Common Cryptographic Architecture Cryptographic Application Programming Interface

Johnson, Donald B.; Dolan, G. M.; Kelly, Meaghan; Le, An N.; Matyas, Stephen M.

doi:10.1147/sj.302.0130

Cited by 20 publications

(4 citation statements)

References 2 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…IBM's Common Cryptographic Architecture (CCA) [20], [19] is a token interface primarily used by banks for securing ATM networks and financial transactions; it is provided by the IBM 4764 cryptoprocessor and its predecessors. CCA defines a control vector for every key that models key usage and other attributes, and introduced a method for binding the control vector securely to a wrapped key.…”

Section: Background and Related Workmentioning

confidence: 99%

A Secure Cryptographic Token Interface

Cachin

Chandran

2009

2009 22nd IEEE Computer Security Foundations Symposium

View full text Add to dashboard Cite

Cryptographic keys must be protected from exposure. In real-world applications, they are often guarded by cryptographic tokens that employ sophisticated hardware-security measures. Several logical attacks on the key management operations of cryptographic tokens have been reported in the past, which allowed to expose keys merely by exploiting the token API in unexpected ways.This paper proposes a novel, provably secure, cryptographic token interface that supports multiple users, implements symmetric cryptosystems and public-key schemes, and provides operations for key generation, encryption, authentication, and key wrapping. The token interface allows only the most important operations found in real-world token APIs; while flexible to be of practical use, it is restricted enough so that it does not expose any key to a user without sufficient privileges. The security policy can be applied to the industry-standard PKCS #11 interface.

show abstract

Section: Background and Related Workmentioning

confidence: 99%

A Secure Cryptographic Token Interface

Cachin

Chandran

2009

2009 22nd IEEE Computer Security Foundations Symposium

View full text Add to dashboard Cite

show abstract

“…The CCA API [24] is a cryptographic-key management API used with secure hardware devices (coprocessors) such as the IBM 4758. The coprocessor provides cryptographic services, such as key-management, to the host computer.…”

Section: The Ibm Cca Apimentioning

confidence: 99%

Automatic discovery of API-level exploits

Ganapathy

Seshia

Jha

et al. 2005

Proceedings of the 27th International Conference on Software Engineering - ICSE '05

View full text Add to dashboard Cite

We argue that finding vulnerabilities in software components is different from finding exploits against them. Exploits that compromise security often use several low-level details of the component, such as layouts of stack frames. Existing software analysis tools, while effective at identifying vulnerabilities, fail to model low-level details, and are hence unsuitable for exploit-finding.We study the issues involved in exploit-finding by considering application programming interface (API) level exploits. A software component is vulnerable to an API-level exploit if its security can be compromised by invoking a sequence of API operations allowed by the component. We present a framework to model low-level details of APIs, and develop an automatic technique based on bounded, infinite-state model checking to discover API-level exploits.We present two instantiations of this framework. We show that format-string exploits can be modeled as API-level exploits, and demonstrate our technique by finding exploits against vulnerabilities in widely-used software. We also use the framework to model a cryptographic-key management API (the IBM CCA) and demonstrate a tool that identifies a previously known exploit.

show abstract

“…The Common Cryptographic Architecture (CCA) was designed and developed by IBM to provide cryptographic primitives for confidentiality, integrity, key management, and personal identification number (PIN) processing [751,784,1025,1026,940,752]. Keys are managed by control vectors (CVs) (see Section 8.5).…”

Section: Ibm Common Cryptographic Architecturementioning

confidence: 99%

Applied cryptography: Protocols, algorithms, and source code in C

1994

Computer Law & Security Review

771

View full text Add to dashboard Cite

Common Cryptographic Architecture Cryptographic Application Programming Interface

Cited by 20 publications

References 2 publications

A Secure Cryptographic Token Interface

A Secure Cryptographic Token Interface

Automatic discovery of API-level exploits

Applied cryptography: Protocols, algorithms, and source code in C

Contact Info

Product

Resources

About