Report: Extensibility and Implementation Independence of the .NET Cryptographic API

Authors:
Pieter Philippaerts;Cédric Boon;Frank Piessens
Affiliations:
Dept. of Computer Science, K.U.Leuven,;Dept. of Computer Science, K.U.Leuven,;Dept. of Computer Science, K.U.Leuven,
Venue:
ESSoS '09 Proceedings of the 1st International Symposium on Engineering Secure Software and Systems
Year:
2009

Citing 7
Cited 0

Cryptographic Smart Cards

IEEE Micro
Related-key cryptanalysis of 3-WAY, Biham-DES, CAST, DES-X, NewDES, RC2, and TEA

ICICS '97 Proceedings of the First International Conference on Information and Communication Security
Timing Attacks on Implementations of Diffie-Hellman, RSA, DSS, and Other Systems

CRYPTO '96 Proceedings of the 16th Annual International Cryptology Conference on Advances in Cryptology
Chosen Ciphertext Attacks Against Protocols Based on the RSA Encryption Standard PKCS #1

CRYPTO '98 Proceedings of the 18th Annual International Cryptology Conference on Advances in Cryptology
Integrating Smart Cards Into Authentication Systems

Proceedings of the International Conference on Cryptography: Policy and Algorithms
Payments and banking with mobile personal devices

Communications of the ACM - Wireless networking security
Finding collisions in the full SHA-1

CRYPTO'05 Proceedings of the 25th annual international conference on Advances in Cryptology

Quantified Score

Hi-index	0.00

Visualization

Abstract

When a vulnerability is discovered in a cryptographic algorithm, or in a specific implementation of that algorithm, it is important that software using that algorithm or implementation is upgraded quickly. Hence, modern cryptographic libraries such as the .NET crypto libraries are designed to be extensible with new algorithms. In addition, they also support algorithm and implementation independent use. Software written against these libraries can be implemented such that switching to a new crypto algorithm or implementation requires very little effort. This paper reports on our experiences with the implementation of a number of extensions to the .NET cryptographic framework. The extensions we consider are smart card based implementations of existing algorithms. We evaluate the extensibility of the libraries, and the support for implementation independence. We identify several problems with the libraries that have a negative impact on these properties, and we propose solutions. The main conclusion of the paper is that extensibility and implementation independence can be substantially improved with only minor changes. These changes maintain backwards compatibility for client code.