2012/02/01 by Vijay Ganesh, Michael Carbin, Ganesh, Vijay +3
Computer Science · #Advanced Malware Detection Techniques #Cryptographic Implementations and Security #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Programming Languages (cs.PL) #Security and Verification in Computing #Software Engineering (cs.SE)
paper · pdf · doi:10.48550/arxiv.1202.0359
openalex publication_date 2012/02/01 · openalex created_date 2025/10/24 · openalex updated_date 2026/07/28
We propose a novel approach to improving software security called\nCryptographic Path Hardening, which is aimed at hiding security vulnerabilities\nin software from attackers through the use of provably secure and obfuscated\ncryptographic devices to harden paths in programs.\n By "harden" we mean that certain error-checking if-conditionals in a given\nprogram P are replaced by equivalent" we mean that adversaries cannot use\nsemi-automatic program analysis techniques to reason about the hardened program\npaths and thus cannot discover as-yet-unknown errors along those paths, except\nperhaps through black-box dictionary attacks or random testing (which we can\nnever prevent).\n Other than these unpreventable attack methods, we can make program analysis\naimed at error-finding "provably hard" for a resource-bounded attacker, in the\nsame sense that cryptographic schemes are hard to break. Unlike\nsecurity-through-obscurity, in Cryptographic Path Hardening we use\nprovably-secure crypto devices to hide errors and our mathematical arguments of\nsecurity are the same as the standard ones used in cryptography.\n One application of Cryptographic Path Hardening is that software patches or\nfilters often reveal enough information to an attacker that they can be used to\nconstruct error-revealing inputs to exploit an unpatched version of the\nprogram. By "hardening" the patch we make it difficult for the attacker to\nanalyze the patched program to construct error-revealing inputs, and thus\nprevent him from potentially constructing exploits.\n