Start Your ENGINEs: Dynamically Loadable Contemporary Crypto

No ratings

Presented at IEEESecDev 2019 by

Nicola Brumley

Software ever-increasingly relies on building blocksimplemented by security libraries, which provide access toevolving standards, protocols, and cryptographic primitives.These libraries are often subject to complex development modelsand long decision-making processes, which limit the ability ofcontributors to participate in the development process, hinderthe deployment of scientific results and pose challenges for OSmaintainers. In this paper, focusing on OpenSSL as a de-factostandard, we analyze these limits, their impact on the securityof modern systems, and their significance for researchers. Wepropose the OpenSSL ENGINE API as a tool in a frameworkto overcome these limits, describing how it fits in the OpenSSLarchitecture, its features, and a technical review of its internals.We evaluate our methodology by instantiating libsuola, a newENGINE providing support for emerging cryptographic standardssuch as X25519 and Ed25519 for currently deployed versions ofOpenSSL, performing benchmarks to demonstrate the viabilityand benefits. The results confirm that the ENGINE API offers (1)an ideal architecture to address wide-ranging security concerns;(2) a valuable tool to enhance future research by easing testingand facilitating the dissemination of novel results in real-worldsystems; and (3) a means to bridge the gaps between researchresults and currently deployed systems.