Google has released a set of tests that developers can use to check some open source cryptographic libraries for known security vulnerabilities.
The company has named the set of tests Project Wycheproof, after a mountain in Australia, which has the distinction of being the world’s smallest registered mountain.
“The main motivation for the project is to have an achievable goal,” Google security engineers Daniel Bleichenbacher and Thai Duong, explained in a blog announcing Project Wycheproof. “The smaller the mountain the easier it is to climb it!”
The engineers wrote that Project Wycheproof is designed to help developers catch subtle mistakes in open source cryptographic libraries that, if left unaddressed, can have catastrophic consequences. Such mistakes can be repeated too often and become prevalent wherever the encryption is implemented they noted.
The collection of unit tests that Project Wycheproof consists of allows developers to test whether certain cryptographic libraries, including those associated with popular algorithms such as RSA, authenticated encryption and elliptic curve cryptography are vulnerable to attack.
The tests include those for so-called invalid curve attacks, weaknesses in digital signature schemes and a variety of other exploits. In total, Project Wycheproof currently includes unit tests for 80 different types of attacks against cryptographic algorithms. To develop each unit test, Google’s cryptographers surveyed available literature and implemented most of the known attacks against the algorithms.
The tests have already allowed Google to discover a total of 40 security flaws in cryptographic algorithms such as the Digital Signature Algorithm (DSA), Elliptic Curve Diffie-Hellman Cryptography (ECDHC). Some of the flaws that Google discovered via the Project Wycheproof tests were serious, including one that could be used to recover the private keys associated with ECDHC and DSA implementations.
Unit tests are currently available for several popular open source algorithms including DSA, ECDH, RSA, AES and Diffie-Hellman.
Google will continue to develop as many new attacks as possible to test open cryptographic libraries, but the company’s effort is by no means comprehensive and developers should not assume their code is error free just because they pass Project Wycheproof, the two Google researchers said.
“Passing the tests does not imply that the library is secure, it just means that it is not vulnerable to the attacks that Project Wycheproof tests for,” Bleichenbacher and Duong wrote.
Project Wycheproof is the second set of testing tools that Google has released recently. Earlier this month, the company released OSS-Fuzz, a continuous testing service for open source software. The service is designed to uncover security flaws by subjecting software to a continuous stream of attack data.
Google has said the goal is to help developers and researchers find critical issues like SQL injection errors and buffer overflows in some of the largest and most widely-used open source projects and components in the world.