Staff

Quantum key distribution provides a means for cryptographic applications to exchange a symmetric key between different parties in a provably secure manner. The security of this method is based on the errors generated during information exchange by an eavesdropping attack – based on principles of quantum mechanics – which are noticeable by the involved parties. Therefore, it is important that the keys are post-processed before they are used. Post-processing consists of error correction of the key and subsequent privacy enhancement.

Examiner: Prof. Dr.-Ing. Mira Mezini

Quantum key distribution provides a means for cryptographic applications to exchange a symmetric key between different parties in a provably secure manner. The security of this method is based on the errors generated during information exchange by an eavesdropping attack – based on principles of quantum mechanics – which are noticeable by the involved parties. Therefore, it is important that the keys are post-processed before they are used. Post-processing consists of error correction of the key and subsequent privacy enhancement.

Examiner: Prof. Dr.-Ing. Mira Mezini

Currently, CogniCryptSAST can handle subsequent crypto misuses due to the expressiveness of the used rules set. For example, an insecurely generated initialization vector can cause several misuse reports: a) the insecure call to generate random numbers which will be used as IV b) passing the IV to the cipher object. While the second information is valuable, a developer or security auditor is more interested in the places where they have to fix a misuse.This thesis should investigate if the current architecture of CogniCrypt can report subsequent errors to the users, and implement a potential prototype. Further, we plan to evaluate if the implementation improves the usability, e.g., by an expert interview.

Examiner: Prof. Dr.-Ing. Mira Mezini

The goal of the thesis is the evaluation of existing algorithms for error correction and key derivation for the use case of quantum key exchange. In previous publications in this area, the quality of the used algorithms was not the main focus. Thus, results are difficult to compare, and we aim to compare different established algorithms for error correction and key derivation in the field of quantum key exchange.

Examiner: Prof. Dr.-Ing. Mira Mezini

The goal of this thesis is the identification and analysis of unsafe usages in popular Go applications. The unsafe API allows developers to circumvent the memory-safety functionality in Go. Previous research analyzed the usages and resulting security implications for related APIs in Java and Rust. In this thesis, we aim to evaluate the usage and security issues caused by unsafe usages in Go.

To achieve this aim, we analyzed possible security vulnerabilities due to unsafe usages in Go. To quantify the unsafe usages in Go, we implemented an analysis, go-geiger, to identify unsafe usages in the application code and its dependencies. Based on an analysis of the usages, we identified the main underlying reasons to integrate the unsafe library into the code. Further, we implemented go-safer to identify security-critical usages.

The thesis resulted in the publication: Uncovering the Hidden Dangers: Finding Unsafe Go Code in the Wild by Johannes Lauinger, Lars Baumgärtner, Anna-Katharina Wickert, and Mira Mezini published at TrustCom20.

Examiner: Prof. Dr.-Ing. Mira Mezini

The goal of this thesis is to develop and evaluate an approach to learn cryptographic rules based on the implementation of the crypto library.

Previous work to learn usage rules for APIs rely on the most-frequent implementations using the respective API, and are successful for other domains. However, for crypto APIs this approach fails as the majority of usages is insecure.

This thesis evaluated an approach to derive usage rules based on the implementation of a crypto API rather than the on the implementations using the crypto API.

Examiner: Prof. Dr.-Ing. Mira Mezini

The goal of this thesis is to develop and evaluate an approach to learn cryptographic rules based on the implementation of the crypto library.

Previous work to learn usage rules for APIs rely on the most-frequent implementations using the respective API, and are successful for other domains. However, for crypto APIs this approach fails as the majority of usages is insecure.

This thesis evaluated an approach to derive usage rules based on the implementation of a crypto API rather than the on the implementations using the crypto API.

Examiner: Prof. Dr.-Ing. Mira Mezini

The goal of this thesis is to develop and evaluate an approach to learn cryptographic rules based on the implementation of the crypto library.

Previous work to learn usage rules for APIs rely on the most-frequent implementations using the respective API, and are successful for other domains. However, for crypto APIs this approach fails as the majority of usages is insecure.

This thesis evaluated an approach to derive usage rules based on the implementation of a crypto API rather than the on the implementations using the crypto API.

Examiner: Prof. Dr.-Ing. Mira Mezini

The goal of this thesis is to develop and evaluate an approach to learn cryptographic rules based on the implementation of the crypto library.

Previous work to learn usage rules for APIs rely on the most-frequent implementations using the respective API, and are successful for other domains. However, for crypto APIs this approach fails as the majority of usages is insecure.

This thesis evaluated an approach to derive usage rules based on the implementation of a crypto API rather than the on the implementations using the crypto API.

Examiner: Prof. Dr.-Ing. Mira Mezini

The goal of the thesis is to create a data set of parametric crypto misuses into an existing API misuse dataset, MuBench, and enrich some of the misuses with corrected usages. Based upon this data set, existing analyses for crypto misuses should be evaluated.

Examiner: Prof. Dr.-Ing. Mira Mezini

The goal of this thesis is to develop and evaluate an approach to learn cryptographic rules based on the implementation of the crypto library.

Previous work to learn usage rules for APIs rely on the most-frequent implementations using the respective API, and are successful for other domains. However, for crypto APIs this approach fails as the majority of usages is insecure.

This thesis evaluated an approach to derive usage rules based on the implementation of a crypto API rather than the on the implementations using the crypto API.

Examiner: Prof. Dr.-Ing. Mira Mezini

The goal of this thesis is to build a dataset of security vulnerabilities in software, integrate the dataset in MuBench and evaluate the dataset against existing API-Misuse and bug detectors. The result will answer the question whether existing API-Misuse and bug detectors can identify software vulnerabilities. Further, the dataset helps future research to benchmark their tools against software vulnerabilities.

Our approach is to identify CVEs which affect open source projects written in Java. For each application, we want to identify the method which needs to be changed to fix the vulnerability. Further, we provide the necessary information to build the respective versions. All these information will create a misuse dataset which we plan to integrate into the benchmark MuBench to evaluate existing approaches.

Examiner: Prof. Dr.-Ing. Mira Mezini