“You have to read 50 different RFCs that contradict each other”: An Interview Study on the Experiences of Implementing Cryptographic Standards

Abstract

Implementing cryptographic standards is a critical process for the cryptographic ecosystem. Cryptographic standards aim to support developers and engineers in implementing cryptographic primitives and protocols. However, past security incidents suggest that implementing cryptographic standards can be challenging and might jeopardize software and hardware security. We need to understand and mitigate the pain points of those implementing cryptographic standards to support them better.

To shed light on the challenges and obstacles of implementing cryptographic standards, we conducted 20 semi-structured interviews with experienced cryptographers and cryptographic software engineers. We identify common practices when implementing standards, including the criticality of reference and third-party implementations, test vectors to verify implementations, and the open standard community as central support for questions and reviews of implementations.

Based on our findings, we recommend transparent standardization processes, strong (ideally formal) verification, improved support for comparing implementations, and covering updates and error handling in the standardization process.

Reference

@inproceedings{conf/usenix/huaman24,
 author = {Nicolas Huaman and
Jacques Suray and
Jan H. Klemmer and
Marcel Fourné and
Sabrina Amft and
Ivana Trummová and
Yasemin Acar and
Sascha Fahl},
 booktitle = {In 33rd USENIX Security Symposium, USENIX Security '24, Philadelphia, PA, USA, August 14-16, 2024},
 month = {Aug},
 publisher = {USENIX Association},
 title = {``You have to read 50 different RFCs that contradict each other'': An Interview Study on the Experiences of Implementing Cryptographic Standards},
 url = {https://www.usenix.org/conference/usenixsecurity24/presentation/huaman},
 year = {2024}
}