English

From Struggle to Simplicity with a Usable and Secure API for Encryption in Java

Cryptography and Security 2024-09-10 v1 Software Engineering
Authors: Ehsan Firouzi , Ammar Mansuri , Mohammad Ghafari , Maziar Kaveh
View on arXiv ↗ PDF ↗ DOI ↗

Abstract

Cryptography misuses are prevalent in the wild. Crypto APIs are hard to use for developers, and static analysis tools do not detect every misuse. We developed SafEncrypt, an API that streamlines encryption tasks for Java developers. It is built on top of the native Java Cryptography Architecture, and it shields developers from crypto complexities and erroneous low-level details. Experiments showed that SafEncrypt is suitable for developers with varying levels of experience.

Cite

@article{arxiv.2409.05128,
  title  = {From Struggle to Simplicity with a Usable and Secure API for Encryption in Java},
  author = {Ehsan Firouzi and Ammar Mansuri and Mohammad Ghafari and Maziar Kaveh},
  journal= {arXiv preprint arXiv:2409.05128},
  year   = {2024}
}

Comments

ESEM 2024

Related papers

View all related →
Cryptography and Security · Computer Science
Java Cryptography Uses in the Wild
Mohammadreza Hazhirpasand, Mohammad Ghafari, Oscar Nierstrasz
2020-09-03
Cryptography and Security · Computer Science
FluentCrypto: Cryptography in Easy Mode
Simon Kafader, Mohammad Ghafari
2021-08-17
Software Engineering · Computer Science
CryptoExplorer: An Interactive Web Platform Supporting Secure Use of Cryptography APIs
Mohammadreza Hazhirpasand, Mohammad Ghafari, Oscar Nierstrasz
2020-01-06
Cryptography and Security · Computer Science
The Impact of Developer Experience in Using Java Cryptography
Mohammadreza Hazhirpasand, Mohammad Ghafari, Stefan Krüger, Eric Bodden +1
2019-08-06
Cryptography and Security · Computer Science
Secure Coding Practices in Java: Challenges and Vulnerabilities
Na Meng, Stefan Nagy, Daphne Yao, Wenjie Zhuang +1
2017-09-29
Cryptography and Security · Computer Science
Usability and Security Effects of Code Examples on Crypto APIs - CryptoExamples: A platform for free, minimal, complete and secure crypto examples
Kai Mindermann, Stefan Wagner
2018-07-04
Cryptography and Security · Computer Science
Time to Separate from StackOverflow and Match with ChatGPT for Encryption
Ehsan Firouzi, Mohammad Ghafari
2024-06-11
Cryptography and Security · Computer Science
Towards Low-level Cryptographic Primitives for JavaCards
Vasilios Mavroudis, Petr Svenda
2018-10-04
Cryptography and Security · Computer Science
Hurdles for Developers in Cryptography
Mohammadreza Hazhirpasand, Oscar Nierstrasz, Mohammadhossein Shabani, Mohammad Ghafari
2021-08-17
Software Engineering · Computer Science
Python Crypto Misuses in the Wild
Anna-Katharina Wickert, Lars Baumgärtner, Florian Breitfelder, Mira Mezini
2021-09-03
Software Engineering · Computer Science
When Contracts Meets Crypto: Exploring Developers' Struggles with Ethereum Cryptographic APIs
Jiashuo Zhang, Jiachi Chen, Zhiyuan Wan, Ting Chen +2
2023-12-18
Cryptography and Security · Computer Science
Why Johnny Can't Store Passwords Securely? A Usability Evaluation of Bouncycastle Password Hashing
Chamila Wijayarathna, Nalin Asanka Gamagedara Arachchilage
2018-05-25
Cryptography and Security · Computer Science
ChatGPT's Potential in Cryptography Misuse Detection: A Comparative Analysis with Static Analysis Tools
Ehsan Firouzi, Mohammad Ghafari, Mike Ebrahimi
2024-09-11
Cryptography and Security · Computer Science
Evaluation of Static Vulnerability Detection Tools with Java Cryptographic API Benchmarks
Sharmin Afrose, Ya Xiao, Sazzadur Rahaman, Barton P. Miller +2
2021-12-09
Cryptography and Security · Computer Science
A Java Data Security Framework (JDSF) and its Case Studies
Serguei A. Mokhov, Lee Wei Huynh, Jian Li, Farid Rassai
2016-04-04
Cryptography and Security · Computer Science
A Longitudinal Study of Cryptographic API: a Decade of Android Malware
Adam Janovsky, Davide Maiorca, Dominik Macko, Vashek Matyas +1
2022-07-08
Cryptography and Security · Computer Science
To Fix or Not to Fix: A Critical Study of Crypto-misuses in the Wild
Anna-Katharina Wickert, Lars Baumgärtner, Michael Schlichtig, Krishna Narasimhan +1
2023-03-27
Cryptography and Security · Computer Science
Are easily usable security libraries possible and how should experts work together to create them?
Kai Mindermann
2016-03-24
Cryptography and Security · Computer Science
CryptoGuard: High Precision Detection of Cryptographic Vulnerabilities in Massive-sized Java Projects
Sazzadur Rahaman, Ya Xiao, Sharmin Afrose, Fahad Shaon +5
2019-03-28
Cryptography and Security · Computer Science
Example-Based Vulnerability Detection and Repair in Java Code
Ying Zhang, Ya Xiao, Md Mahir Asef Kabir, Danfeng +2
2022-05-02
Cryptography and Security · Computer Science
Data-Driven Vulnerability Detection and Repair in Java Code
Ying Zhang, Mahir Kabir, Ya Xiao, Danfeng +2
2021-02-16
Software Engineering · Computer Science
CrySL: Validating Correct Usage of Cryptographic APIs
Stefan Krüger, Johannes Späth, Karim Ali, Eric Bodden +1
2017-10-04
Software Engineering · Computer Science
AFGNN: API Misuse Detection using Graph Neural Networks and Clustering
Ponnampalam Pirapuraj, Tamal Mondal, Sharanya Gupta, Akash Lal +2
2026-04-10
Cryptography and Security · Computer Science
Dealing with Variability in API Misuse Specification
Rodrigo Bonifacio, Stefan Krüger, Krishna Narasimhan, Eric Bodden +1
2021-05-18
Software Engineering · Computer Science
Why and How Java Developers Break APIs
Aline Brito, Laerte Xavier, Andre Hora, Marco Tulio Valente
2018-08-09
R2 v1 2026-06-28T18:37:47.301Z