Automated code validation service could take the pain out of bug-fixes
Cisco and the United States’ National Institute of Standards and Technology (NIST) have quietly taken the covers off an important development for cryptographers: the first implementation of the Automated Cryptographic Validation Protocol (ACVP).
First discussed at May’s ICM conference, its aim is to help developers get across the huge knock-on problems that can flow from a single bug in the toolchain.
The underpinnings of this proposal can be seen then a new CVE (common vulnerabilities and exposures) number emerges and puts any big vendor between a rock and a hard place: on the one hand, they need to keep their systems secure; on the other, doing so means re-starting the long process of validating software and systems against the standards that let them sell to the US Government (such as FIPS-140).
If validation can be automated, it clears a roadblock to fixing vulnerabilities.
Looking over libavcp gives us an idea of the architecture involved.
It envisages a server acting as a repository of test vectors for cryptographic modules.
This allows the user of client-side software to request the vectors needed to validate a particular module (for example, AES-GCM, the one used in Cisco’s demonstrator).
The NIST project page explains that the server sends back the test vectors, the client processes them, and returns the results to the server for validation.
There would be one test vector per individual crypto algorithm to be validated – SHA-1, SHA-224, SHA-256 and so on.
Right now, NIST is running the only server for the experimental program, and industry participants need to get their client certificate from the agency. ®
Sponsored: 2016 Cyberthreat defense report