(…) {
if (true || s == null) return true; …
03 · Hide it where developers would
Three scopes. Three kinds of developer.
MAIN SCOPE
Always reachable
Seeded at the start of a template app’s main method.
Benign developerSIMILARITY SCOPE
Right next door
Seeded where real apps already call a similar crypto API.
Benign developerEXHAUSTIVE SCOPE
Everywhere
Every class, branch, method and inner object that compiles.
Evasive developer
0 mutants against 9 major crypto-detectors
Generated in about 15 minutes, with no human intervention.
0
previously unknown flaws, in 5 flaw classes
59.2%of flaw instances found only through mutation
6 of 9detectors: every flaw surfaced only by MASC
PatchedCryptoGuard accepted our fix for “des”
Why Crypto-detectors Fail: A Systematic Evaluation of Cryptographic Misuse Detection Techniques
Amit Seal Ami · Nathan Cooper · Kaushal Kafle · Kevin Moran · Denys Poshyvanyk · Adwait Nadkarni
IEEE S&P 2022 · IEEE Symposium on Security and Privacy