Keynote: Building Trustworthy Cryptographic Tools to Support Software Developers 🔐

Abstract: In this keynote, I will present our multi-year effort on understanding and addressing the practical challenges of writing secure cryptographic code faced by developers. I will focus on our Java cryptographic API misuse detection tool, CryptoGuard, and explain how our specialized static data-flow analysis design achieves extremely false-positive rates in practice, including the evaluation of production code at Oracle Labs. I will also briefly mention our ongoing work on LSTM-based automatic code completion for crypto, as well as the need for our research community to contribute toward difficult deployment problems. Slides: http://people.cs.vt.edu/~danfeng/Yao-Inscrypt-Keynote-2020-compressed.pdf Inscrypt 2020 (The 16th International Conference on Information Security and Cryptology) https://conf.jnu.edu.cn/