Tampere University of Technology

TUTCRIS Research Portal

Start your ENGINEs: Dynamically Loadable Contemporary Crypto

Research output: Chapter in Book/Report/Conference proceedingConference contributionScientificpeer-review

Details

Original languageEnglish
Title of host publication2019 IEEE Cybersecurity Development (SecDev)
PublisherIEEE COMPUTER SOCIETY PRESS
ISBN (Electronic)978-1-5386-7289-1
ISBN (Print)978-1-5386-7290-7
DOIs
Publication statusPublished - Sep 2019
Publication typeA4 Article in a conference publication
EventIEEE Secure Development Conference -
Duration: 1 Jan 2000 → …

Conference

ConferenceIEEE Secure Development Conference
Period1/01/00 → …

Abstract

Software ever-increasingly relies on building blocks implemented by security libraries, which provide access to evolving standards, protocols, and cryptographic primitives. These libraries are often subject to complex development models and long decision-making processes, which limit the ability of contributors to participate in the development process, hinder the deployment of scientific results and pose challenges for OS maintainers. In this paper, focusing on OpenSSL as a de-facto standard, we analyze these limits, their impact on the security of modern systems, and their significance for researchers. We propose the OpenSSL ENGINE API as a tool in a framework to overcome these limits, describing how it fits in the OpenSSL architecture, its features, and a technical review of its internals.

We evaluate our methodology by instantiating libsuola, a new ENGINE providing support for emerging cryptographic standards such as X25519 and Ed25519 for currently deployed versions of OpenSSL, performing benchmarks to demonstrate the viability and benefits.

The results confirm that the ENGINE API offers (1) an ideal architecture to address wide-ranging security concerns; (2) a valuable tool to enhance future research by easing testing and facilitating the dissemination of novel results in real-world systems; and (3) a means to bridge the gaps between research results and currently deployed systems.

Publication forum classification

Field of science, Statistics Finland