Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add subsequent error detection (CC_SUBS) #521

Merged
merged 5 commits into from
Feb 5, 2024
Merged

Conversation

smeyer198
Copy link
Contributor

This PR adds the basic functionality to collect subsequent errors. Each error references preceding and subsequent errors, which improves the overall error detection, and which allows comprehending errors. In addition to that, the analysis is able to parse and deal with predicates that contain the keyword this. An example could look like this:

KeyGenerator kg = KeyGenerator.getInstance("AES");
kg.initialize(64);                    // constraint error
SecretKey key = kg.generateKey();     // the key is not generated securely

A key size of 64 is not allowed. Therefore, the analysis reports a ConstraintError for KeyGenerator and kg is not secure. Hence, the returned key from generateKey() is not secure, too, and a RequiredPredicateError is reported. This RequiredPredicateError references the previous ConstraintError and allows reasoning that the RequiredPredicateError is caused by the ConstraintError (and vice versa: the ConstraintError references the RequiredPredicateError, that is, the ConstraintError causes the RequiredPredicateError).

The idea and logic was implemented by @marvinvo and most changes were taken from his work: https://github.com/marvinvo/CryptoAnalysis

Note: Currently, preceding and subsequent errors are not included in the reports, yet. They are only stored internally, which still allows testing the functionality.

@schlichtig schlichtig merged commit e169111 into develop Feb 5, 2024
8 checks passed
@smeyer198 smeyer198 deleted the feature/cc_subs branch February 5, 2024 13:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants