Google this week announced the availability of Project Wycheproof, an open source tool designed for finding known vulnerabilities in popular cryptographic software libraries.
Developed in Java due to its common cryptographic interface, Project Wycheproof includes tests for the most popular crypto algorithms, including AES-EAX, AES-GCM, DH, DHIES, DSA, ECDH, ECDSA, ECIES and RSA. The more than 80 test cases developed by Google experts have led to the discovery of over 40 bugs in RSA, DSA, ECDH and DH.
Google has pointed out that Project Wycheproof is not complete as crypto experts regularly discover new weaknesses in protocols. However, the search giant believes the tool can be useful for developers and users considering that the secure implementation of cryptographic algorithms is not an easy task.
“The main motivation for the project is to have an achievable goal. That’s why we’ve named it after the Mount Wycheproof, the smallest mountain in the world. The smaller the mountain the easier it is to climb it!” Daniel Bleichenbacher and Thai Duong, Google security engineers and Project Wycheproof maintainers, said in a blog post.
While the tool is developed and maintained by members of the Google Security Team, Project Wycheproof is not an official Google product. Contributions are welcome, but those who want to take part in the project have been advised to report the vulnerabilities they find directly to the maintainers of the affected libraries and submit the tests only after the bug has been fixed or acknowledged.
Some of the flaws discovered by Google have yet to be made public as they are still being patched by vendors.
Google also pointed out that some open-source products are covered by its bug bounty program and vulnerabilities found with Project Wycheproof tests could qualify for a reward.
Project Wycheproof is not the only security tool released this year by Google. The company also made available the OSS-Fuzz open source fuzzing service, a Vendor Security Assessment Questionnaire framework, the binary comparison tool BinDiff, and the XSS prevention tools CSP Evaluator and CSP Mitigator.
Related: Microsoft Experts Launch Anti-Recon Tool for Windows 10, Server 2016
Related: Mozilla Launches Website Security Testing Tool
Related: Facebook’s “Osquery” Security Tool Available for Windows
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Industrial Giant ABB Confirms Ransomware Attack, Data Theft
- Zyxel Firewalls Hacked by Mirai Botnet
- New Russia-Linked CosmicEnergy ICS Malware Could Disrupt Electric Grids
- Drop in Insider Breaches Drives Decline in Intrusions at OT Organizations
- Zero-Day Vulnerability Exploited to Hack Barracuda Email Security Gateway Appliances
- OAuth Vulnerabilities in Widely Used Expo Framework Allowed Account Takeovers
- New Honeywell OT Cybersecurity Solution Helps Identify Vulnerabilities, Threats
- Rheinmetall Says Military Business Not Impacted by Ransomware Attack
Latest News
- Industrial Giant ABB Confirms Ransomware Attack, Data Theft
- Organizations Worldwide Targeted in Rapidly Evolving Buhti Ransomware Operation
- Google Cloud Users Can Now Automate TLS Certificate Lifecycle
- Zyxel Firewalls Hacked by Mirai Botnet
- Watch Now: Threat Detection and Incident Response Virtual Summit
- NCC Group Releases Open Source Tools for Developers, Pentesters
- Memcyco Raises $10 Million in Seed Funding to Prevent Website Impersonation
- New Russia-Linked CosmicEnergy ICS Malware Could Disrupt Electric Grids
