security w

Published on December 31st, 2016 | 985 views Post Views

Wycheproof – Test Crypto Libraries Against Known Attacks

Project Wycheproof is a tool to test crypto libraries against known attacks. It is developed and maintained by members of Google Security Team, but it is not an official Google product.

 

At Google, they rely on many third party cryptographic software libraries. Unfortunately, in cryptography, subtle mistakes can have catastrophic consequences, and they found that libraries fall into such implementation pitfalls much too often and for much too long.

Good implementation guidelines, however, are hard to come by: understanding how to implement cryptography securely requires digesting decades’ worth of academic literature.

They recognise that software engineers fix and prevent bugs with unit testing, and they also found that cryptographic loopholes can be resolved by the same means.

 

These observations have prompted them to develop Project Wycheproof, a collection of unit tests that detect known weaknesses or check for expected behaviours of some cryptographic algorithm. Project Wycheproof provides tests for most cryptographic algorithms, including RSA, elliptic curve crypto and authenticated encryption.

Features

Project Wycheproof has tests for the most popular crypto algorithms, including

  • AES-EAX
  • AES-GCM
  • DH
  • DHIES
  • DSA
  • ECDH
  • ECDSA
  • ECIES
  • RSA

▼Advertisements

The tests detect whether a library is vulnerable to many attacks, including:

  • Invalid curve attacks
  • Biased nonces in digital signature schemes
  • Of course, all Bleichenbacher’s attacks
  • And many more — there are over 80 test cases

You can download Project Wychproof here:

wycheproof-master.zip

Or read more here.

Share on Facebook0Share on Google+1Tweet about this on TwitterShare on Reddit0Email this to someonePrint this pageShare on StumbleUpon0Digg thisPin on Pinterest0Share on LinkedIn0











Leave a Reply

Your email address will not be published. Required fields are marked *

Back to Top ↑

You Might Also Like:
NETATTACK 2 Advanced Wireless Network Scan and Attack Tool

An advanced network scan and attack script based on GUI. 2nd version of no-GUI netattack. NETATTACK 2 is a python...

Close